Edit tour

Windows Analysis Report
ps11.0.0.129pro.exe

Overview

General Information

Sample name:	ps11.0.0.129pro.exe
Analysis ID:	1500780
MD5:	fc13bc8b09702ec0ca1a48f7e9157380
SHA1:	3895eac6524ea439e1dc0e3c537a868f8b3f84af
SHA256:	c2a5572944067b561cb0d269b8975affb8253631278741130f621d6d7d39f9cd
Infos:

Detection

Score:	34
Range:	0 - 100
Whitelisted:	false
Confidence:	20%

Signatures

.NET source code contains very large array initializations

Hides threads from debuggers

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade debugger and weak emulator (self modifying code)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE file contains executable resources (Code or Archives)

PE file contains strange resources

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Office Autorun Keys Modification

Sigma detected: Potential Persistence Via Visual Studio Tools for Office

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

ps11.0.0.129pro.exe (PID: 5316 cmdline: "C:\Users\user\Desktop\ps11.0.0.129pro.exe" MD5: FC13BC8B09702EC0CA1A48F7E9157380)

ps11.0.0.129pro.tmp (PID: 6252 cmdline: "C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp" /SL5="$20410,54471570,58368,C:\Users\user\Desktop\ps11.0.0.129pro.exe" MD5: 5ED68C2D50F4232A83D39C41722BC908)

_setup64.tmp (PID: 5260 cmdline: helper 105 0x3E4 MD5: E4211D6D009757C078A9FAC7FF4F03D4)

conhost.exe (PID: 6016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PlanSwift.exe (PID: 416 cmdline: "C:\Program Files (x86)\PlanSwift11\PlanSwift.exe" /regserver MD5: B157207600DF34B69CA9AA91F1659383)

PlanSwift.exe (PID: 3140 cmdline: "C:\Program Files (x86)\PlanSwift11\PlanSwift.exe" /init MD5: B157207600DF34B69CA9AA91F1659383)

PlanSwift.exe (PID: 5888 cmdline: "C:\Program Files (x86)\PlanSwift11\PlanSwift.exe" -o "Sample Plan" MD5: B157207600DF34B69CA9AA91F1659383)

splwow64.exe (PID: 2656 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.2340509901.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000000B.00000002.2917164884.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000000B.00000003.2587147896.0000000006290000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
9.2.PlanSwift.exe.f80000.1.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
7.2.PlanSwift.exe.f80000.1.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
11.2.PlanSwift.exe.f80000.1.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: Excel Addin For PlanSwift, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp, ProcessId: 6252, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Excel\Addins\SwiftExcel\Description

Sigma detected: Potential Persistence Via Visual Studio Tools for Office

Source: Registry Key set

Author: Bhabesh Raj: Data: Details: Excel Addin For PlanSwift, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp, ProcessId: 6252, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Excel\Addins\SwiftExcel\Description

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION PlanSwift.exe

Source: ps11.0.0.129pro.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.CONSTRUCTCONNECT INC.PLANSWIFT SOFTWAREElectronic End User License AgreementNOTICE TO USER: This End User License Agreement ("Agreement") is a legal agreement. Please read the Agreement carefully before completing the installation process and using the Software. It provides a license to use the Software and contains warranty information and liability disclaimers. BY INSTALLING THE SOFTWARE YOU ARE AGREEING TO BECOME BOUND BY THE TERMS OF THIS AGREEMENT. You ("Licensee") agree that this Agreement is like any written negotiated agreement signed by You. The Agreement is enforceable against You and any legal entity that obtains the Software and on whose behalf it is used. If You do not agree with the terms of this Agreement do not install or use the Software. The terms of this Agreement also apply to any Software upgrades patches modified versions Updates additions copies of the Software licensed to You by ConstructConnect or third parties and support services for the Software unless other terms accompany those items. If so those terms apply.1. Definitions"Licensee" means the entity that has purchased a license or licenses to use the Software."Licensor" means ConstructConnect Inc."Physical Server" means a computing device running an operating system on which other software or utilities are installed. The operating system runs directly on the hardware of the device not in an emulated or virtualized environment. A Virtual Server is not a Physical Server."Representative" means any representative of a Licensee whether employee agent independent contractor subcontractor or otherwise whom Licensee authorizes to access or use the Software on the Licensee's behalf."Reseller" means an authorized reseller of the Software in a Territory."Software" means (a) all of the information with which this Agreement is provided including but not limited to: (i) all software files and other computer files or information; (ii) sample and stock photographs images sounds clip art and other artistic works bundled with Software; and (iii) related explanatory written materials and files ("Documentation") and (b) any modified versions and copies of upgrades patches Updates and additions to such information provided to You by Licensor or third parties on behalf of Licensor at any time to the extent not provided under separate terms (collectively "Updates")."Territory" means a designated territory in which a Reseller has exclusive rights to distribute the Software."Updates" means those subsequent releases of the Software which are generally made available to compliant licensees of the Software who purchase them. Updates shall not include: (i) any releases enhancements functionality services or products that PlanSwift licenses separately or charges for separately; or (ii) an
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.CONSTRUCTCONNECT INC.PLANSWIFT SOFTWAREElectronic End User License AgreementNOTICE TO USER: This End User License Agreement ("Agreement") is a legal agreement. Please read the Agreement carefully before completing the installation process and using the Software. It provides a license to use the Software and contains warranty information and liability disclaimers. BY INSTALLING THE SOFTWARE YOU ARE AGREEING TO BECOME BOUND BY THE TERMS OF THIS AGREEMENT. You ("Licensee") agree that this Agreement is like any written negotiated agreement signed by You. The Agreement is enforceable against You and any legal entity that obtains the Software and on whose behalf it is used. If You do not agree with the terms of this Agreement do not install or use the Software. The terms of this Agreement also apply to any Software upgrades patches modified versions Updates additions copies of the Software licensed to You by ConstructConnect or third parties and support services for the Software unless other terms accompany those items. If so those terms apply.1. Definitions"Licensee" means the entity that has purchased a license or licenses to use the Software."Licensor" means ConstructConnect Inc."Physical Server" means a computing device running an operating system on which other software or utilities are installed. The operating system runs directly on the hardware of the device not in an emulated or virtualized environment. A Virtual Server is not a Physical Server."Representative" means any representative of a Licensee whether employee agent independent contractor subcontractor or otherwise whom Licensee authorizes to access or use the Software on the Licensee's behalf."Reseller" means an authorized reseller of the Software in a Territory."Software" means (a) all of the information with which this Agreement is provided including but not limited to: (i) all software files and other computer files or information; (ii) sample and stock photographs images sounds clip art and other artistic works bundled with Software; and (iii) related explanatory written materials and files ("Documentation") and (b) any modified versions and copies of upgrades patches Updates and additions to such information provided to You by Licensor or third parties on behalf of Licensor at any time to the extent not provided under separate terms (collectively "Updates")."Territory" means a designated territory in which a Reseller has exclusive rights to distribute the Software."Updates" means those subsequent releases of the Software which are generally made available to compliant licensees of the Software who purchase them. Updates shall not include: (i) any releases enhancements functionality services or products that PlanSwift licenses separately or charges for separately; or (ii) an
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.CONSTRUCTCONNECT INC.PLANSWIFT SOFTWAREElectronic End User License AgreementNOTICE TO USER: This End User License Agreement ("Agreement") is a legal agreement. Please read the Agreement carefully before completing the installation process and using the Software. It provides a license to use the Software and contains warranty information and liability disclaimers. BY INSTALLING THE SOFTWARE YOU ARE AGREEING TO BECOME BOUND BY THE TERMS OF THIS AGREEMENT. You ("Licensee") agree that this Agreement is like any written negotiated agreement signed by You. The Agreement is enforceable against You and any legal entity that obtains the Software and on whose behalf it is used. If You do not agree with the terms of this Agreement do not install or use the Software. The terms of this Agreement also apply to any Software upgrades patches modified versions Updates additions copies of the Software licensed to You by ConstructConnect or third parties and support services for the Software unless other terms accompany those items. If so those terms apply.1. Definitions"Licensee" means the entity that has purchased a license or licenses to use the Software."Licensor" means ConstructConnect Inc."Physical Server" means a computing device running an operating system on which other software or utilities are installed. The operating system runs directly on the hardware of the device not in an emulated or virtualized environment. A Virtual Server is not a Physical Server."Representative" means any representative of a Licensee whether employee agent independent contractor subcontractor or otherwise whom Licensee authorizes to access or use the Software on the Licensee's behalf."Reseller" means an authorized reseller of the Software in a Territory."Software" means (a) all of the information with which this Agreement is provided including but not limited to: (i) all software files and other computer files or information; (ii) sample and stock photographs images sounds clip art and other artistic works bundled with Software; and (iii) related explanatory written materials and files ("Documentation") and (b) any modified versions and copies of upgrades patches Updates and additions to such information provided to You by Licensor or third parties on behalf of Licensor at any time to the extent not provided under separate terms (collectively "Updates")."Territory" means a designated territory in which a Reseller has exclusive rights to distribute the Software."Updates" means those subsequent releases of the Software which are generally made available to compliant licensees of the Software who purchase them. Updates shall not include: (i) any releases enhancements functionality services or products that PlanSwift licenses separately or charges for separately; or (ii) an

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\dea351d9-e184-49ac-833f-c98a60d0ae27_is1

Jump to behavior

Source: ps11.0.0.129pro.exe

Static PE information: certificate valid

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 18.144.71.249:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.144.71.249:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.144.71.249:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.60.103.30:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.60.103.30:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.60.103.30:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.11.207:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.4:49754 version: TLS 1.2

Source: ps11.0.0.129pro.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00476DFC FindFirstFileA,FindNextFileA,FindClose,	1_2_00476DFC
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00453238 FindFirstFileA,GetLastError,	1_2_00453238
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_0049ACD8 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_0049ACD8
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_004650D0 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_004650D0
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_0046554C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_0046554C
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00463B44 FindFirstFileA,FindNextFileA,FindClose,	1_2_00463B44
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 7_2_0040E0C0 FindFirstFileW,FindClose,	7_2_0040E0C0
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 7_2_0040DAEC GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	7_2_0040DAEC
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 9_2_0040E0C0 FindFirstFileW,FindClose,	9_2_0040E0C0
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 9_2_0040DAEC GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	9_2_0040DAEC
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_00BAE0C0 FindFirstFileW,FindClose,	11_2_00BAE0C0
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_00BADAEC GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	11_2_00BADAEC

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: global traffic

HTTP traffic detected: POST /status/ HTTP/1.1Content-Type: multipart/form-data; boundary=------------000001050802010608020008Host: www.planswift.comContent-Length: 375

Source: Joe Sandbox View	IP Address: 104.18.11.207 104.18.11.207
Source: Joe Sandbox View	IP Address: 104.18.11.207 104.18.11.207
Source: Joe Sandbox View	IP Address: 199.60.103.30 199.60.103.30
Source: Joe Sandbox View	IP Address: 104.17.25.14 104.17.25.14

Source: Joe Sandbox View	JA3 fingerprint: fed8d14fc5a67b40cd470ba239019785
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /getting-started-viewer?licenseType=Viewer&edition=Professional&version=11.0.0.129& HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0Accept-Language: en-us,en;q=0.5Accept-Encoding: gzipHost: www.planswift.com
Source: global traffic	HTTP traffic detected: GET /getting-started-viewer?licenseType=Viewer&edition=Professional&version=11.0.0.129& HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0Accept-Language: en-us,en;q=0.5Accept-Encoding: gzipHost: hub.planswift.com
Source: global traffic	HTTP traffic detected: GET /hs-fs/hub/2347101/hub_generated/template_assets/23959717271/1580250761785/HubUI-PlanSwift/assets/production.min.css HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: hub.planswift.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hs-fs/hub/2347101/hub_generated/template_assets/9927841831/1580250760790/Custom/page/Planswift_May2017-theme/Planswift_May2017-style.min.css HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: hub.planswift.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hs-fs/hubfs/PS%20-%20Getting%20Started/Whats%20New%20in%20PlanSwift%C2%AE%2011.png?width=500&name=Whats%20New%20in%20PlanSwift%C2%AE%2011.png HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: hub.planswift.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /font-awesome/4.6.3/css/font-awesome.min.css HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: maxcdn.bootstrapcdn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hubfs/bid-boss.jpg HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: hub.planswift.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ajax/libs/fancybox/3.5.2/jquery.fancybox.min.css HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: cdnjs.cloudflare.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ajax/libs/slick-carousel/1.8.0/slick-theme.css HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: cdnjs.cloudflare.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hubfs/PS%20-%20Getting%20Started/spaceFrame_700.jpg HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: hub.planswift.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ajax/libs/slick-carousel/1.8.0/slick.min.css HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: cdnjs.cloudflare.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /getting-started-viewer?licenseType=Viewer&edition=Professional&version=11.0.0.129& HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0Accept-Language: en-us,en;q=0.5Accept-Encoding: gzipHost: www.planswift.com
Source: global traffic	HTTP traffic detected: GET /getting-started-viewer?licenseType=Viewer&edition=Professional&version=11.0.0.129& HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0Accept-Language: en-us,en;q=0.5Accept-Encoding: gzipHost: hub.planswift.com
Source: global traffic	HTTP traffic detected: GET /hs-fs/hub/2347101/hub_generated/template_assets/23959717271/1580250761785/HubUI-PlanSwift/assets/production.min.css HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: hub.planswift.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hs-fs/hub/2347101/hub_generated/template_assets/9927841831/1580250760790/Custom/page/Planswift_May2017-theme/Planswift_May2017-style.min.css HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: hub.planswift.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hs-fs/hubfs/PS%20-%20Getting%20Started/Whats%20New%20in%20PlanSwift%C2%AE%2011.png?width=500&name=Whats%20New%20in%20PlanSwift%C2%AE%2011.png HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: hub.planswift.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /font-awesome/4.6.3/css/font-awesome.min.css HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: maxcdn.bootstrapcdn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hubfs/bid-boss.jpg HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: hub.planswift.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ajax/libs/fancybox/3.5.2/jquery.fancybox.min.css HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: cdnjs.cloudflare.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ajax/libs/slick-carousel/1.8.0/slick-theme.css HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: cdnjs.cloudflare.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hubfs/PS%20-%20Getting%20Started/spaceFrame_700.jpg HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: hub.planswift.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ajax/libs/slick-carousel/1.8.0/slick.min.css HTTP/1.1Accept: /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: cdnjs.cloudflare.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: www.planswift.com
Source: global traffic	DNS traffic detected: DNS query: hub.planswift.com
Source: global traffic	DNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com

Source: unknown

HTTP traffic detected: POST /status/ HTTP/1.1Content-Type: multipart/form-data; boundary=------------000001050802010608020008Host: www.planswift.comContent-Length: 375

Source: PlanSwift.exe	String found in binary or memory: ftp://ftp.000010002000300040005000600070008000900110012001300140015001600170018001900210022002300240
Source: PlanSwift.exe, 00000007.00000003.2266073890.00000000064FB000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2360641025.000000000668B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www..com
Source: PlanSwift.exe	String found in binary or memory: http://www.chilkatsoft.com/rssComponent.html
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000001981000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.fast-report.com
Source: PlanSwift.exe, 00000007.00000003.2262470356.0000000000F20000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000007.00000003.2337279134.00000000069E3000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2358261010.0000000000EF0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2425201679.0000000006BB3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: ps11.0.0.129pro.tmp, ps11.0.0.129pro.tmp, 00000001.00000000.1666665834.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: ps11.0.0.129pro.exe, ps11.0.0.129pro.exe, 00000000.00000000.1665343528.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
Source: ps11.0.0.129pro.exe, 00000000.00000000.1665343528.0000000000401000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: PlanSwift.exe, 00000009.00000003.2425793276.00000000065BD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.planswift.com/activate/PlanSwiftActivation/
Source: PlanSwift.exe, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.planswift.com/swifttube/player/SwiftTubePlayer2.swf?VID=
Source: PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.planswift.com/swifttube/player/SwiftTubePlayer2.swf?VID=U
Source: ps11.0.0.129pro.exe, 00000000.00000003.1666090769.0000000002320000.00000004.00001000.00020000.00000000.sdmp, ps11.0.0.129pro.exe, 00000000.00000003.1666302856.000000000210C000.00000004.00001000.00020000.00000000.sdmp, ps11.0.0.129pro.tmp, ps11.0.0.129pro.tmp, 00000001.00000000.1666665834.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: ps11.0.0.129pro.exe, 00000000.00000003.1666090769.0000000002320000.00000004.00001000.00020000.00000000.sdmp, ps11.0.0.129pro.exe, 00000000.00000003.1666302856.000000000210C000.00000004.00001000.00020000.00000000.sdmp, ps11.0.0.129pro.tmp, 00000001.00000000.1666665834.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.remobjects.com/psU
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/Jcl8087.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclAnsiStrings.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclBase.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclCharsets.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclDateTime.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclFileUtils.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclIniFiles.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclLogic.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclMath.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclMime.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclRTTI.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclResources.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclSimpleXml.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclStreams.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclStringConversions.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclStrings.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclSynch.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclSysInfo.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclSysUtils.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclUnicode.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclUnitVersioning.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclWideStrings.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/vcl/JclGraphUtils.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/vcl/JclVclResources.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/windows/JclAppInst.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/windows/JclConsole.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/windows/JclRegistry.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/windows/JclSecurity.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/windows/JclShell.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/windows/JclWin32.pas
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/windows/Snmp.pas
Source: PlanSwift.exe, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://ldapauth.planswift.net
Source: PlanSwift.exe, 00000007.00000002.2340509901.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp, PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://ldapauth.planswift.netU
Source: PlanSwift.exe, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://myaccount.planswift.com
Source: PlanSwift.exe, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://myaccount.planswift.com/password/email
Source: PlanSwift.exe, 00000007.00000002.2340509901.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp, PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://myaccount.planswift.com/password/emailU
Source: PlanSwift.exe, 00000007.00000002.2340509901.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp, PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://myaccount.planswift.comU
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://planswift.com/support
Source: PlanSwift.exe, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://plugins.planswift.com
Source: PlanSwift.exe, 00000007.00000002.2340509901.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp, PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://plugins.planswift.comU
Source: PlanSwift.exe, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://share.planswift.com
Source: PlanSwift.exe, 00000007.00000002.2340509901.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp, PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://share.planswift.comU
Source: ps11.0.0.129pro.exe, 00000000.00000003.1665694428.0000000002320000.00000004.00001000.00020000.00000000.sdmp, ps11.0.0.129pro.exe, 00000000.00000003.1665762973.00000000020F8000.00000004.00001000.00020000.00000000.sdmp, ps11.0.0.129pro.exe, 00000000.00000003.2483568739.00000000020F8000.00000004.00001000.00020000.00000000.sdmp, ps11.0.0.129pro.exe, 00000000.00000003.2483442313.00000000020F4000.00000004.00001000.00020000.00000000.sdmp, ps11.0.0.129pro.tmp, 00000001.00000003.1667380568.0000000002228000.00000004.00001000.00020000.00000000.sdmp, ps11.0.0.129pro.tmp, 00000001.00000003.2310510471.0000000003464000.00000004.00000020.00020000.00000000.sdmp, ps11.0.0.129pro.tmp, 00000001.00000003.1948604214.000000000078B000.00000004.00000020.00020000.00000000.sdmp, ps11.0.0.129pro.tmp, 00000001.00000003.1667307291.00000000030F0000.00000004.00001000.00020000.00000000.sdmp, ps11.0.0.129pro.tmp, 00000001.00000003.2477022758.0000000002228000.00000004.00001000.00020000.00000000.sdmp, ps11.0.0.129pro.tmp, 00000001.00000003.2252827367.0000000003464000.00000004.00000020.00020000.00000000.sdmp, ps11.0.0.129pro.tmp, 00000001.00000003.2471290854.000000000346C000.00000004.00000020.00020000.00000000.sdmp, ps11.0.0.129pro.tmp, 00000001.00000003.2473431795.0000000002224000.00000004.00001000.00020000.00000000.sdmp, ps11.0.0.129pro.tmp, 00000001.00000003.2472399532.0000000000769000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.constructconnect.com/privacy-policy
Source: PlanSwift.exe, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.fast-report.com
Source: PlanSwift.exe, 00000007.00000002.2340509901.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp, PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.fast-report.comU
Source: PlanSwift.exe, PlanSwift.exe, 00000009.00000003.2357414981.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.planswift.com
Source: PlanSwift.exe, 00000009.00000003.2357414981.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.planswift.com/activate/
Source: PlanSwift.exe, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.planswift.com/eula/
Source: PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.planswift.com/eula/OpenU
Source: PlanSwift.exe, 00000009.00000003.2357414981.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.planswift.com/pricing
Source: PlanSwift.exe, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.planswift.com/purchase
Source: PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.planswift.com/removelicense/
Source: PlanSwift.exe, 00000009.00000003.2357414981.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.planswift.com/requesttrial
Source: PlanSwift.exe, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.planswift.com/sVideoURL/?psVideoID=
Source: PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.planswift.com/sVideoURL/?psVideoID=U
Source: PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000007.00000003.2256979397.0000000006D20000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.planswift.com/support
Source: PlanSwift.exe, 00000007.00000002.2340509901.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp, PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.planswift.comU

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 18.144.71.249:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.144.71.249:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.144.71.249:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.60.103.30:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.60.103.30:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.60.103.30:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.11.207:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.25.14:443 -> 192.168.2.4:49754 version: TLS 1.2

System Summary

.NET source code contains very large array initializations

Source: is-P9DH3.tmp.1.dr, ImagesAssemblyImageList.cs

Large array initialization: ImagesAssemblyImageList: array initializer size 4225

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00424014 NtdllDefWindowProc_A,	1_2_00424014
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_0047A9E8 NtdllDefWindowProc_A,	1_2_0047A9E8
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00412A68 NtdllDefWindowProc_A,	1_2_00412A68
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_0042FA00 NtdllDefWindowProc_A,	1_2_0042FA00
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00457E24 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	1_2_00457E24

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp

Code function: 1_2_0042EDC4: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,

1_2_0042EDC4

Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe	Code function: 0_2_00409920 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_00409920
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00455E14 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		1_2_00455E14

Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe	Code function: 0_2_004088C0	0_2_004088C0
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_004688B8	1_2_004688B8
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00482A88	1_2_00482A88
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00471FB0	1_2_00471FB0
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00452194	1_2_00452194
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_0043E240	1_2_0043E240
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_004905E0	1_2_004905E0
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_0043083C	1_2_0043083C
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_0046A974	1_2_0046A974
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_004449B8	1_2_004449B8
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00434AB4	1_2_00434AB4
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00488E3C	1_2_00488E3C
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00444F60	1_2_00444F60
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_004313C8	1_2_004313C8
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00445658	1_2_00445658
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_004357B8	1_2_004357B8
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_0045F954	1_2_0045F954
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00445A64	1_2_00445A64
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_0045BA04	1_2_0045BA04
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00489D9C	1_2_00489D9C
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 7_2_0040C27C	7_2_0040C27C
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 7_2_004134E4	7_2_004134E4
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 9_2_0040C27C	9_2_0040C27C
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 9_2_004134E4	9_2_004134E4
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_00BAC27C	11_2_00BAC27C

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: String function: 00453B40 appears 97 times
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: String function: 0040909C appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: String function: 0040596C appears 114 times
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: String function: 004587AC appears 81 times
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: String function: 00403400 appears 62 times
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: String function: 004585A0 appears 120 times
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: String function: 00406F54 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: String function: 00403494 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: String function: 00446594 appears 58 times
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: String function: 0040357C appears 34 times
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: String function: 004462C4 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: String function: 004349CC appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: String function: 00403684 appears 233 times
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: String function: 00407D84 appears 43 times
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: String function: 00CCCC98 appears 241 times
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: String function: 03AF7174 appears 45 times
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: String function: 0052CC98 appears 482 times
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: String function: 0040CD68 appears 34 times

Source: ps11.0.0.129pro.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: ps11.0.0.129pro.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: ps11.0.0.129pro.tmp.0.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: is-RQBTG.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-RQBTG.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-RQBTG.tmp.1.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped

Source: is-S2ENC.tmp.1.dr

Static PE information: Resource name: RT_VERSION type: MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"

Source: ps11.0.0.129pro.exe, 00000000.00000003.1666090769.0000000002320000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs ps11.0.0.129pro.exe
Source: ps11.0.0.129pro.exe, 00000000.00000003.1666302856.000000000210C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs ps11.0.0.129pro.exe

Source: ps11.0.0.129pro.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: sus34.evad.winEXE@14/1587@4/4

Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe	Code function: 0_2_00409920 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_00409920
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00455E14 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		1_2_00455E14

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp

Code function: 1_2_0045663C GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceExA,GetDiskFreeSpaceA,

1_2_0045663C

Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe

Code function: 0_2_0040A10C FindResourceA,SizeofResource,LoadResource,LockResource,

0_2_0040A10C

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp

File created: C:\Program Files (x86)\PlanSwift11

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6016:120:WilError_03
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Mutant created: \Sessions\1\BaseNamedObjects\MutexNPA_UnitVersioning_416
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Mutant created: \Sessions\1\BaseNamedObjects\MutexNPA_UnitVersioning_5888
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Mutant created: \Sessions\1\BaseNamedObjects\firebird_trace_mutex
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Mutant created: \Sessions\1\BaseNamedObjects\MutexNPA_UnitVersioning_3140

Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe

File created: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp

Jump to behavior

Source: Yara match	File source: 9.2.PlanSwift.exe.f80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.PlanSwift.exe.f80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.PlanSwift.exe.f80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2340509901.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2917164884.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2587147896.0000000006290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: ps11.0.0.129pro.exe	String found in binary or memory: need to be updated. /RESTARTAPPLICATIONS Instructs Setup to restart applications. /NORESTARTAPPLICATIONS Prevents Setup from restarting applications. /LOADINF="filename" Instructs Setup to load the settings from the specified file after having checked t
Source: PlanSwift.exe	String found in binary or memory: application/vnd.groove-help
Source: PlanSwift.exe	String found in binary or memory: application/vnd.adobe.air-application-installer-package+zip
Source: PlanSwift.exe	String found in binary or memory: application/x-install-instructions
Source: PlanSwift.exe	String found in binary or memory: Cache/getting-started.mht
Source: PlanSwift.exe	String found in binary or memory: /getting-started-licensed
Source: PlanSwift.exe	String found in binary or memory: /getting-started-expired
Source: PlanSwift.exe	String found in binary or memory: /getting-started-viewer
Source: PlanSwift.exe	String found in binary or memory: /getting-started-trial
Source: PlanSwift.exe	String found in binary or memory: /getting-started/
Source: PlanSwift.exe	String found in binary or memory: application/vnd.groove-help
Source: PlanSwift.exe	String found in binary or memory: application/vnd.adobe.air-application-installer-package+zip
Source: PlanSwift.exe	String found in binary or memory: application/x-install-instructions
Source: PlanSwift.exe	String found in binary or memory: Are you sure you want to continue with the plugin un-installation
Source: PlanSwift.exe	String found in binary or memory: Uninstallation of installed plugins will REQUIRE a restart of PlanSwift immediately after the plugin un-installation has completed
Source: PlanSwift.exe	String found in binary or memory: Package is already installed on your system. You will need to uninstall it before it can be re-installed. Do you want to uninstall plugin identified above
Source: PlanSwift.exe	String found in binary or memory: NATS-DANO-ADD
Source: PlanSwift.exe	String found in binary or memory: NATS-SEFI-ADD
Source: PlanSwift.exe	String found in binary or memory: Cache/getting-started.mht
Source: PlanSwift.exe	String found in binary or memory: /getting-started-licensed
Source: PlanSwift.exe	String found in binary or memory: /getting-started-expired
Source: PlanSwift.exe	String found in binary or memory: /getting-started-viewer
Source: PlanSwift.exe	String found in binary or memory: /getting-started-trial
Source: PlanSwift.exe	String found in binary or memory: /getting-started/
Source: PlanSwift.exe	String found in binary or memory: JIS_C6229-1984-hand-add
Source: PlanSwift.exe	String found in binary or memory: jp-ocr-hand-add
Source: PlanSwift.exe	String found in binary or memory: jp-ocr-b-add
Source: PlanSwift.exe	String found in binary or memory: JIS_C6229-1984-b-add
Source: PlanSwift.exe	String found in binary or memory: ISO_6937-2-add
Source: PlanSwift.exe	String found in binary or memory: application/vnd.groove-help
Source: PlanSwift.exe	String found in binary or memory: application/vnd.adobe.air-application-installer-package+zip
Source: PlanSwift.exe	String found in binary or memory: application/x-install-instructions

Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe

File read: C:\Users\user\Desktop\ps11.0.0.129pro.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-K4N7C.tmp\_isetup\_setup64.tmp

Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

graph_5-67

Source: unknown	Process created: C:\Users\user\Desktop\ps11.0.0.129pro.exe "C:\Users\user\Desktop\ps11.0.0.129pro.exe"
Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe	Process created: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp "C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp" /SL5="$20410,54471570,58368,C:\Users\user\Desktop\ps11.0.0.129pro.exe"
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-K4N7C.tmp\_isetup\_setup64.tmp helper 105 0x3E4
Source: C:\Users\user\AppData\Local\Temp\is-K4N7C.tmp\_isetup\_setup64.tmp	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Process created: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe "C:\Program Files (x86)\PlanSwift11\PlanSwift.exe" /regserver
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Process created: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe "C:\Program Files (x86)\PlanSwift11\PlanSwift.exe" /init
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Process created: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe "C:\Program Files (x86)\PlanSwift11\PlanSwift.exe" -o "Sample Plan"
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe	Process created: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp "C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp" /SL5="$20410,54471570,58368,C:\Users\user\Desktop\ps11.0.0.129pro.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-K4N7C.tmp\_isetup\_setup64.tmp helper 105 0x3E4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Process created: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe "C:\Program Files (x86)\PlanSwift11\PlanSwift.exe" /regserver	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Process created: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe "C:\Program Files (x86)\PlanSwift11\PlanSwift.exe" /init	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Process created: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe "C:\Program Files (x86)\PlanSwift11\PlanSwift.exe" -o "Sample Plan"	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288

Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-K4N7C.tmp\_isetup\_setup64.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: chilkatdelphixe.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: planswiftanalyticsservice.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: fpdfsdk.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: wship6.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: dspdf.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: gds32.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: icuuc30.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: icudt30.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: ibxml.dll	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: chilkatdelphixe.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: usp10.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: planswiftanalyticsservice.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: fpdfsdk.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: textshaping.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: wship6.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: netprofm.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: npmproxy.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: riched20.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: msls31.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: dspdf.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: msftedit.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: sxs.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: gds32.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: icuuc30.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: icudt30.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: ibxml.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: firewallapi.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: fwbase.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: chilkatdelphixe.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: usp10.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: planswiftanalyticsservice.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: textshaping.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: textinputframework.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: fpdfsdk.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: wship6.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: netprofm.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: npmproxy.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: riched20.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: msls31.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: dspdf.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: msftedit.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: sxs.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: gds32.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: icuuc30.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: icudt30.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: ibxml.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: ieframe.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: wkscli.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: dataexchange.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: d3d11.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: dcomp.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: dxgi.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: msiso.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: mshtml.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: srpapi.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: jscript9.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: msimtf.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: mlang.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: schannel.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: d2d1.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: dwrite.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: d3d10warp.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: dxcore.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: mskeyprotect.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: ntasn1.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: dpapi.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: ncrypt.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: ncryptsslp.dll
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Section loaded: uianimation.dll

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

File written: C:\Program Files (x86)\PlanSwift11\PERSIST.INI

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Automated click: I accept the agreement

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

File opened: C:\Windows\SysWOW64\Msftedit.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.CONSTRUCTCONNECT INC.PLANSWIFT SOFTWAREElectronic End User License AgreementNOTICE TO USER: This End User License Agreement ("Agreement") is a legal agreement. Please read the Agreement carefully before completing the installation process and using the Software. It provides a license to use the Software and contains warranty information and liability disclaimers. BY INSTALLING THE SOFTWARE YOU ARE AGREEING TO BECOME BOUND BY THE TERMS OF THIS AGREEMENT. You ("Licensee") agree that this Agreement is like any written negotiated agreement signed by You. The Agreement is enforceable against You and any legal entity that obtains the Software and on whose behalf it is used. If You do not agree with the terms of this Agreement do not install or use the Software. The terms of this Agreement also apply to any Software upgrades patches modified versions Updates additions copies of the Software licensed to You by ConstructConnect or third parties and support services for the Software unless other terms accompany those items. If so those terms apply.1. Definitions"Licensee" means the entity that has purchased a license or licenses to use the Software."Licensor" means ConstructConnect Inc."Physical Server" means a computing device running an operating system on which other software or utilities are installed. The operating system runs directly on the hardware of the device not in an emulated or virtualized environment. A Virtual Server is not a Physical Server."Representative" means any representative of a Licensee whether employee agent independent contractor subcontractor or otherwise whom Licensee authorizes to access or use the Software on the Licensee's behalf."Reseller" means an authorized reseller of the Software in a Territory."Software" means (a) all of the information with which this Agreement is provided including but not limited to: (i) all software files and other computer files or information; (ii) sample and stock photographs images sounds clip art and other artistic works bundled with Software; and (iii) related explanatory written materials and files ("Documentation") and (b) any modified versions and copies of upgrades patches Updates and additions to such information provided to You by Licensor or third parties on behalf of Licensor at any time to the extent not provided under separate terms (collectively "Updates")."Territory" means a designated territory in which a Reseller has exclusive rights to distribute the Software."Updates" means those subsequent releases of the Software which are generally made available to compliant licensees of the Software who purchase them. Updates shall not include: (i) any releases enhancements functionality services or products that PlanSwift licenses separately or charges for separately; or (ii) an
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.CONSTRUCTCONNECT INC.PLANSWIFT SOFTWAREElectronic End User License AgreementNOTICE TO USER: This End User License Agreement ("Agreement") is a legal agreement. Please read the Agreement carefully before completing the installation process and using the Software. It provides a license to use the Software and contains warranty information and liability disclaimers. BY INSTALLING THE SOFTWARE YOU ARE AGREEING TO BECOME BOUND BY THE TERMS OF THIS AGREEMENT. You ("Licensee") agree that this Agreement is like any written negotiated agreement signed by You. The Agreement is enforceable against You and any legal entity that obtains the Software and on whose behalf it is used. If You do not agree with the terms of this Agreement do not install or use the Software. The terms of this Agreement also apply to any Software upgrades patches modified versions Updates additions copies of the Software licensed to You by ConstructConnect or third parties and support services for the Software unless other terms accompany those items. If so those terms apply.1. Definitions"Licensee" means the entity that has purchased a license or licenses to use the Software."Licensor" means ConstructConnect Inc."Physical Server" means a computing device running an operating system on which other software or utilities are installed. The operating system runs directly on the hardware of the device not in an emulated or virtualized environment. A Virtual Server is not a Physical Server."Representative" means any representative of a Licensee whether employee agent independent contractor subcontractor or otherwise whom Licensee authorizes to access or use the Software on the Licensee's behalf."Reseller" means an authorized reseller of the Software in a Territory."Software" means (a) all of the information with which this Agreement is provided including but not limited to: (i) all software files and other computer files or information; (ii) sample and stock photographs images sounds clip art and other artistic works bundled with Software; and (iii) related explanatory written materials and files ("Documentation") and (b) any modified versions and copies of upgrades patches Updates and additions to such information provided to You by Licensor or third parties on behalf of Licensor at any time to the extent not provided under separate terms (collectively "Updates")."Territory" means a designated territory in which a Reseller has exclusive rights to distribute the Software."Updates" means those subsequent releases of the Software which are generally made available to compliant licensees of the Software who purchase them. Updates shall not include: (i) any releases enhancements functionality services or products that PlanSwift licenses separately or charges for separately; or (ii) an
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.CONSTRUCTCONNECT INC.PLANSWIFT SOFTWAREElectronic End User License AgreementNOTICE TO USER: This End User License Agreement ("Agreement") is a legal agreement. Please read the Agreement carefully before completing the installation process and using the Software. It provides a license to use the Software and contains warranty information and liability disclaimers. BY INSTALLING THE SOFTWARE YOU ARE AGREEING TO BECOME BOUND BY THE TERMS OF THIS AGREEMENT. You ("Licensee") agree that this Agreement is like any written negotiated agreement signed by You. The Agreement is enforceable against You and any legal entity that obtains the Software and on whose behalf it is used. If You do not agree with the terms of this Agreement do not install or use the Software. The terms of this Agreement also apply to any Software upgrades patches modified versions Updates additions copies of the Software licensed to You by ConstructConnect or third parties and support services for the Software unless other terms accompany those items. If so those terms apply.1. Definitions"Licensee" means the entity that has purchased a license or licenses to use the Software."Licensor" means ConstructConnect Inc."Physical Server" means a computing device running an operating system on which other software or utilities are installed. The operating system runs directly on the hardware of the device not in an emulated or virtualized environment. A Virtual Server is not a Physical Server."Representative" means any representative of a Licensee whether employee agent independent contractor subcontractor or otherwise whom Licensee authorizes to access or use the Software on the Licensee's behalf."Reseller" means an authorized reseller of the Software in a Territory."Software" means (a) all of the information with which this Agreement is provided including but not limited to: (i) all software files and other computer files or information; (ii) sample and stock photographs images sounds clip art and other artistic works bundled with Software; and (iii) related explanatory written materials and files ("Documentation") and (b) any modified versions and copies of upgrades patches Updates and additions to such information provided to You by Licensor or third parties on behalf of Licensor at any time to the extent not provided under separate terms (collectively "Updates")."Territory" means a designated territory in which a Reseller has exclusive rights to distribute the Software."Updates" means those subsequent releases of the Software which are generally made available to compliant licensees of the Software who purchase them. Updates shall not include: (i) any releases enhancements functionality services or products that PlanSwift licenses separately or charges for separately; or (ii) an

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Excel\Addins\SwiftExcel

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\dea351d9-e184-49ac-833f-c98a60d0ae27_is1

Jump to behavior

Source: ps11.0.0.129pro.exe

Static PE information: certificate valid

Source: ps11.0.0.129pro.exe

Static file information: File size 54814096 > 1048576

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: ps11.0.0.129pro.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp

Code function: 1_2_00450A28 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00450A28

Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe	Code function: 0_2_00406A50 push 00406A8Dh; ret	0_2_00406A85
Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe	Code function: 0_2_004040B5 push eax; ret	0_2_004040F1
Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe	Code function: 0_2_00404185 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe	Code function: 0_2_00404206 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe	Code function: 0_2_004042E8 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe	Code function: 0_2_00404283 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe	Code function: 0_2_004093EC push 0040941Fh; ret	0_2_00409417
Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe	Code function: 0_2_004085B8 push ecx; mov dword ptr [esp], eax	0_2_004085BD
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00409DDC push 00409E19h; ret	1_2_00409E11
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_0041A0B8 push ecx; mov dword ptr [esp], ecx	1_2_0041A0BD
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00452194 push ecx; mov dword ptr [esp], eax	1_2_00452199
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_004062CC push ecx; mov dword ptr [esp], eax	1_2_004062CD
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_0040A2DF push ds; ret	1_2_0040A2E0
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_004605AC push ecx; mov dword ptr [esp], ecx	1_2_004605B0
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00458848 push 00458880h; ret	1_2_00458878
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00410970 push ecx; mov dword ptr [esp], edx	1_2_00410975
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_0049CD48 pushad ; retf	1_2_0049CD57
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00412DB8 push 00412E1Bh; ret	1_2_00412E13
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_0040D2C8 push ecx; mov dword ptr [esp], edx	1_2_0040D2CA
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_0040546D push eax; ret	1_2_004054A9
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_0040553D push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_004055BE push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_0040563B push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_004056A0 push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_0040F828 push ecx; mov dword ptr [esp], edx	1_2_0040F82A
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_004978C8 push ecx; mov dword ptr [esp], ecx	1_2_004978CD
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_004878A0 push ecx; mov dword ptr [esp], ecx	1_2_004878A5
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00443930 push ecx; mov dword ptr [esp], ecx	1_2_00443934
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00479A30 push ecx; mov dword ptr [esp], edx	1_2_00479A31
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00459B60 push 00459BA4h; ret	1_2_00459B9C
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00451FD0 push 00452003h; ret	1_2_00451FFB

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.Sparkline.v17.2.Core.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-J8M7F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.Sparkline.v17.2.Core.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-6IN84.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.XtraLayout.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ru\is-P0OB4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.Printing.v17.2.Core.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.Pdf.v17.2.Core.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-M0JQ2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-S2ENC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.Printing.v17.2.Core.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.XtraEditors.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Microsoft.Office.Tools.Common.v4.0.Utilities.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.Sparkline.v17.2.Core.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.Pdf.v17.2.Core.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-CPQJG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-NC4QM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.XtraEditors.v17.2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\PsTokenService.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.Pdf.v17.2.Core.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.XtraTreeList.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-L2OVJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-LCN76.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.Utils.v17.2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.Data.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\PsService.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-H37KB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.Utils.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-03RG0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-3TOPV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-LF9SO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.Utils.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\en\is-4KI03.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-OF3B7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.XtraEditors.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-UQKVV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Newtonsoft.Json.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-GH56H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-38AFE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-BGR7A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ru\DevExpress.Pdf.v17.2.Core.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\PsSwift_Excel.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.XtraLayout.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.XtraLayout.v17.2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.Data.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-P9DH3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Users\user\AppData\Local\Temp\is-K4N7C.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-C6KMG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-S1QUV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\is-RQBTG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-KF882.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.XtraTreeList.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.XtraEditors.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.Images.v17.2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-H8F7U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-9TO3L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-LNG1S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-2UQDK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.XtraTreeList.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.Utils.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-RKMEQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ExcelConnectService.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe	File created: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.Sparkline.v17.2.Core.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-C5VI4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-453AR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-EI8K0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.Data.v17.2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.Printing.v17.2.Core.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ExcelImport.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ru\is-9HNDC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ru\DevExpress.Data.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\en\PsSwift_Excel.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-PAU3O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.Pdf.v17.2.Core.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-1G665.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.XtraTreeList.v17.2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.XtraLayout.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-CD3K2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-R6F91.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-VD39V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-EVE0N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-B71FA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.Printing.v17.2.Core.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-2G38J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-UJ625.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-QSKEV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-7A7VE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	File created: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.Data.v17.2.resources.dll (copy)	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Window searched: window name: FilemonClass
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Window searched: window name: RegmonClass
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Window searched: window name: FilemonClass
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Window searched: window name: RegmonClass

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlanSwift 11\PlanSwift 11.lnk

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_0042409C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_0042409C
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_0042409C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_0042409C
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00422CEC SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	1_2_00422CEC
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_0041815E IsIconic,SetWindowPos,	1_2_0041815E
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00418160 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	1_2_00418160
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_0042466C IsIconic,SetActiveWindow,SetFocus,	1_2_0042466C
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00424624 IsIconic,SetActiveWindow,	1_2_00424624
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00418814 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	1_2_00418814
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_0042F75C IsIconic,GetWindowLongA,GetWindowLongA,GetActiveWindow,MessageBoxA,SetActiveWindow,GetActiveWindow,MessageBoxA,SetActiveWindow,	1_2_0042F75C
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00417A28 IsIconic,GetCapture,	1_2_00417A28
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00485AAC IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	1_2_00485AAC

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp

Code function: 1_2_0041F5A8 GetVersion,SetErrorMode,LoadLibraryA,SetErrorMode,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

1_2_0041F5A8

Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	System information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

Special instruction interceptor: First address: 2C91862 instructions caused by: Self-modifying code

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Memory allocated: E9A0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Memory allocated: F720000 memory commit \| memory reserve \| memory write watch
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Memory allocated: F8A0000 memory commit \| memory reserve \| memory write watch
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Memory allocated: F8C0000 memory commit \| memory reserve \| memory write watch
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Memory allocated: EFC0000 memory commit \| memory reserve \| memory write watch
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Memory allocated: ED40000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Memory allocated: 10A80000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Memory allocated: 15230000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Memory allocated: 108C0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Memory allocated: 16030000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Memory allocated: 10CB0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Memory allocated: 10CD0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Memory allocated: 10CF0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Memory allocated: 16840000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Memory allocated: 16860000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Memory allocated: 15110000 memory reserve \| memory write watch

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.Sparkline.v17.2.Core.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.Sparkline.v17.2.Core.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-J8M7F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-6IN84.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.XtraLayout.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ru\is-P0OB4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.Printing.v17.2.Core.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.Pdf.v17.2.Core.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.Printing.v17.2.Core.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-S2ENC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-M0JQ2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.XtraEditors.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Microsoft.Office.Tools.Common.v4.0.Utilities.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.Sparkline.v17.2.Core.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.Pdf.v17.2.Core.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-CPQJG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\PsTokenService.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.XtraEditors.v17.2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-NC4QM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.XtraTreeList.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.Pdf.v17.2.Core.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-L2OVJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-LCN76.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.Utils.v17.2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.Data.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\PsService.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-H37KB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.Utils.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-03RG0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-3TOPV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-LF9SO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.Utils.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\en\is-4KI03.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.XtraEditors.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-OF3B7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Newtonsoft.Json.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-UQKVV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-GH56H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-38AFE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-BGR7A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ru\DevExpress.Pdf.v17.2.Core.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\PsSwift_Excel.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.XtraLayout.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.XtraLayout.v17.2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.Data.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-P9DH3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-C6KMG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-S1QUV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\is-RQBTG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-KF882.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.XtraTreeList.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.XtraEditors.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.Images.v17.2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-9TO3L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-H8F7U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-LNG1S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-2UQDK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.XtraTreeList.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.Utils.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ExcelConnectService.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-RKMEQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.Sparkline.v17.2.Core.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-C5VI4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-453AR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-EI8K0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.Data.v17.2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.Printing.v17.2.Core.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ExcelImport.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ru\DevExpress.Data.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ru\is-9HNDC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\en\PsSwift_Excel.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-PAU3O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.Pdf.v17.2.Core.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.XtraTreeList.v17.2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.XtraLayout.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-1G665.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-CD3K2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-R6F91.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-VD39V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-EVE0N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-B71FA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.Printing.v17.2.Core.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-UJ625.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-2G38J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-7A7VE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.Data.v17.2.resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-QSKEV.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_0-5994

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	API coverage: 6.8 %
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	API coverage: 6.8 %
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	API coverage: 8.3 %

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00476DFC FindFirstFileA,FindNextFileA,FindClose,	1_2_00476DFC
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00453238 FindFirstFileA,GetLastError,	1_2_00453238
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_0049ACD8 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_0049ACD8
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_004650D0 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_004650D0
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_0046554C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_0046554C
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: 1_2_00463B44 FindFirstFileA,FindNextFileA,FindClose,	1_2_00463B44
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 7_2_0040E0C0 FindFirstFileW,FindClose,	7_2_0040E0C0
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 7_2_0040DAEC GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	7_2_0040DAEC
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 9_2_0040E0C0 FindFirstFileW,FindClose,	9_2_0040E0C0
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 9_2_0040DAEC GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	9_2_0040DAEC
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_00BAE0C0 FindFirstFileW,FindClose,	11_2_00BAE0C0
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_00BADAEC GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	11_2_00BADAEC

Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe

Code function: 0_2_0040A050 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

0_2_0040A050

Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: PlanSwift.exe, 00000007.00000002.2340509901.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	Binary or memory string: TatVirtualMachines(<A
Source: PlanSwift.exe, 00000007.00000002.2340509901.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp, PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	Binary or memory string: TatVirtualMachine
Source: PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: TatVirtualMachines(<
Source: PlanSwift.exe, 00000007.00000002.2340509901.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp, PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	Binary or memory string: TatVirtualMachines
Source: ps11.0.0.129pro.tmp, 00000001.00000003.2472918711.0000000000754000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\k
Source: PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: TatVirtualMachineh=
Source: ps11.0.0.129pro.tmp, 00000001.00000003.2472918711.0000000000754000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ms
Source: PlanSwift.exe, 00000007.00000002.2340509901.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	Binary or memory string: TatVirtualMachineh=A

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

API call chain: ExitProcess graph end node

graph_11-19234

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Thread information set: HideFromDebugger
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Open window title or class name: regmonclass
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Open window title or class name: gbdyllo
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Open window title or class name: procmon_window_class
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Open window title or class name: ollydbg
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Open window title or class name: filemonclass
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process queried: DebugObjectHandle
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process queried: DebugPort
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process queried: DebugObjectHandle
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Process queried: DebugPort

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

Code function: 7_2_00412F5A IsDebuggerPresent,

7_2_00412F5A

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp

Code function: 1_2_00450A28 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00450A28

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

Code function: 11_2_03951467 GetProcessHeap,HeapAlloc,

11_2_03951467

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp

Code function: 1_2_0047A42C ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

1_2_0047A42C

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp

Process created: C:\Users\user\AppData\Local\Temp\is-K4N7C.tmp\_isetup\_setup64.tmp helper 105 0x3E4

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp

Code function: 1_2_0042F294 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateMutexA,

1_2_0042F294

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp

Code function: 1_2_0042E52C AllocateAndInitializeSid,GetVersion,GetModuleHandleA,GetProcAddress,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,

1_2_0042E52C

Source: PlanSwift.exe, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	Binary or memory string: Shell_TrayWnd
Source: PlanSwift.exe, 00000007.00000002.2340509901.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp, PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndU

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

Code function: 7_2_00407AD4 cpuid

7_2_00407AD4

Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe	Code function: GetLocaleInfoA,	0_2_00405694
Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe	Code function: GetLocaleInfoA,	0_2_004056E0
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: GetLocaleInfoA,	1_2_004089F8
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Code function: GetLocaleInfoA,	1_2_00408A44
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	7_2_0040E218
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: EnumSystemLocalesW,	7_2_00412D32
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: GetLocaleInfoW,	7_2_00412DC2
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: GetLocaleInfoW,	7_2_00412DCA
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	7_2_0040D688
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	9_2_0040E218
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: EnumSystemLocalesW,	9_2_00412D32
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: GetLocaleInfoW,	9_2_00412DC2
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: GetLocaleInfoW,	9_2_00412DCA
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	9_2_0040D688
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	11_2_00BAE218
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	11_2_00BAD688

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp

Code function: 1_2_00458E58 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,

1_2_00458E58

Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe

Code function: 0_2_004026C4 GetSystemTime,

0_2_004026C4

Source: C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp

Code function: 1_2_00455DCC GetUserNameA,

1_2_00455DCC

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

Code function: 7_2_00412EB2 GetTimeZoneInformation,

7_2_00412EB2

Source: C:\Users\user\Desktop\ps11.0.0.129pro.exe

Code function: 0_2_00404654 GetModuleHandleA,GetVersion,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,SetProcessDEPPolicy,

0_2_00404654

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION

Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_0395538C CkBinData_AppendEncoded,	11_2_0395538C
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_039553C0 CkBinData_AppendEncodedSb,	11_2_039553C0
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_039553FC CkBinData_AppendSb,	11_2_039553FC
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_03955324 CkBinData_AppendBinary,	11_2_03955324
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_0395535C CkBinData_AppendBom,	11_2_0395535C
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_03955280 CkBinData_getLastMethodSuccess,	11_2_03955280
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_039552A8 CkBinData_putLastMethodSuccess,	11_2_039552A8
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_039552D0 CkBinData_getNumBytes,	11_2_039552D0
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_039552EC CkBinData_AppendBd,	11_2_039552EC
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_03955214 CkBinData_Dispose,	11_2_03955214
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_0395520C CkBinData_Create,	11_2_0395520C
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_0395579C CkBinData_WriteFile,	11_2_0395579C
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_03955710 CkBinData_LoadFile,	11_2_03955710
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_03955740 CkBinData_RemoveChunk,	11_2_03955740
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_03955774 CkBinData_SecureClear,	11_2_03955774
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_03955684 CkBinData__getString,	11_2_03955684
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_039556A4 CkBinData_LoadBinary,	11_2_039556A4
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_039556DC CkBinData_LoadEncoded,	11_2_039556DC
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_0395560C CkBinData_GetEncodedSb,	11_2_0395560C
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_03955648 CkBinData_GetString,	11_2_03955648
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_03955580 CkBinData__getEncoded,	11_2_03955580
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_039555A0 CkBinData_GetEncodedChunk,	11_2_039555A0
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_039555E4 CkBinData__getEncodedChunk,	11_2_039555E4
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_03955504 CkBinData_GetBinaryChunk,	11_2_03955504
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_03955544 CkBinData_GetEncoded,	11_2_03955544
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_03955494 CkBinData_ContentsEqual,	11_2_03955494
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_039554CC CkBinData_GetBinary,	11_2_039554CC
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_03955438 CkBinData_AppendString,	11_2_03955438
Source: C:\Program Files (x86)\PlanSwift11\PlanSwift.exe	Code function: 11_2_0395546C CkBinData_Clear,	11_2_0395546C

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	21 Native API	1 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Windows Service	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	1 Windows Service	1 DLL Side-Loading	NTDS	147 System Information Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	13 Process Injection	2 Masquerading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	1 Modify Registry	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	341 Virtualization/Sandbox Evasion	DCSync	341 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	13 Process Injection	/etc/passwd and /etc/shadow	3 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ps11.0.0.129pro.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.Data.v17.2.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.Images.v17.2.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.Pdf.v17.2.Core.dll (copy)	4%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.Printing.v17.2.Core.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.Sparkline.v17.2.Core.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.Utils.v17.2.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.XtraEditors.v17.2.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.XtraLayout.v17.2.dll (copy)	4%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.XtraTreeList.v17.2.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ExcelConnectService.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ExcelImport.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Microsoft.Office.Tools.Common.v4.0.Utilities.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Newtonsoft.Json.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\PsService.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\PsSwift_Excel.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\PsTokenService.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.Data.v17.2.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.Pdf.v17.2.Core.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.Printing.v17.2.Core.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.Sparkline.v17.2.Core.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.Utils.v17.2.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.XtraEditors.v17.2.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.XtraLayout.v17.2.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.XtraTreeList.v17.2.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-2UQDK.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-38AFE.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-CD3K2.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-GH56H.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-KF882.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-LNG1S.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-R6F91.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-RKMEQ.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\en\PsSwift_Excel.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\en\is-4KI03.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.Data.v17.2.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.Pdf.v17.2.Core.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.Printing.v17.2.Core.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.Sparkline.v17.2.Core.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.Utils.v17.2.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.XtraEditors.v17.2.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.XtraLayout.v17.2.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.XtraTreeList.v17.2.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-03RG0.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-1G665.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-6IN84.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-9TO3L.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-C5VI4.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-CPQJG.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-EVE0N.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-L2OVJ.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-3TOPV.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-453AR.tmp	4%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-B71FA.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-C6KMG.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-EI8K0.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-H8F7U.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-J8M7F.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-LF9SO.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-M0JQ2.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-OF3B7.tmp	4%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-P9DH3.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-PAU3O.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-QSKEV.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-S1QUV.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-S2ENC.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-VD39V.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.Data.v17.2.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.Pdf.v17.2.Core.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.Printing.v17.2.Core.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.Sparkline.v17.2.Core.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.Utils.v17.2.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.XtraEditors.v17.2.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.XtraLayout.v17.2.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.XtraTreeList.v17.2.resources.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-2G38J.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-7A7VE.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-BGR7A.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-H37KB.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-LCN76.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-NC4QM.tmp	0%	ReversingLabs
C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-UJ625.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
http://www.indyproject.org/	0%	URL Reputation	safe
http://www.innosetup.com/	0%	URL Reputation	safe
http://www.remobjects.com/psU	0%	URL Reputation	safe
http://www.remobjects.com/ps	0%	URL Reputation	safe
https://ldapauth.planswift.netU	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclResources.pas	0%	Avira URL Cloud	safe
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclBase.pas	0%	Avira URL Cloud	safe
https://cdnjs.cloudflare.com/ajax/libs/fancybox/3.5.2/jquery.fancybox.min.css	0%	Avira URL Cloud	safe
https://hub.planswift.com/hubfs/bid-boss.jpg	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclUnitVersioning.pas	0%	Avira URL Cloud	safe
https://share.planswift.comU	0%	Avira URL Cloud	safe
https://www.planswift.com/removelicense/	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclDateTime.pas	0%	Avira URL Cloud	safe
https://www.planswift.com	0%	Avira URL Cloud	safe
https://www.planswift.comU	0%	Avira URL Cloud	safe
https://share.planswift.com	0%	Avira URL Cloud	safe
http://www.planswift.com/swifttube/player/SwiftTubePlayer2.swf?VID=U	0%	Avira URL Cloud	safe
ftp://ftp.000010002000300040005000600070008000900110012001300140015001600170018001900210022002300240	0%	Avira URL Cloud	safe
https://www.planswift.com/requesttrial	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclStringConversions.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclFileUtils.pas	0%	Avira URL Cloud	safe
https://www.planswift.com/purchase	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclCharsets.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/windows/JclShell.pas	0%	Avira URL Cloud	safe
https://www.planswift.com/getting-started-viewer?licenseType=Viewer&edition=Professional&version=11.0.0.129&	0%	Avira URL Cloud	safe
https://hub.planswift.com/hs-fs/hub/2347101/hub_generated/template_assets/9927841831/1580250760790/Custom/page/Planswift_May2017-theme/Planswift_May2017-style.min.css	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclLogic.pas	0%	Avira URL Cloud	safe
https://www.planswift.com/status/	0%	Avira URL Cloud	safe
https://plugins.planswift.comU	0%	Avira URL Cloud	safe
https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.8.0/slick.min.css	0%	Avira URL Cloud	safe
https://hub.planswift.com/hs-fs/hubfs/PS%20-%20Getting%20Started/Whats%20New%20in%20PlanSwift%C2%AE%2011.png?width=500&name=Whats%20New%20in%20PlanSwift%C2%AE%2011.png	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclRTTI.pas	0%	Avira URL Cloud	safe
https://ldapauth.planswift.net	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclSysInfo.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclUnicode.pas	0%	Avira URL Cloud	safe
https://www.fast-report.com	0%	Avira URL Cloud	safe
https://www.planswift.com/pricing	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/windows/JclConsole.pas	0%	Avira URL Cloud	safe
http://www.planswift.com/activate/PlanSwiftActivation/	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclMime.pas	0%	Avira URL Cloud	safe
http://www.fast-report.com	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/vcl/JclVclResources.pas	0%	Avira URL Cloud	safe
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline	0%	Avira URL Cloud	safe
http://www.chilkatsoft.com/rssComponent.html	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclMath.pas	0%	Avira URL Cloud	safe
https://www.planswift.com/eula/OpenU	0%	Avira URL Cloud	safe
https://hub.planswift.com/hs-fs/hub/2347101/hub_generated/template_assets/23959717271/1580250761785/HubUI-PlanSwift/assets/production.min.css	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/windows/JclRegistry.pas	0%	Avira URL Cloud	safe
https://hub.planswift.com/hubfs/PS%20-%20Getting%20Started/spaceFrame_700.jpg	0%	Avira URL Cloud	safe
https://www.planswift.com/eula/	0%	Avira URL Cloud	safe
https://maxcdn.bootstrapcdn.com/font-awesome/4.6.3/css/font-awesome.min.css	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/windows/Snmp.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/windows/JclWin32.pas	0%	Avira URL Cloud	safe
https://www.planswift.com/activate/	0%	Avira URL Cloud	safe
https://www.planswift.com/sVideoURL/?psVideoID=	0%	Avira URL Cloud	safe
https://www.fast-report.comU	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclSimpleXml.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/Jcl8087.pas	0%	Avira URL Cloud	safe
https://myaccount.planswift.com/password/emailU	0%	Avira URL Cloud	safe
https://myaccount.planswift.comU	0%	Avira URL Cloud	safe
http://www..com	0%	Avira URL Cloud	safe
https://www.planswift.com/support	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/vcl/JclGraphUtils.pas	0%	Avira URL Cloud	safe
https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.8.0/slick-theme.css	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclAnsiStrings.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclIniFiles.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclStrings.pas	0%	Avira URL Cloud	safe
https://planswift.com/support	0%	Avira URL Cloud	safe
https://plugins.planswift.com	0%	Avira URL Cloud	safe
https://www.planswift.com/sVideoURL/?psVideoID=U	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/windows/JclAppInst.pas	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclSysUtils.pas	0%	Avira URL Cloud	safe
https://myaccount.planswift.com/password/email	0%	Avira URL Cloud	safe
https://myaccount.planswift.com	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclStreams.pas	0%	Avira URL Cloud	safe
http://www.planswift.com/swifttube/player/SwiftTubePlayer2.swf?VID=	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/windows/JclSecurity.pas	0%	Avira URL Cloud	safe
https://hub.planswift.com/getting-started-viewer?licenseType=Viewer&edition=Professional&version=11.0.0.129&	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclSynch.pas	0%	Avira URL Cloud	safe
https://www.constructconnect.com/privacy-policy	0%	Avira URL Cloud	safe
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclWideStrings.pas	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.planswift.com	18.144.71.249	true	false	unknown
group1.sites.hscoscdn00.net	199.60.103.30	true	false	unknown
cdnjs.cloudflare.com	104.17.25.14	true	false	unknown
maxcdn.bootstrapcdn.com	104.18.11.207	true	false	unknown
hub.planswift.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdnjs.cloudflare.com/ajax/libs/fancybox/3.5.2/jquery.fancybox.min.css	false	Avira URL Cloud: safe	unknown
https://hub.planswift.com/hubfs/bid-boss.jpg	false	Avira URL Cloud: safe	unknown
https://www.planswift.com/getting-started-viewer?licenseType=Viewer&edition=Professional&version=11.0.0.129&	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.8.0/slick.min.css	false	Avira URL Cloud: safe	unknown
https://www.planswift.com/status/	false	Avira URL Cloud: safe	unknown
https://hub.planswift.com/hs-fs/hub/2347101/hub_generated/template_assets/9927841831/1580250760790/Custom/page/Planswift_May2017-theme/Planswift_May2017-style.min.css	false	Avira URL Cloud: safe	unknown
https://hub.planswift.com/hs-fs/hubfs/PS%20-%20Getting%20Started/Whats%20New%20in%20PlanSwift%C2%AE%2011.png?width=500&name=Whats%20New%20in%20PlanSwift%C2%AE%2011.png	false	Avira URL Cloud: safe	unknown
https://hub.planswift.com/hubfs/PS%20-%20Getting%20Started/spaceFrame_700.jpg	false	Avira URL Cloud: safe	unknown
https://hub.planswift.com/hs-fs/hub/2347101/hub_generated/template_assets/23959717271/1580250761785/HubUI-PlanSwift/assets/production.min.css	false	Avira URL Cloud: safe	unknown
https://maxcdn.bootstrapcdn.com/font-awesome/4.6.3/css/font-awesome.min.css	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.8.0/slick-theme.css	false	Avira URL Cloud: safe	unknown
https://hub.planswift.com/getting-started-viewer?licenseType=Viewer&edition=Professional&version=11.0.0.129&	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://share.planswift.comU	PlanSwift.exe, 00000007.00000002.2340509901.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp, PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://ldapauth.planswift.netU	PlanSwift.exe, 00000007.00000002.2340509901.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp, PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclResources.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	ps11.0.0.129pro.exe, 00000000.00000000.1665343528.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclDateTime.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://www.planswift.com/removelicense/	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
http://www.indyproject.org/	PlanSwift.exe, 00000007.00000003.2262470356.0000000000F20000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000007.00000003.2337279134.00000000069E3000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2358261010.0000000000EF0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2425201679.0000000006BB3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclBase.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclUnitVersioning.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://www.planswift.com/requesttrial	PlanSwift.exe, 00000009.00000003.2357414981.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.planswift.com	PlanSwift.exe, PlanSwift.exe, 00000009.00000003.2357414981.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://share.planswift.com	PlanSwift.exe, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://www.planswift.comU	PlanSwift.exe, 00000007.00000002.2340509901.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp, PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
http://www.planswift.com/swifttube/player/SwiftTubePlayer2.swf?VID=U	PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclStringConversions.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://www.planswift.com/purchase	PlanSwift.exe, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
ftp://ftp.000010002000300040005000600070008000900110012001300140015001600170018001900210022002300240	PlanSwift.exe	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclCharsets.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclFileUtils.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/windows/JclShell.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclLogic.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclRTTI.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://ldapauth.planswift.net	PlanSwift.exe, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://plugins.planswift.comU	PlanSwift.exe, 00000007.00000002.2340509901.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp, PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclUnicode.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclSysInfo.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
http://www.innosetup.com/	ps11.0.0.129pro.tmp, ps11.0.0.129pro.tmp, 00000001.00000000.1666665834.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
http://www.planswift.com/activate/PlanSwiftActivation/	PlanSwift.exe, 00000009.00000003.2425793276.00000000065BD000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fast-report.com	PlanSwift.exe, 00000009.00000002.2432296214.0000000001981000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/windows/JclConsole.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://www.fast-report.com	PlanSwift.exe, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://www.planswift.com/pricing	PlanSwift.exe, 00000009.00000003.2357414981.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/vcl/JclVclResources.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline	ps11.0.0.129pro.exe, ps11.0.0.129pro.exe, 00000000.00000000.1665343528.0000000000401000.00000020.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclMime.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
http://www.chilkatsoft.com/rssComponent.html	PlanSwift.exe	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/windows/Snmp.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclMath.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://www.planswift.com/eula/	PlanSwift.exe, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://www.planswift.com/eula/OpenU	PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/windows/JclRegistry.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/windows/JclWin32.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://www.planswift.com/activate/	PlanSwift.exe, 00000009.00000003.2357414981.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.remobjects.com/psU	ps11.0.0.129pro.exe, 00000000.00000003.1666090769.0000000002320000.00000004.00001000.00020000.00000000.sdmp, ps11.0.0.129pro.exe, 00000000.00000003.1666302856.000000000210C000.00000004.00001000.00020000.00000000.sdmp, ps11.0.0.129pro.tmp, 00000001.00000000.1666665834.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
https://www.planswift.com/sVideoURL/?psVideoID=	PlanSwift.exe, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://myaccount.planswift.com/password/emailU	PlanSwift.exe, 00000007.00000002.2340509901.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp, PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://myaccount.planswift.comU	PlanSwift.exe, 00000007.00000002.2340509901.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp, PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclSimpleXml.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/Jcl8087.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
http://www..com	PlanSwift.exe, 00000007.00000003.2266073890.00000000064FB000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2360641025.000000000668B000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.fast-report.comU	PlanSwift.exe, 00000007.00000002.2340509901.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp, PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://www.planswift.com/support	PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000007.00000003.2256979397.0000000006D20000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.0000000006EB0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/vcl/JclGraphUtils.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclAnsiStrings.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclIniFiles.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclStrings.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://planswift.com/support	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://plugins.planswift.com	PlanSwift.exe, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://www.planswift.com/sVideoURL/?psVideoID=U	PlanSwift.exe, 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclSysUtils.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/windows/JclAppInst.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://myaccount.planswift.com/password/email	PlanSwift.exe, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
http://www.remobjects.com/ps	ps11.0.0.129pro.exe, 00000000.00000003.1666090769.0000000002320000.00000004.00001000.00020000.00000000.sdmp, ps11.0.0.129pro.exe, 00000000.00000003.1666302856.000000000210C000.00000004.00001000.00020000.00000000.sdmp, ps11.0.0.129pro.tmp, ps11.0.0.129pro.tmp, 00000001.00000000.1666665834.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
https://myaccount.planswift.com	PlanSwift.exe, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclStreams.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
http://www.planswift.com/swifttube/player/SwiftTubePlayer2.swf?VID=	PlanSwift.exe, PlanSwift.exe, 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://www.constructconnect.com/privacy-policy	ps11.0.0.129pro.exe, 00000000.00000003.1665694428.0000000002320000.00000004.00001000.00020000.00000000.sdmp, ps11.0.0.129pro.exe, 00000000.00000003.1665762973.00000000020F8000.00000004.00001000.00020000.00000000.sdmp, ps11.0.0.129pro.exe, 00000000.00000003.2483568739.00000000020F8000.00000004.00001000.00020000.00000000.sdmp, ps11.0.0.129pro.exe, 00000000.00000003.2483442313.00000000020F4000.00000004.00001000.00020000.00000000.sdmp, ps11.0.0.129pro.tmp, 00000001.00000003.1667380568.0000000002228000.00000004.00001000.00020000.00000000.sdmp, ps11.0.0.129pro.tmp, 00000001.00000003.2310510471.0000000003464000.00000004.00000020.00020000.00000000.sdmp, ps11.0.0.129pro.tmp, 00000001.00000003.1948604214.000000000078B000.00000004.00000020.00020000.00000000.sdmp, ps11.0.0.129pro.tmp, 00000001.00000003.1667307291.00000000030F0000.00000004.00001000.00020000.00000000.sdmp, ps11.0.0.129pro.tmp, 00000001.00000003.2477022758.0000000002228000.00000004.00001000.00020000.00000000.sdmp, ps11.0.0.129pro.tmp, 00000001.00000003.2252827367.0000000003464000.00000004.00000020.00020000.00000000.sdmp, ps11.0.0.129pro.tmp, 00000001.00000003.2471290854.000000000346C000.00000004.00000020.00020000.00000000.sdmp, ps11.0.0.129pro.tmp, 00000001.00000003.2473431795.0000000002224000.00000004.00001000.00020000.00000000.sdmp, ps11.0.0.129pro.tmp, 00000001.00000003.2472399532.0000000000769000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclSynch.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/windows/JclSecurity.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://jcl.svn.sourceforge.net/svnroot/jcl/trunk/jcl/source/common/JclWideStrings.pas	PlanSwift.exe, 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.18.11.207	maxcdn.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
18.144.71.249	www.planswift.com	United States	16509	AMAZON-02US	false
199.60.103.30	group1.sites.hscoscdn00.net	Canada	23181	QUICKSILVER1CA	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1500780
Start date and time:	2024-08-28 22:39:20 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ps11.0.0.129pro.exe
Detection:	SUS
Classification:	sus34.evad.winEXE@14/1587@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.184.234, 142.250.186.163
Excluded domains from analysis (whitelisted): fonts.googleapis.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: ps11.0.0.129pro.exe

Simulations

Behavior and APIs

Time	Type	Description
16:41:47	API Interceptor	242x Sleep call for process: splwow64.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.18.11.207	http://googlle.com	Get hash	malicious	Unknown	Browse	maxcdn.bootstrapcdn.com/font-awesome/4.1.0/fonts/fontawesome-webfont.woff?v=4.1.0
	https://city-of-goodyear.webnode.page/	Get hash	malicious	Unknown	Browse	maxcdn.bootstrapcdn.com/bootstrap/3.3.4/css/bootstrap-theme.min.css
	http://Voyages.CNTraveler.com	Get hash	malicious	Unknown	Browse	maxcdn.bootstrapcdn.com/font-awesome/4.3.0/fonts/fontawesome-webfont.woff2?v=4.3.0
	http://185.67.82.114	Get hash	malicious	Unknown	Browse	maxcdn.bootstrapcdn.com/bootstrap/3.2.0/js/bootstrap.min.js
	SecuriteInfo.com.Exploit.Siggen3.17149.4489.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.3543.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.3543.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.24514.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.12724.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.8245.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
199.60.103.30	https://accountservicing.com/e3t/Ctc/2H+113/ccl-Y04/VVqYcj9d1pTLW16y89n4DRlWxW1xTZ7Q5jxmFNN5BW0Sj3qgyTW7Y8-PT6lZ3n-W7K16HT7thx4hV6kpN06fVkc-W7yxLrN95hXZjW4rblJ-6TSnSZW65gGqH4W43v4N3_YsqT-3YKYVxfV2W58G73YW3cFwVC8ny83jW8Fz12N8-V0SmW5SSzp43rM_L2W245fnt8p94jMW4PPrDY6Cb9HjW2Zf9wL3lKcTbW61Hhz233pYyDW5Qh4rN5z3QrwW1QwY5K38F8JxW433Jj716pqBlW5WlHSd1QR2ZcVsdP_h6JX3RcW6YQskh3NNSGKW9hbgq820G9QVW4RCZ8N3hkwKQW6Ykd0p7cQ_DrW48gHN96lLqMFW4402zd4Vsz0kW8KJCq78P_VX-f5RrgHM04	Get hash	malicious	Unknown	Browse
	https://jpmchase.secure.virtru.com/start/?c=experiment&t=emailtemplate2019-09&s=cb.fraud.support%40jpmorgan.com&p=4f79d996-936e-4d5d-a540-5defd22d4f2e#v=3.0.0&d=https%3A%2F%2Fapi.virtru.com%2Fstorage%2Fapi%2Fpolicies%2F4f79d996-936e-4d5d-a540-5defd22d4f2e%2Fdata%2Fmetadata&dk=I5EC7descIWFFylbdh6NmXQ7qAI3%2BubbOr64PfYZWaU%3D	Get hash	malicious	Unknown	Browse
	https://jpmchase.secure.virtru.com/start/?c=experiment&t=emailtemplate2019-09&s=noreplies.sua%40jpmchase.com&p=961fc2d4-d54b-4e27-b0ef-85377d25ec3e#v=3.0.0&d=https%3A%2F%2Fapi.virtru.com%2Fstorage%2Fapi%2Fpolicies%2F961fc2d4-d54b-4e27-b0ef-85377d25ec3e%2Fdata%2Fmetadata&dk=yarD3Ypd4wo8DD0GDaxf%2B35bfyFVndHAJ4GCt3tZfRQ%3D	Get hash	malicious	Unknown	Browse
	https://equifax.secure.virtru.com/start/?c=experiment&t=emailtemplate2019-09&s=dcsdataquality%40equifax.com&p=dd344d89-e9f0-4ad2-b235-09d9246d1e0f#v=3.0.0&d=https%3A%2F%2Fapi.virtru.com%2Fstorage%2Fapi%2Fpolicies%2Fdd344d89-e9f0-4ad2-b235-09d9246d1e0f%2Fdata%2Fmetadata&dk=6iPNYDhOZu4bgqt2whRHwXK7U%2FAD3%2BLSMPIUpzwYeKw%3D	Get hash	malicious	Unknown	Browse
	https://jpmchase.secure.virtru.com/start/?c=experiment&t=emailtemplate2019-09&s=cb.fraud.support40jpmorgan.com&p=fa9cd416-f12d-4ca6-9ede-e6b8c83c4a51v=3.0.0&d=https3A2F2Fapi.virtru.com2Fstorage2Fapi2Fpolicies2Ffa9cd416-f12d-4ca6-9ede-e6b8c83c4a512Fdata2Fmetadata&dk=yMl90AuSQMEzRCCwV9qeqdksefzqpu7fga3Wagk8u4I3D__;JSMlJSUlJSUlJSUl!!HkjQSg!0uP8FiMYlk3jO60MGS9hLQK-DpGcqhK4tP28hlMpQJ50EIQ5fdHAiEOfq-YjCoK5Zdcyv2Co3yyd4yCft4FhvBrIEKP9$	Get hash	malicious	Unknown	Browse
	https://api.virtru.com/accounts/email-activation?linkId=6a354426-d14b-461c-9068-d631a3772906-99eaadf1-1535-4926-b117-94d72b1cdf72&loginRedirectUrl=https://jpmchase.secure.virtru.com/secure-reader&userId=supplies@stinsons.com&senderEmail=noreplies.sua@jpmchase.com&c=E,1,GJLSrPtvth0tvKAsk9Y8SirlbwhoEVEruSrOswYM_LloAIiVFwyhuRHy64qpEnuVb816Gf3-lgJ8eHDKwE1BYzbKlN_iUmGn6C8RtrX3Te-ZHW3l4Q,,&typo=1	Get hash	malicious	Unknown	Browse
	https://info.virtualhealth.com/e3t/Ctc/GB+113/cmmfD04/VWRD9T8N6WzjN8MJTHvTlRp-W842MfZ5g9NL_N6-TN-l3qgyTW7Y8-PT6lZ3mfW56Rjx787zhFxW4_YPND6r6flrW4BlJlg1DphdCVWC28Z4PpMbRW6GGMRN2bfpFdW7hSWPP6KFbcRW4PBy7c6n3dRqN7ztR5NtV-d9W1y6F6Z799h-lN1ZbvtmQ73TLW5ShFj48-W2NPW1L2f016vN6bSW45yp6K7Xp_V9W1fy0nl6xLNR_N5n9x3txmtWFN2nZ6w9QgWwJW1rlxcq4rmPQZW2D31f_3FjFXjN7D51x8lx574V_S2G96X3V3rW3xJHsh5zkBZjW6M_Gg24KcjVwW2wm07P9jh6znVyVtyJ6VBB3ZW80wlHc6H0YX2W1stJK56XtGc2f45z9Cx04	Get hash	malicious	Unknown	Browse
	https://equifax.secure.virtru.com/start/?c=experiment&t=emailtemplate2019-09&s=twn_noreply%40equifax.com&p=d5b52cbc-0569-42e0-86cf-8416889c1b1d#v=3.0.0&d=https%3A%2F%2Fapi.virtru.com%2Fstorage%2Fapi%2Fpolicies%2Fd5b52cbc-0569-42e0-86cf-8416889c1b1d%2Fdata%2Fmetadata&dk=CSTBBNbTEYumPZCavpjONtXXrHKWZsLJITyIS27OqaA%3D	Get hash	malicious	Unknown	Browse
	https://www.wealthguff.com/readme.html	Get hash	malicious	HTMLPhisher	Browse
	https://tracking.arbolus.com/u/gIKFUa0YUMyAXVmBzVV5WY2QkI/i02bj5CbpFWbnBUO3UzMxIXZtFmc0R3bjNnI/	Get hash	malicious	Unknown	Browse
104.17.25.14	http://tvchd.com	Get hash	malicious	Unknown	Browse	cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/webfonts/fa-solid-900.woff2

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cdnjs.cloudflare.com	https://07d6b6-35.myshopify.com/pages/enternal/#1aWdvYmVsaUBoaWxjb3JwLmNvbQ0=	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.17.24.14
	Play_VMNow-GlobalpCOINC.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	phish_alert_iocp_v1.4.48 (43).eml	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://shorturl.at/1l4Xw	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://pub-6a08b05596ae4c139f14fc7b92eb075c.r2.dev/NewOneDrive78.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://fb1f1d-d3.myshopify.com/pages/fb1f1d-d3-scanning#0YnJhbmRpLnRyeW9uQGFjYWRlbWljcGFydG5lcnNoaXBzLmNvbQ0=	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.17.24.14
	https://www.linkedin.com/redir/redirect?url=https://assets-usa.mkt.dynamics.com/2143bba1-f463-ef11-a66d-6045bd003910/digitalassets/standaloneforms/3d28dcfa-8464-ef11-bfe2-0022480a9151&urlhash=OzMH&trk=article-ssr-frontend-pulse_little-text-block	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://oh3y.ulvantiro.su/82xG/	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://www.linkedin.com/redir/redirect?url=https://assets-usa.mkt.dynamics.com/da18b4d8-ef63-ef11-a66d-002248282d21/digitalassets/standaloneforms/c645fb5a-f963-ef11-bfe3-7c1e52023edb&urlhash=Dt1u&trk=article-ssr-frontend-pulse_little-text-block	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	roquette.com PURCHASE ORDER.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
maxcdn.bootstrapcdn.com	https://shorturl.at/1l4Xw	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	https://link.edgepilot.com/s/9af6615e/9PTSwESci0mLBHHjcB2qKA?u=https://niverapaints.com/	Get hash	malicious	Unknown	Browse	104.18.11.207
	https://cb1cd44761364cecb21c459c42a86757.svc.dynamics.com/t/t/oIX7RshqCPFFtVxUphHklxDHFg31zySxgRv75vmlL2Yx/ipf8JYDu9fTBRLVxBJ5f98zUiqcPZCqXAj98vZXuDQkx	Get hash	malicious	Unknown	Browse	104.18.11.207
	Documents_27-08.html	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://berajpaints.com.pk/tag/dolor/	Get hash	malicious	Unknown	Browse	104.18.11.207
	Proforma.Invoice.Payment.$$.html	Get hash	malicious	Unknown	Browse	104.18.10.207
	https://zngw.officeinvoicedoc.com/DhpuI	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	http://tekrollindustrial.com.br/wp-includes/kr.html#kh.jang@hyundaimovex.com	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	http://autoiothiatowers.web.app/0.05389702077273273	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	http://pub-4fc2ac5871b646109dbe90ceb8933125.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
group1.sites.hscoscdn00.net	https://share-eu1.hsforms.com/1sGud63SnQn2lKl1OUCRCgwfc604	Get hash	malicious	HTMLPhisher	Browse	199.60.103.226
	https://share-eu1.hsforms.com/1sGud63SnQn2lKl1OUCRCgwfc604	Get hash	malicious	HTMLPhisher	Browse	199.60.103.226
	https://share.hsforms.com/1fZer32exQtCYcCHJONVWXQcwuve	Get hash	malicious	HTMLPhisher	Browse	199.60.103.226

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://07d6b6-35.myshopify.com/pages/enternal/#1aWdvYmVsaUBoaWxjb3JwLmNvbQ0=	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.17.25.14
	Play_VMNow-GlobalpCOINC.html	Get hash	malicious	HTMLPhisher	Browse	172.67.206.58
	https://ca.docusign.net/Signing/EmailStart.aspx?a=1cdabf46-ff5a-4450-ae28-4b5293077687&etti=24&acct=938a1226-4cc2-4b96-95f9-d33be464ae6b&er=5b95ae4e-7414-40c0-b9fc-e2de228fcc1b	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://leembal.com.mx	Get hash	malicious	Unknown	Browse	104.18.95.41
	http://www.de-blizzard.com	Get hash	malicious	Unknown	Browse	104.18.86.42
	phish_alert_iocp_v1.4.48 (43).eml	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	http://www.chessmetrics.com/cm/DL/DL9.html	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	x64_installer__v4.5.6.msi	Get hash	malicious	Unknown	Browse	188.114.97.3
AMAZON-02US	https://ca.docusign.net/Signing/EmailStart.aspx?a=1cdabf46-ff5a-4450-ae28-4b5293077687&etti=24&acct=938a1226-4cc2-4b96-95f9-d33be464ae6b&er=5b95ae4e-7414-40c0-b9fc-e2de228fcc1b	Get hash	malicious	Unknown	Browse	52.32.246.233
	GMP Architecture MailBox System shared _PROPOSAL REQUEST PORTAL_ with you.eml	Get hash	malicious	Unknown	Browse	13.227.219.36
	http://www.de-blizzard.com	Get hash	malicious	Unknown	Browse	18.238.248.46
	phish_alert_iocp_v1.4.48 (43).eml	Get hash	malicious	HTMLPhisher	Browse	13.32.145.9
	http://www.chessmetrics.com/cm/DL/DL9.html	Get hash	malicious	Unknown	Browse	54.69.173.176
	https://ca.docusign.net/Signing/EmailStart.aspx?a=f73cd823-d46e-4c1d-9aa7-a3313bd2d402&etti=24&acct=9d2cdf2a-d1fa-4c66-83f5-9dd312af890e&er=68a0e22a-40d9-446a-8837-385c38bcc4d8	Get hash	malicious	Unknown	Browse	18.244.28.50
	Ad#U043ebe_Activator.exe	Get hash	malicious	LummaC	Browse	185.166.143.50
	https://link.edgepilot.com/s/9af6615e/9PTSwESci0mLBHHjcB2qKA?u=https://niverapaints.com/	Get hash	malicious	Unknown	Browse	13.227.219.70
	Bonus_Acknowledgment_Letter.docx	Get hash	malicious	Unknown	Browse	34.252.40.201
	https://www.scribd.com/document/762765489/Advice-Notification#fullscreen&from_embed	Get hash	malicious	Unknown	Browse	18.239.18.124
CLOUDFLARENETUS	https://07d6b6-35.myshopify.com/pages/enternal/#1aWdvYmVsaUBoaWxjb3JwLmNvbQ0=	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.17.25.14
	Play_VMNow-GlobalpCOINC.html	Get hash	malicious	HTMLPhisher	Browse	172.67.206.58
	https://ca.docusign.net/Signing/EmailStart.aspx?a=1cdabf46-ff5a-4450-ae28-4b5293077687&etti=24&acct=938a1226-4cc2-4b96-95f9-d33be464ae6b&er=5b95ae4e-7414-40c0-b9fc-e2de228fcc1b	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://leembal.com.mx	Get hash	malicious	Unknown	Browse	104.18.95.41
	http://www.de-blizzard.com	Get hash	malicious	Unknown	Browse	104.18.86.42
	phish_alert_iocp_v1.4.48 (43).eml	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	http://www.chessmetrics.com/cm/DL/DL9.html	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	x64_installer__v4.5.6.msi	Get hash	malicious	Unknown	Browse	188.114.97.3
QUICKSILVER1CA	https://d4g6kw04.na1.hubspotlinks.com/Ctc/I9+113/d4G6KW04/VVDXvw2129f7W9lgpSl3-BQgwW4125np5kh8PvN1n_9Xx5kBl-W50kH_H6lZ3lBW5xCLbK6c416cW6G0HMx6QhV7VVrZqSG3HBKSjV6wDNg4ZyZn6W7_FTpm1dqZm4W723tVM4rftccW3vWlSp1wGvTJW2zXXwV1X740xN1t2gyvnMRlqW7JdFVP1Ty-FHN3Fp_ww3m7TdW66_q2r1Q3VwtW7Dpks077Qf8bM1V49whQ40NW6RphCp8kpt1HV_HZcV84HKmBW5lF7ZC61FD66W73XZV57GJ9ZkVDMN0b9hXGx2W8dysfm3qm-8VMZTWKPM6VCVW6l8ws98dhwKqW4Z2gzl8fZ601N7pH1zqJ5vZ5N90-353vPlZ7VD24xR8Rht6PVyTztF65g6ScN24XQrJRlvxMW20qlrM4TTNP7W6Lc5vQ43Pq7NW32bHwR84HFLgVgWx3d5S85nlf8gcVNq04	Get hash	malicious	Unknown	Browse	199.60.103.31
	http://scratchpay.referralrock.com	Get hash	malicious	Unknown	Browse	199.60.103.29
	http://scratchpay.com	Get hash	malicious	Unknown	Browse	199.60.103.29
	https://shared.outlook.inky.com/link?domain=urldefense.proofpoint.com&t=h.eJxVUE2PmzAU_CsrDpxK-AazEuqyS5JqE9Jmg9IoF8sYQ0jABtvANlX_eyGHSr08vfdmNKOZ30rPa-X5SblI2YpnXZ_OnBSECrJoOWNFyyoqF5g1-mDN4Nc-fFA1O4KwRFT2dJq3nuLqhjh5UCEcW82KK4rrPicCtqxhMJtYAjYVJVDNw3hMVtGo4pD067OQGKVxXQ9Vs9yBzL-e-Nh9L7TBjeBb3pb0WFRVkqg8fIXd7u7ffby-lqdsKIVxMQ7yLfnx06k3JzJoxLu6EBvQitQmBGP3vi9cfgCb66cZO4BdtpvOWtXYGjbgWwnPbZWIAzp3MoW_Rin2BMS7Na8OOydFGVNFCCInhbL-vBDf-xg-_KPdrtDyCMHyvt5v35k2bFPZs9fs7KgkVL48Kbe5TUok42Uhfd-37CDQy4JP8QvG5cu_DdFcMCoe3XrIJ7nrBHaW2aZrmJ4BDDezPexlhmvngW5OOi5wbDdYmLMLebigehJgL-guCUZNM0vNYD6D_z3__AXAcKQ4.MEUCIB-PNKp_9-d3drOD5owphdjbOwtYz5OQxdgeN5g2hPNUAiEAleTizC6zi0EZIypSMBPG6kkRYgzdslitxgPkKL9II8M	Get hash	malicious	Unknown	Browse	199.60.103.2
	https://accountservicing.com/e3t/Ctc/2H+113/ccl-Y04/VVqYcj9d1pTLW16y89n4DRlWxW1xTZ7Q5jxmFNN5BW0Sj3qgyTW7Y8-PT6lZ3n-W7K16HT7thx4hV6kpN06fVkc-W7yxLrN95hXZjW4rblJ-6TSnSZW65gGqH4W43v4N3_YsqT-3YKYVxfV2W58G73YW3cFwVC8ny83jW8Fz12N8-V0SmW5SSzp43rM_L2W245fnt8p94jMW4PPrDY6Cb9HjW2Zf9wL3lKcTbW61Hhz233pYyDW5Qh4rN5z3QrwW1QwY5K38F8JxW433Jj716pqBlW5WlHSd1QR2ZcVsdP_h6JX3RcW6YQskh3NNSGKW9hbgq820G9QVW4RCZ8N3hkwKQW6Ykd0p7cQ_DrW48gHN96lLqMFW4402zd4Vsz0kW8KJCq78P_VX-f5RrgHM04	Get hash	malicious	Unknown	Browse	199.60.103.51
	AnyDesk.msi	Get hash	malicious	Unknown	Browse	199.60.103.28
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=VEPAnwijpUm87o3xy8ND1cJ8xINveHJMur3NEXJwuyVUMDZRQTJTMVUyUVRBUkdRRE1IQU5RTlpQNi4u	Get hash	malicious	HTMLPhisher	Browse	199.60.103.28
	(No subject) (43).eml	Get hash	malicious	Unknown	Browse	199.60.103.2
	AnyDesk.msi	Get hash	malicious	Unknown	Browse	199.60.103.28
	https://discovery.silvercloudhealth.com/signup/start/?code=9429330ddb3ea414c097c290e79322a8fc29edc7	Get hash	malicious	Unknown	Browse	199.60.103.2

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fed8d14fc5a67b40cd470ba239019785	5CxmQXL0LD.exe	Get hash	malicious	SystemBC	Browse	199.60.103.30 18.144.71.249
	RqrQG7s66x.dll	Get hash	malicious	Unknown	Browse	199.60.103.30 18.144.71.249
	RqrQG7s66x.dll	Get hash	malicious	Unknown	Browse	199.60.103.30 18.144.71.249
	f552fGDYQS.exe	Get hash	malicious	Socks5Systemz	Browse	199.60.103.30 18.144.71.249
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.18.11.207 199.60.103.30 104.17.25.14
	x64_installer__v4.5.6.msi	Get hash	malicious	Unknown	Browse	104.18.11.207 199.60.103.30 104.17.25.14
	Ad#U043ebe_Activator.exe	Get hash	malicious	LummaC	Browse	104.18.11.207 199.60.103.30 104.17.25.14
	file.exe	Get hash	malicious	Meduza Stealer	Browse	104.18.11.207 199.60.103.30 104.17.25.14
	file.exe	Get hash	malicious	Meduza Stealer	Browse	104.18.11.207 199.60.103.30 104.17.25.14
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.18.11.207 199.60.103.30 104.17.25.14
	0eyaBVo6tq.msi	Get hash	malicious	Unknown	Browse	104.18.11.207 199.60.103.30 104.17.25.14
	2ANivMQUch.msi	Get hash	malicious	Unknown	Browse	104.18.11.207 199.60.103.30 104.17.25.14
	NmJ4sVw68P.msi	Get hash	malicious	Unknown	Browse	104.18.11.207 199.60.103.30 104.17.25.14
	7Mr3U9Zd5W.msi	Get hash	malicious	Unknown	Browse	104.18.11.207 199.60.103.30 104.17.25.14

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (954), with CRLF line terminators
Category:	dropped
Size (bytes):	6284
Entropy (8bit):	5.108886176656682
Encrypted:	false
SSDEEP:	96:kAz3qd2uI0MdOM2Wbd/ul0MdOM3bdwz0MdOMKebcwk0MdOMNMqbddy0MdOMrbddz:BdOzdOZdOXdOEMLdOvgdObZdO6dOsCd
MD5:	064897F8A4AB5A4EAAD98F71F2769994
SHA1:	9675608380259871523E40FA8529A0FA6F02492B
SHA-256:	BD704248CF74A6CE2818D43409881CFE7583A873F1E98F21C88D33B49EEF04DC
SHA-512:	C76243FD9EEE596B32CB417AEFD5E07565E2B0545EC0B60328CA4AA84D871D733B628F5BD8BEF1EF1E0E7624B7FA7B5FA64193D5C701990BD49B950D638DBC22
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Additional Help" GUID="{16E3A938-C463-48D8-AE99-1C57D688842F}">.. <Properties>.. <Property Class="Text" GUID="{8CBBCC61-5F73-44A0-9AA3-72A81DFCFF33}" Name="Name" inheritaction="" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Additional Help</Property>.. <Property Class="Type" GUID="{15330163-EE6B-4527-A3C0-43036726ADBB}" Name="Type" inheritaction="" calculatebef

C:\Program Files (x86)\PlanSwift11\Data\Developers\Additional Help\is-4OIJL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (954), with CRLF line terminators
Category:	dropped
Size (bytes):	6284
Entropy (8bit):	5.108886176656682
Encrypted:	false
SSDEEP:	96:kAz3qd2uI0MdOM2Wbd/ul0MdOM3bdwz0MdOMKebcwk0MdOMNMqbddy0MdOMrbddz:BdOzdOZdOXdOEMLdOvgdObZdO6dOsCd
MD5:	064897F8A4AB5A4EAAD98F71F2769994
SHA1:	9675608380259871523E40FA8529A0FA6F02492B
SHA-256:	BD704248CF74A6CE2818D43409881CFE7583A873F1E98F21C88D33B49EEF04DC
SHA-512:	C76243FD9EEE596B32CB417AEFD5E07565E2B0545EC0B60328CA4AA84D871D733B628F5BD8BEF1EF1E0E7624B7FA7B5FA64193D5C701990BD49B950D638DBC22
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Additional Help" GUID="{16E3A938-C463-48D8-AE99-1C57D688842F}">.. <Properties>.. <Property Class="Text" GUID="{8CBBCC61-5F73-44A0-9AA3-72A81DFCFF33}" Name="Name" inheritaction="" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Additional Help</Property>.. <Property Class="Type" GUID="{15330163-EE6B-4527-A3C0-43036726ADBB}" Name="Type" inheritaction="" calculatebef

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (412), with CRLF line terminators
Category:	dropped
Size (bytes):	2266
Entropy (8bit):	5.571542502704049
Encrypted:	false
SSDEEP:	48:cM5KTK+ZUs1OzRz1PD5anKkjangxLgGfFlfRlSFt:fps10RJdFcLgGjfUt
MD5:	DD65FB9EA8DC153640B2E973816F2B65
SHA1:	09E9C5C2E48E60A692DB900DB00F6FEE1945207F
SHA-256:	CC644F7297F77041B6481CE41DD5F5B4960A53A693F113E9A96F31D928D8D495
SHA-512:	4DFB238B7B8C9F9551BD409CAF35ED962121F69AEEF2DB9E09986E429C8097BE703B9E199CCA4B37E7A047CFB79C94B7BD7C49631D69D2085B7FE52076D0F260
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="COM Object Model" GUID="{DAD97FD5-E4B5-4E09-874A-51749BFD6D0E}">.. <Properties>.. <Property Class="Text" GUID="{9898B794-B208-4843-A102-960FCECA0AC6}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">COM Object Model</Property>.. <Property Class="Type" GUID="{2D483A9F-E509-48C8-BE40-F66A5C8ABD71}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Topic</Property>.. <Property Class="Memo" GUID="{E85CE22E-EE61-4C6E-8A29-7B90BAC269F7}" Name="Help String" input="True" group="Item" OrderIndex="3" DecimalPlaces="" List="cmbList" PluginToExecute="cmbList">Planswift COM object interface.</Property>.. <Property Class="Text" GUID="{33AA502A-8A24-46EF-9E4D-1BBA6854F777}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{DAD97FD5-E4B5-4E09-874A-51749BFD6D0E}</Property>.. <Property Class="Number"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\About\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1084), with CRLF line terminators
Category:	dropped
Size (bytes):	8169
Entropy (8bit):	5.211758058708484
Encrypted:	false
SSDEEP:	192:tGdOjdOgdOSJdOtdOSjSdOSyC8pOdOeEdOxdO9:IdOjdOgdOwdOtdOS+dO7pOdOJdOxdO9
MD5:	10048A90BCCFD9DEB6DCDBBEDD7D8A2C
SHA1:	C84A45183FF7DEDD327547EC490BF0A818953FDA
SHA-256:	9A84BAA90F5BB7F1A0272F66C3F39A7DCF5E22CF6B85AE699C213AE23DF2723C
SHA-512:	EFB14B67DC050AD446F8DA2D00063A460ABA7510C1B43AD4EA742380EF1CA6FCEBBEC299D10BD810D672656F29C4766168E327D0D992FBAE58C65E909EA63999
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="About" GUID="{18C0BF37-D004-4B7C-83FF-D28DD6146019}">.. <Properties>.. <Property Class="Text" GUID="{2CBEA691-3806-4730-8285-39916DBB7DBF}" Name="Name" inheritaction="" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">About</Property>.. <Property Class="Type" GUID="{46768965-78A1-4F56-9D6E-1504240903DE}" Name="Type" inheritaction="" calculatebefore="0" inherited="F

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\About\is-VVUUP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1084), with CRLF line terminators
Category:	dropped
Size (bytes):	8169
Entropy (8bit):	5.211758058708484
Encrypted:	false
SSDEEP:	192:tGdOjdOgdOSJdOtdOSjSdOSyC8pOdOeEdOxdO9:IdOjdOgdOwdOtdOS+dO7pOdOJdOxdO9
MD5:	10048A90BCCFD9DEB6DCDBBEDD7D8A2C
SHA1:	C84A45183FF7DEDD327547EC490BF0A818953FDA
SHA-256:	9A84BAA90F5BB7F1A0272F66C3F39A7DCF5E22CF6B85AE699C213AE23DF2723C
SHA-512:	EFB14B67DC050AD446F8DA2D00063A460ABA7510C1B43AD4EA742380EF1CA6FCEBBEC299D10BD810D672656F29C4766168E327D0D992FBAE58C65E909EA63999
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="About" GUID="{18C0BF37-D004-4B7C-83FF-D28DD6146019}">.. <Properties>.. <Property Class="Text" GUID="{2CBEA691-3806-4730-8285-39916DBB7DBF}" Name="Name" inheritaction="" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">About</Property>.. <Property Class="Type" GUID="{46768965-78A1-4F56-9D6E-1504240903DE}" Name="Type" inheritaction="" calculatebefore="0" inherited="F

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\BeginFormulaUpdate\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1143), with CRLF line terminators
Category:	dropped
Size (bytes):	8326
Entropy (8bit):	5.21120177074144
Encrypted:	false
SSDEEP:	192:sdORdOEvdOgdO2bdOlEdOke5FpOdOGb+JdO9IdOG:sdORdOedOgdOudO2dOlpOdOVJdO9IdOG
MD5:	1D2CB3A69FFDD4428FB2C7BB347C25D2
SHA1:	284E834F30DFB72096DF495ED29CF73F8245ED8E
SHA-256:	C6076494B5D6171EC9C638E17B185DC17BBF81A25A13F356628C3C8CD4C22E8D
SHA-512:	6C51C4D35236E0C247C2A1703374B4BA9842FCF1DDA417ED1CEF0FFEBBB9067F3BA1912BDEEA60DF483092F00410A572647B90AD31CB6FC11E6B3D2AB6D0C252
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="BeginFormulaUpdate" GUID="{870B5AC1-282D-495F-8E22-37DC25BBE1A2}">.. <Properties>.. <Property Class="Text" GUID="{DAA63BB1-B22D-4A3F-8434-0E60A746E386}" Name="Name" inheritaction="" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">BeginFormulaUpdate</Property>.. <Property Class="Type" GUID="{1B8DE26F-DC99-4CA1-ADC2-350A8BB0E4D9}" Name="Type" inheritaction="" calcul

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\BeginFormulaUpdate\is-6QE92.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1143), with CRLF line terminators
Category:	dropped
Size (bytes):	8326
Entropy (8bit):	5.21120177074144
Encrypted:	false
SSDEEP:	192:sdORdOEvdOgdO2bdOlEdOke5FpOdOGb+JdO9IdOG:sdORdOedOgdOudO2dOlpOdOVJdO9IdOG
MD5:	1D2CB3A69FFDD4428FB2C7BB347C25D2
SHA1:	284E834F30DFB72096DF495ED29CF73F8245ED8E
SHA-256:	C6076494B5D6171EC9C638E17B185DC17BBF81A25A13F356628C3C8CD4C22E8D
SHA-512:	6C51C4D35236E0C247C2A1703374B4BA9842FCF1DDA417ED1CEF0FFEBBB9067F3BA1912BDEEA60DF483092F00410A572647B90AD31CB6FC11E6B3D2AB6D0C252
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="BeginFormulaUpdate" GUID="{870B5AC1-282D-495F-8E22-37DC25BBE1A2}">.. <Properties>.. <Property Class="Text" GUID="{DAA63BB1-B22D-4A3F-8434-0E60A746E386}" Name="Name" inheritaction="" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">BeginFormulaUpdate</Property>.. <Property Class="Type" GUID="{1B8DE26F-DC99-4CA1-ADC2-350A8BB0E4D9}" Name="Type" inheritaction="" calcul

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\BeginUpdate\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (502), with CRLF line terminators
Category:	dropped
Size (bytes):	4115
Entropy (8bit):	5.493915318753602
Encrypted:	false
SSDEEP:	48:cyizBUWDyYD51NOrl8/NUh8mp6jlaREvDNTvWEKvFkvAvFiEvDDdvWEpvWXobIMF:sRyWHW8ueR8OCwe/pBsobRsg3
MD5:	DFF4884868D077FDF52F6635C5842E32
SHA1:	58CCFEA0F2AC66EC2F3AD686C46F5FF7BF50E824
SHA-256:	4FAEAE1CCDE800972697CE69C3F2A5E3D90C8C2E01A1B82E3BB4C7D0F673899C
SHA-512:	5154B9DAAC074B2DA86A1D8925F6F46868FACAB47B32D0014EABA2B9641283694A62C8C3F2B82F81B1B0EE3977FF0C679F723A97C87B01BA8CACA75707929438
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="BeginUpdate" GUID="{9EF5A9AF-8C59-4D04-AF80-4E8BE4EFE717}">.. <Properties>.. <Property Class="Text" GUID="{FFB4E3A4-180C-4511-877A-9CE198F9FC16}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">BeginUpdate</Property>.. <Property Class="Type" GUID="{BF81105B-84FE-4D45-A842-01A6F4777FE8}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{E93A1BCF-A6B2-469C-B10F-EB2696BEF1E6}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0.5</Property>.. <Property Class="Memo" GUID="{B315BC2A-1A17-49DE-BB9B-37DF5390431B}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1&quot

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\BeginUpdate\is-S0L1M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (502), with CRLF line terminators
Category:	dropped
Size (bytes):	4115
Entropy (8bit):	5.493915318753602
Encrypted:	false
SSDEEP:	48:cyizBUWDyYD51NOrl8/NUh8mp6jlaREvDNTvWEKvFkvAvFiEvDDdvWEpvWXobIMF:sRyWHW8ueR8OCwe/pBsobRsg3
MD5:	DFF4884868D077FDF52F6635C5842E32
SHA1:	58CCFEA0F2AC66EC2F3AD686C46F5FF7BF50E824
SHA-256:	4FAEAE1CCDE800972697CE69C3F2A5E3D90C8C2E01A1B82E3BB4C7D0F673899C
SHA-512:	5154B9DAAC074B2DA86A1D8925F6F46868FACAB47B32D0014EABA2B9641283694A62C8C3F2B82F81B1B0EE3977FF0C679F723A97C87B01BA8CACA75707929438
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="BeginUpdate" GUID="{9EF5A9AF-8C59-4D04-AF80-4E8BE4EFE717}">.. <Properties>.. <Property Class="Text" GUID="{FFB4E3A4-180C-4511-877A-9CE198F9FC16}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">BeginUpdate</Property>.. <Property Class="Type" GUID="{BF81105B-84FE-4D45-A842-01A6F4777FE8}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{E93A1BCF-A6B2-469C-B10F-EB2696BEF1E6}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0.5</Property>.. <Property Class="Memo" GUID="{B315BC2A-1A17-49DE-BB9B-37DF5390431B}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1&quot

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\CancelTool\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1095), with CRLF line terminators
Category:	dropped
Size (bytes):	8242
Entropy (8bit):	5.209816756428096
Encrypted:	false
SSDEEP:	192:5KdOGTdOfcdOzdOBLdOZ8+dOeceSUJWgdOUbrdObudOw:5KdOGTdO0dOzdOBLdOZxdOYWgdO4dOyv
MD5:	F29A263679C096EFB1BD11ECEDE6EE59
SHA1:	B017D7C26C7439FF174D5A459E716096257FF284
SHA-256:	FDED7A58F63950D71EEC5C9B7F524005E8F207162443C189E1E06976661A9A0B
SHA-512:	734F674EDB2829A94714C5658675A421CEB607B7232DD432691A537DC12CA7397C98DBCDD33CA1897CCC8795068D36331AA2E04A0A2F2152AD98DB39A235E0E1
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="CancelTool" GUID="{61345B58-D8B6-4C88-AA8D-B57A270639BC}">.. <Properties>.. <Property Class="Type" GUID="{2ADC273B-0DED-4CE1-8467-9191E1F18E79}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Procedure</Property>.. <Property Class="Text" GUID="{D4757AFA-CE53-45CD-A218-4338E95D227D}" Name="Name" inheritaction="Ignore" calculatebefore

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\CancelTool\is-OM1N5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1095), with CRLF line terminators
Category:	dropped
Size (bytes):	8242
Entropy (8bit):	5.209816756428096
Encrypted:	false
SSDEEP:	192:5KdOGTdOfcdOzdOBLdOZ8+dOeceSUJWgdOUbrdObudOw:5KdOGTdO0dOzdOBLdOZxdOYWgdO4dOyv
MD5:	F29A263679C096EFB1BD11ECEDE6EE59
SHA1:	B017D7C26C7439FF174D5A459E716096257FF284
SHA-256:	FDED7A58F63950D71EEC5C9B7F524005E8F207162443C189E1E06976661A9A0B
SHA-512:	734F674EDB2829A94714C5658675A421CEB607B7232DD432691A537DC12CA7397C98DBCDD33CA1897CCC8795068D36331AA2E04A0A2F2152AD98DB39A235E0E1
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="CancelTool" GUID="{61345B58-D8B6-4C88-AA8D-B57A270639BC}">.. <Properties>.. <Property Class="Type" GUID="{2ADC273B-0DED-4CE1-8467-9191E1F18E79}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Procedure</Property>.. <Property Class="Text" GUID="{D4757AFA-CE53-45CD-A218-4338E95D227D}" Name="Name" inheritaction="Ignore" calculatebefore

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\CloseJob\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1094), with CRLF line terminators
Category:	dropped
Size (bytes):	8269
Entropy (8bit):	5.213009412641798
Encrypted:	false
SSDEEP:	192:8WVdOIrdOcdOKdOYdOZVodODe8LOdOEdOAUOdOebb:1dOIrdOcdOKdOYdOZKdODOdOEdOnOdOO
MD5:	975FA6404FA345768E7F18E13365E1CA
SHA1:	62FB004BA49679ED26F5D6AD1F09C2A09CD14951
SHA-256:	DBCBC01D6556416F290948B99F339EA5031319787112E52E1EB2D909BFCC1709
SHA-512:	8192710274168DB3F044BB964A6F6D5DF10EF031F584306238BC05BBDA9FA882BB444D84C84445F7E3DF5063FB961BFFE815682D17235CF745EF47A6FA4C5F82
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="CloseJob" GUID="{FCF46E88-DD24-4B13-AF2F-D96EE403DD16}">.. <Properties>.. <Property Class="Text" GUID="{C19A15E5-E325-4BF8-8372-EAB4C6D634B2}" Name="Name" inheritaction="" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">CloseJob</Property>.. <Property Class="Type" GUID="{F7C3A5B3-486B-4EBD-8079-82F7B7F87317}" Name="Type" inheritaction="" calculatebefore="0" inheri

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\CloseJob\is-EIV5N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1094), with CRLF line terminators
Category:	dropped
Size (bytes):	8269
Entropy (8bit):	5.213009412641798
Encrypted:	false
SSDEEP:	192:8WVdOIrdOcdOKdOYdOZVodODe8LOdOEdOAUOdOebb:1dOIrdOcdOKdOYdOZKdODOdOEdOnOdOO
MD5:	975FA6404FA345768E7F18E13365E1CA
SHA1:	62FB004BA49679ED26F5D6AD1F09C2A09CD14951
SHA-256:	DBCBC01D6556416F290948B99F339EA5031319787112E52E1EB2D909BFCC1709
SHA-512:	8192710274168DB3F044BB964A6F6D5DF10EF031F584306238BC05BBDA9FA882BB444D84C84445F7E3DF5063FB961BFFE815682D17235CF745EF47A6FA4C5F82
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="CloseJob" GUID="{FCF46E88-DD24-4B13-AF2F-D96EE403DD16}">.. <Properties>.. <Property Class="Text" GUID="{C19A15E5-E325-4BF8-8372-EAB4C6D634B2}" Name="Name" inheritaction="" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">CloseJob</Property>.. <Property Class="Type" GUID="{F7C3A5B3-486B-4EBD-8079-82F7B7F87317}" Name="Type" inheritaction="" calculatebefore="0" inheri

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\CompareVersion\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (982), with CRLF line terminators
Category:	dropped
Size (bytes):	5338
Entropy (8bit):	5.40305194096523
Encrypted:	false
SSDEEP:	96:xDwe8+WviEk3bnVepQn3nY38aFle18xQ1U1KNW1k8RsRx:SH/WeKn3nY38ajemi1U0NYE
MD5:	044BFCCA09D5CCB57339B8939F6B3EAE
SHA1:	8029CBD8FCD6E4707812410FE7FDA20755A9C0E6
SHA-256:	88DCB1B2A627F17E1F06A7EAE14EB31FFB6AEF9B6F9EFE5F92A0888A49ECA259
SHA-512:	63D7D069F3888575353BC49C7866F8E1965664017E246F6A0070A4D5C491A8CE7FE8C44CA14A6CF3D2B60E48ED3661AE8C650972B588F5820B71B85BDED60DF6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="CompareVersion" GUID="{7F78AB2E-3F22-4AB2-84A5-25FBFC2BF498}">.. <Properties>.. <Property Class="Text" GUID="{5C55B581-438D-4C4B-8F2D-822483A18DE7}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">CompareVersion</Property>.. <Property Class="Type" GUID="{F90A02CF-99F5-4CFF-90CB-C6FA5C9B2F59}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{6715CE32-1DBF-4CB0-AED3-CAC1C3EE6951}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3.75</Property>.. <Property Class="Memo" GUID="{B6ED8C35-B23F-430D-A75B-7E178FA06882}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order=&quot

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\CompareVersion\is-I8GUR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (982), with CRLF line terminators
Category:	dropped
Size (bytes):	5338
Entropy (8bit):	5.40305194096523
Encrypted:	false
SSDEEP:	96:xDwe8+WviEk3bnVepQn3nY38aFle18xQ1U1KNW1k8RsRx:SH/WeKn3nY38ajemi1U0NYE
MD5:	044BFCCA09D5CCB57339B8939F6B3EAE
SHA1:	8029CBD8FCD6E4707812410FE7FDA20755A9C0E6
SHA-256:	88DCB1B2A627F17E1F06A7EAE14EB31FFB6AEF9B6F9EFE5F92A0888A49ECA259
SHA-512:	63D7D069F3888575353BC49C7866F8E1965664017E246F6A0070A4D5C491A8CE7FE8C44CA14A6CF3D2B60E48ED3661AE8C650972B588F5820B71B85BDED60DF6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="CompareVersion" GUID="{7F78AB2E-3F22-4AB2-84A5-25FBFC2BF498}">.. <Properties>.. <Property Class="Text" GUID="{5C55B581-438D-4C4B-8F2D-822483A18DE7}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">CompareVersion</Property>.. <Property Class="Type" GUID="{F90A02CF-99F5-4CFF-90CB-C6FA5C9B2F59}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{6715CE32-1DBF-4CB0-AED3-CAC1C3EE6951}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3.75</Property>.. <Property Class="Memo" GUID="{B6ED8C35-B23F-430D-A75B-7E178FA06882}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order=&quot

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\CopyItem\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1161), with CRLF line terminators
Category:	dropped
Size (bytes):	5396
Entropy (8bit):	5.416778468515387
Encrypted:	false
SSDEEP:	96:xwi0dftkWOuFrNupHm/n8/FyHCPcdUfVhRuFrNup4:eG2sm/n8/YHCPqU9hR2Z
MD5:	58224ED3A2B6889B0DAB8EF94C42F354
SHA1:	C52784A7C6EFE1DCD026E6B3429BE7296C5B5C8F
SHA-256:	E01D7FE32153AE75B873594717C5217857708AAAC93B041B733BE136E71F6282
SHA-512:	59D7EA3C2066C58F1F2748F1933A86664E98838AAEAB26A9B369DA4F2E84C2479FBA6F40E52125BD7CFF8F4C154A116C2B8BD066FDE492B363E9127F2C412090
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="CopyItem" GUID="{CD5340C5-5F28-404F-AC08-0642BAB4EE69}">.. <Properties>.. <Property Class="Text" GUID="{976AE3AE-B8A0-40AB-9EF3-94FBD834B37A}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">CopyItem</Property>.. <Property Class="Type" GUID="{A0DEC6DB-CAB8-4B0E-9406-D8E907CFCB5C}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="2">Function</Property>.. <Property Class="Text" GUID="{B0414E74-AF2C-4B02-A8E3-F3BFD7E03DDA}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="1" DecimalPlaces="2">{CD5340C5-5F28-404F-AC08-0642BAB4EE69}</Property>.. <Property Class="Number" GUID="{1D376BF7-7D5C-4A3F-B784-798C3E4A07EF}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">4</Property>.. <Property Class="Memo" GUID="{26F4BF87-9EE9-454B-BE0F-7570A4BD4F51}" Name="Form Layout" systemhidden="True" O

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\CopyItem\is-65ADJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1161), with CRLF line terminators
Category:	dropped
Size (bytes):	5396
Entropy (8bit):	5.416778468515387
Encrypted:	false
SSDEEP:	96:xwi0dftkWOuFrNupHm/n8/FyHCPcdUfVhRuFrNup4:eG2sm/n8/YHCPqU9hR2Z
MD5:	58224ED3A2B6889B0DAB8EF94C42F354
SHA1:	C52784A7C6EFE1DCD026E6B3429BE7296C5B5C8F
SHA-256:	E01D7FE32153AE75B873594717C5217857708AAAC93B041B733BE136E71F6282
SHA-512:	59D7EA3C2066C58F1F2748F1933A86664E98838AAEAB26A9B369DA4F2E84C2479FBA6F40E52125BD7CFF8F4C154A116C2B8BD066FDE492B363E9127F2C412090
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="CopyItem" GUID="{CD5340C5-5F28-404F-AC08-0642BAB4EE69}">.. <Properties>.. <Property Class="Text" GUID="{976AE3AE-B8A0-40AB-9EF3-94FBD834B37A}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">CopyItem</Property>.. <Property Class="Type" GUID="{A0DEC6DB-CAB8-4B0E-9406-D8E907CFCB5C}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="2">Function</Property>.. <Property Class="Text" GUID="{B0414E74-AF2C-4B02-A8E3-F3BFD7E03DDA}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="1" DecimalPlaces="2">{CD5340C5-5F28-404F-AC08-0642BAB4EE69}</Property>.. <Property Class="Number" GUID="{1D376BF7-7D5C-4A3F-B784-798C3E4A07EF}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">4</Property>.. <Property Class="Memo" GUID="{26F4BF87-9EE9-454B-BE0F-7570A4BD4F51}" Name="Form Layout" systemhidden="True" O

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\CurrentVersion\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (627), with CRLF line terminators
Category:	dropped
Size (bytes):	4235
Entropy (8bit):	5.481638418505545
Encrypted:	false
SSDEEP:	96:+LNhqWgbEtTIIe4Kn8KFleifB11KkQLIEOn0x:G2wO4Kn8KjesB10DLIFa
MD5:	E87C1BD4E0C433FF77D20E82C963C25D
SHA1:	82E55DEF984512880EF0110D3F2B70EE50D5A086
SHA-256:	069F7831CAF44A2B910FF602CB1DEC8F7D8F9CB739272D060718C44092D8119B
SHA-512:	0250ED585D7863140CA797B666092A64D971A326D283862B99F38C97FB760CBDA4C76A6F9D1779C1C2DA311AF6C6E8B91644ED2D5657F6AF9F9EC74DED4D16FB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="CurrentVersion" GUID="{9A54F044-AC1B-4968-ACEC-9EA6668B5461}">.. <Properties>.. <Property Class="Text" GUID="{2111EC7F-C215-45C5-9846-1E74613FE07C}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">CurrentVersion</Property>.. <Property Class="Type" GUID="{6EF112ED-98B6-419B-A0F7-A929E2582D99}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{7EDEADA5-5CE9-43F7-9136-554478C8E871}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4.5</Property>.. <Property Class="Memo" GUID="{F10BD025-C36A-453B-BADF-A96D1F590060}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\CurrentVersion\is-N3KDL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (627), with CRLF line terminators
Category:	dropped
Size (bytes):	4235
Entropy (8bit):	5.481638418505545
Encrypted:	false
SSDEEP:	96:+LNhqWgbEtTIIe4Kn8KFleifB11KkQLIEOn0x:G2wO4Kn8KjesB10DLIFa
MD5:	E87C1BD4E0C433FF77D20E82C963C25D
SHA1:	82E55DEF984512880EF0110D3F2B70EE50D5A086
SHA-256:	069F7831CAF44A2B910FF602CB1DEC8F7D8F9CB739272D060718C44092D8119B
SHA-512:	0250ED585D7863140CA797B666092A64D971A326D283862B99F38C97FB760CBDA4C76A6F9D1779C1C2DA311AF6C6E8B91644ED2D5657F6AF9F9EC74DED4D16FB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="CurrentVersion" GUID="{9A54F044-AC1B-4968-ACEC-9EA6668B5461}">.. <Properties>.. <Property Class="Text" GUID="{2111EC7F-C215-45C5-9846-1E74613FE07C}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">CurrentVersion</Property>.. <Property Class="Type" GUID="{6EF112ED-98B6-419B-A0F7-A929E2582D99}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{7EDEADA5-5CE9-43F7-9136-554478C8E871}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4.5</Property>.. <Property Class="Memo" GUID="{F10BD025-C36A-453B-BADF-A96D1F590060}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\CurrentViewport\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (627), with CRLF line terminators
Category:	dropped
Size (bytes):	4092
Entropy (8bit):	5.493575880638022
Encrypted:	false
SSDEEP:	48:crmNnbk0YD51NOrl8aTlcy/mC8ODD0vFxgvDgvWEqvFxgvFgiEvDWpvapvWCAKud:lq0WShptRDDu3qe83qFleilMPAK7bmp
MD5:	273EFCBA9637C00469C73EBAD9D08DCE
SHA1:	329C73FDECF046460DBFBB781F64F99926393635
SHA-256:	959797EC5253CD4074D78FDE22E0653AD4A20D30AEFD5963332EA7F1258C375A
SHA-512:	F1C54F40A9FF5FAA2F9E0EFC498A7CE9E542E46AD38EA3573BDE669E3B26124591FB87F291B487A5E49118CC6FA491EDC574C14C544AE7DC04231A12BA0AD1BE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="CurrentViewport" GUID="{513BD61B-471D-4318-8D4C-166E71072A9E}">.. <Properties>.. <Property Class="Text" GUID="{8FA3111A-35BC-4E3D-8634-05999E77B73F}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">CurrentViewport</Property>.. <Property Class="Type" GUID="{B63ACFA5-0EFA-4903-B198-2F0033B18A18}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{3766B643-6EA7-48E5-9390-7E430FD13B89}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4.75</Property>.. <Property Class="Memo" GUID="{D9EDE061-7224-45EC-9C21-6F5DA5D68543}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order=&qu

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\CurrentViewport\is-K13T8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (627), with CRLF line terminators
Category:	dropped
Size (bytes):	4092
Entropy (8bit):	5.493575880638022
Encrypted:	false
SSDEEP:	48:crmNnbk0YD51NOrl8aTlcy/mC8ODD0vFxgvDgvWEqvFxgvFgiEvDWpvapvWCAKud:lq0WShptRDDu3qe83qFleilMPAK7bmp
MD5:	273EFCBA9637C00469C73EBAD9D08DCE
SHA1:	329C73FDECF046460DBFBB781F64F99926393635
SHA-256:	959797EC5253CD4074D78FDE22E0653AD4A20D30AEFD5963332EA7F1258C375A
SHA-512:	F1C54F40A9FF5FAA2F9E0EFC498A7CE9E542E46AD38EA3573BDE669E3B26124591FB87F291B487A5E49118CC6FA491EDC574C14C544AE7DC04231A12BA0AD1BE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="CurrentViewport" GUID="{513BD61B-471D-4318-8D4C-166E71072A9E}">.. <Properties>.. <Property Class="Text" GUID="{8FA3111A-35BC-4E3D-8634-05999E77B73F}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">CurrentViewport</Property>.. <Property Class="Type" GUID="{B63ACFA5-0EFA-4903-B198-2F0033B18A18}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{3766B643-6EA7-48E5-9390-7E430FD13B89}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4.75</Property>.. <Property Class="Memo" GUID="{D9EDE061-7224-45EC-9C21-6F5DA5D68543}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order=&qu

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (646), with CRLF line terminators
Category:	dropped
Size (bytes):	5926
Entropy (8bit):	5.422235286571373
Encrypted:	false
SSDEEP:	96:6PHg/0SJne+bzoo0eSe80FlIVSmFTUB6L+bzoa346rPf:b0Sh8o0eSe80DIVSm5UB78dkf
MD5:	601E078A0C296314D14FF16F9FC447F9
SHA1:	0D2567492444FB9C6D27CEC4826AEA2A082D1503
SHA-256:	8AA4D28B5C50C9C18325D12D8D1050EBF0EB80B21FEA236057FBC5DD31D7403E
SHA-512:	E5AA676256214048FAFF92D20803BF2047C9A436BD40B26F996807F7D2EC1DE0892BED875FF85C9005EFBB7DA96079A88B54B3D412E5C1F37F262B3395589D19
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="IPlanswift" GUID="{1DC326E7-A03A-441E-AD5A-2C1DF1E163AD}">.. <Properties>.. <Property Class="Text" GUID="{85B1026D-E634-4EC9-AC7D-82CD12D789B9}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">IPlanswift</Property>.. <Property Class="Type" GUID="{5BD96935-68CF-4195-B465-B189EFE8660E}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Object</Property>.. <Property Class="Script" GUID="{489AF711-0171-473B-85B6-363305E95A11}" Name="Source Code" input="True" group="Help" OrderIndex="3" DecimalPlaces="" List="cmbList" PluginToExecute="cmbList" ScriptType="Method" ScriptLanguage="Pascal" Parameters="">var.. pc: IPlanSwift;..begin.. pc := createoleobject('Planswift9.Planswift');.. pc.about;.. pc := nil;..end;</Property>.. <Property Class="Memo" GUID="{58B982D4-1501-4088-8904-91FE774236DC}" Name="HTMLSource" group="Help" OrderIndex="4"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\DeleteItem\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (723), with CRLF line terminators
Category:	dropped
Size (bytes):	3890
Entropy (8bit):	5.480980509851179
Encrypted:	false
SSDEEP:	96:LaySMAmlfWF5eSP1IigK8n4IyugFgXxwD:LCbvP1HR84IyugyXxwD
MD5:	C47740DFC80354093596E0DA82D179BC
SHA1:	9EFDABFAAF5CDA4C65CFB5695FAA922C32909A68
SHA-256:	CF4C2867552843BF8EC7689F159C72D74D07DD703D049299D989C20817DE756C
SHA-512:	0EFA98741FE0CAEF1506AF811C5692E20C87FFA5F516BB15C0524CD09872E1E2D468133AA4AF07CE94FDF38481092B7D8224617E07E5025E8C11AB6134C708BF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="DeleteItem" GUID="{E1F028FF-4AAF-4F87-B0F0-D2AC14E6684D}">.. <Properties>.. <Property Class="Type" GUID="{1524D3F2-8CA2-4226-A4C1-092C2D7BF199}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{D9B62C58-1A40-4D95-AA73-41F568DF4599}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">DeleteItem</Property>.. <Property Class="Number" GUID="{4CE6EC69-880E-4117-9E3A-DED97C51EC7C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">5</Property>.. <Property Class="Text" GUID="{9B50AA2C-4808-4475-9EF0-87621F3C9E7F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{E1F028FF-4AAF-4F87-B0F0-D2AC14E6684D}</Property>.. <Property Class="Memo" GUID="{93A76A5B-D08F-4290-8C3D-0BD9BDE854AF}" Name="Form Layout" systemhidden="True" O

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\DeleteItem\is-E9CNG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (723), with CRLF line terminators
Category:	dropped
Size (bytes):	3890
Entropy (8bit):	5.480980509851179
Encrypted:	false
SSDEEP:	96:LaySMAmlfWF5eSP1IigK8n4IyugFgXxwD:LCbvP1HR84IyugyXxwD
MD5:	C47740DFC80354093596E0DA82D179BC
SHA1:	9EFDABFAAF5CDA4C65CFB5695FAA922C32909A68
SHA-256:	CF4C2867552843BF8EC7689F159C72D74D07DD703D049299D989C20817DE756C
SHA-512:	0EFA98741FE0CAEF1506AF811C5692E20C87FFA5F516BB15C0524CD09872E1E2D468133AA4AF07CE94FDF38481092B7D8224617E07E5025E8C11AB6134C708BF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="DeleteItem" GUID="{E1F028FF-4AAF-4F87-B0F0-D2AC14E6684D}">.. <Properties>.. <Property Class="Type" GUID="{1524D3F2-8CA2-4226-A4C1-092C2D7BF199}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{D9B62C58-1A40-4D95-AA73-41F568DF4599}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">DeleteItem</Property>.. <Property Class="Number" GUID="{4CE6EC69-880E-4117-9E3A-DED97C51EC7C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">5</Property>.. <Property Class="Text" GUID="{9B50AA2C-4808-4475-9EF0-87621F3C9E7F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{E1F028FF-4AAF-4F87-B0F0-D2AC14E6684D}</Property>.. <Property Class="Memo" GUID="{93A76A5B-D08F-4290-8C3D-0BD9BDE854AF}" Name="Form Layout" systemhidden="True" O

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\DeleteProperty\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1011), with CRLF line terminators
Category:	dropped
Size (bytes):	5066
Entropy (8bit):	5.426578377733823
Encrypted:	false
SSDEEP:	96:ouwHK5CaTWF9/BI61WnDxA9r8AFleXJvUa:olHJ9Z7WdA9r8AjeXJvUa
MD5:	3F93074F5B5F6C456FB351E6D45C523A
SHA1:	128E01DA1D7A65E58AE892A475EF49BA2D2D0FF3
SHA-256:	040D740B8F68D07F3DE0E930F7EB0A3B7488C9613B72C20CA3DA74800491324E
SHA-512:	D62A7A34203EC38D5D2DCCFC323C71D5545B99F7CB3FAE94D0A42565820E0C87233FA3537DD24669874493A11CD55BA85B0FFADAB3AAAC4E416CD2F1249C6423
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="DeleteProperty" GUID="{E6E9CF7E-23D2-46CE-987E-23CF2BDCA756}">.. <Properties>.. <Property Class="Type" GUID="{89D0D204-71ED-4207-A05D-6C63C6FB494D}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{4E5AA6D1-F5F9-4A09-ADB9-C4519D6FB2D1}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">DeleteProperty</Property>.. <Property Class="Number" GUID="{BEA3F9BD-914C-4BC0-9D6C-BA03801F452E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">6</Property>.. <Property Class="Text" GUID="{B8D86662-A97B-4347-A37F-AB2259D4A481}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{E6E9CF7E-23D2-46CE-987E-23CF2BDCA756}</Property>.. <Property Class="Memo" GUID="{D4665D36-EA7B-42B5-BAE5-427B38D96DBD}" Name="Form Layout" systemhidden=

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\DeleteProperty\is-DF9NU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1011), with CRLF line terminators
Category:	dropped
Size (bytes):	5066
Entropy (8bit):	5.426578377733823
Encrypted:	false
SSDEEP:	96:ouwHK5CaTWF9/BI61WnDxA9r8AFleXJvUa:olHJ9Z7WdA9r8AjeXJvUa
MD5:	3F93074F5B5F6C456FB351E6D45C523A
SHA1:	128E01DA1D7A65E58AE892A475EF49BA2D2D0FF3
SHA-256:	040D740B8F68D07F3DE0E930F7EB0A3B7488C9613B72C20CA3DA74800491324E
SHA-512:	D62A7A34203EC38D5D2DCCFC323C71D5545B99F7CB3FAE94D0A42565820E0C87233FA3537DD24669874493A11CD55BA85B0FFADAB3AAAC4E416CD2F1249C6423
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="DeleteProperty" GUID="{E6E9CF7E-23D2-46CE-987E-23CF2BDCA756}">.. <Properties>.. <Property Class="Type" GUID="{89D0D204-71ED-4207-A05D-6C63C6FB494D}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{4E5AA6D1-F5F9-4A09-ADB9-C4519D6FB2D1}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">DeleteProperty</Property>.. <Property Class="Number" GUID="{BEA3F9BD-914C-4BC0-9D6C-BA03801F452E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">6</Property>.. <Property Class="Text" GUID="{B8D86662-A97B-4347-A37F-AB2259D4A481}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{E6E9CF7E-23D2-46CE-987E-23CF2BDCA756}</Property>.. <Property Class="Memo" GUID="{D4665D36-EA7B-42B5-BAE5-427B38D96DBD}" Name="Form Layout" systemhidden=

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\DrawOneWayLayout\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1706), with CRLF line terminators
Category:	dropped
Size (bytes):	20077
Entropy (8bit):	5.090491325904358
Encrypted:	false
SSDEEP:	192:uZ4nAREn5SVbBO5zKMeh/XYedOB9r8Qtrkimn8D/XWcOvWjezz/3Xjez0fXtmC+g:PAK5SVdWBf2kdKrz
MD5:	87A60B49CC495012CDFB7C86A04395D9
SHA1:	B262BFB28F270732069CB855AC9A2ECE649852FE
SHA-256:	D8DDD77088D6702B83C4BE916FC403C2BB5BB60471E6B06696FA4C2C53FD256C
SHA-512:	6A298BDED3B2C41902CECECC221455E6BA662CDD7B1027CF5D0955CFAEC44220EB6CE7D23DE7D3EA259292A2AEC2F1F2BF3AE4D84A70781300308938655EC2E3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="DrawOneWayLayout" GUID="{0998D5D3-9080-4FDF-B680-BF41CCD5CFCF}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">DrawOneWayLayout</Property>.. <Property Class="Type" GUID="{B63A0C0C-8069-4A76-B697-78A8365FF967}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{66A40293-E223-45DF-893F-98A5478B391D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">6.5</Property>.. <Property Class="Memo" GUID="{7FDB2E2F-55EB-45B4-BEC1-230EC1FDD72F}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="He

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\DrawOneWayLayout\is-N0NCE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1706), with CRLF line terminators
Category:	dropped
Size (bytes):	20077
Entropy (8bit):	5.090491325904358
Encrypted:	false
SSDEEP:	192:uZ4nAREn5SVbBO5zKMeh/XYedOB9r8Qtrkimn8D/XWcOvWjezz/3Xjez0fXtmC+g:PAK5SVdWBf2kdKrz
MD5:	87A60B49CC495012CDFB7C86A04395D9
SHA1:	B262BFB28F270732069CB855AC9A2ECE649852FE
SHA-256:	D8DDD77088D6702B83C4BE916FC403C2BB5BB60471E6B06696FA4C2C53FD256C
SHA-512:	6A298BDED3B2C41902CECECC221455E6BA662CDD7B1027CF5D0955CFAEC44220EB6CE7D23DE7D3EA259292A2AEC2F1F2BF3AE4D84A70781300308938655EC2E3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="DrawOneWayLayout" GUID="{0998D5D3-9080-4FDF-B680-BF41CCD5CFCF}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">DrawOneWayLayout</Property>.. <Property Class="Type" GUID="{B63A0C0C-8069-4A76-B697-78A8365FF967}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{66A40293-E223-45DF-893F-98A5478B391D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">6.5</Property>.. <Property Class="Memo" GUID="{7FDB2E2F-55EB-45B4-BEC1-230EC1FDD72F}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="He

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\DrawTwoWayLayout\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1706), with CRLF line terminators
Category:	dropped
Size (bytes):	20160
Entropy (8bit):	5.100336508224596
Encrypted:	false
SSDEEP:	192:uHr8Va6BO5zKMeh/XYedOB9r8Qtrkimn8D/XWcOvWjezz/3Xjez0fXtmC+QtmAyY:s8VZWB72XZjz
MD5:	8883CAA13154C4E06114957CFA10F0F3
SHA1:	E6B596F8CD737E5160D7E5C176B647C5DBB2CD0F
SHA-256:	E30A338EB238B029E0B8BAA5CB3AA08CF9812AB7AD0A989544958A6832603C86
SHA-512:	F4D07B77A28D968CFFD386799D33D6854FE487F172605BDF1D1BE12503A90050871531C5044B44E98D7BFEDC1E767CBC29271DE58F7B41DBF18C41F0AFFDAEFD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="DrawTwoWayLayout" GUID="{FFF5FC18-46CA-4829-B46B-1CAAD9C18DFF}">.. <Properties>.. <Property Class="Text" GUID="{AAD281A3-BF98-44E7-9902-0BFFD362D2C9}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">DrawTwoWayLayout</Property>.. <Property Class="Type" GUID="{61D62FB3-5138-483F-AD18-A39C1BA90432}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{F2EA284E-2AC1-4B61-9DB2-F6AC263D512A}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">6.75</Property>.. <Property Class="Memo" GUID="{468CEA46-CE49-4071-8902-BF15D2465350}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order=&

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\DrawTwoWayLayout\is-TLIE4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1706), with CRLF line terminators
Category:	dropped
Size (bytes):	20160
Entropy (8bit):	5.100336508224596
Encrypted:	false
SSDEEP:	192:uHr8Va6BO5zKMeh/XYedOB9r8Qtrkimn8D/XWcOvWjezz/3Xjez0fXtmC+QtmAyY:s8VZWB72XZjz
MD5:	8883CAA13154C4E06114957CFA10F0F3
SHA1:	E6B596F8CD737E5160D7E5C176B647C5DBB2CD0F
SHA-256:	E30A338EB238B029E0B8BAA5CB3AA08CF9812AB7AD0A989544958A6832603C86
SHA-512:	F4D07B77A28D968CFFD386799D33D6854FE487F172605BDF1D1BE12503A90050871531C5044B44E98D7BFEDC1E767CBC29271DE58F7B41DBF18C41F0AFFDAEFD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="DrawTwoWayLayout" GUID="{FFF5FC18-46CA-4829-B46B-1CAAD9C18DFF}">.. <Properties>.. <Property Class="Text" GUID="{AAD281A3-BF98-44E7-9902-0BFFD362D2C9}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">DrawTwoWayLayout</Property>.. <Property Class="Type" GUID="{61D62FB3-5138-483F-AD18-A39C1BA90432}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{F2EA284E-2AC1-4B61-9DB2-F6AC263D512A}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">6.75</Property>.. <Property Class="Memo" GUID="{468CEA46-CE49-4071-8902-BF15D2465350}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order=&

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\Edition\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (543), with CRLF line terminators
Category:	dropped
Size (bytes):	3466
Entropy (8bit):	5.53041112512932
Encrypted:	false
SSDEEP:	48:cMRuJqBu2eYD5anK87SZ09lJzjZ7eIAm7/ZkmC0MYvFgiEvDzvWR:VRu6u2eWFC7eIAm7/ZkOMCFleva
MD5:	8AE8BFA9C2A16CC34C8ED61A3903F561
SHA1:	F6A993F3E8EB332D7CEF10B207602B64402C50E7
SHA-256:	050C8800ECD5813F99DD3F66527BCABD5A3B77487090A6784585A366D9053AAE
SHA-512:	C3027E36FA7222A1486DD4C32023F2AD249E41972B4569CBFBD323AB5D7CBD43D98ABE3159C34E9C0D6977852649C27AC7FD1061E127F6CE7B904951BD0D73F4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Edition" GUID="{D3AEC139-AC30-4A80-9697-6271B008D091}">.. <Properties>.. <Property Class="Type" GUID="{62C2F4C7-B0ED-48F4-957F-568FF7630D87}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{2C6F82C5-E018-4DA9-916A-7596EB5119D1}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">Edition</Property>.. <Property Class="Number" GUID="{32470B51-1697-441C-B7B0-E7E5387176DF}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">7</Property>.. <Property Class="Text" GUID="{303DDAB5-BD1B-4B74-AC4A-80C37F9876B7}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{D3AEC139-AC30-4A80-9697-6271B008D091}</Property>.. <Property Class="Memo" GUID="{1AB6CCBA-04CF-494B-8162-71D6DA85B85E}" Name="Form Layout" systemhidden="True" OrderIn

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\Edition\is-NLJUQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (543), with CRLF line terminators
Category:	dropped
Size (bytes):	3466
Entropy (8bit):	5.53041112512932
Encrypted:	false
SSDEEP:	48:cMRuJqBu2eYD5anK87SZ09lJzjZ7eIAm7/ZkmC0MYvFgiEvDzvWR:VRu6u2eWFC7eIAm7/ZkOMCFleva
MD5:	8AE8BFA9C2A16CC34C8ED61A3903F561
SHA1:	F6A993F3E8EB332D7CEF10B207602B64402C50E7
SHA-256:	050C8800ECD5813F99DD3F66527BCABD5A3B77487090A6784585A366D9053AAE
SHA-512:	C3027E36FA7222A1486DD4C32023F2AD249E41972B4569CBFBD323AB5D7CBD43D98ABE3159C34E9C0D6977852649C27AC7FD1061E127F6CE7B904951BD0D73F4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Edition" GUID="{D3AEC139-AC30-4A80-9697-6271B008D091}">.. <Properties>.. <Property Class="Type" GUID="{62C2F4C7-B0ED-48F4-957F-568FF7630D87}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{2C6F82C5-E018-4DA9-916A-7596EB5119D1}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">Edition</Property>.. <Property Class="Number" GUID="{32470B51-1697-441C-B7B0-E7E5387176DF}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">7</Property>.. <Property Class="Text" GUID="{303DDAB5-BD1B-4B74-AC4A-80C37F9876B7}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{D3AEC139-AC30-4A80-9697-6271B008D091}</Property>.. <Property Class="Memo" GUID="{1AB6CCBA-04CF-494B-8162-71D6DA85B85E}" Name="Form Layout" systemhidden="True" OrderIn

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\EndFormulaUpdate\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (582), with CRLF line terminators
Category:	dropped
Size (bytes):	3464
Entropy (8bit):	5.512321866367329
Encrypted:	false
SSDEEP:	48:cKyx59srlkFYD5anKMumPZ09lJXmdqjXEvD5vWyIu8zycbN:XyxbsRkFWsUMMeZzIu2ycbN
MD5:	4771ED8891120E3B03A3EA76EFC92E69
SHA1:	8334223E2C6C3096FEE2DB13E8B82A73BC018EB0
SHA-256:	63E630090D2CAF1923B6C23013FE5016B30830754FC7D0FFB71A7F6989A9CD81
SHA-512:	DA4196066AD2AA929F9E6D2547090A66A13E3735EE028131F9DA69235C45F1A72DA139D4A38E527D85FE2834267339CB898903520A2B19E90099155635B5BDCD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="EndFormulaUpdate" GUID="{7BC9E56A-8CED-45B0-BC47-B092275E0F3E}">.. <Properties>.. <Property Class="Type" GUID="{FF426B53-B624-4976-9692-23C06DAAEDE2}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Procedure</Property>.. <Property Class="Text" GUID="{753D301E-D4E8-4C80-8DE8-B45F0D880EE7}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">EndFormulaUpdate</Property>.. <Property Class="Number" GUID="{77448916-393E-45BA-BF6C-BA71FC22DED9}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">8</Property>.. <Property Class="Text" GUID="{51901F40-E630-48C1-90F4-3DA2E4145B45}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{7BC9E56A-8CED-45B0-BC47-B092275E0F3E}</Property>.. <Property Class="Memo" GUID="{7938635F-998A-4C06-99A4-98B7E3BAB988}" Name="Form Layout" systemhi

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\EndFormulaUpdate\is-RT6RG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (582), with CRLF line terminators
Category:	dropped
Size (bytes):	3464
Entropy (8bit):	5.512321866367329
Encrypted:	false
SSDEEP:	48:cKyx59srlkFYD5anKMumPZ09lJXmdqjXEvD5vWyIu8zycbN:XyxbsRkFWsUMMeZzIu2ycbN
MD5:	4771ED8891120E3B03A3EA76EFC92E69
SHA1:	8334223E2C6C3096FEE2DB13E8B82A73BC018EB0
SHA-256:	63E630090D2CAF1923B6C23013FE5016B30830754FC7D0FFB71A7F6989A9CD81
SHA-512:	DA4196066AD2AA929F9E6D2547090A66A13E3735EE028131F9DA69235C45F1A72DA139D4A38E527D85FE2834267339CB898903520A2B19E90099155635B5BDCD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="EndFormulaUpdate" GUID="{7BC9E56A-8CED-45B0-BC47-B092275E0F3E}">.. <Properties>.. <Property Class="Type" GUID="{FF426B53-B624-4976-9692-23C06DAAEDE2}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Procedure</Property>.. <Property Class="Text" GUID="{753D301E-D4E8-4C80-8DE8-B45F0D880EE7}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">EndFormulaUpdate</Property>.. <Property Class="Number" GUID="{77448916-393E-45BA-BF6C-BA71FC22DED9}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">8</Property>.. <Property Class="Text" GUID="{51901F40-E630-48C1-90F4-3DA2E4145B45}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{7BC9E56A-8CED-45B0-BC47-B092275E0F3E}</Property>.. <Property Class="Memo" GUID="{7938635F-998A-4C06-99A4-98B7E3BAB988}" Name="Form Layout" systemhi

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\EndUpdate\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (548), with CRLF line terminators
Category:	dropped
Size (bytes):	3382
Entropy (8bit):	5.518537974483726
Encrypted:	false
SSDEEP:	48:chEML7H4sEtZxYD5anKMumPZ09lJimdxQj7UH/EvDDdvWb8Izviz87mEcbge:rqr4sSfWsRMxCUfe/pE8Iz487Ncbge
MD5:	ABF5463E1940663CA3187BEC0A24BC1D
SHA1:	2B805B6BAA24543E97D7AACAC763B06D99718A0C
SHA-256:	ADC2022529FFEB94F6A649F9B4E25A1F89A0340FC4D3169E4C41851F741A9E7D
SHA-512:	0EBBB4619E9383D699A74FE1FED9C0F7327EFB76906AF8D06EAC12FDEC03C5290D3928C7AC0780513A74581DE50C295F529F0F566E9DCC6136C1A6C37134FB10
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="EndUpdate" GUID="{BB1D16FB-4CCD-4058-A046-B9A5FD9BD616}">.. <Properties>.. <Property Class="Type" GUID="{78EB5614-1B2C-4DAB-8071-FC638300F91D}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Procedure</Property>.. <Property Class="Text" GUID="{8B13FB6E-2936-4647-8671-360FEBEFF099}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">EndUpdate</Property>.. <Property Class="Number" GUID="{81F1E132-3F9A-4644-8C81-9F16C6A0B1FF}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">9</Property>.. <Property Class="Text" GUID="{8AAD0458-1CA9-4EEA-B402-31050D8D2586}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{BB1D16FB-4CCD-4058-A046-B9A5FD9BD616}</Property>.. <Property Class="Memo" GUID="{CD2CABB9-F2C8-4780-A94D-25BD3B987476}" Name="Form Layout" systemhidden="True" Or

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\EndUpdate\is-4P5P7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (548), with CRLF line terminators
Category:	dropped
Size (bytes):	3382
Entropy (8bit):	5.518537974483726
Encrypted:	false
SSDEEP:	48:chEML7H4sEtZxYD5anKMumPZ09lJimdxQj7UH/EvDDdvWb8Izviz87mEcbge:rqr4sSfWsRMxCUfe/pE8Iz487Ncbge
MD5:	ABF5463E1940663CA3187BEC0A24BC1D
SHA1:	2B805B6BAA24543E97D7AACAC763B06D99718A0C
SHA-256:	ADC2022529FFEB94F6A649F9B4E25A1F89A0340FC4D3169E4C41851F741A9E7D
SHA-512:	0EBBB4619E9383D699A74FE1FED9C0F7327EFB76906AF8D06EAC12FDEC03C5290D3928C7AC0780513A74581DE50C295F529F0F566E9DCC6136C1A6C37134FB10
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="EndUpdate" GUID="{BB1D16FB-4CCD-4058-A046-B9A5FD9BD616}">.. <Properties>.. <Property Class="Type" GUID="{78EB5614-1B2C-4DAB-8071-FC638300F91D}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Procedure</Property>.. <Property Class="Text" GUID="{8B13FB6E-2936-4647-8671-360FEBEFF099}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">EndUpdate</Property>.. <Property Class="Number" GUID="{81F1E132-3F9A-4644-8C81-9F16C6A0B1FF}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">9</Property>.. <Property Class="Text" GUID="{8AAD0458-1CA9-4EEA-B402-31050D8D2586}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{BB1D16FB-4CCD-4058-A046-B9A5FD9BD616}</Property>.. <Property Class="Memo" GUID="{CD2CABB9-F2C8-4780-A94D-25BD3B987476}" Name="Form Layout" systemhidden="True" Or

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetItem\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (816), with CRLF line terminators
Category:	dropped
Size (bytes):	6129
Entropy (8bit):	5.365441539604655
Encrypted:	false
SSDEEP:	96:IlfwSWF1kfJF5ifG9RmfnF8uFlewHK3BQFeAFzgRa:L1kMf5PaujewHK3BQFeA5gRa
MD5:	08BA2358BB30145FAFB4678C4CD56AFF
SHA1:	92A3A2921DDDFD3CC52C091611B00C5A10CF6983
SHA-256:	1E0722C99A1F53159F7D9AFBAFF8434C28218AC3C789B5BA8B95840F29A1EA98
SHA-512:	D05D7FF894D57022ABA43B75023717FB0E47E966D89F60568D9027947DC09872FE0B0DAB970ACAAE19991F24ADE4D41D9E1BE9C9E1DC2298D2186E6F42D5F23E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetItem" GUID="{2A6038E6-5D16-4B6A-A8CA-42D0AAC637DF}">.. <Properties>.. <Property Class="Type" GUID="{3CF0690E-BD5B-4C0D-B51C-13718566CFD2}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{1EAB2BA9-08AB-4FC0-B422-7269C9A46CDB}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">GetItem</Property>.. <Property Class="Number" GUID="{5598FF60-2BC1-437D-A221-B0B2F0F2A2D7}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">10</Property>.. <Property Class="Text" GUID="{4D077124-D325-45B0-9E24-03C7AC043A8F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{2A6038E6-5D16-4B6A-A8CA-42D0AAC637DF}</Property>.. <Property Class="Memo" GUID="{88BAF35D-5615-4922-8C0E-BE4A713CC6A2}" Name="Form Layout" systemhidden="True" OrderI

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetItem\is-69AL2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (816), with CRLF line terminators
Category:	dropped
Size (bytes):	6129
Entropy (8bit):	5.365441539604655
Encrypted:	false
SSDEEP:	96:IlfwSWF1kfJF5ifG9RmfnF8uFlewHK3BQFeAFzgRa:L1kMf5PaujewHK3BQFeA5gRa
MD5:	08BA2358BB30145FAFB4678C4CD56AFF
SHA1:	92A3A2921DDDFD3CC52C091611B00C5A10CF6983
SHA-256:	1E0722C99A1F53159F7D9AFBAFF8434C28218AC3C789B5BA8B95840F29A1EA98
SHA-512:	D05D7FF894D57022ABA43B75023717FB0E47E966D89F60568D9027947DC09872FE0B0DAB970ACAAE19991F24ADE4D41D9E1BE9C9E1DC2298D2186E6F42D5F23E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetItem" GUID="{2A6038E6-5D16-4B6A-A8CA-42D0AAC637DF}">.. <Properties>.. <Property Class="Type" GUID="{3CF0690E-BD5B-4C0D-B51C-13718566CFD2}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{1EAB2BA9-08AB-4FC0-B422-7269C9A46CDB}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">GetItem</Property>.. <Property Class="Number" GUID="{5598FF60-2BC1-437D-A221-B0B2F0F2A2D7}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">10</Property>.. <Property Class="Text" GUID="{4D077124-D325-45B0-9E24-03C7AC043A8F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{2A6038E6-5D16-4B6A-A8CA-42D0AAC637DF}</Property>.. <Property Class="Memo" GUID="{88BAF35D-5615-4922-8C0E-BE4A713CC6A2}" Name="Form Layout" systemhidden="True" OrderI

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetJobTotal\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (989), with CRLF line terminators
Category:	dropped
Size (bytes):	5548
Entropy (8bit):	5.372940088266364
Encrypted:	false
SSDEEP:	96:z5rb7WCAKgyaJobmi1en/n8bmFleXUXe9UAKYAoa9:N5k/abmi1en/n8bmjeXUXe9UHYQ9
MD5:	A677E5D5197B1FF6D406AC4531FD84F8
SHA1:	781E6D1A7D205FE9A0185CE7C257677C201B4363
SHA-256:	C1EDE549DCB2C3476690151E73C98FF9B13B9EA0DF0A0E2A99E5436990462EBE
SHA-512:	70A58CE74FF083E3A0417198C2DA80E1C677185408DF86EE93A5DCB421968FB527CE0A0C9B8913F0F334DC8A4407F75EE58C602854D13E4A380A8880DD6C7AD0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetJobTotal" GUID="{8F7BC731-7F86-48F3-90DB-14758B62D064}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">GetJobTotal</Property>.. <Property Class="Type" GUID="{0AE23ABE-5BBA-4BA1-AB87-1DAAF7CC4211}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{71E704E0-74A2-4AE5-93BB-57939B571DD4}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">16.5</Property>.. <Property Class="Memo" GUID="{584F0C42-973D-4715-9FB9-F7C1F6FE13CB}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="Help String

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetJobTotal\is-SUU4H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (989), with CRLF line terminators
Category:	dropped
Size (bytes):	5548
Entropy (8bit):	5.372940088266364
Encrypted:	false
SSDEEP:	96:z5rb7WCAKgyaJobmi1en/n8bmFleXUXe9UAKYAoa9:N5k/abmi1en/n8bmjeXUXe9UHYQ9
MD5:	A677E5D5197B1FF6D406AC4531FD84F8
SHA1:	781E6D1A7D205FE9A0185CE7C257677C201B4363
SHA-256:	C1EDE549DCB2C3476690151E73C98FF9B13B9EA0DF0A0E2A99E5436990462EBE
SHA-512:	70A58CE74FF083E3A0417198C2DA80E1C677185408DF86EE93A5DCB421968FB527CE0A0C9B8913F0F334DC8A4407F75EE58C602854D13E4A380A8880DD6C7AD0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetJobTotal" GUID="{8F7BC731-7F86-48F3-90DB-14758B62D064}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">GetJobTotal</Property>.. <Property Class="Type" GUID="{0AE23ABE-5BBA-4BA1-AB87-1DAAF7CC4211}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{71E704E0-74A2-4AE5-93BB-57939B571DD4}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">16.5</Property>.. <Property Class="Memo" GUID="{584F0C42-973D-4715-9FB9-F7C1F6FE13CB}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="Help String

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetLine\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1796), with CRLF line terminators
Category:	dropped
Size (bytes):	8166
Entropy (8bit):	5.251690256293345
Encrypted:	false
SSDEEP:	192:TRY6vGqlRai8rAezCRlaBdjeeL75Z8eLyEBV1lKVJ:TG60PK7
MD5:	6CD37DFAA5BEBC5D89A2D90F96828A59
SHA1:	A68EA23D0D5D14DE92FD32E976F30FEF4599225B
SHA-256:	AD61095169110AB2BE0768CCBB54A39A5F3AD73B4C27A9EC2C9110C2D9E92FA1
SHA-512:	9A51DE252EFAC495E92EF8AC4BD0699E31ADE1CFE1F46154ADC38C0652EAADD345CD67E3A7025349B547E7BD7D0E70F37933EA3DBF0C8D862B00F245FCA8DD04
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetLine" GUID="{EE6E5A1D-8BDA-4768-8CE7-EA104D7BD62F}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">GetLine</Property>.. <Property Class="Type" GUID="{5082558D-9199-4F3C-B787-D421AFA943FA}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{0CA5FB41-2AD5-4A0E-9A19-C0AD57F6C964}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">10.5</Property>.. <Property Class="Memo" GUID="{571FC556-052B-4C42-A35D-32542F18B342}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="Help String" O

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetLine\is-TFF71.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1796), with CRLF line terminators
Category:	dropped
Size (bytes):	8166
Entropy (8bit):	5.251690256293345
Encrypted:	false
SSDEEP:	192:TRY6vGqlRai8rAezCRlaBdjeeL75Z8eLyEBV1lKVJ:TG60PK7
MD5:	6CD37DFAA5BEBC5D89A2D90F96828A59
SHA1:	A68EA23D0D5D14DE92FD32E976F30FEF4599225B
SHA-256:	AD61095169110AB2BE0768CCBB54A39A5F3AD73B4C27A9EC2C9110C2D9E92FA1
SHA-512:	9A51DE252EFAC495E92EF8AC4BD0699E31ADE1CFE1F46154ADC38C0652EAADD345CD67E3A7025349B547E7BD7D0E70F37933EA3DBF0C8D862B00F245FCA8DD04
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetLine" GUID="{EE6E5A1D-8BDA-4768-8CE7-EA104D7BD62F}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">GetLine</Property>.. <Property Class="Type" GUID="{5082558D-9199-4F3C-B787-D421AFA943FA}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{0CA5FB41-2AD5-4A0E-9A19-C0AD57F6C964}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">10.5</Property>.. <Property Class="Memo" GUID="{571FC556-052B-4C42-A35D-32542F18B342}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="Help String" O

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetOneWayLayout\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1757), with CRLF line terminators
Category:	dropped
Size (bytes):	17281
Entropy (8bit):	5.118241305029531
Encrypted:	false
SSDEEP:	192:AoAVbxKMeh/XB9r8Qtrkimn8D/XWcOfXtmC+QtmAy0SSJeEQjweyX/Ut7yQeQUoD:AoAVwBBIwnz
MD5:	E348D4CFEC34C3A63FD8226952E7A981
SHA1:	25661F0708A17CA4D3D47A2F14F5B5556D12D8E2
SHA-256:	7231B73FBD164FE28A67EF3E8807312389582B90605CCF2637FB5A002F6E1663
SHA-512:	49091DF8E3180838EC6D3ECA04F40974BBC7B5FD5AC380CC74DA54981F140AE2A6934204CB0649EF42864AB08410EEEDEECD6AD96D004C6F6024F05B491F9773
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetOneWayLayout" GUID="{5399F13A-871F-49F8-B210-38CC77CCFF4B}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">GetOneWayLayout</Property>.. <Property Class="Type" GUID="{3D11E35D-2FAD-4F56-ABA7-CD8E473ACE50}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{C9E7170D-2F18-4684-AA64-0906CA7F6F83}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">10.75</Property>.. <Property Class="Memo" GUID="{66986CEA-FC91-445E-BD7B-7628BEB1C888}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="He

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetOneWayLayout\is-4LQTP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1757), with CRLF line terminators
Category:	dropped
Size (bytes):	17281
Entropy (8bit):	5.118241305029531
Encrypted:	false
SSDEEP:	192:AoAVbxKMeh/XB9r8Qtrkimn8D/XWcOfXtmC+QtmAy0SSJeEQjweyX/Ut7yQeQUoD:AoAVwBBIwnz
MD5:	E348D4CFEC34C3A63FD8226952E7A981
SHA1:	25661F0708A17CA4D3D47A2F14F5B5556D12D8E2
SHA-256:	7231B73FBD164FE28A67EF3E8807312389582B90605CCF2637FB5A002F6E1663
SHA-512:	49091DF8E3180838EC6D3ECA04F40974BBC7B5FD5AC380CC74DA54981F140AE2A6934204CB0649EF42864AB08410EEEDEECD6AD96D004C6F6024F05B491F9773
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetOneWayLayout" GUID="{5399F13A-871F-49F8-B210-38CC77CCFF4B}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">GetOneWayLayout</Property>.. <Property Class="Type" GUID="{3D11E35D-2FAD-4F56-ABA7-CD8E473ACE50}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{C9E7170D-2F18-4684-AA64-0906CA7F6F83}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">10.75</Property>.. <Property Class="Memo" GUID="{66986CEA-FC91-445E-BD7B-7628BEB1C888}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="He

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetPropertyFormula\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (894), with CRLF line terminators
Category:	dropped
Size (bytes):	4367
Entropy (8bit):	5.476403740528594
Encrypted:	false
SSDEEP:	48:che7a4xtwIYMbHYD5anK87SZ09lJ9ZEtrlIEDW78yNH3mfC9vFgiEvDEvtVvRivD:eea8lY0HWFkQJI0W71XJFleKHOD
MD5:	E670DB747704AC9A90B91DD42398C6D0
SHA1:	331131DDD0DF85E170AE71F1E715BCB446186DB7
SHA-256:	CF1A938AC146417D9DCD82F9ED4DD6630DF5C388AD812198C1DD4CAC5D10217C
SHA-512:	64617D89CFEB217DB7645E7495349A55EEA71C5A57E047F56F134DF3E2BE97DA35F1DC7DC3D6BDFDD0EC7D60ECB30A7F025EAD5FEFA9F465FBCC083E6198ECBA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetPropertyFormula" GUID="{38FF8CEF-8B6C-4A95-A583-4669565D7E65}">.. <Properties>.. <Property Class="Type" GUID="{943FC241-2909-464C-8706-2957A1D48BD2}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{F276D20F-68C0-4BC4-B33B-B9163A35FB22}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">GetPropertyFormula</Property>.. <Property Class="Number" GUID="{14752093-FF37-40C8-89B6-944809A6CB4B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">12</Property>.. <Property Class="Text" GUID="{5B4F700C-4E7E-46EC-837E-C56DABE1CBA3}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{38FF8CEF-8B6C-4A95-A583-4669565D7E65}</Property>.. <Property Class="Memo" GUID="{DFA50F9A-BA62-4829-8AA2-CADAB4952359}" Name="Form Layout" syst

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetPropertyFormula\is-BK5SB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (894), with CRLF line terminators
Category:	dropped
Size (bytes):	4367
Entropy (8bit):	5.476403740528594
Encrypted:	false
SSDEEP:	48:che7a4xtwIYMbHYD5anK87SZ09lJ9ZEtrlIEDW78yNH3mfC9vFgiEvDEvtVvRivD:eea8lY0HWFkQJI0W71XJFleKHOD
MD5:	E670DB747704AC9A90B91DD42398C6D0
SHA1:	331131DDD0DF85E170AE71F1E715BCB446186DB7
SHA-256:	CF1A938AC146417D9DCD82F9ED4DD6630DF5C388AD812198C1DD4CAC5D10217C
SHA-512:	64617D89CFEB217DB7645E7495349A55EEA71C5A57E047F56F134DF3E2BE97DA35F1DC7DC3D6BDFDD0EC7D60ECB30A7F025EAD5FEFA9F465FBCC083E6198ECBA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetPropertyFormula" GUID="{38FF8CEF-8B6C-4A95-A583-4669565D7E65}">.. <Properties>.. <Property Class="Type" GUID="{943FC241-2909-464C-8706-2957A1D48BD2}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{F276D20F-68C0-4BC4-B33B-B9163A35FB22}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">GetPropertyFormula</Property>.. <Property Class="Number" GUID="{14752093-FF37-40C8-89B6-944809A6CB4B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">12</Property>.. <Property Class="Text" GUID="{5B4F700C-4E7E-46EC-837E-C56DABE1CBA3}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{38FF8CEF-8B6C-4A95-A583-4669565D7E65}</Property>.. <Property Class="Memo" GUID="{DFA50F9A-BA62-4829-8AA2-CADAB4952359}" Name="Form Layout" syst

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetPropertyResultAsB\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1077), with CRLF line terminators
Category:	dropped
Size (bytes):	4589
Entropy (8bit):	5.459674057335069
Encrypted:	false
SSDEEP:	48:chJ8ZcqI69fzYD5anK87SZ09lJF1Z4CjhYihZcw66PNqmkWxW6PGvFgiEvDVvtV2:eJ8OyfzWF+Hqihuw6Lg4lFleNHOcdM
MD5:	DCFC0582CB61D6EA71A2B605EDCF0132
SHA1:	D10896F67B5A165B06B632E4B8900438BA1DF5B1
SHA-256:	995E41B6243C73ED13D75B69CBE2DF0090D823A5617E5565E3E3708B055DB5DB
SHA-512:	6D09239D482EC74D140D1F3787573B0E39D322C8B6EE345D00A726ED7B0885459BEC283A7D70560B7A1D8A65A7907E3CC75639B19B59F841390152AA0BE55724
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetPropertyResultAsBoolean" GUID="{FC133DCF-FA47-47C9-8C1D-653FF9F943DF}">.. <Properties>.. <Property Class="Type" GUID="{0EA2F19F-45C5-4E0C-90A9-392CFB54CA81}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{D1394E82-AA20-4589-B7D2-E31157FC4691}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">GetPropertyResultAsBoolean</Property>.. <Property Class="Number" GUID="{C1825C4A-7A54-4436-ABE7-2C16096F9A05}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">14</Property>.. <Property Class="Text" GUID="{CE2B7BCE-EEC4-4E5E-A83C-B28AE12A780C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{FC133DCF-FA47-47C9-8C1D-653FF9F943DF}</Property>.. <Property Class="Memo" GUID="{F6190B23-BA1A-430A-BEEE-E24A68038C06}" Name="F

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetPropertyResultAsB\is-6V07R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1077), with CRLF line terminators
Category:	dropped
Size (bytes):	4589
Entropy (8bit):	5.459674057335069
Encrypted:	false
SSDEEP:	48:chJ8ZcqI69fzYD5anK87SZ09lJF1Z4CjhYihZcw66PNqmkWxW6PGvFgiEvDVvtV2:eJ8OyfzWF+Hqihuw6Lg4lFleNHOcdM
MD5:	DCFC0582CB61D6EA71A2B605EDCF0132
SHA1:	D10896F67B5A165B06B632E4B8900438BA1DF5B1
SHA-256:	995E41B6243C73ED13D75B69CBE2DF0090D823A5617E5565E3E3708B055DB5DB
SHA-512:	6D09239D482EC74D140D1F3787573B0E39D322C8B6EE345D00A726ED7B0885459BEC283A7D70560B7A1D8A65A7907E3CC75639B19B59F841390152AA0BE55724
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetPropertyResultAsBoolean" GUID="{FC133DCF-FA47-47C9-8C1D-653FF9F943DF}">.. <Properties>.. <Property Class="Type" GUID="{0EA2F19F-45C5-4E0C-90A9-392CFB54CA81}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{D1394E82-AA20-4589-B7D2-E31157FC4691}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">GetPropertyResultAsBoolean</Property>.. <Property Class="Number" GUID="{C1825C4A-7A54-4436-ABE7-2C16096F9A05}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">14</Property>.. <Property Class="Text" GUID="{CE2B7BCE-EEC4-4E5E-A83C-B28AE12A780C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{FC133DCF-FA47-47C9-8C1D-653FF9F943DF}</Property>.. <Property Class="Memo" GUID="{F6190B23-BA1A-430A-BEEE-E24A68038C06}" Name="F

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetPropertyResultAsBoolean\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1349), with CRLF line terminators
Category:	dropped
Size (bytes):	9522
Entropy (8bit):	5.2390748077777305
Encrypted:	false
SSDEEP:	192:5XdO8dOPdOodOQdOScdOfpOdOiydOh8dOYljeNHOqM:hdO8dOPdOodOQdOScdOfpOdONdOh8dOa
MD5:	A3F9FFB93A0357FD9D28D2BEC43F46E4
SHA1:	D229EA7A23388B24899C9444A4ECFB981AAD4257
SHA-256:	E1A22171FB4B8475A6401CACD9307E0E53F05509FE435D3456AA51B4FF6015D1
SHA-512:	E02A07405DAC4ABC8997D84345A628F1C56B55D6B884980AFD98C983DFE2EE2996882973351FD76D58A4127D42D1DDB7BD8106B44EC916B3AF9456803960DCE1
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetPropertyResultAsBoolean" GUID="{FC133DCF-FA47-47C9-8C1D-653FF9F943DF}">.. <Properties>.. <Property Class="Type" GUID="{0EA2F19F-45C5-4E0C-90A9-392CFB54CA81}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{D1394E82-AA20-4589-B7D2-E31157FC4691}" Name="Name" inheritaction="Ignore"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetPropertyResultAsBoolean\is-S80S6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1349), with CRLF line terminators
Category:	dropped
Size (bytes):	9522
Entropy (8bit):	5.2390748077777305
Encrypted:	false
SSDEEP:	192:5XdO8dOPdOodOQdOScdOfpOdOiydOh8dOYljeNHOqM:hdO8dOPdOodOQdOScdOfpOdONdOh8dOa
MD5:	A3F9FFB93A0357FD9D28D2BEC43F46E4
SHA1:	D229EA7A23388B24899C9444A4ECFB981AAD4257
SHA-256:	E1A22171FB4B8475A6401CACD9307E0E53F05509FE435D3456AA51B4FF6015D1
SHA-512:	E02A07405DAC4ABC8997D84345A628F1C56B55D6B884980AFD98C983DFE2EE2996882973351FD76D58A4127D42D1DDB7BD8106B44EC916B3AF9456803960DCE1
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetPropertyResultAsBoolean" GUID="{FC133DCF-FA47-47C9-8C1D-653FF9F943DF}">.. <Properties>.. <Property Class="Type" GUID="{0EA2F19F-45C5-4E0C-90A9-392CFB54CA81}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{D1394E82-AA20-4589-B7D2-E31157FC4691}" Name="Name" inheritaction="Ignore"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetPropertyResultAsF\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1086), with CRLF line terminators
Category:	dropped
Size (bytes):	4613
Entropy (8bit):	5.472036033030609
Encrypted:	false
SSDEEP:	48:chdroIPQ4DIWYD5anK87SZ09lJAueZLwihnTikWmOggvFgiEvDPvtVvRivRvivuo:e5/PQ4DIWWFrumLwihTilAqFlebHON8D
MD5:	DE0B776149669E3B7B9566F69F247734
SHA1:	72E2FEC95EE255D62011A62D11366297A687A7CB
SHA-256:	950A0375BEC778650E4835C6E2E55D8FECF75641D37B913CEABB2852F8544AB2
SHA-512:	25FB4B1490CAD046CA8E3BCE32C2EF24E60AA2A3250696337238939130D4BA4985F8F446599D2F83467E71017C0288979A3CA4319B88A01FF2B0516E392BD77B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetPropertyResultAsFloat" GUID="{86E5DB03-461B-4FD4-BFE3-6E2F776B9098}">.. <Properties>.. <Property Class="Type" GUID="{4EC3B24D-37CE-4098-94B7-758E815A07C9}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{A99E4A86-2312-455E-8073-17F0A5231655}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">GetPropertyResultAsFloat</Property>.. <Property Class="Number" GUID="{C0C7449E-9E4C-43BC-A98C-1F43515A0BE9}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">15</Property>.. <Property Class="Text" GUID="{0E477842-99CF-4BB1-9200-EAF7F72EC244}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{86E5DB03-461B-4FD4-BFE3-6E2F776B9098}</Property>.. <Property Class="Memo" GUID="{4F90E1BD-23A1-409F-9C03-0784CF6CEE78}" Name="Form

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetPropertyResultAsF\is-HU6U3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1086), with CRLF line terminators
Category:	dropped
Size (bytes):	4613
Entropy (8bit):	5.472036033030609
Encrypted:	false
SSDEEP:	48:chdroIPQ4DIWYD5anK87SZ09lJAueZLwihnTikWmOggvFgiEvDPvtVvRivRvivuo:e5/PQ4DIWWFrumLwihTilAqFlebHON8D
MD5:	DE0B776149669E3B7B9566F69F247734
SHA1:	72E2FEC95EE255D62011A62D11366297A687A7CB
SHA-256:	950A0375BEC778650E4835C6E2E55D8FECF75641D37B913CEABB2852F8544AB2
SHA-512:	25FB4B1490CAD046CA8E3BCE32C2EF24E60AA2A3250696337238939130D4BA4985F8F446599D2F83467E71017C0288979A3CA4319B88A01FF2B0516E392BD77B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetPropertyResultAsFloat" GUID="{86E5DB03-461B-4FD4-BFE3-6E2F776B9098}">.. <Properties>.. <Property Class="Type" GUID="{4EC3B24D-37CE-4098-94B7-758E815A07C9}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{A99E4A86-2312-455E-8073-17F0A5231655}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">GetPropertyResultAsFloat</Property>.. <Property Class="Number" GUID="{C0C7449E-9E4C-43BC-A98C-1F43515A0BE9}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">15</Property>.. <Property Class="Text" GUID="{0E477842-99CF-4BB1-9200-EAF7F72EC244}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{86E5DB03-461B-4FD4-BFE3-6E2F776B9098}</Property>.. <Property Class="Memo" GUID="{4F90E1BD-23A1-409F-9C03-0784CF6CEE78}" Name="Form

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetPropertyResultAsFloat\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1358), with CRLF line terminators
Category:	dropped
Size (bytes):	9542
Entropy (8bit):	5.249832280629215
Encrypted:	false
SSDEEP:	192:fdO4dORYdOmEdOHdOSTdOVpOdOiQdOTadORqjebHON8D:fdO4dORYdOPdOHdOSTdOVpOdOhdOTadG
MD5:	6FC8490698DCB837A848650F0FE79A23
SHA1:	95670EF587757BF574C2D1007C33F60AE0C04421
SHA-256:	7947ED3808362066B0DB5E0EE9B910927E5E5F6113856BA4D8D6D698D4253737
SHA-512:	3A966387A3B972600933364974CEA8C7A4286AA4D1CDAA3A0D3678BBC40C08A1B97664C1EDCD75EE30D55EA71801A4F5C4B6D9BEB190D17B178607C4D6A3A02C
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetPropertyResultAsFloat" GUID="{86E5DB03-461B-4FD4-BFE3-6E2F776B9098}">.. <Properties>.. <Property Class="Type" GUID="{4EC3B24D-37CE-4098-94B7-758E815A07C9}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{A99E4A86-2312-455E-8073-17F0A5231655}" Name="Name" inheritaction="Ignore" ca

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetPropertyResultAsFloat\is-PURKT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1358), with CRLF line terminators
Category:	dropped
Size (bytes):	9542
Entropy (8bit):	5.249832280629215
Encrypted:	false
SSDEEP:	192:fdO4dORYdOmEdOHdOSTdOVpOdOiQdOTadORqjebHON8D:fdO4dORYdOPdOHdOSTdOVpOdOhdOTadG
MD5:	6FC8490698DCB837A848650F0FE79A23
SHA1:	95670EF587757BF574C2D1007C33F60AE0C04421
SHA-256:	7947ED3808362066B0DB5E0EE9B910927E5E5F6113856BA4D8D6D698D4253737
SHA-512:	3A966387A3B972600933364974CEA8C7A4286AA4D1CDAA3A0D3678BBC40C08A1B97664C1EDCD75EE30D55EA71801A4F5C4B6D9BEB190D17B178607C4D6A3A02C
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetPropertyResultAsFloat" GUID="{86E5DB03-461B-4FD4-BFE3-6E2F776B9098}">.. <Properties>.. <Property Class="Type" GUID="{4EC3B24D-37CE-4098-94B7-758E815A07C9}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{A99E4A86-2312-455E-8073-17F0A5231655}" Name="Name" inheritaction="Ignore" ca

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetPropertyResultAsI\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1084), with CRLF line terminators
Category:	dropped
Size (bytes):	4593
Entropy (8bit):	5.464181566997819
Encrypted:	false
SSDEEP:	48:chlX8kdIlfSO3EYD5anK87SZ09lJyLZWihDlwL7Smu7vvFgiEvDXvtVvRivRviA7:eF8/dSOUWFDFWihpwLOjXFle7HONHD
MD5:	DFAA7DF84670C714F7199B177A2ED5EA
SHA1:	0982F8AAE134389599C0C40739378C6D79880B49
SHA-256:	418ABD9846FB6F0D0B3812B0FE9FBAE496D87E6E4F33E531A329E2A9C0076963
SHA-512:	C7F9244F28EB29F188C56CC0BA798871E94F67D0267407708781F2CC94A02002F4E7B07D708BD8B74943E9FE7863E2164EBEF66A5EECD13702B9FA52082027A0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetPropertyResultAsInteger" GUID="{BE408E7B-01F0-4611-9C67-50499C4C417E}">.. <Properties>.. <Property Class="Type" GUID="{03D0B62B-DD3B-4912-985E-6395F527E44F}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{2C36E45D-37AD-407D-9AC7-463A30FABA26}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">GetPropertyResultAsInteger</Property>.. <Property Class="Number" GUID="{3CCE7C2B-2D9C-4998-AC0B-61490A6FE81D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">16</Property>.. <Property Class="Text" GUID="{11DA0AF9-3AB5-48AB-BEB0-A1CC221B83A1}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{BE408E7B-01F0-4611-9C67-50499C4C417E}</Property>.. <Property Class="Memo" GUID="{37B26440-7718-462F-B460-F7D65BA6188A}" Name="F

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetPropertyResultAsI\is-3FR96.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1084), with CRLF line terminators
Category:	dropped
Size (bytes):	4593
Entropy (8bit):	5.464181566997819
Encrypted:	false
SSDEEP:	48:chlX8kdIlfSO3EYD5anK87SZ09lJyLZWihDlwL7Smu7vvFgiEvDXvtVvRivRviA7:eF8/dSOUWFDFWihpwLOjXFle7HONHD
MD5:	DFAA7DF84670C714F7199B177A2ED5EA
SHA1:	0982F8AAE134389599C0C40739378C6D79880B49
SHA-256:	418ABD9846FB6F0D0B3812B0FE9FBAE496D87E6E4F33E531A329E2A9C0076963
SHA-512:	C7F9244F28EB29F188C56CC0BA798871E94F67D0267407708781F2CC94A02002F4E7B07D708BD8B74943E9FE7863E2164EBEF66A5EECD13702B9FA52082027A0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetPropertyResultAsInteger" GUID="{BE408E7B-01F0-4611-9C67-50499C4C417E}">.. <Properties>.. <Property Class="Type" GUID="{03D0B62B-DD3B-4912-985E-6395F527E44F}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{2C36E45D-37AD-407D-9AC7-463A30FABA26}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">GetPropertyResultAsInteger</Property>.. <Property Class="Number" GUID="{3CCE7C2B-2D9C-4998-AC0B-61490A6FE81D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">16</Property>.. <Property Class="Text" GUID="{11DA0AF9-3AB5-48AB-BEB0-A1CC221B83A1}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{BE408E7B-01F0-4611-9C67-50499C4C417E}</Property>.. <Property Class="Memo" GUID="{37B26440-7718-462F-B460-F7D65BA6188A}" Name="F

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetPropertyResultAsInteger\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1350), with CRLF line terminators
Category:	dropped
Size (bytes):	9522
Entropy (8bit):	5.246622936060572
Encrypted:	false
SSDEEP:	192:lldOfdOqdOMdOpdOS06dOLpOdOipLdOmNdOeXje7HONHD:ndOfdOqdOMdOpdOS06dOLpOdOodOmNdR
MD5:	D71F528263AD8CAF42B72EE8628476B5
SHA1:	9A99B5F18D79381175F53880625843BEE58BD426
SHA-256:	2CDEAE18C055F6729F26D6433E2B8FFACFDCF4D7697C42F07318202FF474787F
SHA-512:	F06C218B089974258252697311B0472AB20A81E71FD3F00332311ECAE95F0B9F245A44803769D5C63F2C3A9919FABF92F49CB150AC4884DB48DF8362BDC306FE
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetPropertyResultAsInteger" GUID="{BE408E7B-01F0-4611-9C67-50499C4C417E}">.. <Properties>.. <Property Class="Type" GUID="{03D0B62B-DD3B-4912-985E-6395F527E44F}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{2C36E45D-37AD-407D-9AC7-463A30FABA26}" Name="Name" inheritaction="Ignore"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetPropertyResultAsInteger\is-OJPPR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1350), with CRLF line terminators
Category:	dropped
Size (bytes):	9522
Entropy (8bit):	5.246622936060572
Encrypted:	false
SSDEEP:	192:lldOfdOqdOMdOpdOS06dOLpOdOipLdOmNdOeXje7HONHD:ndOfdOqdOMdOpdOS06dOLpOdOodOmNdR
MD5:	D71F528263AD8CAF42B72EE8628476B5
SHA1:	9A99B5F18D79381175F53880625843BEE58BD426
SHA-256:	2CDEAE18C055F6729F26D6433E2B8FFACFDCF4D7697C42F07318202FF474787F
SHA-512:	F06C218B089974258252697311B0472AB20A81E71FD3F00332311ECAE95F0B9F245A44803769D5C63F2C3A9919FABF92F49CB150AC4884DB48DF8362BDC306FE
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetPropertyResultAsInteger" GUID="{BE408E7B-01F0-4611-9C67-50499C4C417E}">.. <Properties>.. <Property Class="Type" GUID="{03D0B62B-DD3B-4912-985E-6395F527E44F}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{2C36E45D-37AD-407D-9AC7-463A30FABA26}" Name="Name" inheritaction="Ignore"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetPropertyResultAsS\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1092), with CRLF line terminators
Category:	dropped
Size (bytes):	4509
Entropy (8bit):	5.476472768816054
Encrypted:	false
SSDEEP:	48:chRGFwIb1wSih6FdYD5anK87SZ09lJadZKihyBFHL/atfzmvqevFgiEvDMvtVvRJ:eMxDihgWF1vKihojat7HsFle6HOzcD
MD5:	E8DCB558AA57EBAA49713DC0431371C5
SHA1:	F9C5C22F3E0D3ECF4B611428B4EFC36429850066
SHA-256:	BE5F9DA8E06A8BCEA61595C4007A4B2187E434B1E662988AA886EC49DA978EA2
SHA-512:	FCF1D83D2E1783F1CD9D0318E8C95B6B9DB8BAD9F209BB5965BB09B3974A94E896C7980F0560286FBCD21F79D3AACDA31D394875CF344279EDF6035533092442
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetPropertyResultAsString" GUID="{E0AEAAD5-9D4A-4E7D-89B7-FD8C6681297C}">.. <Properties>.. <Property Class="Type" GUID="{94C4A021-4DCB-4666-91FD-608C22CC6773}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{1884C570-E7BB-4818-A53A-9B1E6D6C9E0C}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">GetPropertyResultAsString</Property>.. <Property Class="Number" GUID="{8B708F7F-3CB0-4A16-9EE8-304D18CCA480}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">17</Property>.. <Property Class="Text" GUID="{9DC73694-F834-4E7E-A108-6F17EDC83B6F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{E0AEAAD5-9D4A-4E7D-89B7-FD8C6681297C}</Property>.. <Property Class="Memo" GUID="{3705F1AB-E5A0-4F02-B51A-692C84CD0C1D}" Name="For

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetPropertyResultAsS\is-T5S5F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1092), with CRLF line terminators
Category:	dropped
Size (bytes):	4509
Entropy (8bit):	5.476472768816054
Encrypted:	false
SSDEEP:	48:chRGFwIb1wSih6FdYD5anK87SZ09lJadZKihyBFHL/atfzmvqevFgiEvDMvtVvRJ:eMxDihgWF1vKihojat7HsFle6HOzcD
MD5:	E8DCB558AA57EBAA49713DC0431371C5
SHA1:	F9C5C22F3E0D3ECF4B611428B4EFC36429850066
SHA-256:	BE5F9DA8E06A8BCEA61595C4007A4B2187E434B1E662988AA886EC49DA978EA2
SHA-512:	FCF1D83D2E1783F1CD9D0318E8C95B6B9DB8BAD9F209BB5965BB09B3974A94E896C7980F0560286FBCD21F79D3AACDA31D394875CF344279EDF6035533092442
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetPropertyResultAsString" GUID="{E0AEAAD5-9D4A-4E7D-89B7-FD8C6681297C}">.. <Properties>.. <Property Class="Type" GUID="{94C4A021-4DCB-4666-91FD-608C22CC6773}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{1884C570-E7BB-4818-A53A-9B1E6D6C9E0C}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">GetPropertyResultAsString</Property>.. <Property Class="Number" GUID="{8B708F7F-3CB0-4A16-9EE8-304D18CCA480}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">17</Property>.. <Property Class="Text" GUID="{9DC73694-F834-4E7E-A108-6F17EDC83B6F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{E0AEAAD5-9D4A-4E7D-89B7-FD8C6681297C}</Property>.. <Property Class="Memo" GUID="{3705F1AB-E5A0-4F02-B51A-692C84CD0C1D}" Name="For

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetPropertyResultAsString\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1295), with CRLF line terminators
Category:	dropped
Size (bytes):	9438
Entropy (8bit):	5.248016214101588
Encrypted:	false
SSDEEP:	192:0dOidO+dORdOFdOS0UdORpOdOioAdO5tsdOKsje6HOzcD:0dOidO+dORdOFdOS7dORpOdOSdO5tsdc
MD5:	8DFDE1B7D8776EAF52F09930B43087B0
SHA1:	150223BAB7C5EE72D74FECB65CC84B2184081018
SHA-256:	0111A8C4DD2D0B339648E1ECF9A8B47558B12C4099B107F959BE0A9818A46014
SHA-512:	F9E32A2C31899915BCEC452C8B690CB584C1090725B68DEFE5684DB06354110ADF2D9E71DD1F60568E77844A5F9E5CEFA91497236A14BBD6A8CD00A82FA51A8C
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetPropertyResultAsString" GUID="{E0AEAAD5-9D4A-4E7D-89B7-FD8C6681297C}">.. <Properties>.. <Property Class="Type" GUID="{94C4A021-4DCB-4666-91FD-608C22CC6773}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{1884C570-E7BB-4818-A53A-9B1E6D6C9E0C}" Name="Name" inheritaction="Ignore" c

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetPropertyResultAsString\is-0O0OP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1295), with CRLF line terminators
Category:	dropped
Size (bytes):	9438
Entropy (8bit):	5.248016214101588
Encrypted:	false
SSDEEP:	192:0dOidO+dORdOFdOS0UdORpOdOioAdO5tsdOKsje6HOzcD:0dOidO+dORdOFdOS7dORpOdOSdO5tsdc
MD5:	8DFDE1B7D8776EAF52F09930B43087B0
SHA1:	150223BAB7C5EE72D74FECB65CC84B2184081018
SHA-256:	0111A8C4DD2D0B339648E1ECF9A8B47558B12C4099B107F959BE0A9818A46014
SHA-512:	F9E32A2C31899915BCEC452C8B690CB584C1090725B68DEFE5684DB06354110ADF2D9E71DD1F60568E77844A5F9E5CEFA91497236A14BBD6A8CD00A82FA51A8C
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetPropertyResultAsString" GUID="{E0AEAAD5-9D4A-4E7D-89B7-FD8C6681297C}">.. <Properties>.. <Property Class="Type" GUID="{94C4A021-4DCB-4666-91FD-608C22CC6773}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{1884C570-E7BB-4818-A53A-9B1E6D6C9E0C}" Name="Name" inheritaction="Ignore" c

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetPropertyResult\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (893), with CRLF line terminators
Category:	dropped
Size (bytes):	4055
Entropy (8bit):	5.504320913899034
Encrypted:	false
SSDEEP:	48:ch/TFaIBRpaAYD5anK87SZ09lJaTZCEihvyOkSeAzwN+Am4Cz5vFgiEvDpvtVvR6:e/TbB3aAWF1NJihreiY50VFlehHOD
MD5:	D123138B6AAE4448B767110ECDBC5550
SHA1:	9A2624D15083034ED4837099EC5F23F9A6B9CF91
SHA-256:	9236D9362B9077AEFE7CF2376A3A22AA2DFACA7BE0DB0DECBE80C8729B921119
SHA-512:	1E2E71FF6E467C780F35FBF98937363F9A496F32D2FD8EC813F008BEC4A6561992329FB5AE8B8FD2648638D8A00EC27047A2A5E5314ACD4E289F51F56B57CD27
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetPropertyResult" GUID="{DCE9BA9D-DE9D-4670-89B5-90C0170760CE}">.. <Properties>.. <Property Class="Type" GUID="{7E3DEA85-C927-415B-957A-B78BEB85E5DF}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{B69BC03B-94D3-486C-B34B-F01086FD59AD}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">GetPropertyResult</Property>.. <Property Class="Number" GUID="{BB22669C-5404-4790-A082-9968C0178C78}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">13</Property>.. <Property Class="Text" GUID="{33A7DAB5-02C6-48A7-8889-6311759B8FAF}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{DCE9BA9D-DE9D-4670-89B5-90C0170760CE}</Property>.. <Property Class="Memo" GUID="{716D3819-CDBB-4B09-AF54-9347E5458ED9}" Name="Form Layout" system

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetPropertyResult\is-VRVT7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (893), with CRLF line terminators
Category:	dropped
Size (bytes):	4055
Entropy (8bit):	5.504320913899034
Encrypted:	false
SSDEEP:	48:ch/TFaIBRpaAYD5anK87SZ09lJaTZCEihvyOkSeAzwN+Am4Cz5vFgiEvDpvtVvR6:e/TbB3aAWF1NJihreiY50VFlehHOD
MD5:	D123138B6AAE4448B767110ECDBC5550
SHA1:	9A2624D15083034ED4837099EC5F23F9A6B9CF91
SHA-256:	9236D9362B9077AEFE7CF2376A3A22AA2DFACA7BE0DB0DECBE80C8729B921119
SHA-512:	1E2E71FF6E467C780F35FBF98937363F9A496F32D2FD8EC813F008BEC4A6561992329FB5AE8B8FD2648638D8A00EC27047A2A5E5314ACD4E289F51F56B57CD27
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetPropertyResult" GUID="{DCE9BA9D-DE9D-4670-89B5-90C0170760CE}">.. <Properties>.. <Property Class="Type" GUID="{7E3DEA85-C927-415B-957A-B78BEB85E5DF}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{B69BC03B-94D3-486C-B34B-F01086FD59AD}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">GetPropertyResult</Property>.. <Property Class="Number" GUID="{BB22669C-5404-4790-A082-9968C0178C78}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">13</Property>.. <Property Class="Text" GUID="{33A7DAB5-02C6-48A7-8889-6311759B8FAF}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{DCE9BA9D-DE9D-4670-89B5-90C0170760CE}</Property>.. <Property Class="Memo" GUID="{716D3819-CDBB-4B09-AF54-9347E5458ED9}" Name="Form Layout" system

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetProperty\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (898), with CRLF line terminators
Category:	dropped
Size (bytes):	6177
Entropy (8bit):	5.363586579011888
Encrypted:	false
SSDEEP:	96:ecRwktUYRMWFPAIF2mWo2gMFTUmFleiHOK3BAFAF/ga:lSAVoi27SM5UmjeiHOK3BAFAVga
MD5:	7F5FBD2697D90F099BA0F76D0D73078D
SHA1:	12A7B3D6F92DF95958D87F054873446D7C1D9A45
SHA-256:	445A282E94942418B2109A6EA041356544256C45FCEBDD1388C89AB4804CA3CC
SHA-512:	1E54C14C3DCB6B5D2C66AF8CDCDAB6380EEE105CC12E8B3E5A2B161CD4BC01F6397299B428FFD91C38138D36E0ECB8C72299AF37660317E7B85186F32496CFDB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetProperty" GUID="{65CECA32-1215-419A-985A-B16AD83613B3}">.. <Properties>.. <Property Class="Type" GUID="{A6102E48-352D-448A-B5C2-F128B2AFBB72}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{7D74F48B-1174-4151-90CE-C2D0F16FD2E6}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">GetProperty</Property>.. <Property Class="Number" GUID="{D3BF81FD-6F30-4F99-8046-4D6210610A5C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">11</Property>.. <Property Class="Text" GUID="{22356EC8-3257-4AD4-97E8-42EFCD3869FD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{65CECA32-1215-419A-985A-B16AD83613B3}</Property>.. <Property Class="Memo" GUID="{D192AB19-3F6C-4DEC-8832-156C8DED905D}" Name="Form Layout" systemhidden="True

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetProperty\is-4AD2R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (898), with CRLF line terminators
Category:	dropped
Size (bytes):	6177
Entropy (8bit):	5.363586579011888
Encrypted:	false
SSDEEP:	96:ecRwktUYRMWFPAIF2mWo2gMFTUmFleiHOK3BAFAF/ga:lSAVoi27SM5UmjeiHOK3BAFAVga
MD5:	7F5FBD2697D90F099BA0F76D0D73078D
SHA1:	12A7B3D6F92DF95958D87F054873446D7C1D9A45
SHA-256:	445A282E94942418B2109A6EA041356544256C45FCEBDD1388C89AB4804CA3CC
SHA-512:	1E54C14C3DCB6B5D2C66AF8CDCDAB6380EEE105CC12E8B3E5A2B161CD4BC01F6397299B428FFD91C38138D36E0ECB8C72299AF37660317E7B85186F32496CFDB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetProperty" GUID="{65CECA32-1215-419A-985A-B16AD83613B3}">.. <Properties>.. <Property Class="Type" GUID="{A6102E48-352D-448A-B5C2-F128B2AFBB72}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{7D74F48B-1174-4151-90CE-C2D0F16FD2E6}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">GetProperty</Property>.. <Property Class="Number" GUID="{D3BF81FD-6F30-4F99-8046-4D6210610A5C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">11</Property>.. <Property Class="Text" GUID="{22356EC8-3257-4AD4-97E8-42EFCD3869FD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{65CECA32-1215-419A-985A-B16AD83613B3}</Property>.. <Property Class="Memo" GUID="{D192AB19-3F6C-4DEC-8832-156C8DED905D}" Name="Form Layout" systemhidden="True

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetRect\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1626), with CRLF line terminators
Category:	dropped
Size (bytes):	8128
Entropy (8bit):	5.257062124733754
Encrypted:	false
SSDEEP:	192:vVvkRxGqlRai8rZCRla4djeeL7GZ8eLyEBTaxKe:vVsRnv
MD5:	683BAEBCC9E67B3D4E18D6D991FEDB16
SHA1:	9ADDCB800B678EBE712D044F19EAD3CEEEE6D238
SHA-256:	BFBCB8B3C0F468A1A3173AFDF2588F4288265F82BC025A9182E72BA900A5807C
SHA-512:	1A16605DB97F9751319094F6D3C1B94945E76EE11AE5CD4F878CDCDF536A39C756431ED881FFD236C5236653DC7FAF6C9B34E6323A08C07BDF1C3B10AB5A879D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetRect" GUID="{D436C2B4-6253-432F-B731-D65F006844E0}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">GetRect</Property>.. <Property Class="Type" GUID="{E96375B1-97A3-4FEF-AAB6-57C9CEFC6158}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{6183B4FC-E082-45FB-9253-EF909F73C7C1}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">16.125</Property>.. <Property Class="Memo" GUID="{E0D4494B-83F8-478F-9CDB-79069AC85466}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="Help String"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetRect\is-OARNH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1626), with CRLF line terminators
Category:	dropped
Size (bytes):	8128
Entropy (8bit):	5.257062124733754
Encrypted:	false
SSDEEP:	192:vVvkRxGqlRai8rZCRla4djeeL7GZ8eLyEBTaxKe:vVsRnv
MD5:	683BAEBCC9E67B3D4E18D6D991FEDB16
SHA1:	9ADDCB800B678EBE712D044F19EAD3CEEEE6D238
SHA-256:	BFBCB8B3C0F468A1A3173AFDF2588F4288265F82BC025A9182E72BA900A5807C
SHA-512:	1A16605DB97F9751319094F6D3C1B94945E76EE11AE5CD4F878CDCDF536A39C756431ED881FFD236C5236653DC7FAF6C9B34E6323A08C07BDF1C3B10AB5A879D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetRect" GUID="{D436C2B4-6253-432F-B731-D65F006844E0}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">GetRect</Property>.. <Property Class="Type" GUID="{E96375B1-97A3-4FEF-AAB6-57C9CEFC6158}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{6183B4FC-E082-45FB-9253-EF909F73C7C1}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">16.125</Property>.. <Property Class="Memo" GUID="{E0D4494B-83F8-478F-9CDB-79069AC85466}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="Help String"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetTwoWayLayout\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1757), with CRLF line terminators
Category:	dropped
Size (bytes):	17319
Entropy (8bit):	5.122785439147011
Encrypted:	false
SSDEEP:	192:GnJKVagxKMeh/XB9r8Qtrkimn8D/XWcOfXtmC+QtmAy0SSJeEQFwecX/Ut7yQeQ0:SKVwBB/wzz
MD5:	AD7769513901A060D6E55FC0830BDDC3
SHA1:	D5E76C93D0C150CC3F0A81CD1833C1CA4B1144C1
SHA-256:	C52736C695E8AB7763954DBF17C256A8802829457EC124838148BECB261D913D
SHA-512:	110702CEE354097EF8FD12FD2019F159E5399A6F9B13D19B2A3FA2A32B1CDDA06B4A6F17C7B5BC73277C74FF32045FDD94FF426308BEFA5EA9DFD1D0C033257A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetTwoWayLayout" GUID="{10421EB0-C700-4B92-82E0-92EB42BA9136}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">GetTwoWayLayout</Property>.. <Property Class="Type" GUID="{B25B4BEB-1B84-4FE1-BF0D-544E0071589B}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{2CCE5119-0AC8-4F4E-88F1-2171EE9B13F6}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">16.25</Property>.. <Property Class="Memo" GUID="{A517D444-1A39-45A8-8277-148C4A083944}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="He

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetTwoWayLayout\is-H7U8J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1757), with CRLF line terminators
Category:	dropped
Size (bytes):	17319
Entropy (8bit):	5.122785439147011
Encrypted:	false
SSDEEP:	192:GnJKVagxKMeh/XB9r8Qtrkimn8D/XWcOfXtmC+QtmAy0SSJeEQFwecX/Ut7yQeQ0:SKVwBB/wzz
MD5:	AD7769513901A060D6E55FC0830BDDC3
SHA1:	D5E76C93D0C150CC3F0A81CD1833C1CA4B1144C1
SHA-256:	C52736C695E8AB7763954DBF17C256A8802829457EC124838148BECB261D913D
SHA-512:	110702CEE354097EF8FD12FD2019F159E5399A6F9B13D19B2A3FA2A32B1CDDA06B4A6F17C7B5BC73277C74FF32045FDD94FF426308BEFA5EA9DFD1D0C033257A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetTwoWayLayout" GUID="{10421EB0-C700-4B92-82E0-92EB42BA9136}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">GetTwoWayLayout</Property>.. <Property Class="Type" GUID="{B25B4BEB-1B84-4FE1-BF0D-544E0071589B}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{2CCE5119-0AC8-4F4E-88F1-2171EE9B13F6}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">16.25</Property>.. <Property Class="Memo" GUID="{A517D444-1A39-45A8-8277-148C4A083944}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="He

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetZoom\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (625), with CRLF line terminators
Category:	dropped
Size (bytes):	4216
Entropy (8bit):	5.47547703758977
Encrypted:	false
SSDEEP:	48:cSAVJeYS9NYD51NOrl8TUemt/vFGvz8vWEqvFGvFgiEvD/vWEpvWdxKbTciAN:xqel7WrUeAGi8GFlezBgxK/e
MD5:	597908B346E49FD53548971954CA0AD1
SHA1:	0AE9D49C4FBF26C6978D877A848D2598B8E4739E
SHA-256:	9E5DD8B2B1CAC7B093886A7B3557754D93D136FFF6971EB391B8B857CD0E77D5
SHA-512:	32BD2358B8FF1E7A14C4F56FFA68B8D7860E379F0A78F4F0AAF1F0A09928D8BAFBDDDC02EDF9FC8D7A43DB82803AB8990EF7429B9FB2AE5AA01D06037AA62229
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetZoom" GUID="{23239515-F547-4EA1-8F42-6AA5F8A37482}">.. <Properties>.. <Property Class="Text" GUID="{67DF4330-1738-4F41-8656-438320531D58}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">GetZoom</Property>.. <Property Class="Type" GUID="{2471258E-3D1D-410D-8100-A030A102987F}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{92E78A44-1B6E-4015-8D19-01CEDE995AE0}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">17</Property>.. <Property Class="Memo" GUID="{499279DF-0CF9-4915-8FD5-E80935DBAD62}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/>&lt

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\GetZoom\is-3ITI7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (625), with CRLF line terminators
Category:	dropped
Size (bytes):	4216
Entropy (8bit):	5.47547703758977
Encrypted:	false
SSDEEP:	48:cSAVJeYS9NYD51NOrl8TUemt/vFGvz8vWEqvFGvFgiEvD/vWEpvWdxKbTciAN:xqel7WrUeAGi8GFlezBgxK/e
MD5:	597908B346E49FD53548971954CA0AD1
SHA1:	0AE9D49C4FBF26C6978D877A848D2598B8E4739E
SHA-256:	9E5DD8B2B1CAC7B093886A7B3557754D93D136FFF6971EB391B8B857CD0E77D5
SHA-512:	32BD2358B8FF1E7A14C4F56FFA68B8D7860E379F0A78F4F0AAF1F0A09928D8BAFBDDDC02EDF9FC8D7A43DB82803AB8990EF7429B9FB2AE5AA01D06037AA62229
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GetZoom" GUID="{23239515-F547-4EA1-8F42-6AA5F8A37482}">.. <Properties>.. <Property Class="Text" GUID="{67DF4330-1738-4F41-8656-438320531D58}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">GetZoom</Property>.. <Property Class="Type" GUID="{2471258E-3D1D-410D-8100-A030A102987F}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{92E78A44-1B6E-4015-8D19-01CEDE995AE0}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">17</Property>.. <Property Class="Memo" GUID="{499279DF-0CF9-4915-8FD5-E80935DBAD62}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/>&lt

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\Handle\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (619), with CRLF line terminators
Category:	dropped
Size (bytes):	4120
Entropy (8bit):	5.46877831899891
Encrypted:	false
SSDEEP:	48:cX+4oWJS0YD51NOrl80I96FmsjjtuavFRvzrvWEqvFRvFgiEvDnvFpvWvKQDFbgN:G+W80Wd96Fbw4X38XFlej3oK4bgnJ
MD5:	3B43B968F724983E4C6EA5C23D6238F6
SHA1:	203730F879B3987FF70F8F01E155A3F9A913E006
SHA-256:	1907362AECB4DB24807CCBB817FF1586C6FEF85185043EADD89710390E25DB3C
SHA-512:	9043BF03E7683170427A7D269CC0A6CF871FED010DFB40A2BCDA0A201A3EC6B2C4A30B5A5FB9B82D78C6C3056F6711E001614463DB9F9336356397D6D1B9D6C4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Handle" GUID="{80E5BB16-AE24-428B-8848-A7716651430B}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Handle</Property>.. <Property Class="Type" GUID="{20D202F3-B7B4-4BBE-BA28-55ECDB8CACC3}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{66B1F027-1240-4E4C-AF43-0D6C26D8E510}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">17.5</Property>.. <Property Class="Memo" GUID="{61177B76-E144-4B29-9DC9-0D88F9816442}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="Help String" Ord

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\Handle\is-N5V7J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (619), with CRLF line terminators
Category:	dropped
Size (bytes):	4120
Entropy (8bit):	5.46877831899891
Encrypted:	false
SSDEEP:	48:cX+4oWJS0YD51NOrl80I96FmsjjtuavFRvzrvWEqvFRvFgiEvDnvFpvWvKQDFbgN:G+W80Wd96Fbw4X38XFlej3oK4bgnJ
MD5:	3B43B968F724983E4C6EA5C23D6238F6
SHA1:	203730F879B3987FF70F8F01E155A3F9A913E006
SHA-256:	1907362AECB4DB24807CCBB817FF1586C6FEF85185043EADD89710390E25DB3C
SHA-512:	9043BF03E7683170427A7D269CC0A6CF871FED010DFB40A2BCDA0A201A3EC6B2C4A30B5A5FB9B82D78C6C3056F6711E001614463DB9F9336356397D6D1B9D6C4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Handle" GUID="{80E5BB16-AE24-428B-8848-A7716651430B}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Handle</Property>.. <Property Class="Type" GUID="{20D202F3-B7B4-4BBE-BA28-55ECDB8CACC3}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{66B1F027-1240-4E4C-AF43-0D6C26D8E510}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">17.5</Property>.. <Property Class="Memo" GUID="{61177B76-E144-4B29-9DC9-0D88F9816442}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="Help String" Ord

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\CanRecord\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1099), with CRLF line terminators
Category:	dropped
Size (bytes):	8360
Entropy (8bit):	5.218081950775997
Encrypted:	false
SSDEEP:	192:4dOgdO+dO/SdO7dOS/dOxpDUaWgdOidOB3dOZ:4dOgdO+dO/SdO7dOS/dOxVWgdOidOB3q
MD5:	18E7D0FEDB438739221303F2639B8B09
SHA1:	A8D9F13D539826052B121416B7E9CD05BEF349DD
SHA-256:	4065AE8BF6B8933096A7F155A7BB6508CC8B03EB9B3D7E076F677D0479639EE6
SHA-512:	B449A90592F44A597E041D0CC47A339BA27EE6890830757F975AC8FF8C4E38BA11C39264CFFEF9E185F5769DF75EFAAA44DD9EC4BD05B3A49B5781ADA6331620
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="CanRecord" GUID="{356CA906-90E2-4F5A-9D7E-5B6998759AD1}">.. <Properties>.. <Property Class="Type" GUID="{84B76FE0-BCAE-4DC5-A50C-6E760229C64F}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{9660A674-B518-40D5-ACF1-7EE960D2F50B}" Name="Name" inheritaction="Ignore" calculatebefore="

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\CanRecord\is-J2D96.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1099), with CRLF line terminators
Category:	dropped
Size (bytes):	8360
Entropy (8bit):	5.218081950775997
Encrypted:	false
SSDEEP:	192:4dOgdO+dO/SdO7dOS/dOxpDUaWgdOidOB3dOZ:4dOgdO+dO/SdO7dOS/dOxVWgdOidOB3q
MD5:	18E7D0FEDB438739221303F2639B8B09
SHA1:	A8D9F13D539826052B121416B7E9CD05BEF349DD
SHA-256:	4065AE8BF6B8933096A7F155A7BB6508CC8B03EB9B3D7E076F677D0479639EE6
SHA-512:	B449A90592F44A597E041D0CC47A339BA27EE6890830757F975AC8FF8C4E38BA11C39264CFFEF9E185F5769DF75EFAAA44DD9EC4BD05B3A49B5781ADA6331620
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="CanRecord" GUID="{356CA906-90E2-4F5A-9D7E-5B6998759AD1}">.. <Properties>.. <Property Class="Type" GUID="{84B76FE0-BCAE-4DC5-A50C-6E760229C64F}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{9660A674-B518-40D5-ACF1-7EE960D2F50B}" Name="Name" inheritaction="Ignore" calculatebefore="

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\ChildCount\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1105), with CRLF line terminators
Category:	dropped
Size (bytes):	8374
Entropy (8bit):	5.211731631923898
Encrypted:	false
SSDEEP:	192:3dODydOcdOw5dOsdOS2dOQDyfWgdOSdO3dOR:3dO2dOcdOsdOsdOS2dOXWgdOSdO3dOR
MD5:	0A2FB3DD6A8F509B370F35F29998E167
SHA1:	3BB8FDBA0667E1A2C4A5A183454A0A71243D46F1
SHA-256:	94D999D3B2B663FB7B188D8C00C88A93F2BEB2702FFB451DC6D197DC7D45060F
SHA-512:	B2A0BD2DF1533AC8F1D7F9AE38DCC4C1D60C7844BF0BDDBFCCD4688A442E835A5136345978F32CE3EC1EECEFAA7D3BF683ADCB2D3E04D416B82DBCB2A401E12C
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="ChildCount" GUID="{E7C7F5FE-4CD0-47DC-B02D-F45B40845743}">.. <Properties>.. <Property Class="Type" GUID="{D40BAA20-CA30-422A-B72C-9AAF057E36E6}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{3F5F9D41-571D-4205-BE58-5BB2557F5E5A}" Name="Name" inheritaction="Ignore" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\ChildCount\is-HJU84.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1105), with CRLF line terminators
Category:	dropped
Size (bytes):	8374
Entropy (8bit):	5.211731631923898
Encrypted:	false
SSDEEP:	192:3dODydOcdOw5dOsdOS2dOQDyfWgdOSdO3dOR:3dO2dOcdOsdOsdOS2dOXWgdOSdO3dOR
MD5:	0A2FB3DD6A8F509B370F35F29998E167
SHA1:	3BB8FDBA0667E1A2C4A5A183454A0A71243D46F1
SHA-256:	94D999D3B2B663FB7B188D8C00C88A93F2BEB2702FFB451DC6D197DC7D45060F
SHA-512:	B2A0BD2DF1533AC8F1D7F9AE38DCC4C1D60C7844BF0BDDBFCCD4688A442E835A5136345978F32CE3EC1EECEFAA7D3BF683ADCB2D3E04D416B82DBCB2A401E12C
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="ChildCount" GUID="{E7C7F5FE-4CD0-47DC-B02D-F45B40845743}">.. <Properties>.. <Property Class="Type" GUID="{D40BAA20-CA30-422A-B72C-9AAF057E36E6}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{3F5F9D41-571D-4205-BE58-5BB2557F5E5A}" Name="Name" inheritaction="Ignore" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\ChildItem\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1120), with CRLF line terminators
Category:	dropped
Size (bytes):	10121
Entropy (8bit):	5.268726658725071
Encrypted:	false
SSDEEP:	192:/wFdOqgdOMTdOEdOuJdOSLqdODKsR5ey7GeADiZG3yWgdOkdOMKP4dOg:mdOqgdOMTdOEdOcdOSLqdODKcWgdOkd1
MD5:	1B7FA9B59D5A65FBFD8221A3723156E0
SHA1:	F9AE0CF29D0AFD9EE255A149CB4EDAF226DFC349
SHA-256:	32070003693A7DF53997052ECA461B2B46308A7551B74EE18EC9A9F7FE3733F9
SHA-512:	D5C6E4998F9051D0990D9C282886616FE04F556DEC2D54C815B59DD993714F0EC58D470731F080E83F093EB4C28458A4804BFC96EE09BAA789AB87F891809A6E
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="ChildItem" GUID="{84CB244D-3D11-48F6-8E5C-ABFA79E1F753}">.. <Properties>.. <Property Class="Type" GUID="{CE456391-33FD-4DB3-8AA4-03AD73ADBEC8}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{7302E8A5-FD5D-4BCC-8447-A48137335A02}" Name="Name" inheritaction="Ignore" calculatebefore="

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\ChildItem\is-EDEK4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1120), with CRLF line terminators
Category:	dropped
Size (bytes):	10121
Entropy (8bit):	5.268726658725071
Encrypted:	false
SSDEEP:	192:/wFdOqgdOMTdOEdOuJdOSLqdODKsR5ey7GeADiZG3yWgdOkdOMKP4dOg:mdOqgdOMTdOEdOcdOSLqdODKcWgdOkd1
MD5:	1B7FA9B59D5A65FBFD8221A3723156E0
SHA1:	F9AE0CF29D0AFD9EE255A149CB4EDAF226DFC349
SHA-256:	32070003693A7DF53997052ECA461B2B46308A7551B74EE18EC9A9F7FE3733F9
SHA-512:	D5C6E4998F9051D0990D9C282886616FE04F556DEC2D54C815B59DD993714F0EC58D470731F080E83F093EB4C28458A4804BFC96EE09BAA789AB87F891809A6E
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="ChildItem" GUID="{84CB244D-3D11-48F6-8E5C-ABFA79E1F753}">.. <Properties>.. <Property Class="Type" GUID="{CE456391-33FD-4DB3-8AA4-03AD73ADBEC8}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{7302E8A5-FD5D-4BCC-8447-A48137335A02}" Name="Name" inheritaction="Ignore" calculatebefore="

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (707), with CRLF line terminators
Category:	dropped
Size (bytes):	3858
Entropy (8bit):	5.48491315960604
Encrypted:	false
SSDEEP:	48:cic3cg1Do8oXGVHTScQYD5anKreBuPZ0ClSwfIm+nKQDpaNtVtIvFgRIvDGvW7Kt:K3cn7XGFhQWPZInpGMFlgsK4pGErXI
MD5:	3C7E524B04B0DB2B4498BFB555AAA9E4
SHA1:	1A87849CDD80985235BD2436CCD243F5B36DC4D5
SHA-256:	369F249B01687EE9D46085114EB7EE2DDB2BD007109F79EE7779FBCDAD154F24
SHA-512:	43B18438F80EC0E275DB845C8C38DF453B8D6FD3AF63697129BACF0E977064881785E34F50038B17A026DD8D806218F87F66D67D5BD485B720C7AE865FD244FD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="IItem" GUID="{12C0D7F8-181E-4195-AC81-561A3EA365A0}">.. <Properties>.. <Property Class="Type" GUID="{25F086E6-BDEA-4836-8A83-68093DBFAFB4}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Object</Property>.. <Property Class="Text" GUID="{9D6DF743-9D49-43DF-BB36-72EF61708846}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">IItem</Property>.. <Property Class="Number" GUID="{4C2F0026-7255-42F3-9DF7-7F177A289CAC}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">18</Property>.. <Property Class="Text" GUID="{43CD5482-073F-46A9-83F6-BCA513A9EE1D}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{12C0D7F8-181E-4195-AC81-561A3EA365A0}</Property>.. <Property Class="Memo" GUID="{D0FC529F-5630-4483-B4C0-14AB6DDE7951}" Name="Form Layout" systemhidden="True" OrderIndex="

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\DeleteItem\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1077), with CRLF line terminators
Category:	dropped
Size (bytes):	5389
Entropy (8bit):	5.38892786564774
Encrypted:	false
SSDEEP:	96:Lcm8pDMRiRQW6Nop4IvOGXUKUwn8r4eXxY/Fe93BqNKkOKIKhOGXT:LcdN4IvOcUKUwn8r4eXxY/Fe93BqskOq
MD5:	3B36B9DABAC18CCE5B8603F6BCC5C547
SHA1:	F8B98CB175264F654261CA4A9F4CCFEDCA827C79
SHA-256:	D9E00F4B78CF230A3707D17020DA9EB3C08B0E0BEB462F34F81CF611913159A7
SHA-512:	C33C08E35D740D31F5B1157CB3F6C4E07BF0D7649A18AC3E53287F7CDCFAF2272385296C98092871AE93AFD83A5BB0BC1F3D18A6A8B592EA4B265DD3E6ABF6F6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="DeleteItem" GUID="{89AF5B0A-C214-4B18-B5A8-FEB425933FB9}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">DeleteItem</Property>.. <Property Class="Type" GUID="{24537CF9-B4E9-469C-ABB9-19DEF2293A79}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{4CFA7C32-3E1E-47D3-B1E7-003D08B6F3FE}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3.5</Property>.. <Property Class="Memo" GUID="{6FA7FA56-C616-425F-86D6-4F692EB9EF7F}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="Help String&qu

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\DeleteItem\is-254GB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1077), with CRLF line terminators
Category:	dropped
Size (bytes):	5389
Entropy (8bit):	5.38892786564774
Encrypted:	false
SSDEEP:	96:Lcm8pDMRiRQW6Nop4IvOGXUKUwn8r4eXxY/Fe93BqNKkOKIKhOGXT:LcdN4IvOcUKUwn8r4eXxY/Fe93BqskOq
MD5:	3B36B9DABAC18CCE5B8603F6BCC5C547
SHA1:	F8B98CB175264F654261CA4A9F4CCFEDCA827C79
SHA-256:	D9E00F4B78CF230A3707D17020DA9EB3C08B0E0BEB462F34F81CF611913159A7
SHA-512:	C33C08E35D740D31F5B1157CB3F6C4E07BF0D7649A18AC3E53287F7CDCFAF2272385296C98092871AE93AFD83A5BB0BC1F3D18A6A8B592EA4B265DD3E6ABF6F6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="DeleteItem" GUID="{89AF5B0A-C214-4B18-B5A8-FEB425933FB9}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">DeleteItem</Property>.. <Property Class="Type" GUID="{24537CF9-B4E9-469C-ABB9-19DEF2293A79}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{4CFA7C32-3E1E-47D3-B1E7-003D08B6F3FE}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3.5</Property>.. <Property Class="Memo" GUID="{6FA7FA56-C616-425F-86D6-4F692EB9EF7F}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="Help String&qu

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\DeleteProperty\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1123), with CRLF line terminators
Category:	dropped
Size (bytes):	8536
Entropy (8bit):	5.218749883786086
Encrypted:	false
SSDEEP:	192:65dOIdOldO1rdOKdOZEdO1XXMPWgdO+qdOKgdOO:4dOIdOldO1dOKdOZEdO1AWgdOFdOKgdL
MD5:	785103D6A998F55EE74AC2479D001F88
SHA1:	52C218FE8BD2955E46A914E3A987D4B68CA47C78
SHA-256:	3B3E114A617572B721CF4AD5C7AAAD2447BA5A10B59C7406263B6C82DD7E5E89
SHA-512:	216C3D138C8E6F5E839AD54010150A5968473476E51762E508C8FF8420647D4FBA66C6CD2A68B893275AEDC3D67586FCCD567BFCAE66E0C5F642152D6330D8AD
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="DeleteProperty" GUID="{F4D0A78A-C28F-4DE5-AADC-58B85B4DBE89}">.. <Properties>.. <Property Class="Type" GUID="{75EFFCC9-D4FE-4752-AE66-5A230E36498C}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Procedure</Property>.. <Property Class="Text" GUID="{69EEA7E8-D12A-4E9A-9F76-8E78EA3B6A68}" Name="Name" inheritaction="Ignore" calculatebe

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\DeleteProperty\is-PVAEU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1123), with CRLF line terminators
Category:	dropped
Size (bytes):	8536
Entropy (8bit):	5.218749883786086
Encrypted:	false
SSDEEP:	192:65dOIdOldO1rdOKdOZEdO1XXMPWgdO+qdOKgdOO:4dOIdOldO1dOKdOZEdO1AWgdOFdOKgdL
MD5:	785103D6A998F55EE74AC2479D001F88
SHA1:	52C218FE8BD2955E46A914E3A987D4B68CA47C78
SHA-256:	3B3E114A617572B721CF4AD5C7AAAD2447BA5A10B59C7406263B6C82DD7E5E89
SHA-512:	216C3D138C8E6F5E839AD54010150A5968473476E51762E508C8FF8420647D4FBA66C6CD2A68B893275AEDC3D67586FCCD567BFCAE66E0C5F642152D6330D8AD
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="DeleteProperty" GUID="{F4D0A78A-C28F-4DE5-AADC-58B85B4DBE89}">.. <Properties>.. <Property Class="Type" GUID="{75EFFCC9-D4FE-4752-AE66-5A230E36498C}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Procedure</Property>.. <Property Class="Text" GUID="{69EEA7E8-D12A-4E9A-9F76-8E78EA3B6A68}" Name="Name" inheritaction="Ignore" calculatebe

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\Delete\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1087), with CRLF line terminators
Category:	dropped
Size (bytes):	9162
Entropy (8bit):	5.246659079910309
Encrypted:	false
SSDEEP:	192:CtdOBdOjdOzdOnydOZ4jdOit0HeuQGAWgdO2dOgQdOZ:MdOBdOjdOzdOydOZydOOWgdO2dOpdOZ
MD5:	18A7BC6FC8C1965842A614770FC0C29B
SHA1:	85A1D23267CAB11CEAA1253F6173AD3A7038DB20
SHA-256:	DDA3E18EC855214DA21FE12AFFA936E09B0F33E9EFA57A8A3E9A9A79E652741D
SHA-512:	625FDB004A690829D5C4A0E0AEF0FB3CE449917F00A1867B150AB9BAB47E9C9365C6944EC0C89BDF0DB44F8EAFB04ECD45463E318BE4B472294A6BD3A6A512E6
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Delete" GUID="{7AE3AB21-502C-49FA-81E3-8DBBDD0D157F}">.. <Properties>.. <Property Class="Type" GUID="{3D769F00-6142-4363-B255-F5897C9DBB72}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Procedure</Property>.. <Property Class="Text" GUID="{CD2B7BA2-6EA5-4259-992D-C572E591797B}" Name="Name" inheritaction="Ignore" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\Delete\is-JFI69.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1087), with CRLF line terminators
Category:	dropped
Size (bytes):	9162
Entropy (8bit):	5.246659079910309
Encrypted:	false
SSDEEP:	192:CtdOBdOjdOzdOnydOZ4jdOit0HeuQGAWgdO2dOgQdOZ:MdOBdOjdOzdOydOZydOOWgdO2dOpdOZ
MD5:	18A7BC6FC8C1965842A614770FC0C29B
SHA1:	85A1D23267CAB11CEAA1253F6173AD3A7038DB20
SHA-256:	DDA3E18EC855214DA21FE12AFFA936E09B0F33E9EFA57A8A3E9A9A79E652741D
SHA-512:	625FDB004A690829D5C4A0E0AEF0FB3CE449917F00A1867B150AB9BAB47E9C9365C6944EC0C89BDF0DB44F8EAFB04ECD45463E318BE4B472294A6BD3A6A512E6
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Delete" GUID="{7AE3AB21-502C-49FA-81E3-8DBBDD0D157F}">.. <Properties>.. <Property Class="Type" GUID="{3D769F00-6142-4363-B255-F5897C9DBB72}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Procedure</Property>.. <Property Class="Text" GUID="{CD2B7BA2-6EA5-4259-992D-C572E591797B}" Name="Name" inheritaction="Ignore" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\DoRecord\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1140), with CRLF line terminators
Category:	dropped
Size (bytes):	9666
Entropy (8bit):	5.257182898940453
Encrypted:	false
SSDEEP:	192:vQdO3dOodOndOSdOS7FKydOYeU+ADdAtPyeWgdO+dOXdOe:IdO3dOodOndOSdOS9dO1vWgdO+dOXdOe
MD5:	CC920A14EEC8C556FB042AA1EF3FDEE7
SHA1:	E5736681215FBBCE0FB928A02FFE08ACA49447F7
SHA-256:	1A0F4E5BE4B71E02F080FAAA99B2FBAB21C26C56E140A796E949A677BE1A6271
SHA-512:	55DB46F3E7FF6D3D93048EC8C930A71C6FA5B858DB898ADC8906ABD0339E764B402EFE764CC6C3B06BCA51A9B18026755124FF353130D6CAF972899FAEAEFF3E
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="DoRecord" GUID="{071E5CFD-E7BB-4C63-BDDC-0F0030E6954A}">.. <Properties>.. <Property Class="Type" GUID="{AE18A2C5-0FE3-4EE9-85AF-2BF9AD387272}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{2774B63B-90C7-4311-95B1-D721DED5B472}" Name="Name" inheritaction="Ignore" calculatebefore="0

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\DoRecord\is-JU453.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1140), with CRLF line terminators
Category:	dropped
Size (bytes):	9666
Entropy (8bit):	5.257182898940453
Encrypted:	false
SSDEEP:	192:vQdO3dOodOndOSdOS7FKydOYeU+ADdAtPyeWgdO+dOXdOe:IdO3dOodOndOSdOS9dO1vWgdO+dOXdOe
MD5:	CC920A14EEC8C556FB042AA1EF3FDEE7
SHA1:	E5736681215FBBCE0FB928A02FFE08ACA49447F7
SHA-256:	1A0F4E5BE4B71E02F080FAAA99B2FBAB21C26C56E140A796E949A677BE1A6271
SHA-512:	55DB46F3E7FF6D3D93048EC8C930A71C6FA5B858DB898ADC8906ABD0339E764B402EFE764CC6C3B06BCA51A9B18026755124FF353130D6CAF972899FAEAEFF3E
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="DoRecord" GUID="{071E5CFD-E7BB-4C63-BDDC-0F0030E6954A}">.. <Properties>.. <Property Class="Type" GUID="{AE18A2C5-0FE3-4EE9-85AF-2BF9AD387272}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{2774B63B-90C7-4311-95B1-D721DED5B472}" Name="Name" inheritaction="Ignore" calculatebefore="0

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\Edit\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1109), with CRLF line terminators
Category:	dropped
Size (bytes):	8552
Entropy (8bit):	5.234772574887382
Encrypted:	false
SSDEEP:	192:zzdOXdO7zdOjdOjdOSIdOFDpuxWgdO1edOXxdOt:fdOXdO7zdOjdOjdOSIdOMWgdOEdOXxdW
MD5:	38ED7C0AD377405855EF50A710B6C53C
SHA1:	FEFB4C7B790E91075B2CF044EFAED953ABB52E2F
SHA-256:	246CFEE786115B21745730377BB11342FA4BE51A26282CC4240D37922E30C834
SHA-512:	C28D0C93468021D703DDFD6A600486B68C69DD9B6868D1D173D9A951202844189A3F020A6B48BBF757E5BE27BC6C177757BBEC28BB6B68B40C372875BB281AA9
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Edit" GUID="{4725FCE5-E6AD-47B0-9BE9-5B7E519F6E65}">.. <Properties>.. <Property Class="Type" GUID="{0D108C79-FF88-4E19-B2F7-D552019A87DC}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{B2591CB2-C399-4E2E-8214-26D3AC522079}" Name="Name" inheritaction="Ignore" calculatebefore="0" in

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\Edit\is-H8O66.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1109), with CRLF line terminators
Category:	dropped
Size (bytes):	8552
Entropy (8bit):	5.234772574887382
Encrypted:	false
SSDEEP:	192:zzdOXdO7zdOjdOjdOSIdOFDpuxWgdO1edOXxdOt:fdOXdO7zdOjdOjdOSIdOMWgdOEdOXxdW
MD5:	38ED7C0AD377405855EF50A710B6C53C
SHA1:	FEFB4C7B790E91075B2CF044EFAED953ABB52E2F
SHA-256:	246CFEE786115B21745730377BB11342FA4BE51A26282CC4240D37922E30C834
SHA-512:	C28D0C93468021D703DDFD6A600486B68C69DD9B6868D1D173D9A951202844189A3F020A6B48BBF757E5BE27BC6C177757BBEC28BB6B68B40C372875BB281AA9
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Edit" GUID="{4725FCE5-E6AD-47B0-9BE9-5B7E519F6E65}">.. <Properties>.. <Property Class="Type" GUID="{0D108C79-FF88-4E19-B2F7-D552019A87DC}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{B2591CB2-C399-4E2E-8214-26D3AC522079}" Name="Name" inheritaction="Ignore" calculatebefore="0" in

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\FullPath\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1085), with CRLF line terminators
Category:	dropped
Size (bytes):	8330
Entropy (8bit):	5.2161678320097735
Encrypted:	false
SSDEEP:	192:YdOtdOJEdOsndOQdOSbzdOO3Db4WgdO8dORdOj:YdOtdOJEdOsndOQdOS3dORWgdO8dORdS
MD5:	E566CE3E5831DAFDB563AD38F7E2EAE8
SHA1:	BC5CABC1EF8D0B44B835517B1AA4B41B40E97A14
SHA-256:	D4C2E56EBCE7CC0A878F67C0F5176EA760A8ED4E803A45044720D5354976DD84
SHA-512:	3BC25EF22D21E49503775C13EA69FACC5C62AE26DF848068916DA07E8838323809EECC8BE85925F09C316CF5DB82206B9416533E472681B99E3459A340CA38EC
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="FullPath" GUID="{23A5F948-726B-47BC-A782-1319EC10EB6E}">.. <Properties>.. <Property Class="Type" GUID="{CDBD1D2B-7460-4C39-A95E-EF0F64B693EE}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{ADE38BF2-82FD-4940-8A9A-9C339FB9780E}" Name="Name" inheritaction="Ignore" calculatebefore="0

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\FullPath\is-NB66R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1085), with CRLF line terminators
Category:	dropped
Size (bytes):	8330
Entropy (8bit):	5.2161678320097735
Encrypted:	false
SSDEEP:	192:YdOtdOJEdOsndOQdOSbzdOO3Db4WgdO8dORdOj:YdOtdOJEdOsndOQdOS3dORWgdO8dORdS
MD5:	E566CE3E5831DAFDB563AD38F7E2EAE8
SHA1:	BC5CABC1EF8D0B44B835517B1AA4B41B40E97A14
SHA-256:	D4C2E56EBCE7CC0A878F67C0F5176EA760A8ED4E803A45044720D5354976DD84
SHA-512:	3BC25EF22D21E49503775C13EA69FACC5C62AE26DF848068916DA07E8838323809EECC8BE85925F09C316CF5DB82206B9416533E472681B99E3459A340CA38EC
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="FullPath" GUID="{23A5F948-726B-47BC-A782-1319EC10EB6E}">.. <Properties>.. <Property Class="Type" GUID="{CDBD1D2B-7460-4C39-A95E-EF0F64B693EE}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{ADE38BF2-82FD-4940-8A9A-9C339FB9780E}" Name="Name" inheritaction="Ignore" calculatebefore="0

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\GUID\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1069), with CRLF line terminators
Category:	dropped
Size (bytes):	8291
Entropy (8bit):	5.2336607550285486
Encrypted:	false
SSDEEP:	192:EGdOIdOYdOldOgdOS2BdOCDCFWgdObydOXdOy:tdOIdOYdOldOgdOS4dOPWgdObydOXdOy
MD5:	B1D09CA3F5B2F11CAAA08F56DEEECF59
SHA1:	CA81F7163057C6A33DB4D6AF3C168D2F0D8E4116
SHA-256:	BF546714F352F67817E4B26E09A8172E8923F3E564E6C18F843B06F6105E422D
SHA-512:	90F419323FB9B5DAF0BDB50247D16DCD6F93B87E1DAC7EFFC40E55614983CF23B1ADF5B9CA8D5D400D9D2C1226B9E286DF894ED3AC22409481156E25286C06A8
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GUID" GUID="{FAA2288D-5BE1-4D8F-B8CB-82FB1B1B12EA}">.. <Properties>.. <Property Class="Type" GUID="{F379DFBD-B53E-4BB7-B1E7-D73A1F02960C}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{6618DDB7-CEBF-46A6-8F91-8365769611DA}" Name="Name" inheritaction="Ignore" calculatebefore="0" in

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\GUID\is-6K1OV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1069), with CRLF line terminators
Category:	dropped
Size (bytes):	8291
Entropy (8bit):	5.2336607550285486
Encrypted:	false
SSDEEP:	192:EGdOIdOYdOldOgdOS2BdOCDCFWgdObydOXdOy:tdOIdOYdOldOgdOS4dOPWgdObydOXdOy
MD5:	B1D09CA3F5B2F11CAAA08F56DEEECF59
SHA1:	CA81F7163057C6A33DB4D6AF3C168D2F0D8E4116
SHA-256:	BF546714F352F67817E4B26E09A8172E8923F3E564E6C18F843B06F6105E422D
SHA-512:	90F419323FB9B5DAF0BDB50247D16DCD6F93B87E1DAC7EFFC40E55614983CF23B1ADF5B9CA8D5D400D9D2C1226B9E286DF894ED3AC22409481156E25286C06A8
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GUID" GUID="{FAA2288D-5BE1-4D8F-B8CB-82FB1B1B12EA}">.. <Properties>.. <Property Class="Type" GUID="{F379DFBD-B53E-4BB7-B1E7-D73A1F02960C}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{6618DDB7-CEBF-46A6-8F91-8365769611DA}" Name="Name" inheritaction="Ignore" calculatebefore="0" in

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\GetItemByGUID\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1141), with CRLF line terminators
Category:	dropped
Size (bytes):	10816
Entropy (8bit):	5.298145274856063
Encrypted:	false
SSDEEP:	192:jdOtdOGdO4AtdOWdOSOdO9D8W0CqB3FAkcAAgbWgdOo1dOvdOT:jdOtdOGdOVtdOWdOSOdOeWgdOGdOvdOT
MD5:	056837D1FD2CE059171CAFA1E405F7C6
SHA1:	F5B900E277721A68FD3F6EB65FEC0DCEB8EDDC89
SHA-256:	B104B48E73DD13DD24964FF64577464359CCCD170E662A34B795C14C66BAFA7B
SHA-512:	CA027CF22AB55998773BCDFD55091967CEE6DEB3A763475A8B5F8AC2EFF2657ED6780D879663620FBE79421529B03DC44634D80E010A89E55DF7B9DBB7A7415A
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetItemByGUID" GUID="{890C4F27-EA33-4228-A909-E35A686E0DEE}">.. <Properties>.. <Property Class="Type" GUID="{B7BBF410-E6CA-4E72-ACBC-3934CED6992E}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{6980795E-737B-409D-8715-BB1834631DBE}" Name="Name" inheritaction="Ignore" calculatebefo

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\GetItemByGUID\is-J48L9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1141), with CRLF line terminators
Category:	dropped
Size (bytes):	10816
Entropy (8bit):	5.298145274856063
Encrypted:	false
SSDEEP:	192:jdOtdOGdO4AtdOWdOSOdO9D8W0CqB3FAkcAAgbWgdOo1dOvdOT:jdOtdOGdOVtdOWdOSOdOeWgdOGdOvdOT
MD5:	056837D1FD2CE059171CAFA1E405F7C6
SHA1:	F5B900E277721A68FD3F6EB65FEC0DCEB8EDDC89
SHA-256:	B104B48E73DD13DD24964FF64577464359CCCD170E662A34B795C14C66BAFA7B
SHA-512:	CA027CF22AB55998773BCDFD55091967CEE6DEB3A763475A8B5F8AC2EFF2657ED6780D879663620FBE79421529B03DC44634D80E010A89E55DF7B9DBB7A7415A
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetItemByGUID" GUID="{890C4F27-EA33-4228-A909-E35A686E0DEE}">.. <Properties>.. <Property Class="Type" GUID="{B7BBF410-E6CA-4E72-ACBC-3934CED6992E}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{6980795E-737B-409D-8715-BB1834631DBE}" Name="Name" inheritaction="Ignore" calculatebefo

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\GetItem\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1106), with CRLF line terminators
Category:	dropped
Size (bytes):	10398
Entropy (8bit):	5.277371102102073
Encrypted:	false
SSDEEP:	192:idOkdOWydOZYdOmdOSvdO79Dw6qB3FAkcAAggLWgdO41dOtXdOr:idOkdOWydOedOmdOSvdO7hWgdOadOtXk
MD5:	675B9BB0BC8FDCF11561BB20681CFCEB
SHA1:	D91531A5D44C1E73D086E514029699FF68B1F208
SHA-256:	9897B4501A50BFD8840F130153061642B3D5778A9367E8C7321DC21B2E660B11
SHA-512:	E0F884FD3BFFCCEC36681F4E8638AFBE7A43317E217E9BEC16D256CA1BCC6AD50653FA8801865235114529BE60329BF12312A7E791B85F6819E1729D11396F73
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetItem" GUID="{ACD0C2A1-91C2-449C-BE47-A5B9490C92DF}">.. <Properties>.. <Property Class="Type" GUID="{3001A8FC-6901-4F34-88A5-BAADCFF656D7}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{F12C278C-A8CC-4B88-88E5-37E0A895175D}" Name="Name" inheritaction="Ignore" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\GetItem\is-FT5IC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1106), with CRLF line terminators
Category:	dropped
Size (bytes):	10398
Entropy (8bit):	5.277371102102073
Encrypted:	false
SSDEEP:	192:idOkdOWydOZYdOmdOSvdO79Dw6qB3FAkcAAggLWgdO41dOtXdOr:idOkdOWydOedOmdOSvdO7hWgdOadOtXk
MD5:	675B9BB0BC8FDCF11561BB20681CFCEB
SHA1:	D91531A5D44C1E73D086E514029699FF68B1F208
SHA-256:	9897B4501A50BFD8840F130153061642B3D5778A9367E8C7321DC21B2E660B11
SHA-512:	E0F884FD3BFFCCEC36681F4E8638AFBE7A43317E217E9BEC16D256CA1BCC6AD50653FA8801865235114529BE60329BF12312A7E791B85F6819E1729D11396F73
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetItem" GUID="{ACD0C2A1-91C2-449C-BE47-A5B9490C92DF}">.. <Properties>.. <Property Class="Type" GUID="{3001A8FC-6901-4F34-88A5-BAADCFF656D7}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{F12C278C-A8CC-4B88-88E5-37E0A895175D}" Name="Name" inheritaction="Ignore" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\GetPoint\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1127), with CRLF line terminators
Category:	dropped
Size (bytes):	9540
Entropy (8bit):	5.265229533207003
Encrypted:	false
SSDEEP:	192:dA5dOidOedOQdOxdOSRdOOpKHea7G+BD/ZG2WgdOydOAKCdOMg:dwdOidOedOQdOxdOSRdO0KnWgdOydOAu
MD5:	5689D63F1BE763FEE9FAF2FE23195913
SHA1:	331BEF0B7584C5E8B19EBD8DE52172FCA6E18D50
SHA-256:	576FE75C670BDFDE709A1D76A2D24BAB02B5D3B73EB6FAC7F5416CB6446FAAA2
SHA-512:	4C348F0EB1EDF1A3035B12D64531803DF4B146443F714AAEB2929BC0815BDFA543476A5753F41FD510E53F44AFEE6CE2D7258D06E354002EC250520B98A7C750
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetPoint" GUID="{C09C7B2C-F09A-442E-8CAC-64BE8FDD6B75}">.. <Properties>.. <Property Class="Type" GUID="{35F2C3CB-781E-4339-A08B-1C7E54D1CF7C}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{999D528D-11D2-438C-A7DB-79B865F803C5}" Name="Name" inheritaction="Ignore" calculatebefore="0

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\GetPoint\is-GQVI3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1127), with CRLF line terminators
Category:	dropped
Size (bytes):	9540
Entropy (8bit):	5.265229533207003
Encrypted:	false
SSDEEP:	192:dA5dOidOedOQdOxdOSRdOOpKHea7G+BD/ZG2WgdOydOAKCdOMg:dwdOidOedOQdOxdOSRdO0KnWgdOydOAu
MD5:	5689D63F1BE763FEE9FAF2FE23195913
SHA1:	331BEF0B7584C5E8B19EBD8DE52172FCA6E18D50
SHA-256:	576FE75C670BDFDE709A1D76A2D24BAB02B5D3B73EB6FAC7F5416CB6446FAAA2
SHA-512:	4C348F0EB1EDF1A3035B12D64531803DF4B146443F714AAEB2929BC0815BDFA543476A5753F41FD510E53F44AFEE6CE2D7258D06E354002EC250520B98A7C750
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetPoint" GUID="{C09C7B2C-F09A-442E-8CAC-64BE8FDD6B75}">.. <Properties>.. <Property Class="Type" GUID="{35F2C3CB-781E-4339-A08B-1C7E54D1CF7C}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{999D528D-11D2-438C-A7DB-79B865F803C5}" Name="Name" inheritaction="Ignore" calculatebefore="0

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\GetPropertyFormula\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1148), with CRLF line terminators
Category:	dropped
Size (bytes):	8681
Entropy (8bit):	5.2326379428763925
Encrypted:	false
SSDEEP:	192:SdOZudOcdOndO+dOSidO39DK6wWgdOjdOIedOK:SdOAdOcdOndO+dOSidO3QWgdOjdOIed3
MD5:	0FEF1601978BD2F084D3037666260846
SHA1:	0E660996C9A2CE1147B9E1D8062BB500C98A3218
SHA-256:	415332DCB9508DB13886A9079237EDAFCCA14C304E90E4D8C46B2406F22D3223
SHA-512:	39E3E93A581F5EB6784925ABD8B290554476A916DE1FF9ED9280DBA0D2D05137FAF56C30FB9124BED0CF0E66691D5BEDD2CC5439D3F9C0CB91C9EBA6292F658D
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetPropertyFormula" GUID="{8C339B63-A412-4C2A-B0C6-24463A8AE770}">.. <Properties>.. <Property Class="Type" GUID="{A9C41F7F-3E8D-4766-828E-E040B89FF16F}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{DC0B647A-5B9F-4271-80DB-765128187680}" Name="Name" inheritaction="Ignore" calculat

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\GetPropertyFormula\is-RA826.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1148), with CRLF line terminators
Category:	dropped
Size (bytes):	8681
Entropy (8bit):	5.2326379428763925
Encrypted:	false
SSDEEP:	192:SdOZudOcdOndO+dOSidO39DK6wWgdOjdOIedOK:SdOAdOcdOndO+dOSidO3QWgdOjdOIed3
MD5:	0FEF1601978BD2F084D3037666260846
SHA1:	0E660996C9A2CE1147B9E1D8062BB500C98A3218
SHA-256:	415332DCB9508DB13886A9079237EDAFCCA14C304E90E4D8C46B2406F22D3223
SHA-512:	39E3E93A581F5EB6784925ABD8B290554476A916DE1FF9ED9280DBA0D2D05137FAF56C30FB9124BED0CF0E66691D5BEDD2CC5439D3F9C0CB91C9EBA6292F658D
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetPropertyFormula" GUID="{8C339B63-A412-4C2A-B0C6-24463A8AE770}">.. <Properties>.. <Property Class="Type" GUID="{A9C41F7F-3E8D-4766-828E-E040B89FF16F}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{DC0B647A-5B9F-4271-80DB-765128187680}" Name="Name" inheritaction="Ignore" calculat

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\GetPropertyResultAsBoolean\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1207), with CRLF line terminators
Category:	dropped
Size (bytes):	8815
Entropy (8bit):	5.2282124362983335
Encrypted:	false
SSDEEP:	192:OdOldO4dOBdOOdOSLdOYSDN6xWgdOidOtJdO0:OdOldO4dOBdOOdOSLdOY7WgdOidOtJdn
MD5:	FE610DC3A74E7C807B39824166F2E557
SHA1:	0438CDB6CF8A55A3063CD5B455EEF8710F62AC7B
SHA-256:	2B98FD59D466D6D0B3648721B8C60490652BE7D53FBBEBC1938FE5DB1D1DB17F
SHA-512:	119E34A560714B1666810B1CF18C5B7189BF3D14863F7AB62554F603EDBBBF8FA268439870E9EC3757669C574A1FC43CEE7BED982F924A6639E1BCD10B78895F
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetPropertyResultAsBoolean" GUID="{698B049C-4A46-4BF4-A3CF-5872A89900DB}">.. <Properties>.. <Property Class="Type" GUID="{9270735F-06CF-4379-A9D6-11A00272E5CA}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{F25C1A72-359C-48F2-A020-89C5BE9B7EDD}" Name="Name" inheritaction="Ignore"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\GetPropertyResultAsBoolean\is-Q2SJP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1207), with CRLF line terminators
Category:	dropped
Size (bytes):	8815
Entropy (8bit):	5.2282124362983335
Encrypted:	false
SSDEEP:	192:OdOldO4dOBdOOdOSLdOYSDN6xWgdOidOtJdO0:OdOldO4dOBdOOdOSLdOY7WgdOidOtJdn
MD5:	FE610DC3A74E7C807B39824166F2E557
SHA1:	0438CDB6CF8A55A3063CD5B455EEF8710F62AC7B
SHA-256:	2B98FD59D466D6D0B3648721B8C60490652BE7D53FBBEBC1938FE5DB1D1DB17F
SHA-512:	119E34A560714B1666810B1CF18C5B7189BF3D14863F7AB62554F603EDBBBF8FA268439870E9EC3757669C574A1FC43CEE7BED982F924A6639E1BCD10B78895F
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetPropertyResultAsBoolean" GUID="{698B049C-4A46-4BF4-A3CF-5872A89900DB}">.. <Properties>.. <Property Class="Type" GUID="{9270735F-06CF-4379-A9D6-11A00272E5CA}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{F25C1A72-359C-48F2-A020-89C5BE9B7EDD}" Name="Name" inheritaction="Ignore"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\GetPropertyResultAsFloat\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1191), with CRLF line terminators
Category:	dropped
Size (bytes):	8779
Entropy (8bit):	5.228387275561693
Encrypted:	false
SSDEEP:	192:XqdOfdOQdO6dOlAdOS7jedOfvDb6QWgdODdOtydOF:6dOfdOQdO6dOSdOS3edOfpWgdODdOtyo
MD5:	32CAC67A317827B29A1D2AFD52280BBA
SHA1:	EDFC5E64D89F921FF9B99095FEC4C90729CB6A1E
SHA-256:	BAEDDBF6C5FEBF00A2790874A85CCAABEA24C55A9140E09A2ECE18EC246019A2
SHA-512:	6314A99663B9C838517F5B2F71F678ECE9FCC7C9FCF5496FEAF1B5757E490152E0C01209FC8FDC875E9AB40B7632F2D85C632D112A4072C6B896598D84DC7687
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetPropertyResultAsFloat" GUID="{BD7D598C-D620-4E74-BA10-6985F204D7A5}">.. <Properties>.. <Property Class="Type" GUID="{F239CA7E-13C7-48FA-A4D4-26A0FF852688}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{EA3804D9-50FF-47F2-AFB3-B3E3C3A21CD5}" Name="Name" inheritaction="Ignore" ca

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\GetPropertyResultAsFloat\is-6TD8P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1191), with CRLF line terminators
Category:	dropped
Size (bytes):	8779
Entropy (8bit):	5.228387275561693
Encrypted:	false
SSDEEP:	192:XqdOfdOQdO6dOlAdOS7jedOfvDb6QWgdODdOtydOF:6dOfdOQdO6dOSdOS3edOfpWgdODdOtyo
MD5:	32CAC67A317827B29A1D2AFD52280BBA
SHA1:	EDFC5E64D89F921FF9B99095FEC4C90729CB6A1E
SHA-256:	BAEDDBF6C5FEBF00A2790874A85CCAABEA24C55A9140E09A2ECE18EC246019A2
SHA-512:	6314A99663B9C838517F5B2F71F678ECE9FCC7C9FCF5496FEAF1B5757E490152E0C01209FC8FDC875E9AB40B7632F2D85C632D112A4072C6B896598D84DC7687
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetPropertyResultAsFloat" GUID="{BD7D598C-D620-4E74-BA10-6985F204D7A5}">.. <Properties>.. <Property Class="Type" GUID="{F239CA7E-13C7-48FA-A4D4-26A0FF852688}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{EA3804D9-50FF-47F2-AFB3-B3E3C3A21CD5}" Name="Name" inheritaction="Ignore" ca

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\GetPropertyResultAsInteger\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1204), with CRLF line terminators
Category:	dropped
Size (bytes):	8809
Entropy (8bit):	5.227293795326559
Encrypted:	false
SSDEEP:	192:idOxsdO5TdOMdO1NmdOSWYdOVaD767HgWgdObdOtfdOb:idO6dONdOMdOGdOSWYdOVrAWgdObdOti
MD5:	18C95A21AD2194155E8B65E527F9423A
SHA1:	33A9D7295E9997A3502AD4BC4CF02544CD8BBBD9
SHA-256:	EED3AA58EF711A9251F61BC8D048351C1AADE3C714B92E09BB5874A21BAA41F6
SHA-512:	2418DF9D5AF011AE2238945F448AA1534C0A6B2D720D079F10BC97EFA3E7D29242F8F8A39C726389673EE34997344EAF9BEF05A8EA568F569DA939FF99578AB3
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetPropertyResultAsInteger" GUID="{CACF05A4-4D0A-459B-A2A8-879CF649EF06}">.. <Properties>.. <Property Class="Type" GUID="{AA088D71-0E14-408F-BB78-3176FEEC271A}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{0EA8E40F-02B3-4AF4-9A6E-391B2AF8ADF5}" Name="Name" inheritaction="Ignore"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\GetPropertyResultAsInteger\is-U3TI5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1204), with CRLF line terminators
Category:	dropped
Size (bytes):	8809
Entropy (8bit):	5.227293795326559
Encrypted:	false
SSDEEP:	192:idOxsdO5TdOMdO1NmdOSWYdOVaD767HgWgdObdOtfdOb:idO6dONdOMdOGdOSWYdOVrAWgdObdOti
MD5:	18C95A21AD2194155E8B65E527F9423A
SHA1:	33A9D7295E9997A3502AD4BC4CF02544CD8BBBD9
SHA-256:	EED3AA58EF711A9251F61BC8D048351C1AADE3C714B92E09BB5874A21BAA41F6
SHA-512:	2418DF9D5AF011AE2238945F448AA1534C0A6B2D720D079F10BC97EFA3E7D29242F8F8A39C726389673EE34997344EAF9BEF05A8EA568F569DA939FF99578AB3
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetPropertyResultAsInteger" GUID="{CACF05A4-4D0A-459B-A2A8-879CF649EF06}">.. <Properties>.. <Property Class="Type" GUID="{AA088D71-0E14-408F-BB78-3176FEEC271A}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{0EA8E40F-02B3-4AF4-9A6E-391B2AF8ADF5}" Name="Name" inheritaction="Ignore"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\GetPropertyResultAsString\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1208), with CRLF line terminators
Category:	dropped
Size (bytes):	8815
Entropy (8bit):	5.2321764916360936
Encrypted:	false
SSDEEP:	192:RndOjdODTdOLdOZdOSxdOQ9D66MWgdOSdOtVdOS:ldOjdODTdOLdOZdOSxdOQYWgdOSdOtVf
MD5:	ECE58FEACF903D442097FEB715F7F79B
SHA1:	EA175823BBAE896C733B28CC9E16B2042DCF52B8
SHA-256:	67FEFB68B33BCA0F4FEA43089114DDA95D3AFAA877B08C0DBEA56932AF2D992C
SHA-512:	7C7BD844FD5E6F008EE91021928D1C7DAB8EA6A5CA78F0BA5F80C412598203110520315E4DBD9AD9B7493CA479F222C40443D277D299DA53B955640090CC6B27
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetPropertyResultAsString" GUID="{55C5D72C-D009-450A-9D08-D01F3F1855F2}">.. <Properties>.. <Property Class="Type" GUID="{E640FDD7-7466-489A-AF46-91B6D274DB10}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{33633AEB-EA16-4CDD-B72E-0AD4126430DB}" Name="Name" inheritaction="Ignore" c

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\GetPropertyResultAsString\is-6M828.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1208), with CRLF line terminators
Category:	dropped
Size (bytes):	8815
Entropy (8bit):	5.2321764916360936
Encrypted:	false
SSDEEP:	192:RndOjdODTdOLdOZdOSxdOQ9D66MWgdOSdOtVdOS:ldOjdODTdOLdOZdOSxdOQYWgdOSdOtVf
MD5:	ECE58FEACF903D442097FEB715F7F79B
SHA1:	EA175823BBAE896C733B28CC9E16B2042DCF52B8
SHA-256:	67FEFB68B33BCA0F4FEA43089114DDA95D3AFAA877B08C0DBEA56932AF2D992C
SHA-512:	7C7BD844FD5E6F008EE91021928D1C7DAB8EA6A5CA78F0BA5F80C412598203110520315E4DBD9AD9B7493CA479F222C40443D277D299DA53B955640090CC6B27
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetPropertyResultAsString" GUID="{55C5D72C-D009-450A-9D08-D01F3F1855F2}">.. <Properties>.. <Property Class="Type" GUID="{E640FDD7-7466-489A-AF46-91B6D274DB10}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{33633AEB-EA16-4CDD-B72E-0AD4126430DB}" Name="Name" inheritaction="Ignore" c

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\GetPropertyResult\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1142), with CRLF line terminators
Category:	dropped
Size (bytes):	8669
Entropy (8bit):	5.226943474777542
Encrypted:	false
SSDEEP:	192:WRdONdOgdO8dOmWdOS5dOSDhoxWgdO1DdOgdOh:kdONdOgdO8dOFdOS5dOnWgdOZdOgdOh
MD5:	309504114688E4BB6081AA101DBB3587
SHA1:	21016EB5E553648D3BE5E6A0BD447FA0875506E6
SHA-256:	69765C1B51F7BA6A4D7ADE0FCC8D1F2FB9325258E6EF37858A583D8D9DA16258
SHA-512:	9E6A4C5BEC142E7C32979A2CF12C22E919C378E79C44EB60F75EA89226737DBF219CB0F5417065F876642309B6A28676C8B24A416383F095BA0AE776716996AA
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetPropertyResult" GUID="{FC7671AE-AEFF-4A1A-95A3-99ABEBAA04CD}">.. <Properties>.. <Property Class="Type" GUID="{819B46D4-6C6A-4E76-BC8B-BF835A26C30C}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{88E0A322-6814-495A-BD54-20B2D9A909D5}" Name="Name" inheritaction="Ignore" calculate

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\GetPropertyResult\is-NNEJD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1142), with CRLF line terminators
Category:	dropped
Size (bytes):	8669
Entropy (8bit):	5.226943474777542
Encrypted:	false
SSDEEP:	192:WRdONdOgdO8dOmWdOS5dOSDhoxWgdO1DdOgdOh:kdONdOgdO8dOFdOS5dOnWgdOZdOgdOh
MD5:	309504114688E4BB6081AA101DBB3587
SHA1:	21016EB5E553648D3BE5E6A0BD447FA0875506E6
SHA-256:	69765C1B51F7BA6A4D7ADE0FCC8D1F2FB9325258E6EF37858A583D8D9DA16258
SHA-512:	9E6A4C5BEC142E7C32979A2CF12C22E919C378E79C44EB60F75EA89226737DBF219CB0F5417065F876642309B6A28676C8B24A416383F095BA0AE776716996AA
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetPropertyResult" GUID="{FC7671AE-AEFF-4A1A-95A3-99ABEBAA04CD}">.. <Properties>.. <Property Class="Type" GUID="{819B46D4-6C6A-4E76-BC8B-BF835A26C30C}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{88E0A322-6814-495A-BD54-20B2D9A909D5}" Name="Name" inheritaction="Ignore" calculate

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\GetProperty\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1182), with CRLF line terminators
Category:	dropped
Size (bytes):	10625
Entropy (8bit):	5.274367461361392
Encrypted:	false
SSDEEP:	192:PmdOBdOZdOqdOzdOSzdOCQHkcbDizqXBJlAagVWgdOf2dOtm/OdOE:+dOBdOZdOqdOzdOSzdOCQgWgdOOdOtiU
MD5:	CF3A5CA9C3CD1930C0FD7F772F06A4C8
SHA1:	7725C7B377B271794DF2F544F2FED973316C6417
SHA-256:	0F9ACB8CAF542BAF8C3A5BFF1A6E3F63C4EB26F6EBC61EA9C20C1FE0094DA124
SHA-512:	A096023B871AA018E9E10E8A78504F2F3A35E08B466D3B2ADBFB2A24F7C1A3BD18175330C5B7F70D0E88C47C4144D201071888134F2AF6EAF4DCCDA454A40FC8
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetProperty" GUID="{9F6D33A9-431B-419E-BA40-A7BB48D88AA5}">.. <Properties>.. <Property Class="Type" GUID="{AF4502BF-74D2-47B2-9A40-F0DCE4ACC60C}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{8B627228-F849-42F0-AAE3-36501A629B46}" Name="Name" inheritaction="Ignore" calculatebefore

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\GetProperty\is-32V9D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1182), with CRLF line terminators
Category:	dropped
Size (bytes):	10625
Entropy (8bit):	5.274367461361392
Encrypted:	false
SSDEEP:	192:PmdOBdOZdOqdOzdOSzdOCQHkcbDizqXBJlAagVWgdOf2dOtm/OdOE:+dOBdOZdOqdOzdOSzdOCQgWgdOOdOtiU
MD5:	CF3A5CA9C3CD1930C0FD7F772F06A4C8
SHA1:	7725C7B377B271794DF2F544F2FED973316C6417
SHA-256:	0F9ACB8CAF542BAF8C3A5BFF1A6E3F63C4EB26F6EBC61EA9C20C1FE0094DA124
SHA-512:	A096023B871AA018E9E10E8A78504F2F3A35E08B466D3B2ADBFB2A24F7C1A3BD18175330C5B7F70D0E88C47C4144D201071888134F2AF6EAF4DCCDA454A40FC8
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="GetProperty" GUID="{9F6D33A9-431B-419E-BA40-A7BB48D88AA5}">.. <Properties>.. <Property Class="Type" GUID="{AF4502BF-74D2-47B2-9A40-F0DCE4ACC60C}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{8B627228-F849-42F0-AAE3-36501A629B46}" Name="Name" inheritaction="Ignore" calculatebefore

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\IPoint\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (806), with CRLF line terminators
Category:	dropped
Size (bytes):	4151
Entropy (8bit):	5.450012963453606
Encrypted:	false
SSDEEP:	48:c0CMrtisHk9lqiYD5anKreBuSZ0ClJj3xxEv1RIvDkvzviFv1uvFuvFgRIvDTvWm:7CuMD9lqiWSfeea7G+qFl/IsRYVcnR
MD5:	4D6BE96CE0E40EE629AB9A332862CFA9
SHA1:	0FF76788D03255B19E31250A0CF2A034A0E7C79D
SHA-256:	AFA808B7F983ABDB0EB6C6CF437CBC96020B1418F1B6F8AA1F582CB1246E61DF
SHA-512:	DE90B54C4180139D9486A3A0CAAF3AB1D8E5CCF9B3C977D92F4A80A3E822E70DDCFDF7791D1BAF8564E41EE72B1B826B0DF15E686F1E173BCF0F1BDD158716C9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="IPoint" GUID="{7C9E4C1E-5462-43B7-8677-B362CD2CB1B8}">.. <Properties>.. <Property Class="Type" GUID="{57C5C9F1-8DD4-47F5-9F34-4D4FE804D37C}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Object</Property>.. <Property Class="Text" GUID="{0F12CF84-F59A-4B47-8AE4-B8E0CEE8D42C}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">IPoint</Property>.. <Property Class="Number" GUID="{DC352C5D-7F87-4AA3-A506-4D02ADD789DE}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">20</Property>.. <Property Class="Text" GUID="{DCD816E1-89CD-486A-B082-2AA66BD51D2B}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{7C9E4C1E-5462-43B7-8677-B362CD2CB1B8}</Property>.. <Property Class="Memo" GUID="{1DA5DD4F-338C-4D0E-AA71-61FF08ABCEB5}" Name="Form Layout" systemhidden="True" OrderIndex

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\IPoint\X\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1074), with CRLF line terminators
Category:	dropped
Size (bytes):	9541
Entropy (8bit):	5.267425496469741
Encrypted:	false
SSDEEP:	192:fdOMdO0dOEdOgdOhea7G+AD/ZGAgcQdONgdOqadOfdOw:fdOMdO0dOEdOgdOKQdONgdOqadOfdOw
MD5:	F092CB4578B2FFD49C5826BC70BAFC9A
SHA1:	54F4DBA02A1AC2A2CCF7AC1420C22F939C4ECEF1
SHA-256:	3BE65FD95A9631C0F63C40B697A2F4A717E1D8451ED6BF7F53D993C3D4647997
SHA-512:	523835062E6F066B355B30AFCB21A49F7FE12FA5908A9A218C420BF69D895B4A82BA9391D265920C70D59CC99558F4931F77C498EF159A901FE78892094B0434
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="X" GUID="{45C03CB7-80C8-40B8-AC3F-4B54FC8CDA15}">.. <Properties>.. <Property Class="Type" GUID="{59837786-08B0-417B-BE9A-BFC3A2BF85CB}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Property</Property>.. <Property Class="Text" GUID="{BB2CF67B-DDFB-4BC9-8C6C-5A1C03A0ABCA}" Name="Name" inheritaction="Ignore" calculatebefore="0" inher

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\IPoint\X\is-AD2Q1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1074), with CRLF line terminators
Category:	dropped
Size (bytes):	9541
Entropy (8bit):	5.267425496469741
Encrypted:	false
SSDEEP:	192:fdOMdO0dOEdOgdOhea7G+AD/ZGAgcQdONgdOqadOfdOw:fdOMdO0dOEdOgdOKQdONgdOqadOfdOw
MD5:	F092CB4578B2FFD49C5826BC70BAFC9A
SHA1:	54F4DBA02A1AC2A2CCF7AC1420C22F939C4ECEF1
SHA-256:	3BE65FD95A9631C0F63C40B697A2F4A717E1D8451ED6BF7F53D993C3D4647997
SHA-512:	523835062E6F066B355B30AFCB21A49F7FE12FA5908A9A218C420BF69D895B4A82BA9391D265920C70D59CC99558F4931F77C498EF159A901FE78892094B0434
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="X" GUID="{45C03CB7-80C8-40B8-AC3F-4B54FC8CDA15}">.. <Properties>.. <Property Class="Type" GUID="{59837786-08B0-417B-BE9A-BFC3A2BF85CB}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Property</Property>.. <Property Class="Text" GUID="{BB2CF67B-DDFB-4BC9-8C6C-5A1C03A0ABCA}" Name="Name" inheritaction="Ignore" calculatebefore="0" inher

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\IPoint\Y\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1072), with CRLF line terminators
Category:	dropped
Size (bytes):	9537
Entropy (8bit):	5.266278136737099
Encrypted:	false
SSDEEP:	192:jdO9dOYedO7dODdOftUXea7G+AD/ZGiS5QdO/hgdO92dOnvu8dOw:jdO9dOYedO7dODdOSVQdOpgdO92dOnvb
MD5:	0E7547A5DEDD54A540F444FB46AA3850
SHA1:	9D5EACA12FEAD296F321A68E4EF57201B195D6F7
SHA-256:	0E44B19AFAA1086D76856D1A37CB5FD645310541C026F903C4E9A8837D04BC14
SHA-512:	E053ADA09FD6274E13B7D1235CD6EBECD80CD68C9E8C106F34AE6B445AFB47DA58D32F5D0C20AAB0BE02AEFFC1E7D6583B14F12C4E811B0D41235397FC6B10C2
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Y" GUID="{590ACAA0-1DEF-45EF-8B9A-24788B98FF8E}">.. <Properties>.. <Property Class="Type" GUID="{F8950F2C-A511-4DF5-ADBC-ABBD77655D14}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Property</Property>.. <Property Class="Text" GUID="{B5453830-4CAC-4A0E-B2F6-DDC5BE1022D3}" Name="Name" inheritaction="Ignore" calculatebefore="0" inher

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\IPoint\Y\is-AUSOI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1072), with CRLF line terminators
Category:	dropped
Size (bytes):	9537
Entropy (8bit):	5.266278136737099
Encrypted:	false
SSDEEP:	192:jdO9dOYedO7dODdOftUXea7G+AD/ZGiS5QdO/hgdO92dOnvu8dOw:jdO9dOYedO7dODdOSVQdOpgdO92dOnvb
MD5:	0E7547A5DEDD54A540F444FB46AA3850
SHA1:	9D5EACA12FEAD296F321A68E4EF57201B195D6F7
SHA-256:	0E44B19AFAA1086D76856D1A37CB5FD645310541C026F903C4E9A8837D04BC14
SHA-512:	E053ADA09FD6274E13B7D1235CD6EBECD80CD68C9E8C106F34AE6B445AFB47DA58D32F5D0C20AAB0BE02AEFFC1E7D6583B14F12C4E811B0D41235397FC6B10C2
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Y" GUID="{590ACAA0-1DEF-45EF-8B9A-24788B98FF8E}">.. <Properties>.. <Property Class="Type" GUID="{F8950F2C-A511-4DF5-ADBC-ABBD77655D14}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Property</Property>.. <Property Class="Text" GUID="{B5453830-4CAC-4A0E-B2F6-DDC5BE1022D3}" Name="Name" inheritaction="Ignore" calculatebefore="0" inher

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\IPoint\is-V249P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (806), with CRLF line terminators
Category:	dropped
Size (bytes):	4151
Entropy (8bit):	5.450012963453606
Encrypted:	false
SSDEEP:	48:c0CMrtisHk9lqiYD5anKreBuSZ0ClJj3xxEv1RIvDkvzviFv1uvFuvFgRIvDTvWm:7CuMD9lqiWSfeea7G+qFl/IsRYVcnR
MD5:	4D6BE96CE0E40EE629AB9A332862CFA9
SHA1:	0FF76788D03255B19E31250A0CF2A034A0E7C79D
SHA-256:	AFA808B7F983ABDB0EB6C6CF437CBC96020B1418F1B6F8AA1F582CB1246E61DF
SHA-512:	DE90B54C4180139D9486A3A0CAAF3AB1D8E5CCF9B3C977D92F4A80A3E822E70DDCFDF7791D1BAF8564E41EE72B1B826B0DF15E686F1E173BCF0F1BDD158716C9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="IPoint" GUID="{7C9E4C1E-5462-43B7-8677-B362CD2CB1B8}">.. <Properties>.. <Property Class="Type" GUID="{57C5C9F1-8DD4-47F5-9F34-4D4FE804D37C}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Object</Property>.. <Property Class="Text" GUID="{0F12CF84-F59A-4B47-8AE4-B8E0CEE8D42C}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">IPoint</Property>.. <Property Class="Number" GUID="{DC352C5D-7F87-4AA3-A506-4D02ADD789DE}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">20</Property>.. <Property Class="Text" GUID="{DCD816E1-89CD-486A-B082-2AA66BD51D2B}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{7C9E4C1E-5462-43B7-8677-B362CD2CB1B8}</Property>.. <Property Class="Memo" GUID="{1DA5DD4F-338C-4D0E-AA71-61FF08ABCEB5}" Name="Form Layout" systemhidden="True" OrderIndex

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\ItemType\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1114), with CRLF line terminators
Category:	dropped
Size (bytes):	9334
Entropy (8bit):	5.251603281543916
Encrypted:	false
SSDEEP:	192:IdOkdOHdO0dOEdOMQdOowgdOyeUteuUVcdOBdO0:IdOkdOHdO0dOEdOMQdOowgdOOdOBdO0
MD5:	3F30606869000C3A3C783B1F77F13BF5
SHA1:	E14BAF4D9A57528F783242B7205DBE627F55C1CE
SHA-256:	E6C585037943C6A80EA8E120E9CB0BF453E5F98074D3AE23A2EE98694E8B741D
SHA-512:	9E1A7C6678C699C5CB0AE198942624AEC8072DB3F941547BB09EEE34990C574CF9B47E42EF12F5483C72ACECF909908E91F83A840A376B42DE41036455232BFE
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="ItemType" GUID="{D7A075B1-08E7-4C09-9590-1BC53BFDB537}">.. <Properties>.. <Property Class="Type" GUID="{46F2047E-22F7-4A80-B647-BB8EE84E0072}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Property</Property>.. <Property Class="Text" GUID="{D3B3734E-8B60-4FE5-BB2A-FBC8B22A8A6D}" Name="Name" inheritaction="Ignore" calculatebefore="0

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\ItemType\is-NKDJE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1114), with CRLF line terminators
Category:	dropped
Size (bytes):	9334
Entropy (8bit):	5.251603281543916
Encrypted:	false
SSDEEP:	192:IdOkdOHdO0dOEdOMQdOowgdOyeUteuUVcdOBdO0:IdOkdOHdO0dOEdOMQdOowgdOOdOBdO0
MD5:	3F30606869000C3A3C783B1F77F13BF5
SHA1:	E14BAF4D9A57528F783242B7205DBE627F55C1CE
SHA-256:	E6C585037943C6A80EA8E120E9CB0BF453E5F98074D3AE23A2EE98694E8B741D
SHA-512:	9E1A7C6678C699C5CB0AE198942624AEC8072DB3F941547BB09EEE34990C574CF9B47E42EF12F5483C72ACECF909908E91F83A840A376B42DE41036455232BFE
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="ItemType" GUID="{D7A075B1-08E7-4C09-9590-1BC53BFDB537}">.. <Properties>.. <Property Class="Type" GUID="{46F2047E-22F7-4A80-B647-BB8EE84E0072}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Property</Property>.. <Property Class="Text" GUID="{D3B3734E-8B60-4FE5-BB2A-FBC8B22A8A6D}" Name="Name" inheritaction="Ignore" calculatebefore="0

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\Name\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1101), with CRLF line terminators
Category:	dropped
Size (bytes):	9337
Entropy (8bit):	5.253470162995509
Encrypted:	false
SSDEEP:	192:5dOtdO8dOWdOOdOSNdO7egLeugTzWgdOedOSdOs:5dOtdO8dOWdOOdOSNdOGWgdOedOSdOs
MD5:	00BEC6F685E488111DEC71663314FBB9
SHA1:	AC2BA92A6244EE01BE70BA1EE395D6CD86774CFB
SHA-256:	B711619F992A7D7BA890A32CC8FF641FC8BF2588B41B314002BEEFA350218334
SHA-512:	83544127237745513BDA1157A2940D40807F7F5819847860A093F3A237D93D0AC137BC6874780672FD0378F05FD1E1D3FE38ACEB91B88C0C71C7A89CE666BA9A
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Name" GUID="{53BEA982-10CF-4AE9-AE99-DECFAB45B4D0}">.. <Properties>.. <Property Class="Type" GUID="{B3A3844A-38AD-452E-B779-0BD5E9E5B605}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Property</Property>.. <Property Class="Text" GUID="{822A4DA7-E131-4917-9DA2-00FC62A207DC}" Name="Name" inheritaction="Ignore" calculatebefore="0" in

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\Name\is-TOL52.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1101), with CRLF line terminators
Category:	dropped
Size (bytes):	9337
Entropy (8bit):	5.253470162995509
Encrypted:	false
SSDEEP:	192:5dOtdO8dOWdOOdOSNdO7egLeugTzWgdOedOSdOs:5dOtdO8dOWdOOdOSNdOGWgdOedOSdOs
MD5:	00BEC6F685E488111DEC71663314FBB9
SHA1:	AC2BA92A6244EE01BE70BA1EE395D6CD86774CFB
SHA-256:	B711619F992A7D7BA890A32CC8FF641FC8BF2588B41B314002BEEFA350218334
SHA-512:	83544127237745513BDA1157A2940D40807F7F5819847860A093F3A237D93D0AC137BC6874780672FD0378F05FD1E1D3FE38ACEB91B88C0C71C7A89CE666BA9A
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Name" GUID="{53BEA982-10CF-4AE9-AE99-DECFAB45B4D0}">.. <Properties>.. <Property Class="Type" GUID="{B3A3844A-38AD-452E-B779-0BD5E9E5B605}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Property</Property>.. <Property Class="Text" GUID="{822A4DA7-E131-4917-9DA2-00FC62A207DC}" Name="Name" inheritaction="Ignore" calculatebefore="0" in

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\NewItemEx\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1167), with CRLF line terminators
Category:	dropped
Size (bytes):	6821
Entropy (8bit):	5.303668759472054
Encrypted:	false
SSDEEP:	192:RT4iRfqicCVIt4ebOfDyGIJKFAghsAlNdVLyVt:LcCVNVOD
MD5:	A78AF6A1B1C71743D6D106A118A207BD
SHA1:	14D996D2F19952C7204449C7D02F47FED5DF8779
SHA-256:	4A3CFA96CB752BE25BFD916FFC12094018A91E9BA8D3DCA626E638B55FDD1656
SHA-512:	E64E11546650C7755427750F7D883709832335BAE50C6F2874CB9EADD04329824D6B35B03A53CCFC07056D3170CE91B9125D040FBC47EE61C5C81E8B6BE0DEFB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewItemEx" GUID="{ED668911-DBDB-459E-A0C8-B0985EDB7C57}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">NewItemEx</Property>.. <Property Class="Type" GUID="{50157DBF-5938-4E7F-AC1A-5CE2B5FC76FE}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{F84BA63B-927F-48B7-9C50-04BA6FC75452}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">23</Property>.. <Property Class="Memo" GUID="{97CE46F8-0246-426A-B0D7-05CB1983B48C}" Name="Form Layout" systemhidden="True" OrderIndex="4" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="Help String"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\NewItemEx\is-RL011.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1167), with CRLF line terminators
Category:	dropped
Size (bytes):	6821
Entropy (8bit):	5.303668759472054
Encrypted:	false
SSDEEP:	192:RT4iRfqicCVIt4ebOfDyGIJKFAghsAlNdVLyVt:LcCVNVOD
MD5:	A78AF6A1B1C71743D6D106A118A207BD
SHA1:	14D996D2F19952C7204449C7D02F47FED5DF8779
SHA-256:	4A3CFA96CB752BE25BFD916FFC12094018A91E9BA8D3DCA626E638B55FDD1656
SHA-512:	E64E11546650C7755427750F7D883709832335BAE50C6F2874CB9EADD04329824D6B35B03A53CCFC07056D3170CE91B9125D040FBC47EE61C5C81E8B6BE0DEFB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewItemEx" GUID="{ED668911-DBDB-459E-A0C8-B0985EDB7C57}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">NewItemEx</Property>.. <Property Class="Type" GUID="{50157DBF-5938-4E7F-AC1A-5CE2B5FC76FE}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{F84BA63B-927F-48B7-9C50-04BA6FC75452}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">23</Property>.. <Property Class="Memo" GUID="{97CE46F8-0246-426A-B0D7-05CB1983B48C}" Name="Form Layout" systemhidden="True" OrderIndex="4" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="Help String"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\NewItem\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1145), with CRLF line terminators
Category:	dropped
Size (bytes):	9429
Entropy (8bit):	5.262261402974875
Encrypted:	false
SSDEEP:	192:DdOvdOOdO+fdOVdOSndOtDyswNAbyWgdOvdOEdOp:DdOvdOOdO+fdOVdOSndO8WgdOvdOEdOp
MD5:	28F4EA569608359D67C05F46B49B4FF5
SHA1:	CAECB0E99A117C160204A504E774FE3FFDD5C4C0
SHA-256:	D240DB38C90EBBBFEE69218264A6A45374544B12F5EA05829217B7EFD7EDFEF3
SHA-512:	A261CA30A999E3E83F1BE45EA14B0C24C7A0ED70ADF0602CC288897E8C4F35C324E3BE68AC51C0063762C894BC741BA24DD074FECD523A2B9DD247F2E8B580DB
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="NewItem" GUID="{B3BE3D37-C657-41B5-9610-F6B7FD3EEA55}">.. <Properties>.. <Property Class="Type" GUID="{A31F617B-34FA-4B99-B1D9-AA1F23F8DC20}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{B284316E-DB94-4EB1-8BCE-7D7A8E8AE575}" Name="Name" inheritaction="Ignore" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\NewItem\is-GS3LH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1145), with CRLF line terminators
Category:	dropped
Size (bytes):	9429
Entropy (8bit):	5.262261402974875
Encrypted:	false
SSDEEP:	192:DdOvdOOdO+fdOVdOSndOtDyswNAbyWgdOvdOEdOp:DdOvdOOdO+fdOVdOSndO8WgdOvdOEdOp
MD5:	28F4EA569608359D67C05F46B49B4FF5
SHA1:	CAECB0E99A117C160204A504E774FE3FFDD5C4C0
SHA-256:	D240DB38C90EBBBFEE69218264A6A45374544B12F5EA05829217B7EFD7EDFEF3
SHA-512:	A261CA30A999E3E83F1BE45EA14B0C24C7A0ED70ADF0602CC288897E8C4F35C324E3BE68AC51C0063762C894BC741BA24DD074FECD523A2B9DD247F2E8B580DB
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="NewItem" GUID="{B3BE3D37-C657-41B5-9610-F6B7FD3EEA55}">.. <Properties>.. <Property Class="Type" GUID="{A31F617B-34FA-4B99-B1D9-AA1F23F8DC20}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{B284316E-DB94-4EB1-8BCE-7D7A8E8AE575}" Name="Name" inheritaction="Ignore" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\NewPoint\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (804), with CRLF line terminators
Category:	dropped
Size (bytes):	4725
Entropy (8bit):	5.444169001509152
Encrypted:	false
SSDEEP:	48:cHIQHFIl+5Jz2YD5anKMumPZ09lJ6c3k7yUv1RIvDm5v1OvFqvFRIvDNvtvi7vRE:hQ+qt2WsjbeUeeuNZYNYsMV9hq5e
MD5:	0E9AF5C040850CE3899C75A249BB4A40
SHA1:	0E129E7B4CCFD589F7B4BC56C747D72DD7795802
SHA-256:	5D09FB74E3E1D6DEF273C170C6BD7952E830290BDBAD81761E21BA333E5A8139
SHA-512:	FB96B36A48F6C26FA8C4F2D1BF1FB5253017DC197D82740A508DBD418C8FBA3F4526C1258EBDA697FDEBE488625D72E52E4381BB7BBC68D77FF58AE5DF6A46E9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewPoint" GUID="{0750CAD6-E021-4A13-8552-B7FC1416FC81}">.. <Properties>.. <Property Class="Type" GUID="{FD4B0F83-27EB-4708-8627-55F02B0288E0}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Procedure</Property>.. <Property Class="Text" GUID="{D113AB15-FC36-4E3E-A058-3FE288C90123}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">NewPoint</Property>.. <Property Class="Number" GUID="{D9E965BA-03B9-44F9-B0A2-36FD4081A36D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">24</Property>.. <Property Class="Text" GUID="{F2433EB3-CB83-4F73-9214-F379BA84EBF9}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{0750CAD6-E021-4A13-8552-B7FC1416FC81}</Property>.. <Property Class="Memo" GUID="{106242CA-2542-4BAE-A51A-D2C1D48DD23A}" Name="Form Layout" systemhidden="True" Ord

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\NewPoint\is-AOOOT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (804), with CRLF line terminators
Category:	dropped
Size (bytes):	4725
Entropy (8bit):	5.444169001509152
Encrypted:	false
SSDEEP:	48:cHIQHFIl+5Jz2YD5anKMumPZ09lJ6c3k7yUv1RIvDm5v1OvFqvFRIvDNvtvi7vRE:hQ+qt2WsjbeUeeuNZYNYsMV9hq5e
MD5:	0E9AF5C040850CE3899C75A249BB4A40
SHA1:	0E129E7B4CCFD589F7B4BC56C747D72DD7795802
SHA-256:	5D09FB74E3E1D6DEF273C170C6BD7952E830290BDBAD81761E21BA333E5A8139
SHA-512:	FB96B36A48F6C26FA8C4F2D1BF1FB5253017DC197D82740A508DBD418C8FBA3F4526C1258EBDA697FDEBE488625D72E52E4381BB7BBC68D77FF58AE5DF6A46E9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewPoint" GUID="{0750CAD6-E021-4A13-8552-B7FC1416FC81}">.. <Properties>.. <Property Class="Type" GUID="{FD4B0F83-27EB-4708-8627-55F02B0288E0}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Procedure</Property>.. <Property Class="Text" GUID="{D113AB15-FC36-4E3E-A058-3FE288C90123}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">NewPoint</Property>.. <Property Class="Number" GUID="{D9E965BA-03B9-44F9-B0A2-36FD4081A36D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">24</Property>.. <Property Class="Text" GUID="{F2433EB3-CB83-4F73-9214-F379BA84EBF9}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{0750CAD6-E021-4A13-8552-B7FC1416FC81}</Property>.. <Property Class="Memo" GUID="{106242CA-2542-4BAE-A51A-D2C1D48DD23A}" Name="Form Layout" systemhidden="True" Ord

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\NewProperty\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1171), with CRLF line terminators
Category:	dropped
Size (bytes):	7451
Entropy (8bit):	5.273349198126897
Encrypted:	false
SSDEEP:	192:DWPcC/CSpNIW2YGmlKz3i6aDi6qBJFBDo62mNaRB+mSpNIW2YGmlKz3i65:S0ML+k
MD5:	391B875660CC6AFF54095B6B05C1408D
SHA1:	F32AF1361651BABBD815D94DFE1BDA547C1AD68D
SHA-256:	01DF2919CE63A77B8F5E4E1FF67B4525F1C8AE51BC47D638593F9C2894448925
SHA-512:	F03AF4BD4CC8502E61C47E0DD25B82BEA380D1B372F7ACB6292FC2C81E423261691D8D04C1EC8E9A6139FAD1015955A8D077866B4012931B987D7FD0026F7826
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewProperty" GUID="{54ABD023-58E9-4317-A8BD-53CEE8F413D4}">.. <Properties>.. <Property Class="Type" GUID="{1F05A038-0A94-4A38-962A-B31A3E259F93}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{22B166D4-2579-4F7F-8E85-835C9E8AB52E}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">NewProperty</Property>.. <Property Class="Number" GUID="{7C15ADBD-A3E1-4279-8CF6-FC09BD4C1555}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">25</Property>.. <Property Class="Text" GUID="{0E452EF8-137A-4838-A054-91F0A1EFFAEC}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{54ABD023-58E9-4317-A8BD-53CEE8F413D4}</Property>.. <Property Class="Memo" GUID="{77B06005-6E89-4706-92CA-B6DFC641B999}" Name="Form Layout" systemhidden="True

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\NewProperty\is-1MJ7E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1171), with CRLF line terminators
Category:	dropped
Size (bytes):	7451
Entropy (8bit):	5.273349198126897
Encrypted:	false
SSDEEP:	192:DWPcC/CSpNIW2YGmlKz3i6aDi6qBJFBDo62mNaRB+mSpNIW2YGmlKz3i65:S0ML+k
MD5:	391B875660CC6AFF54095B6B05C1408D
SHA1:	F32AF1361651BABBD815D94DFE1BDA547C1AD68D
SHA-256:	01DF2919CE63A77B8F5E4E1FF67B4525F1C8AE51BC47D638593F9C2894448925
SHA-512:	F03AF4BD4CC8502E61C47E0DD25B82BEA380D1B372F7ACB6292FC2C81E423261691D8D04C1EC8E9A6139FAD1015955A8D077866B4012931B987D7FD0026F7826
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewProperty" GUID="{54ABD023-58E9-4317-A8BD-53CEE8F413D4}">.. <Properties>.. <Property Class="Type" GUID="{1F05A038-0A94-4A38-962A-B31A3E259F93}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{22B166D4-2579-4F7F-8E85-835C9E8AB52E}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">NewProperty</Property>.. <Property Class="Number" GUID="{7C15ADBD-A3E1-4279-8CF6-FC09BD4C1555}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">25</Property>.. <Property Class="Text" GUID="{0E452EF8-137A-4838-A054-91F0A1EFFAEC}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{54ABD023-58E9-4317-A8BD-53CEE8F413D4}</Property>.. <Property Class="Memo" GUID="{77B06005-6E89-4706-92CA-B6DFC641B999}" Name="Form Layout" systemhidden="True

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\NewSection\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (713), with CRLF line terminators
Category:	dropped
Size (bytes):	3717
Entropy (8bit):	5.5116752403716704
Encrypted:	false
SSDEEP:	48:cY85dv9XDYD5anK87SZ09lJu3LtELxcyvFgRIvDAvtivABCVcncy3k:t8Pv9TWFbZEd7FlmWoCVqP0
MD5:	2906B2A2A498342B06350CD32F34A38E
SHA1:	6BC7570B0F77E05CF1C9C5726858F5D17B71284C
SHA-256:	91345F63107B6B8CAAEB11CB915688767624FA8C86D59E9786BDAE9B173D4715
SHA-512:	5799CAD84E3826CA8F16B50758523E0322F5F91B3AB5ACE9483D1855973473395A9163435348D2558B41D09BA80A592B6170ED619A3FE85E02FB80E2FD1D9870
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewSection" GUID="{4C73E30F-0BBD-4B2B-B194-4373C2C31A91}">.. <Properties>.. <Property Class="Type" GUID="{0D136202-E2BF-462E-87B1-8B2D7DA3BF2C}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{5C9B713D-2EF9-40FD-A97F-B40B98C6FC56}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">NewSection</Property>.. <Property Class="Number" GUID="{2DF4640C-D56A-4E9D-B5E9-C4D63CB61AEE}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">26</Property>.. <Property Class="Text" GUID="{ECE7809E-6DE9-4517-9556-C7F4A14E5621}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{4C73E30F-0BBD-4B2B-B194-4373C2C31A91}</Property>.. <Property Class="Memo" GUID="{3B909D3E-6AEB-447D-9D95-E351899050F1}" Name="Form Layout" systemhidden="True"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\NewSection\is-N1P4D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (713), with CRLF line terminators
Category:	dropped
Size (bytes):	3717
Entropy (8bit):	5.5116752403716704
Encrypted:	false
SSDEEP:	48:cY85dv9XDYD5anK87SZ09lJu3LtELxcyvFgRIvDAvtivABCVcncy3k:t8Pv9TWFbZEd7FlmWoCVqP0
MD5:	2906B2A2A498342B06350CD32F34A38E
SHA1:	6BC7570B0F77E05CF1C9C5726858F5D17B71284C
SHA-256:	91345F63107B6B8CAAEB11CB915688767624FA8C86D59E9786BDAE9B173D4715
SHA-512:	5799CAD84E3826CA8F16B50758523E0322F5F91B3AB5ACE9483D1855973473395A9163435348D2558B41D09BA80A592B6170ED619A3FE85E02FB80E2FD1D9870
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewSection" GUID="{4C73E30F-0BBD-4B2B-B194-4373C2C31A91}">.. <Properties>.. <Property Class="Type" GUID="{0D136202-E2BF-462E-87B1-8B2D7DA3BF2C}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{5C9B713D-2EF9-40FD-A97F-B40B98C6FC56}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">NewSection</Property>.. <Property Class="Number" GUID="{2DF4640C-D56A-4E9D-B5E9-C4D63CB61AEE}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">26</Property>.. <Property Class="Text" GUID="{ECE7809E-6DE9-4517-9556-C7F4A14E5621}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{4C73E30F-0BBD-4B2B-B194-4373C2C31A91}</Property>.. <Property Class="Memo" GUID="{3B909D3E-6AEB-447D-9D95-E351899050F1}" Name="Form Layout" systemhidden="True"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\ParentItem\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (694), with CRLF line terminators
Category:	dropped
Size (bytes):	3435
Entropy (8bit):	5.500208574190305
Encrypted:	false
SSDEEP:	48:cbrLubrjV8K3f9ghliYD5anK87SZ09lJ7pdnJdMvFgRIvDxIvDGCvWEmVSh:mqNJP9ghkWFQGFl0CA+Vg
MD5:	0EBC73C3E96A53A71E962F16E6640732
SHA1:	E4068AE788E550659F808D95E960B5E72E84C56B
SHA-256:	91C6378F4D9DC0598AD24E017CD69737C9965CF31FF78B0DC7678A56C56A9E27
SHA-512:	AF768075C136700318B03284101FF607D76A3BD53E59FAEC08EB23B53AA8F41F713E4D2A4E5670EACEFC3D34BB8C052597B43DE66D142915C1E468563F1B1A27
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ParentItem" GUID="{CA5C4F23-4C3D-470E-BB75-00EE9CEE7CE0}">.. <Properties>.. <Property Class="Type" GUID="{6D2BAFD9-DD4E-410C-951D-1E8797F39E32}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{4658D7FA-9932-48A2-87AC-31B5BA40C2F9}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ParentItem</Property>.. <Property Class="Number" GUID="{F1C63304-638A-4D71-9D12-0421B8AAE371}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">27</Property>.. <Property Class="Text" GUID="{2E119891-2BF7-46EB-ACBA-17A0B9456EA6}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{CA5C4F23-4C3D-470E-BB75-00EE9CEE7CE0}</Property>.. <Property Class="Memo" GUID="{0AE2E999-22E6-4152-AD62-5C5D31EE5444}" Name="Form Layout" systemhidden="True"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\ParentItem\is-946QG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (694), with CRLF line terminators
Category:	dropped
Size (bytes):	3435
Entropy (8bit):	5.500208574190305
Encrypted:	false
SSDEEP:	48:cbrLubrjV8K3f9ghliYD5anK87SZ09lJ7pdnJdMvFgRIvDxIvDGCvWEmVSh:mqNJP9ghkWFQGFl0CA+Vg
MD5:	0EBC73C3E96A53A71E962F16E6640732
SHA1:	E4068AE788E550659F808D95E960B5E72E84C56B
SHA-256:	91C6378F4D9DC0598AD24E017CD69737C9965CF31FF78B0DC7678A56C56A9E27
SHA-512:	AF768075C136700318B03284101FF607D76A3BD53E59FAEC08EB23B53AA8F41F713E4D2A4E5670EACEFC3D34BB8C052597B43DE66D142915C1E468563F1B1A27
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ParentItem" GUID="{CA5C4F23-4C3D-470E-BB75-00EE9CEE7CE0}">.. <Properties>.. <Property Class="Type" GUID="{6D2BAFD9-DD4E-410C-951D-1E8797F39E32}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{4658D7FA-9932-48A2-87AC-31B5BA40C2F9}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ParentItem</Property>.. <Property Class="Number" GUID="{F1C63304-638A-4D71-9D12-0421B8AAE371}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">27</Property>.. <Property Class="Text" GUID="{2E119891-2BF7-46EB-ACBA-17A0B9456EA6}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{CA5C4F23-4C3D-470E-BB75-00EE9CEE7CE0}</Property>.. <Property Class="Memo" GUID="{0AE2E999-22E6-4152-AD62-5C5D31EE5444}" Name="Form Layout" systemhidden="True"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\PointCount\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (522), with CRLF line terminators
Category:	dropped
Size (bytes):	3295
Entropy (8bit):	5.518492323857505
Encrypted:	false
SSDEEP:	48:cpTRUyqeBJCK27cYD5anK87SZ09lJ4/P+vFgRIvDkvWSWEVtyLRF:ORoePCKkcWFpcFla/Vt4
MD5:	2FEAD4510B81389BF6D8A5FCA4BE2005
SHA1:	411313AB9F1EDAD3F418F6D6ECAE47E0E838F110
SHA-256:	FEEE73374E0ADF0BC949CC69E3891FB4EE00F859FABD73FF8B424A57168B3206
SHA-512:	9E49F6D5A05DD7B4A1D23F9619B09E423EE179B81B30970712D8EE6228EF67E4297B818E648D84108AE579E120F30B60AC90F75217F010A613D9ABBAA68337AF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="PointCount" GUID="{70EF65D9-A7B4-4B93-BC0C-5E48345B51C9}">.. <Properties>.. <Property Class="Type" GUID="{D9675E75-E749-46C3-B69C-D66BF4A07FE3}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{C2F6C883-C53D-457D-BDE3-F776F533B18E}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">PointCount</Property>.. <Property Class="Number" GUID="{A6048AD3-0A9F-42A0-8E98-1BEC6F44E335}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">28</Property>.. <Property Class="Text" GUID="{A5C3AC26-178E-40A5-AC2E-62413E2BD3EE}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{70EF65D9-A7B4-4B93-BC0C-5E48345B51C9}</Property>.. <Property Class="Memo" GUID="{C6EDA4E8-3510-4B6D-BD6A-F9E9860D85AF}" Name="Form Layout" systemhidden="True"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\PointCount\is-HI435.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (522), with CRLF line terminators
Category:	dropped
Size (bytes):	3295
Entropy (8bit):	5.518492323857505
Encrypted:	false
SSDEEP:	48:cpTRUyqeBJCK27cYD5anK87SZ09lJ4/P+vFgRIvDkvWSWEVtyLRF:ORoePCKkcWFpcFla/Vt4
MD5:	2FEAD4510B81389BF6D8A5FCA4BE2005
SHA1:	411313AB9F1EDAD3F418F6D6ECAE47E0E838F110
SHA-256:	FEEE73374E0ADF0BC949CC69E3891FB4EE00F859FABD73FF8B424A57168B3206
SHA-512:	9E49F6D5A05DD7B4A1D23F9619B09E423EE179B81B30970712D8EE6228EF67E4297B818E648D84108AE579E120F30B60AC90F75217F010A613D9ABBAA68337AF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="PointCount" GUID="{70EF65D9-A7B4-4B93-BC0C-5E48345B51C9}">.. <Properties>.. <Property Class="Type" GUID="{D9675E75-E749-46C3-B69C-D66BF4A07FE3}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{C2F6C883-C53D-457D-BDE3-F776F533B18E}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">PointCount</Property>.. <Property Class="Number" GUID="{A6048AD3-0A9F-42A0-8E98-1BEC6F44E335}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">28</Property>.. <Property Class="Text" GUID="{A5C3AC26-178E-40A5-AC2E-62413E2BD3EE}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{70EF65D9-A7B4-4B93-BC0C-5E48345B51C9}</Property>.. <Property Class="Memo" GUID="{C6EDA4E8-3510-4B6D-BD6A-F9E9860D85AF}" Name="Form Layout" systemhidden="True"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\PropertyCount\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (526), with CRLF line terminators
Category:	dropped
Size (bytes):	3309
Entropy (8bit):	5.507486539327465
Encrypted:	false
SSDEEP:	48:cCsqYQwjgjERGyRYD5anK87SZ09lJF5zUOvFgRIvDNvWgVHiGb:PsqekjERGyRWFCjFld/VHb
MD5:	D203DE7B496B77C878444AB0C6494810
SHA1:	0C94E35242B7FAE802BBF147E220E2FF4A114902
SHA-256:	88EA8A87D96DE62DB1A718C753434B46D9A92ACCE7F102085D7925517A57F098
SHA-512:	5A866CB440DDD94A74805BC124EC7921A9D9D082D71F4A2D2AFA504D4EF05539454FDB216930131CDDCC6E07409DBC221EADC23FB448DC3DABD29BBFA8289934
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="PropertyCount" GUID="{8B39EFC0-C5A7-42EE-A8BC-BF79CAC38EEC}">.. <Properties>.. <Property Class="Type" GUID="{3E5A131E-9D4B-4170-B2AC-483F941E8C3D}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{10D1FAE7-24ED-4864-9886-B337AF281C75}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">PropertyCount</Property>.. <Property Class="Number" GUID="{23B88FF2-8965-430A-AEA4-A819A351A0F2}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">29</Property>.. <Property Class="Text" GUID="{CF05B249-ADB3-420D-BA49-A4AC849A97FD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{8B39EFC0-C5A7-42EE-A8BC-BF79CAC38EEC}</Property>.. <Property Class="Memo" GUID="{8B2CA9AE-DFF2-4A26-9CA2-9A9630A22B61}" Name="Form Layout" systemhidden="

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\PropertyCount\is-P2QHL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (526), with CRLF line terminators
Category:	dropped
Size (bytes):	3309
Entropy (8bit):	5.507486539327465
Encrypted:	false
SSDEEP:	48:cCsqYQwjgjERGyRYD5anK87SZ09lJF5zUOvFgRIvDNvWgVHiGb:PsqekjERGyRWFCjFld/VHb
MD5:	D203DE7B496B77C878444AB0C6494810
SHA1:	0C94E35242B7FAE802BBF147E220E2FF4A114902
SHA-256:	88EA8A87D96DE62DB1A718C753434B46D9A92ACCE7F102085D7925517A57F098
SHA-512:	5A866CB440DDD94A74805BC124EC7921A9D9D082D71F4A2D2AFA504D4EF05539454FDB216930131CDDCC6E07409DBC221EADC23FB448DC3DABD29BBFA8289934
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="PropertyCount" GUID="{8B39EFC0-C5A7-42EE-A8BC-BF79CAC38EEC}">.. <Properties>.. <Property Class="Type" GUID="{3E5A131E-9D4B-4170-B2AC-483F941E8C3D}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{10D1FAE7-24ED-4864-9886-B337AF281C75}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">PropertyCount</Property>.. <Property Class="Number" GUID="{23B88FF2-8965-430A-AEA4-A819A351A0F2}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">29</Property>.. <Property Class="Text" GUID="{CF05B249-ADB3-420D-BA49-A4AC849A97FD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{8B39EFC0-C5A7-42EE-A8BC-BF79CAC38EEC}</Property>.. <Property Class="Memo" GUID="{8B2CA9AE-DFF2-4A26-9CA2-9A9630A22B61}" Name="Form Layout" systemhidden="

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\PropertyItem\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (873), with CRLF line terminators
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	5.502939065343623
Encrypted:	false
SSDEEP:	48:c+QRbsc/pQ8oOmHfch//xduYD5anK87SZ09lJG4Rgn8hFoK13/vFgRIvDUIvtvix:qRwcYOmH0l/xduWFFKtFlfZG3eRVQKy
MD5:	136361FBA3976B65E0FE1908F2B1FE35
SHA1:	CDEFE865A1D5BDD228A25EF6956FDF9471D436D7
SHA-256:	47A75BB87DB139A06248CE2467A527F3FB81CE9A42F072536FD5794F477A9869
SHA-512:	D4BB59E4A421085DE97A647BEB820B1BECC50B9ED09AC3EADCBB8213F0D9F2F5940094D8B338B785D1CA674A4B92A00B8F6026A4FA078989C7DFF55FD3F22FFB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="PropertyItem" GUID="{8E053BBB-7900-4346-A3FE-FE91F8B4591B}">.. <Properties>.. <Property Class="Type" GUID="{96D1B5F0-3F7C-4A9E-86BE-673C5637F963}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{27C42735-BD9F-44FE-ABD5-7CF4EFCFDDF9}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">PropertyItem</Property>.. <Property Class="Number" GUID="{12D52FC5-8955-4E6F-986A-49F5BC5E071B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">30</Property>.. <Property Class="Text" GUID="{6DABBD28-122A-411A-9E29-E74271445A60}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{8E053BBB-7900-4346-A3FE-FE91F8B4591B}</Property>.. <Property Class="Memo" GUID="{144BF8DB-D664-4112-B960-6968E0B722D5}" Name="Form Layout" systemhidden="Tr

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\PropertyItem\is-CP7AE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (873), with CRLF line terminators
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	5.502939065343623
Encrypted:	false
SSDEEP:	48:c+QRbsc/pQ8oOmHfch//xduYD5anK87SZ09lJG4Rgn8hFoK13/vFgRIvDUIvtvix:qRwcYOmH0l/xduWFFKtFlfZG3eRVQKy
MD5:	136361FBA3976B65E0FE1908F2B1FE35
SHA1:	CDEFE865A1D5BDD228A25EF6956FDF9471D436D7
SHA-256:	47A75BB87DB139A06248CE2467A527F3FB81CE9A42F072536FD5794F477A9869
SHA-512:	D4BB59E4A421085DE97A647BEB820B1BECC50B9ED09AC3EADCBB8213F0D9F2F5940094D8B338B785D1CA674A4B92A00B8F6026A4FA078989C7DFF55FD3F22FFB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="PropertyItem" GUID="{8E053BBB-7900-4346-A3FE-FE91F8B4591B}">.. <Properties>.. <Property Class="Type" GUID="{96D1B5F0-3F7C-4A9E-86BE-673C5637F963}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{27C42735-BD9F-44FE-ABD5-7CF4EFCFDDF9}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">PropertyItem</Property>.. <Property Class="Number" GUID="{12D52FC5-8955-4E6F-986A-49F5BC5E071B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">30</Property>.. <Property Class="Text" GUID="{6DABBD28-122A-411A-9E29-E74271445A60}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{8E053BBB-7900-4346-A3FE-FE91F8B4591B}</Property>.. <Property Class="Memo" GUID="{144BF8DB-D664-4112-B960-6968E0B722D5}" Name="Form Layout" systemhidden="Tr

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\SetPoint\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (983), with CRLF line terminators
Category:	dropped
Size (bytes):	4840
Entropy (8bit):	5.434789434340062
Encrypted:	false
SSDEEP:	96:7YYxWQXkWsL7Neea7G+uLZGNYNjWCVciff:7YmLuL7Iea7G+uLZGNYNjWsbff
MD5:	C093E3D8F7E922EC9ADC818A2DEE5077
SHA1:	1D3B2FED5F13274A92F9D6F65691490FEA4904CD
SHA-256:	74712EF3429E004B41BB45332B287D2B06858875DC93F43D765C851BA85262D4
SHA-512:	B2DFAF4A9EE614F971B62BF1BAD6E5FF7848C63C138E9549F3C2CCB61360F1B76952B5B4E77CF30B9E8074CF2D30C4437E3A47BCCDA83AB02E9CB38FEBEF0918
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SetPoint" GUID="{041C5A01-7C61-40B2-8E4E-91310BD89E57}">.. <Properties>.. <Property Class="Type" GUID="{D7161BE7-D01C-4434-A862-8BC3060E7C1E}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Procedure</Property>.. <Property Class="Text" GUID="{C2F9B7A8-DAC7-4A2E-ADC6-861749A7A659}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SetPoint</Property>.. <Property Class="Number" GUID="{0ED014EB-DF0C-4688-A91E-E86949466CE4}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">31</Property>.. <Property Class="Text" GUID="{FF9A5966-2E96-4023-BD38-2257803A9180}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{041C5A01-7C61-40B2-8E4E-91310BD89E57}</Property>.. <Property Class="Memo" GUID="{59C293F7-3E49-4EC6-9F7A-44C40D94EE0C}" Name="Form Layout" systemhidden="True" Ord

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\SetPoint\is-6FTNL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (983), with CRLF line terminators
Category:	dropped
Size (bytes):	4840
Entropy (8bit):	5.434789434340062
Encrypted:	false
SSDEEP:	96:7YYxWQXkWsL7Neea7G+uLZGNYNjWCVciff:7YmLuL7Iea7G+uLZGNYNjWsbff
MD5:	C093E3D8F7E922EC9ADC818A2DEE5077
SHA1:	1D3B2FED5F13274A92F9D6F65691490FEA4904CD
SHA-256:	74712EF3429E004B41BB45332B287D2B06858875DC93F43D765C851BA85262D4
SHA-512:	B2DFAF4A9EE614F971B62BF1BAD6E5FF7848C63C138E9549F3C2CCB61360F1B76952B5B4E77CF30B9E8074CF2D30C4437E3A47BCCDA83AB02E9CB38FEBEF0918
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SetPoint" GUID="{041C5A01-7C61-40B2-8E4E-91310BD89E57}">.. <Properties>.. <Property Class="Type" GUID="{D7161BE7-D01C-4434-A862-8BC3060E7C1E}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Procedure</Property>.. <Property Class="Text" GUID="{C2F9B7A8-DAC7-4A2E-ADC6-861749A7A659}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SetPoint</Property>.. <Property Class="Number" GUID="{0ED014EB-DF0C-4688-A91E-E86949466CE4}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">31</Property>.. <Property Class="Text" GUID="{FF9A5966-2E96-4023-BD38-2257803A9180}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{041C5A01-7C61-40B2-8E4E-91310BD89E57}</Property>.. <Property Class="Memo" GUID="{59C293F7-3E49-4EC6-9F7A-44C40D94EE0C}" Name="Form Layout" systemhidden="True" Ord

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\SetPropertyFormula\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (733), with CRLF line terminators
Category:	dropped
Size (bytes):	3691
Entropy (8bit):	5.49396198851378
Encrypted:	false
SSDEEP:	48:clek8RRER4HOSqqr6YD5anKMumPZ09lJNB8IIz6aNcIvDglvtivRUvB9FbVrz8BQ:i8RukqqOWsmKNzO6kLRV7Nau
MD5:	0811D304179E25D93F0E1FDE1C2C9031
SHA1:	2A0036700FA921F160A1EED2E5A3F570440C3B74
SHA-256:	67AC7C263FBEC4E936BE64CE4CBFE36643F682F4260911B0678DAF9EDD15D311
SHA-512:	2368FA9BF1AAF9744BF10F7F2C126417FA0FDC0A96C8A194BB0A8937EE4484E154DD43E6605EC15FD6282463E8F0E2C5BF4EB4998D94FE165E54D68EFAA74C83
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SetPropertyFormula" GUID="{FDCC29BF-C3A2-48E7-BB47-C49D23F983E2}">.. <Properties>.. <Property Class="Type" GUID="{30B357B2-331E-47AE-A327-22F595435E63}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Procedure</Property>.. <Property Class="Text" GUID="{03871980-E6EE-46E3-B875-C91F5811020A}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SetPropertyFormula</Property>.. <Property Class="Number" GUID="{74545B75-3A01-4DDD-8A4C-6673B34986A0}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">32</Property>.. <Property Class="Text" GUID="{14F3B0A5-C324-40CD-8786-BBE87376D8F3}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{FDCC29BF-C3A2-48E7-BB47-C49D23F983E2}</Property>.. <Property Class="Memo" GUID="{53E5C0EE-31F7-4383-9D11-F8DE5D9E0BDB}" Name="Form Layout" sys

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\SetPropertyFormula\is-MS6FT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (733), with CRLF line terminators
Category:	dropped
Size (bytes):	3691
Entropy (8bit):	5.49396198851378
Encrypted:	false
SSDEEP:	48:clek8RRER4HOSqqr6YD5anKMumPZ09lJNB8IIz6aNcIvDglvtivRUvB9FbVrz8BQ:i8RukqqOWsmKNzO6kLRV7Nau
MD5:	0811D304179E25D93F0E1FDE1C2C9031
SHA1:	2A0036700FA921F160A1EED2E5A3F570440C3B74
SHA-256:	67AC7C263FBEC4E936BE64CE4CBFE36643F682F4260911B0678DAF9EDD15D311
SHA-512:	2368FA9BF1AAF9744BF10F7F2C126417FA0FDC0A96C8A194BB0A8937EE4484E154DD43E6605EC15FD6282463E8F0E2C5BF4EB4998D94FE165E54D68EFAA74C83
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SetPropertyFormula" GUID="{FDCC29BF-C3A2-48E7-BB47-C49D23F983E2}">.. <Properties>.. <Property Class="Type" GUID="{30B357B2-331E-47AE-A327-22F595435E63}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Procedure</Property>.. <Property Class="Text" GUID="{03871980-E6EE-46E3-B875-C91F5811020A}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SetPropertyFormula</Property>.. <Property Class="Number" GUID="{74545B75-3A01-4DDD-8A4C-6673B34986A0}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">32</Property>.. <Property Class="Text" GUID="{14F3B0A5-C324-40CD-8786-BBE87376D8F3}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{FDCC29BF-C3A2-48E7-BB47-C49D23F983E2}</Property>.. <Property Class="Memo" GUID="{53E5C0EE-31F7-4383-9D11-F8DE5D9E0BDB}" Name="Form Layout" sys

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IItem\is-EV9CL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (707), with CRLF line terminators
Category:	dropped
Size (bytes):	3858
Entropy (8bit):	5.48491315960604
Encrypted:	false
SSDEEP:	48:cic3cg1Do8oXGVHTScQYD5anKreBuPZ0ClSwfIm+nKQDpaNtVtIvFgRIvDGvW7Kt:K3cn7XGFhQWPZInpGMFlgsK4pGErXI
MD5:	3C7E524B04B0DB2B4498BFB555AAA9E4
SHA1:	1A87849CDD80985235BD2436CCD243F5B36DC4D5
SHA-256:	369F249B01687EE9D46085114EB7EE2DDB2BD007109F79EE7779FBCDAD154F24
SHA-512:	43B18438F80EC0E275DB845C8C38DF453B8D6FD3AF63697129BACF0E977064881785E34F50038B17A026DD8D806218F87F66D67D5BD485B720C7AE865FD244FD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="IItem" GUID="{12C0D7F8-181E-4195-AC81-561A3EA365A0}">.. <Properties>.. <Property Class="Type" GUID="{25F086E6-BDEA-4836-8A83-68093DBFAFB4}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Object</Property>.. <Property Class="Text" GUID="{9D6DF743-9D49-43DF-BB36-72EF61708846}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">IItem</Property>.. <Property Class="Number" GUID="{4C2F0026-7255-42F3-9DF7-7F177A289CAC}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">18</Property>.. <Property Class="Text" GUID="{43CD5482-073F-46A9-83F6-BCA513A9EE1D}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{12C0D7F8-181E-4195-AC81-561A3EA365A0}</Property>.. <Property Class="Memo" GUID="{D0FC529F-5630-4483-B4C0-14AB6DDE7951}" Name="Form Layout" systemhidden="True" OrderIndex="

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\Adjust\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (527), with CRLF line terminators
Category:	dropped
Size (bytes):	3210
Entropy (8bit):	5.532180477181483
Encrypted:	false
SSDEEP:	48:czxDs/WuWpew/sxItFFovFgvvDyvWD7k0bFLyozxUD5anK87ClJA:8mxWw2NyFS88k0Bmoda6
MD5:	34FEE17E4491F91BFAED97411F6191EC
SHA1:	766C0F28F736501A63F31288AFFB9086B0689E25
SHA-256:	C9D02E8EEB7BB2BF6D6155A6C622AC34AC7A1AEE7B2716781D3950F6D200BDD5
SHA-512:	1316F4A6E1E1F77BFD66C7C626603D9BB1785F42AB50AF498078287CA868DD75FE868101FCA3CA6470139BDA6E750B2751A36A34F1FDC59023ACCAA618A85D89
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Adjust" GUID="{64A3DA6B-38CD-4055-AB9E-4DAD1A57F61B}">.. <Properties>.. <Property Class="Type" GUID="{87F66B5F-0DD4-4E0C-9E20-E4F55BD53A8C}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{87E7EBE2-C9A6-4789-B6D4-3A7BA9FD7576}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">Adjust</Property>.. <Property Class="Number" GUID="{C38F6913-9AC5-44AC-9F05-31D0DDC598D8}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">0</Property>.. <Property Class="Text" GUID="{70DDC4A3-1908-46CC-A5CD-B4B94F300890}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{64A3DA6B-38CD-4055-AB9E-4DAD1A57F61B}</Property>.. <Property Class="Memo" GUID="{8C359377-95F1-4D3F-ABF9-DC0CA010A2C1}" Name="HTMLSource" OrderIndex="5" DecimalPlaces="

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\Adjust\is-0GRFC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (527), with CRLF line terminators
Category:	dropped
Size (bytes):	3210
Entropy (8bit):	5.532180477181483
Encrypted:	false
SSDEEP:	48:czxDs/WuWpew/sxItFFovFgvvDyvWD7k0bFLyozxUD5anK87ClJA:8mxWw2NyFS88k0Bmoda6
MD5:	34FEE17E4491F91BFAED97411F6191EC
SHA1:	766C0F28F736501A63F31288AFFB9086B0689E25
SHA-256:	C9D02E8EEB7BB2BF6D6155A6C622AC34AC7A1AEE7B2716781D3950F6D200BDD5
SHA-512:	1316F4A6E1E1F77BFD66C7C626603D9BB1785F42AB50AF498078287CA868DD75FE868101FCA3CA6470139BDA6E750B2751A36A34F1FDC59023ACCAA618A85D89
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Adjust" GUID="{64A3DA6B-38CD-4055-AB9E-4DAD1A57F61B}">.. <Properties>.. <Property Class="Type" GUID="{87F66B5F-0DD4-4E0C-9E20-E4F55BD53A8C}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{87E7EBE2-C9A6-4789-B6D4-3A7BA9FD7576}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">Adjust</Property>.. <Property Class="Number" GUID="{C38F6913-9AC5-44AC-9F05-31D0DDC598D8}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">0</Property>.. <Property Class="Text" GUID="{70DDC4A3-1908-46CC-A5CD-B4B94F300890}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{64A3DA6B-38CD-4055-AB9E-4DAD1A57F61B}</Property>.. <Property Class="Memo" GUID="{8C359377-95F1-4D3F-ABF9-DC0CA010A2C1}" Name="HTMLSource" OrderIndex="5" DecimalPlaces="

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\CalculateBeforeInher\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (573), with CRLF line terminators
Category:	dropped
Size (bytes):	3372
Entropy (8bit):	5.513670357073084
Encrypted:	false
SSDEEP:	48:cFslh8LTvOFUtvFgvvD/vWHZoUbMjK17RUD5anK87ClJA:0DTnFSb0Z3Na6
MD5:	7CF8F3EE77AAE153171F954B0D866AFB
SHA1:	0532EA5FDB9E1EEEB89ED97E43D63C4F03AF4A32
SHA-256:	05391321EF8E796E51BB5494DC0ECCD8744C26807EF0A328E1E8BD142A88B598
SHA-512:	A2EAA60EC556CA5A1995665160CCFB5D80AC66F7B9A62B1BC73DDF4C159608559857218548F54D2A93BFC11BE0461075CDAF0CE369DD5096996EE202A43A9EA7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="CalculateBeforeInherit" GUID="{3BAFB2D1-74C1-4AAC-9CC3-826D7A527396}">.. <Properties>.. <Property Class="Type" GUID="{280AF4DA-DABB-43A3-8C3F-BD16BFB24E4E}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{712AD326-58C9-4A7F-BC66-A9E73BC6EB79}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">CalculateBeforeInherit</Property>.. <Property Class="Number" GUID="{DF45897F-6B8F-43C8-91BC-181097C13C16}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">1</Property>.. <Property Class="Text" GUID="{B50A7750-3106-46D3-9E33-4F12338D65FB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{3BAFB2D1-74C1-4AAC-9CC3-826D7A527396}</Property>.. <Property Class="Memo" GUID="{7862491A-31EE-4FDE-87CD-9DD789441A05}" Name="HTMLSource

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\CalculateBeforeInher\is-CVUV8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (573), with CRLF line terminators
Category:	dropped
Size (bytes):	3372
Entropy (8bit):	5.513670357073084
Encrypted:	false
SSDEEP:	48:cFslh8LTvOFUtvFgvvD/vWHZoUbMjK17RUD5anK87ClJA:0DTnFSb0Z3Na6
MD5:	7CF8F3EE77AAE153171F954B0D866AFB
SHA1:	0532EA5FDB9E1EEEB89ED97E43D63C4F03AF4A32
SHA-256:	05391321EF8E796E51BB5494DC0ECCD8744C26807EF0A328E1E8BD142A88B598
SHA-512:	A2EAA60EC556CA5A1995665160CCFB5D80AC66F7B9A62B1BC73DDF4C159608559857218548F54D2A93BFC11BE0461075CDAF0CE369DD5096996EE202A43A9EA7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="CalculateBeforeInherit" GUID="{3BAFB2D1-74C1-4AAC-9CC3-826D7A527396}">.. <Properties>.. <Property Class="Type" GUID="{280AF4DA-DABB-43A3-8C3F-BD16BFB24E4E}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{712AD326-58C9-4A7F-BC66-A9E73BC6EB79}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">CalculateBeforeInherit</Property>.. <Property Class="Number" GUID="{DF45897F-6B8F-43C8-91BC-181097C13C16}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">1</Property>.. <Property Class="Text" GUID="{B50A7750-3106-46D3-9E33-4F12338D65FB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{3BAFB2D1-74C1-4AAC-9CC3-826D7A527396}</Property>.. <Property Class="Memo" GUID="{7862491A-31EE-4FDE-87CD-9DD789441A05}" Name="HTMLSource

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\CalculateBeforeInherit\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1161), with CRLF line terminators
Category:	dropped
Size (bytes):	8462
Entropy (8bit):	5.214773052983936
Encrypted:	false
SSDEEP:	192:rdOOdOcdOBdOPdOVAbCQdONEgdOKdOidOc:rdOOdOcdOBdOPdOPQdOGgdOKdOidOc
MD5:	58231ECF8378A9474F6864490168A2EB
SHA1:	44145032258F0116DD46298469D111C9CC7FE758
SHA-256:	FE16065EA9CD103D6C2278A11888F47398A0A4848ACC649292C2C4E07E671D39
SHA-512:	1DCB32E4D3B8416EC637508E6F06D5EFC075117C8390B1EDC33D11919B003439DED95680546FCD7055D3E260965558E8D92DA3A991B321A92582B7BC35E959A6
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="CalculateBeforeInherit" GUID="{3BAFB2D1-74C1-4AAC-9CC3-826D7A527396}">.. <Properties>.. <Property Class="Type" GUID="{280AF4DA-DABB-43A3-8C3F-BD16BFB24E4E}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Property</Property>.. <Property Class="Text" GUID="{712AD326-58C9-4A7F-BC66-A9E73BC6EB79}" Name="Name" inheritaction="Ignore" calc

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\CalculateBeforeInherit\is-5SR0U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1161), with CRLF line terminators
Category:	dropped
Size (bytes):	8462
Entropy (8bit):	5.214773052983936
Encrypted:	false
SSDEEP:	192:rdOOdOcdOBdOPdOVAbCQdONEgdOKdOidOc:rdOOdOcdOBdOPdOPQdOGgdOKdOidOc
MD5:	58231ECF8378A9474F6864490168A2EB
SHA1:	44145032258F0116DD46298469D111C9CC7FE758
SHA-256:	FE16065EA9CD103D6C2278A11888F47398A0A4848ACC649292C2C4E07E671D39
SHA-512:	1DCB32E4D3B8416EC637508E6F06D5EFC075117C8390B1EDC33D11919B003439DED95680546FCD7055D3E260965558E8D92DA3A991B321A92582B7BC35E959A6
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="CalculateBeforeInherit" GUID="{3BAFB2D1-74C1-4AAC-9CC3-826D7A527396}">.. <Properties>.. <Property Class="Type" GUID="{280AF4DA-DABB-43A3-8C3F-BD16BFB24E4E}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Property</Property>.. <Property Class="Text" GUID="{712AD326-58C9-4A7F-BC66-A9E73BC6EB79}" Name="Name" inheritaction="Ignore" calc

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\CompileDenyOLE\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (542), with CRLF line terminators
Category:	dropped
Size (bytes):	3294
Entropy (8bit):	5.533398853462572
Encrypted:	false
SSDEEP:	48:c7JCpSbqlBcq5w7Ch+5vFgvvDuvWCdYBnbwi2/rKUD5anK87ClJA:A5bqly4w7xFSAlYBnLUrKa6
MD5:	735E4C0DB2A621D2410759AC16EE3927
SHA1:	F787B58FBDEC084DFD2419D1245590FBC014DF08
SHA-256:	06B64E20E3D7D51A2DB7EA6BCA3FAEC6EAE9B4277492B0065A2156105D7996AF
SHA-512:	03765803DA2ECDF3CE0208C6509E3115B751AACDB29F5D5304DD69DA32F833CA50981E33D6AB77AAA8C99F138F7792A6D83DA08BA423411DD3359CDF6E7061BD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="CompileDenyOLE" GUID="{C26AC3C4-F768-4494-BB37-C9F3072EB831}">.. <Properties>.. <Property Class="Type" GUID="{F238671C-5FA2-4C9B-B06F-DA82983975D9}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{78F6A2CC-3FEF-429F-8775-B1ED08EF8392}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">CompileDenyOLE</Property>.. <Property Class="Number" GUID="{97374E3A-0370-49AD-880E-9C49FEF9FD6F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">2</Property>.. <Property Class="Text" GUID="{36B323AC-9411-4A20-899B-8D9A07D5B625}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{C26AC3C4-F768-4494-BB37-C9F3072EB831}</Property>.. <Property Class="Memo" GUID="{7BBCA9FD-AE32-477B-B132-579C58D4612D}" Name="HTMLSource" OrderIndex="5"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\CompileDenyOLE\is-7U44I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (542), with CRLF line terminators
Category:	dropped
Size (bytes):	3294
Entropy (8bit):	5.533398853462572
Encrypted:	false
SSDEEP:	48:c7JCpSbqlBcq5w7Ch+5vFgvvDuvWCdYBnbwi2/rKUD5anK87ClJA:A5bqly4w7xFSAlYBnLUrKa6
MD5:	735E4C0DB2A621D2410759AC16EE3927
SHA1:	F787B58FBDEC084DFD2419D1245590FBC014DF08
SHA-256:	06B64E20E3D7D51A2DB7EA6BCA3FAEC6EAE9B4277492B0065A2156105D7996AF
SHA-512:	03765803DA2ECDF3CE0208C6509E3115B751AACDB29F5D5304DD69DA32F833CA50981E33D6AB77AAA8C99F138F7792A6D83DA08BA423411DD3359CDF6E7061BD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="CompileDenyOLE" GUID="{C26AC3C4-F768-4494-BB37-C9F3072EB831}">.. <Properties>.. <Property Class="Type" GUID="{F238671C-5FA2-4C9B-B06F-DA82983975D9}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{78F6A2CC-3FEF-429F-8775-B1ED08EF8392}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">CompileDenyOLE</Property>.. <Property Class="Number" GUID="{97374E3A-0370-49AD-880E-9C49FEF9FD6F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">2</Property>.. <Property Class="Text" GUID="{36B323AC-9411-4A20-899B-8D9A07D5B625}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{C26AC3C4-F768-4494-BB37-C9F3072EB831}</Property>.. <Property Class="Memo" GUID="{7BBCA9FD-AE32-477B-B132-579C58D4612D}" Name="HTMLSource" OrderIndex="5"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\CompileDenyRead\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (546), with CRLF line terminators
Category:	dropped
Size (bytes):	3304
Entropy (8bit):	5.532374908451615
Encrypted:	false
SSDEEP:	48:crKQQpNcSCfumZISQ+8hSbvFgvvD+vW5lbCqO/zyjTUD5anK87ClJA:EKhpTCf75zvFSAalJczyjTa6
MD5:	0E75C45F0F26F29E18208AA04C90B953
SHA1:	4325C4FF2033385808524A502265617238C68D79
SHA-256:	FA5E1776EDB414D87C764BAF6C3C01790CBF1110E46BA7621F185FDA7F09B901
SHA-512:	BAD56DB0EDD71AC3346B8A8ECB79DB8951D2FB22E7ED35D6263D890B848BCA5A24D5B0C07FDCF6904AC16BAE76B9F829FFEFD62E42490417E5EEB51265979A37
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="CompileDenyRead" GUID="{0118D1AD-3650-44C5-92D4-773B9EAD3A2B}">.. <Properties>.. <Property Class="Type" GUID="{ADE37A11-A4B2-4417-83CD-59A88924BC3B}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{121AB8B9-1B91-496A-BC94-EA684F4A9D72}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">CompileDenyRead</Property>.. <Property Class="Number" GUID="{38471FF4-BBE4-47DC-85FD-DF85C33CECA2}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">3</Property>.. <Property Class="Text" GUID="{FA096CD2-1053-4246-863A-E98C11B6F29B}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{0118D1AD-3650-44C5-92D4-773B9EAD3A2B}</Property>.. <Property Class="Memo" GUID="{3890C732-7423-4E34-8F82-6653E825150A}" Name="HTMLSource" OrderIndex="

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\CompileDenyRead\is-PS9UU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (546), with CRLF line terminators
Category:	dropped
Size (bytes):	3304
Entropy (8bit):	5.532374908451615
Encrypted:	false
SSDEEP:	48:crKQQpNcSCfumZISQ+8hSbvFgvvD+vW5lbCqO/zyjTUD5anK87ClJA:EKhpTCf75zvFSAalJczyjTa6
MD5:	0E75C45F0F26F29E18208AA04C90B953
SHA1:	4325C4FF2033385808524A502265617238C68D79
SHA-256:	FA5E1776EDB414D87C764BAF6C3C01790CBF1110E46BA7621F185FDA7F09B901
SHA-512:	BAD56DB0EDD71AC3346B8A8ECB79DB8951D2FB22E7ED35D6263D890B848BCA5A24D5B0C07FDCF6904AC16BAE76B9F829FFEFD62E42490417E5EEB51265979A37
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="CompileDenyRead" GUID="{0118D1AD-3650-44C5-92D4-773B9EAD3A2B}">.. <Properties>.. <Property Class="Type" GUID="{ADE37A11-A4B2-4417-83CD-59A88924BC3B}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{121AB8B9-1B91-496A-BC94-EA684F4A9D72}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">CompileDenyRead</Property>.. <Property Class="Number" GUID="{38471FF4-BBE4-47DC-85FD-DF85C33CECA2}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">3</Property>.. <Property Class="Text" GUID="{FA096CD2-1053-4246-863A-E98C11B6F29B}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{0118D1AD-3650-44C5-92D4-773B9EAD3A2B}</Property>.. <Property Class="Memo" GUID="{3890C732-7423-4E34-8F82-6653E825150A}" Name="HTMLSource" OrderIndex="

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\CompileDenyWrite\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (550), with CRLF line terminators
Category:	dropped
Size (bytes):	3314
Entropy (8bit):	5.5174745887586845
Encrypted:	false
SSDEEP:	48:cTNU5oSmbX3CmjWIvFgvvD7vWm34ubrU/nUD5anK87ClJA:aNQlmbXpFSXF4uena6
MD5:	335175241E7F743D2BACF1C8B9ABE53F
SHA1:	4875B1E488CC4006C2581BE4536C1C2DE9CD51B0
SHA-256:	7349D1FBADB3E9501E46C29A897AC0306AB44AE0436585F48B28B7FB7EA8667D
SHA-512:	3BC5CAA0312F01892D28EEDD8777422639F6F9F75E6A320BCD26A97DBC50B5B52AAEA4A401C65B566D4FF6E1478B406C209EE5339885DCB869FF9A882BE93D68
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="CompileDenyWrite" GUID="{4B03A727-4BC8-44A9-B8EF-997021D22F07}">.. <Properties>.. <Property Class="Type" GUID="{36BE97CF-8CC2-40B5-AD22-FDAB7D1B6D96}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{0DEE84F9-E12D-4A84-AF0F-46B2288FCE92}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">CompileDenyWrite</Property>.. <Property Class="Number" GUID="{98C6FE52-C2C0-4AE4-83DE-ED8C3ADEBC31}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">4</Property>.. <Property Class="Text" GUID="{9FEECED4-2F94-438E-83FD-CBC908CE6678}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{4B03A727-4BC8-44A9-B8EF-997021D22F07}</Property>.. <Property Class="Memo" GUID="{43B27A7F-5B6A-48FF-9D64-89974B46CC20}" Name="HTMLSource" OrderIndex

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\CompileDenyWrite\is-UQ8C2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (550), with CRLF line terminators
Category:	dropped
Size (bytes):	3314
Entropy (8bit):	5.5174745887586845
Encrypted:	false
SSDEEP:	48:cTNU5oSmbX3CmjWIvFgvvD7vWm34ubrU/nUD5anK87ClJA:aNQlmbXpFSXF4uena6
MD5:	335175241E7F743D2BACF1C8B9ABE53F
SHA1:	4875B1E488CC4006C2581BE4536C1C2DE9CD51B0
SHA-256:	7349D1FBADB3E9501E46C29A897AC0306AB44AE0436585F48B28B7FB7EA8667D
SHA-512:	3BC5CAA0312F01892D28EEDD8777422639F6F9F75E6A320BCD26A97DBC50B5B52AAEA4A401C65B566D4FF6E1478B406C209EE5339885DCB869FF9A882BE93D68
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="CompileDenyWrite" GUID="{4B03A727-4BC8-44A9-B8EF-997021D22F07}">.. <Properties>.. <Property Class="Type" GUID="{36BE97CF-8CC2-40B5-AD22-FDAB7D1B6D96}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{0DEE84F9-E12D-4A84-AF0F-46B2288FCE92}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">CompileDenyWrite</Property>.. <Property Class="Number" GUID="{98C6FE52-C2C0-4AE4-83DE-ED8C3ADEBC31}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">4</Property>.. <Property Class="Text" GUID="{9FEECED4-2F94-438E-83FD-CBC908CE6678}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{4B03A727-4BC8-44A9-B8EF-997021D22F07}</Property>.. <Property Class="Memo" GUID="{43B27A7F-5B6A-48FF-9D64-89974B46CC20}" Name="HTMLSource" OrderIndex

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (744), with CRLF line terminators
Category:	dropped
Size (bytes):	3950
Entropy (8bit):	5.4816495369680265
Encrypted:	false
SSDEEP:	48:c8t6p1m8mhpt+O8daNtVtIvFgvvDGvWKB8O8daNtVtqE3EgJg94XJZD5anKreBuO:P+m8C8dGMFSgTBr8dGE9g44XJrPqb86
MD5:	95B5A83EB3B33D6012B646C02049E075
SHA1:	1DEC0ECC3F5CB4A5938FC8227958B8C319FFB8CB
SHA-256:	EDAB92140385C8205F90DDCEEB9A7A59C213B9D603D782E7BE1D228C59327CBD
SHA-512:	1CFA00F7E82F725055E24F0F422DBAA557ED1EF3707A6711AA5EAB5C9F1F299DAD07A6687A3D9847E2A306D854B012AF0A2609D4CBD528B6D98B605F40F2E906
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="IPropertyObject" GUID="{BB937A58-11F6-4282-AA44-17D1D63CBA46}">.. <Properties>.. <Property Class="Type" GUID="{263C1CC8-B867-4CB0-A9E8-12B1C070CD91}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Object</Property>.. <Property Class="Text" GUID="{E32FD0F0-674B-41DB-A817-6788421F2185}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">IPropertyObject</Property>.. <Property Class="Script" GUID="{5FE46B5A-5CB0-498B-85F6-34FFF5E71709}" Name="Source Code" input="True" group="Help" OrderIndex="3" DecimalPlaces="" List="cmbList" PluginToExecute="cmbList" Expression="True" ScriptType="Method" ScriptLanguage="Pascal" Parameters="">Result := Property.Name;</Property>.. <Property Class="Text" GUID="{3D39AEBE-A5C9-4A65-ADF5-CF22D5A11985}" Name="HtmlSource" group="Help" OrderIndex="4" DecimalPlaces="" List="cmbList" PluginToExecute="cmbList"><HTML>

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\DecimalPlaces\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (537), with CRLF line terminators
Category:	dropped
Size (bytes):	3282
Entropy (8bit):	5.517636739194914
Encrypted:	false
SSDEEP:	48:cZnWOjFJXBwTFuetHIEvFgvvDivWdtyRbPpb6UD5anK87ClJA:mW4iTFuCFS8gtGUa6
MD5:	2FF049D38F01F9EE26F69DE223A458CE
SHA1:	3A1167140AC3FEA0EA4642F4757D0B52DE62167F
SHA-256:	732911DA019A3FE7812C39CD7720183C0107BD749F98C1E66B0117BE523D83B3
SHA-512:	343C043189F38B88A163F97D22A0BA184CCBF6E0F9B7B7824D1FC5135092363A2BD572F96C0E441FDB22F940F37E48293A35AFD482E9C522A7A86CCAA29A6739
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="DecimalPlaces" GUID="{ED2E9380-42E0-453D-B1D9-A600E9FA769C}">.. <Properties>.. <Property Class="Type" GUID="{AC49B259-3C21-438C-957C-48019C118A22}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{4220294F-E471-4503-80C5-60D1B82AEB28}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">DecimalPlaces</Property>.. <Property Class="Number" GUID="{1BAB0C78-A5A6-4F6C-A224-8BF5FAA9BECA}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">5</Property>.. <Property Class="Text" GUID="{AA86C38F-3903-4A80-BB87-83B0ADBF248B}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{ED2E9380-42E0-453D-B1D9-A600E9FA769C}</Property>.. <Property Class="Memo" GUID="{A01D9256-5C0C-45F4-8891-228E7094F18A}" Name="HTMLSource" OrderIndex="5" D

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\DecimalPlaces\is-E4ERV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (537), with CRLF line terminators
Category:	dropped
Size (bytes):	3282
Entropy (8bit):	5.517636739194914
Encrypted:	false
SSDEEP:	48:cZnWOjFJXBwTFuetHIEvFgvvDivWdtyRbPpb6UD5anK87ClJA:mW4iTFuCFS8gtGUa6
MD5:	2FF049D38F01F9EE26F69DE223A458CE
SHA1:	3A1167140AC3FEA0EA4642F4757D0B52DE62167F
SHA-256:	732911DA019A3FE7812C39CD7720183C0107BD749F98C1E66B0117BE523D83B3
SHA-512:	343C043189F38B88A163F97D22A0BA184CCBF6E0F9B7B7824D1FC5135092363A2BD572F96C0E441FDB22F940F37E48293A35AFD482E9C522A7A86CCAA29A6739
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="DecimalPlaces" GUID="{ED2E9380-42E0-453D-B1D9-A600E9FA769C}">.. <Properties>.. <Property Class="Type" GUID="{AC49B259-3C21-438C-957C-48019C118A22}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{4220294F-E471-4503-80C5-60D1B82AEB28}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">DecimalPlaces</Property>.. <Property Class="Number" GUID="{1BAB0C78-A5A6-4F6C-A224-8BF5FAA9BECA}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">5</Property>.. <Property Class="Text" GUID="{AA86C38F-3903-4A80-BB87-83B0ADBF248B}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{ED2E9380-42E0-453D-B1D9-A600E9FA769C}</Property>.. <Property Class="Memo" GUID="{A01D9256-5C0C-45F4-8891-228E7094F18A}" Name="HTMLSource" OrderIndex="5" D

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\EditScript\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (572), with CRLF line terminators
Category:	dropped
Size (bytes):	3159
Entropy (8bit):	5.522424751266901
Encrypted:	false
SSDEEP:	48:caCI91yVB8xYD5anK87ClJFk1dnpNvDBIvWMVX8UnfFB:nCwMBEWzI0jVl7
MD5:	9BB7E4E1AE74B1F3AD64786C14C6C04B
SHA1:	F173E2CDD069F7066CE9DDF78EC6F771ED4244D0
SHA-256:	5DDB8686832E6A041011A756E13C2E3FE35549F315035948120B87273D7F9DE2
SHA-512:	5CE7EA3F3D9A9D02D56881827E983BCD3A8175D2E285779F916E4B0F91247142A6FAC3EE1648C8B6E34748F7B585721EEFD344FD5A4DE25CE6FA5A1462CD89F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="EditScript" GUID="{64AF8553-77D9-4D3F-9A2F-6A72B76091F7}">.. <Properties>.. <Property Class="Type" GUID="{B42A72C4-E5D7-4F9D-8D58-C89406787817}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Procedure</Property>.. <Property Class="Text" GUID="{E7AF91B9-C892-402E-BC2B-D7B65B9D2335}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">EditScript</Property>.. <Property Class="Number" GUID="{A04E9C39-6D9C-45FD-95AC-09C1E8C754AD}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">6</Property>.. <Property Class="Text" GUID="{28760492-BEE7-4B47-B44E-3B14F421FFE1}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{64AF8553-77D9-4D3F-9A2F-6A72B76091F7}</Property>.. <Property Class="Memo" GUID="{27B89A44-E0BD-462E-82FD-E5FCBFEEB429}" Name="Form Layout" systemhidden="True"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\EditScript\is-CJVIO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (572), with CRLF line terminators
Category:	dropped
Size (bytes):	3159
Entropy (8bit):	5.522424751266901
Encrypted:	false
SSDEEP:	48:caCI91yVB8xYD5anK87ClJFk1dnpNvDBIvWMVX8UnfFB:nCwMBEWzI0jVl7
MD5:	9BB7E4E1AE74B1F3AD64786C14C6C04B
SHA1:	F173E2CDD069F7066CE9DDF78EC6F771ED4244D0
SHA-256:	5DDB8686832E6A041011A756E13C2E3FE35549F315035948120B87273D7F9DE2
SHA-512:	5CE7EA3F3D9A9D02D56881827E983BCD3A8175D2E285779F916E4B0F91247142A6FAC3EE1648C8B6E34748F7B585721EEFD344FD5A4DE25CE6FA5A1462CD89F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="EditScript" GUID="{64AF8553-77D9-4D3F-9A2F-6A72B76091F7}">.. <Properties>.. <Property Class="Type" GUID="{B42A72C4-E5D7-4F9D-8D58-C89406787817}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Procedure</Property>.. <Property Class="Text" GUID="{E7AF91B9-C892-402E-BC2B-D7B65B9D2335}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">EditScript</Property>.. <Property Class="Number" GUID="{A04E9C39-6D9C-45FD-95AC-09C1E8C754AD}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">6</Property>.. <Property Class="Text" GUID="{28760492-BEE7-4B47-B44E-3B14F421FFE1}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{64AF8553-77D9-4D3F-9A2F-6A72B76091F7}</Property>.. <Property Class="Memo" GUID="{27B89A44-E0BD-462E-82FD-E5FCBFEEB429}" Name="Form Layout" systemhidden="True"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ExecuteScript1\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (492), with CRLF line terminators
Category:	dropped
Size (bytes):	2229
Entropy (8bit):	5.518067240294715
Encrypted:	false
SSDEEP:	24:2dFDsHxX2R/CApWo44gAW5F5t1OcWHqcGqD51NOr9P8HPf2WAdOcTHrb3HG89e/7:cA4MiTKYD51NOrl8V2mqnuIiQrw
MD5:	E0A5AF6F4083F5CC728F23A240A4E3D3
SHA1:	819888033F4808FDECF938C0457C6A77EFC9FBB3
SHA-256:	AFD29A887A3015463F86E1DFD13716ECA728054272733604491DD504194C6D73
SHA-512:	66BE3ECC194F58BCD1B6906F5076D9C28D4F92680E55A33CC98007BA8944641CA1971D22AA339E2DED7FCBC3A874840DC13C33627DDFB2AB0426052A732D3795
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ExecuteScript" GUID="{CB4B425E-2C44-4C11-847C-95C71856D579}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">ExecuteScript</Property>.. <Property Class="Type" GUID="{646002E5-73A6-4CCE-A463-7329EEE8EF48}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{2CD95F37-747B-4CF0-83FD-EAFB0A359BEB}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">50</Property>.. <Property Class="Memo" GUID="{E7C6EDBD-AAF2-4C1B-9F1D-E69C301AB913}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="Help Stri

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ExecuteScript1\is-MPHCQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (492), with CRLF line terminators
Category:	dropped
Size (bytes):	2229
Entropy (8bit):	5.518067240294715
Encrypted:	false
SSDEEP:	24:2dFDsHxX2R/CApWo44gAW5F5t1OcWHqcGqD51NOr9P8HPf2WAdOcTHrb3HG89e/7:cA4MiTKYD51NOrl8V2mqnuIiQrw
MD5:	E0A5AF6F4083F5CC728F23A240A4E3D3
SHA1:	819888033F4808FDECF938C0457C6A77EFC9FBB3
SHA-256:	AFD29A887A3015463F86E1DFD13716ECA728054272733604491DD504194C6D73
SHA-512:	66BE3ECC194F58BCD1B6906F5076D9C28D4F92680E55A33CC98007BA8944641CA1971D22AA339E2DED7FCBC3A874840DC13C33627DDFB2AB0426052A732D3795
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ExecuteScript" GUID="{CB4B425E-2C44-4C11-847C-95C71856D579}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">ExecuteScript</Property>.. <Property Class="Type" GUID="{646002E5-73A6-4CCE-A463-7329EEE8EF48}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{2CD95F37-747B-4CF0-83FD-EAFB0A359BEB}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">50</Property>.. <Property Class="Memo" GUID="{E7C6EDBD-AAF2-4C1B-9F1D-E69C301AB913}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="Help Stri

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ExecuteScript\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1535), with CRLF line terminators
Category:	dropped
Size (bytes):	5966
Entropy (8bit):	5.371832752390759
Encrypted:	false
SSDEEP:	96:XSpElQWQjFlihbe/BJG5GxlAFgd1fVS6S:4Dihq/BJG5GxlAad3ZS
MD5:	E64B3911C17D788790F208EDB5E6FBC4
SHA1:	1F8C459FECBD7190D801EA45CCD05271F957E589
SHA-256:	DC369AF3D97B1D6312B455427A37B1521B108472D01D4335E2F97D9C9D0880A9
SHA-512:	0555A6C30BF74F1970E9EB6670C4528509D9E6382847FCC99A0689CFA87CFB34F55C5B41362EFC336FF3739D3C99D7F194478FD77B711988D8E76A5FC346ACBA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ExecuteScript" GUID="{DD48E39C-E664-4532-9B13-93A4A1E74BAF}">.. <Properties>.. <Property Class="Type" GUID="{CCBC0BE7-65F3-4941-8847-4306BD8BDD10}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{562BA06F-7890-4911-932A-2BE617DECB66}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ExecuteScript</Property>.. <Property Class="Number" GUID="{6A1A7E26-BF88-4E9F-941F-93ABDC2FBBC3}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">7</Property>.. <Property Class="Text" GUID="{E78839B2-1890-41D4-8790-F96540744644}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{DD48E39C-E664-4532-9B13-93A4A1E74BAF}</Property>.. <Property Class="Memo" GUID="{78BF25E0-521B-4A88-B628-E240A35D8184}" Name="Form Layout" systemhidden="T

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ExecuteScript\is-9VC8S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1535), with CRLF line terminators
Category:	dropped
Size (bytes):	5966
Entropy (8bit):	5.371832752390759
Encrypted:	false
SSDEEP:	96:XSpElQWQjFlihbe/BJG5GxlAFgd1fVS6S:4Dihq/BJG5GxlAad3ZS
MD5:	E64B3911C17D788790F208EDB5E6FBC4
SHA1:	1F8C459FECBD7190D801EA45CCD05271F957E589
SHA-256:	DC369AF3D97B1D6312B455427A37B1521B108472D01D4335E2F97D9C9D0880A9
SHA-512:	0555A6C30BF74F1970E9EB6670C4528509D9E6382847FCC99A0689CFA87CFB34F55C5B41362EFC336FF3739D3C99D7F194478FD77B711988D8E76A5FC346ACBA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ExecuteScript" GUID="{DD48E39C-E664-4532-9B13-93A4A1E74BAF}">.. <Properties>.. <Property Class="Type" GUID="{CCBC0BE7-65F3-4941-8847-4306BD8BDD10}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{562BA06F-7890-4911-932A-2BE617DECB66}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ExecuteScript</Property>.. <Property Class="Number" GUID="{6A1A7E26-BF88-4E9F-941F-93ABDC2FBBC3}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">7</Property>.. <Property Class="Text" GUID="{E78839B2-1890-41D4-8790-F96540744644}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{DD48E39C-E664-4532-9B13-93A4A1E74BAF}</Property>.. <Property Class="Memo" GUID="{78BF25E0-521B-4A88-B628-E240A35D8184}" Name="Form Layout" systemhidden="T

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\Expression\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (531), with CRLF line terminators
Category:	dropped
Size (bytes):	3252
Entropy (8bit):	5.528240765551754
Encrypted:	false
SSDEEP:	48:cG2u4qeDVLqXCS0hBvFgvvDDvWtRvxbYigdUD5anK87ClJA:P2Me5/LFSfyRvxTQa6
MD5:	397A3C1C1FA6D306C7623C3CC87B99CF
SHA1:	E6A70BBB3841692D710A8F529DA68C42F1837879
SHA-256:	FCDE52776BBE5651E1CC5DE0E3CCC5AC0B74F9D1EFAAEB1110268F0BFA96955E
SHA-512:	93DE966D6316906E801E280D39422E94390627F536851753DDA4A1432BEBD2023A6EC195DE810C8EDE767CF5FAE827D30BB9F0E2AFE63169C8FC57FDF06E4D04
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Expression" GUID="{061CD70C-0203-4541-BB7D-8428B3CFC77F}">.. <Properties>.. <Property Class="Type" GUID="{B934C8C9-1458-4D31-98D8-2C0133243BA7}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{72B223FE-46F7-4787-9CD7-CC4B4FC6C87D}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">Expression</Property>.. <Property Class="Number" GUID="{69D189AA-C7C5-4030-BE59-E0B5283A6C7E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">8</Property>.. <Property Class="Text" GUID="{6CDD42BF-3630-4C1B-B865-789F482D7F7C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{061CD70C-0203-4541-BB7D-8428B3CFC77F}</Property>.. <Property Class="Memo" GUID="{11BF4A34-A3A9-4A6B-B952-C3DDD162C99B}" Name="HTMLSource" OrderIndex="5" Decimal

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\Expression\is-7VFAO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (531), with CRLF line terminators
Category:	dropped
Size (bytes):	3252
Entropy (8bit):	5.528240765551754
Encrypted:	false
SSDEEP:	48:cG2u4qeDVLqXCS0hBvFgvvDDvWtRvxbYigdUD5anK87ClJA:P2Me5/LFSfyRvxTQa6
MD5:	397A3C1C1FA6D306C7623C3CC87B99CF
SHA1:	E6A70BBB3841692D710A8F529DA68C42F1837879
SHA-256:	FCDE52776BBE5651E1CC5DE0E3CCC5AC0B74F9D1EFAAEB1110268F0BFA96955E
SHA-512:	93DE966D6316906E801E280D39422E94390627F536851753DDA4A1432BEBD2023A6EC195DE810C8EDE767CF5FAE827D30BB9F0E2AFE63169C8FC57FDF06E4D04
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Expression" GUID="{061CD70C-0203-4541-BB7D-8428B3CFC77F}">.. <Properties>.. <Property Class="Type" GUID="{B934C8C9-1458-4D31-98D8-2C0133243BA7}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{72B223FE-46F7-4787-9CD7-CC4B4FC6C87D}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">Expression</Property>.. <Property Class="Number" GUID="{69D189AA-C7C5-4030-BE59-E0B5283A6C7E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">8</Property>.. <Property Class="Text" GUID="{6CDD42BF-3630-4C1B-B865-789F482D7F7C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{061CD70C-0203-4541-BB7D-8428B3CFC77F}</Property>.. <Property Class="Memo" GUID="{11BF4A34-A3A9-4A6B-B952-C3DDD162C99B}" Name="HTMLSource" OrderIndex="5" Decimal

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\Formula\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (528), with CRLF line terminators
Category:	dropped
Size (bytes):	3220
Entropy (8bit):	5.52461370358326
Encrypted:	false
SSDEEP:	48:cPAs8O0sPOf5anzvFgvvDGovWAtnSba4eUD5anK87ClJA:jzsPOfSFSCyFnSIa6
MD5:	F6339E5143069908DAB86D407D17ED82
SHA1:	F9B5BB05C32B5451590AB4324D91D3CBAD92E5FF
SHA-256:	1508C45C447096391142F8D4C61BAA2107C51EC596E337754FD4A0ED61679193
SHA-512:	024E09E1A89270A8F153F9557D7F07367776C70BDA7B0A83182876C56D69504E78B3C87E737F6DB41D458A93C478499A0B995288CD72AB183410FEBB98120F5F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Formula" GUID="{EA8C9DBC-5B0B-4046-AAD0-F32DCE30E656}">.. <Properties>.. <Property Class="Type" GUID="{88D4D2A4-88CD-42F3-A36F-C83798492711}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{16E31ED7-5E2E-4C5C-A7A1-BF2DE77DB32B}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">Formula</Property>.. <Property Class="Number" GUID="{3322E2B2-1D0F-4E4A-92A3-B170A59C5D91}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">9</Property>.. <Property Class="Text" GUID="{B22516C2-FC99-4983-9239-06E936C091D9}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{EA8C9DBC-5B0B-4046-AAD0-F32DCE30E656}</Property>.. <Property Class="Memo" GUID="{09C55357-A1E7-47DA-BE42-F0E2606595F8}" Name="HTMLSource" OrderIndex="5" DecimalPlaces

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\Formula\is-5V2JO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (528), with CRLF line terminators
Category:	dropped
Size (bytes):	3220
Entropy (8bit):	5.52461370358326
Encrypted:	false
SSDEEP:	48:cPAs8O0sPOf5anzvFgvvDGovWAtnSba4eUD5anK87ClJA:jzsPOfSFSCyFnSIa6
MD5:	F6339E5143069908DAB86D407D17ED82
SHA1:	F9B5BB05C32B5451590AB4324D91D3CBAD92E5FF
SHA-256:	1508C45C447096391142F8D4C61BAA2107C51EC596E337754FD4A0ED61679193
SHA-512:	024E09E1A89270A8F153F9557D7F07367776C70BDA7B0A83182876C56D69504E78B3C87E737F6DB41D458A93C478499A0B995288CD72AB183410FEBB98120F5F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Formula" GUID="{EA8C9DBC-5B0B-4046-AAD0-F32DCE30E656}">.. <Properties>.. <Property Class="Type" GUID="{88D4D2A4-88CD-42F3-A36F-C83798492711}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{16E31ED7-5E2E-4C5C-A7A1-BF2DE77DB32B}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">Formula</Property>.. <Property Class="Number" GUID="{3322E2B2-1D0F-4E4A-92A3-B170A59C5D91}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">9</Property>.. <Property Class="Text" GUID="{B22516C2-FC99-4983-9239-06E936C091D9}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{EA8C9DBC-5B0B-4046-AAD0-F32DCE30E656}</Property>.. <Property Class="Memo" GUID="{09C55357-A1E7-47DA-BE42-F0E2606595F8}" Name="HTMLSource" OrderIndex="5" DecimalPlaces

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\Group\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (526), with CRLF line terminators
Category:	dropped
Size (bytes):	3199
Entropy (8bit):	5.524084706468715
Encrypted:	false
SSDEEP:	48:csvK5MeoLwLXAHpJvo9vFgvvDmvWV2TZbojaLRQQUD5anK87ClJA:3v0doLwbAPCFSI+kSamQa6
MD5:	B107C97F420F1624E4FF0B960242FD6D
SHA1:	8CDFC1577A160E7A845E9F0D80A6233948435D28
SHA-256:	C472399968E57EA66DEFF2BD8D60736531DED53EC28BA703A520C3DE812B82C4
SHA-512:	F9A2BF4864CE14AA2C9E3FAF8A366303833A45AA7C229D6144566904A425ABCF9CD4ECE8B658C8658D1241F5E24C212B33C98D37A40F0B0689EB719A57E4472C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Group" GUID="{9D12F310-6F2E-4B64-9783-F7E402260409}">.. <Properties>.. <Property Class="Type" GUID="{6054C513-A340-4A72-9289-EB6202EF91B8}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{E3F7C347-C1CF-40D0-84FF-05CDA99C6577}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">Group</Property>.. <Property Class="Number" GUID="{76A1172E-ECDB-44F9-A956-11C81D1501F1}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">10</Property>.. <Property Class="Text" GUID="{A97571D6-1269-4A47-9643-BCA222E6625F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{9D12F310-6F2E-4B64-9783-F7E402260409}</Property>.. <Property Class="Memo" GUID="{B8884662-D88F-4A69-B7A0-E13936EE6049}" Name="HTMLSource" OrderIndex="5" DecimalPlaces=""

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\Group\is-91V0V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (526), with CRLF line terminators
Category:	dropped
Size (bytes):	3199
Entropy (8bit):	5.524084706468715
Encrypted:	false
SSDEEP:	48:csvK5MeoLwLXAHpJvo9vFgvvDmvWV2TZbojaLRQQUD5anK87ClJA:3v0doLwbAPCFSI+kSamQa6
MD5:	B107C97F420F1624E4FF0B960242FD6D
SHA1:	8CDFC1577A160E7A845E9F0D80A6233948435D28
SHA-256:	C472399968E57EA66DEFF2BD8D60736531DED53EC28BA703A520C3DE812B82C4
SHA-512:	F9A2BF4864CE14AA2C9E3FAF8A366303833A45AA7C229D6144566904A425ABCF9CD4ECE8B658C8658D1241F5E24C212B33C98D37A40F0B0689EB719A57E4472C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Group" GUID="{9D12F310-6F2E-4B64-9783-F7E402260409}">.. <Properties>.. <Property Class="Type" GUID="{6054C513-A340-4A72-9289-EB6202EF91B8}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{E3F7C347-C1CF-40D0-84FF-05CDA99C6577}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">Group</Property>.. <Property Class="Number" GUID="{76A1172E-ECDB-44F9-A956-11C81D1501F1}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">10</Property>.. <Property Class="Text" GUID="{A97571D6-1269-4A47-9643-BCA222E6625F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{9D12F310-6F2E-4B64-9783-F7E402260409}</Property>.. <Property Class="Memo" GUID="{B8884662-D88F-4A69-B7A0-E13936EE6049}" Name="HTMLSource" OrderIndex="5" DecimalPlaces=""

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ImageTransparent\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (550), with CRLF line terminators
Category:	dropped
Size (bytes):	3315
Entropy (8bit):	5.514034790898678
Encrypted:	false
SSDEEP:	48:cYGSqUjcTrhscG31bhUrvFgvvDovWjEqbyuNgNUD5anK87ClJA:uSX4CcG3GFSWwEqEa6
MD5:	1CF3B92C19C5872A1777C7C2DAD7E40A
SHA1:	3DE458835F50F2F5B4119C734DD40FF837779D8F
SHA-256:	26AAA2C1840C179DB2EC05AFD3F2E2297EC26304D8C7B5C3690DAEF337B3A864
SHA-512:	CBE1E476A4DCEF3115C8EB471332A508421449DE9E037BFE602D2E30D976BEFFB2B08EFEE9244047000653923FD4A0DCA119C460B64C7463E3A64E5152C01DCA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ImageTransparent" GUID="{BBA6EAD4-3114-40A7-AC5A-135E80C4882E}">.. <Properties>.. <Property Class="Type" GUID="{8C9414B8-B99D-411B-986D-BEF618DEE1F2}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{151A65BF-19AE-49A4-9CBC-1662441031B2}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ImageTransparent</Property>.. <Property Class="Number" GUID="{A2DFEA39-068F-47DD-8806-BFDB3D08A988}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">11</Property>.. <Property Class="Text" GUID="{15DACB7C-08DE-41F9-8D23-5537203B06BA}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{BBA6EAD4-3114-40A7-AC5A-135E80C4882E}</Property>.. <Property Class="Memo" GUID="{07A20DF6-4B27-42FD-BF68-EDD45E0AEAE4}" Name="HTMLSource" OrderInde

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ImageTransparent\is-QH149.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (550), with CRLF line terminators
Category:	dropped
Size (bytes):	3315
Entropy (8bit):	5.514034790898678
Encrypted:	false
SSDEEP:	48:cYGSqUjcTrhscG31bhUrvFgvvDovWjEqbyuNgNUD5anK87ClJA:uSX4CcG3GFSWwEqEa6
MD5:	1CF3B92C19C5872A1777C7C2DAD7E40A
SHA1:	3DE458835F50F2F5B4119C734DD40FF837779D8F
SHA-256:	26AAA2C1840C179DB2EC05AFD3F2E2297EC26304D8C7B5C3690DAEF337B3A864
SHA-512:	CBE1E476A4DCEF3115C8EB471332A508421449DE9E037BFE602D2E30D976BEFFB2B08EFEE9244047000653923FD4A0DCA119C460B64C7463E3A64E5152C01DCA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ImageTransparent" GUID="{BBA6EAD4-3114-40A7-AC5A-135E80C4882E}">.. <Properties>.. <Property Class="Type" GUID="{8C9414B8-B99D-411B-986D-BEF618DEE1F2}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{151A65BF-19AE-49A4-9CBC-1662441031B2}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ImageTransparent</Property>.. <Property Class="Number" GUID="{A2DFEA39-068F-47DD-8806-BFDB3D08A988}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">11</Property>.. <Property Class="Text" GUID="{15DACB7C-08DE-41F9-8D23-5537203B06BA}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{BBA6EAD4-3114-40A7-AC5A-135E80C4882E}</Property>.. <Property Class="Memo" GUID="{07A20DF6-4B27-42FD-BF68-EDD45E0AEAE4}" Name="HTMLSource" OrderInde

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\InheritAction\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (779), with CRLF line terminators
Category:	dropped
Size (bytes):	3767
Entropy (8bit):	5.43716601555129
Encrypted:	false
SSDEEP:	96:aykqVDupX6lquVEgWaFS+5gGatlquVEgWAa6:aIbEOEgFA+DatEOEg/
MD5:	0D78ADA35AB8DECF37C892C64F075F2A
SHA1:	D58036C4B000C8E7A90011EC80DF4ADA342BD7E1
SHA-256:	99F6A3559EBDE23C926DBC802D133A09390907D0677958E55972DF3A984DC8AB
SHA-512:	7D74B111060572127295F0C823AC42A5F01B01F605445707A41C728CBCE5C7DD62D6438B2AE07C725ED0EAFEA4E80CE02F91E048761B68953AB8BE11E539F81A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="InheritAction" GUID="{8FC24254-1E90-4927-8CE8-D68ECEBE82D9}">.. <Properties>.. <Property Class="Type" GUID="{BDB6F02C-5665-45E0-97F2-62D69B220CCD}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{CDCC1B2A-DD3D-4665-B1C3-C25FDABBE567}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">InheritAction</Property>.. <Property Class="Number" GUID="{B6A0FB87-532A-4896-8CA3-F6F7E75BD82F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">12</Property>.. <Property Class="Text" GUID="{7EC4CC0D-EA25-4A04-92A0-C3FD25FE78ED}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{8FC24254-1E90-4927-8CE8-D68ECEBE82D9}</Property>.. <Property Class="Memo" GUID="{778A5DFB-6DCA-4C60-9D85-5283258CBF9F}" Name="HTMLSource" OrderIndex="5"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\InheritAction\is-58NR3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (779), with CRLF line terminators
Category:	dropped
Size (bytes):	3767
Entropy (8bit):	5.43716601555129
Encrypted:	false
SSDEEP:	96:aykqVDupX6lquVEgWaFS+5gGatlquVEgWAa6:aIbEOEgFA+DatEOEg/
MD5:	0D78ADA35AB8DECF37C892C64F075F2A
SHA1:	D58036C4B000C8E7A90011EC80DF4ADA342BD7E1
SHA-256:	99F6A3559EBDE23C926DBC802D133A09390907D0677958E55972DF3A984DC8AB
SHA-512:	7D74B111060572127295F0C823AC42A5F01B01F605445707A41C728CBCE5C7DD62D6438B2AE07C725ED0EAFEA4E80CE02F91E048761B68953AB8BE11E539F81A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="InheritAction" GUID="{8FC24254-1E90-4927-8CE8-D68ECEBE82D9}">.. <Properties>.. <Property Class="Type" GUID="{BDB6F02C-5665-45E0-97F2-62D69B220CCD}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{CDCC1B2A-DD3D-4665-B1C3-C25FDABBE567}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">InheritAction</Property>.. <Property Class="Number" GUID="{B6A0FB87-532A-4896-8CA3-F6F7E75BD82F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">12</Property>.. <Property Class="Text" GUID="{7EC4CC0D-EA25-4A04-92A0-C3FD25FE78ED}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{8FC24254-1E90-4927-8CE8-D68ECEBE82D9}</Property>.. <Property Class="Memo" GUID="{778A5DFB-6DCA-4C60-9D85-5283258CBF9F}" Name="HTMLSource" OrderIndex="5"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\InheritPullFrom\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (545), with CRLF line terminators
Category:	dropped
Size (bytes):	3303
Entropy (8bit):	5.51813672635579
Encrypted:	false
SSDEEP:	48:c5pXCs5Ihsf8ISsQ7m3An0vFgvvDJvWyGObfnrzUD5anK87ClJA:aZL5/fgsQoFSp5GO7a6
MD5:	2580A1821616F0A6A6E095803167D8E3
SHA1:	E5B24C7528EB3A0BA297F72DB927C1C87BEEB8B5
SHA-256:	642BD92DBC71257A6D3DAF46D221C13CAEF924574071CB83C356549BEF605E96
SHA-512:	9797D456BAF66A51AA306963EBA00D582719D3D1E67868496D8639AC6858A180B3280C63AB7531F9B709B91810FA836C0B17706B5646BBF4B0DBB7B38AE65803
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="InheritPullFrom" GUID="{FC875D19-66EC-47D5-AA0A-EC1FD98FD852}">.. <Properties>.. <Property Class="Type" GUID="{2BD6ADAD-EDC4-407D-A5A2-F477130CD1F1}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{57076AD6-0BC3-45D3-96DF-08641FD50BBB}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">InheritPullFrom</Property>.. <Property Class="Number" GUID="{96E704E6-DC06-4C72-B159-D05F93884D10}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">13</Property>.. <Property Class="Text" GUID="{EEB3A4E0-501E-470D-B103-81DA38991A4C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{FC875D19-66EC-47D5-AA0A-EC1FD98FD852}</Property>.. <Property Class="Memo" GUID="{E8E570C6-27DC-449F-9840-3AA283881752}" Name="HTMLSource" OrderIndex=

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\InheritPullFrom\is-IBECB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (545), with CRLF line terminators
Category:	dropped
Size (bytes):	3303
Entropy (8bit):	5.51813672635579
Encrypted:	false
SSDEEP:	48:c5pXCs5Ihsf8ISsQ7m3An0vFgvvDJvWyGObfnrzUD5anK87ClJA:aZL5/fgsQoFSp5GO7a6
MD5:	2580A1821616F0A6A6E095803167D8E3
SHA1:	E5B24C7528EB3A0BA297F72DB927C1C87BEEB8B5
SHA-256:	642BD92DBC71257A6D3DAF46D221C13CAEF924574071CB83C356549BEF605E96
SHA-512:	9797D456BAF66A51AA306963EBA00D582719D3D1E67868496D8639AC6858A180B3280C63AB7531F9B709B91810FA836C0B17706B5646BBF4B0DBB7B38AE65803
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="InheritPullFrom" GUID="{FC875D19-66EC-47D5-AA0A-EC1FD98FD852}">.. <Properties>.. <Property Class="Type" GUID="{2BD6ADAD-EDC4-407D-A5A2-F477130CD1F1}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{57076AD6-0BC3-45D3-96DF-08641FD50BBB}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">InheritPullFrom</Property>.. <Property Class="Number" GUID="{96E704E6-DC06-4C72-B159-D05F93884D10}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">13</Property>.. <Property Class="Text" GUID="{EEB3A4E0-501E-470D-B103-81DA38991A4C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{FC875D19-66EC-47D5-AA0A-EC1FD98FD852}</Property>.. <Property Class="Memo" GUID="{E8E570C6-27DC-449F-9840-3AA283881752}" Name="HTMLSource" OrderIndex=

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\InputCondition\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (540), with CRLF line terminators
Category:	dropped
Size (bytes):	3291
Entropy (8bit):	5.52530770187142
Encrypted:	false
SSDEEP:	48:c9dz5IEAHSqivqF4bNTEvFgvvDgvW8mVbPjqUVSrTUD5anK87ClJA:UXxAyqiy6aFSWrmVvbqTa6
MD5:	C2992CA836FEC7C8A937F532CFA4F461
SHA1:	9942BFA7496127959D5CF7DDDB909343A3DC6EC3
SHA-256:	6966BF5BA0E8C290F60F7A3E444E7D49169C76EAE7DE47F833B6D66CC2CF6F16
SHA-512:	5023AE914A129CA300284E62422B1E167BCA00917BDC2BC48A5DB9DF199650F763F54E41D639EAEE50C481E489BB47EDBF1F9C794605B6BAED8F6A2C92071C55
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="InputCondition" GUID="{667A30B9-0615-4392-BED8-38B5A8936440}">.. <Properties>.. <Property Class="Type" GUID="{C39EEE87-1D6E-4E34-A146-F14A5AC7CD51}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{00691F94-EDFB-4128-A23E-CAF83AA26BF7}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">InputCondition</Property>.. <Property Class="Number" GUID="{71C2A66B-3796-4BBA-9FDF-A1E227447F80}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">14</Property>.. <Property Class="Text" GUID="{01E7FA80-2EFB-4CB9-AA00-A646C72AB024}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{667A30B9-0615-4392-BED8-38B5A8936440}</Property>.. <Property Class="Memo" GUID="{F86C4911-94CD-4140-B915-710B500059D6}" Name="HTMLSource" OrderIndex="5

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\InputCondition\is-0SVUU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (540), with CRLF line terminators
Category:	dropped
Size (bytes):	3291
Entropy (8bit):	5.52530770187142
Encrypted:	false
SSDEEP:	48:c9dz5IEAHSqivqF4bNTEvFgvvDgvW8mVbPjqUVSrTUD5anK87ClJA:UXxAyqiy6aFSWrmVvbqTa6
MD5:	C2992CA836FEC7C8A937F532CFA4F461
SHA1:	9942BFA7496127959D5CF7DDDB909343A3DC6EC3
SHA-256:	6966BF5BA0E8C290F60F7A3E444E7D49169C76EAE7DE47F833B6D66CC2CF6F16
SHA-512:	5023AE914A129CA300284E62422B1E167BCA00917BDC2BC48A5DB9DF199650F763F54E41D639EAEE50C481E489BB47EDBF1F9C794605B6BAED8F6A2C92071C55
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="InputCondition" GUID="{667A30B9-0615-4392-BED8-38B5A8936440}">.. <Properties>.. <Property Class="Type" GUID="{C39EEE87-1D6E-4E34-A146-F14A5AC7CD51}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{00691F94-EDFB-4128-A23E-CAF83AA26BF7}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">InputCondition</Property>.. <Property Class="Number" GUID="{71C2A66B-3796-4BBA-9FDF-A1E227447F80}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">14</Property>.. <Property Class="Text" GUID="{01E7FA80-2EFB-4CB9-AA00-A646C72AB024}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{667A30B9-0615-4392-BED8-38B5A8936440}</Property>.. <Property Class="Memo" GUID="{F86C4911-94CD-4140-B915-710B500059D6}" Name="HTMLSource" OrderIndex="5

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\InputType\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (640), with CRLF line terminators
Category:	dropped
Size (bytes):	4239
Entropy (8bit):	5.436301562724847
Encrypted:	false
SSDEEP:	48:c0Wi27kcgf47QjP+NNEJ+fEv1vvDJv1uvFovFgvvDZvWLFWUb+NNEJ+2bSNUD5aV:4lT6INNEcfedJ+AFSJwT6NNEcra6
MD5:	E2FCB1188757E7CF94F98C90761F34C7
SHA1:	F86993508C2FDFBE1C6D2266FE5F23417B301E1A
SHA-256:	82167C4824AB71201745EB0C3B9B47DBDB8F54F2DBAAB455045E27DA7E1CA368
SHA-512:	194C480865455BBEF6CD3E699090526AD894D61A4802631453618062A80FDC7F6992D2B2EB3920BB1E719A50FA4FD121915ED28C6EB0E1F21B31072E2575E97B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="InputType" GUID="{1A72FEB9-F9FA-4DD9-8076-215EF4F5F057}">.. <Properties>.. <Property Class="Type" GUID="{49795F8C-CE30-4256-952F-6B3D66528B28}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{25843CC0-D011-41FD-ADAE-90F73997E663}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">InputType</Property>.. <Property Class="Number" GUID="{1CDD8899-4A4A-4EF4-B85B-37A91E656DD7}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">15</Property>.. <Property Class="Text" GUID="{49EC7C56-68B1-4429-9E00-8B10C7131D08}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{1A72FEB9-F9FA-4DD9-8076-215EF4F5F057}</Property>.. <Property Class="Memo" GUID="{6988ED82-1F79-4C08-AFD2-C1A2B3C2FB11}" Name="HTMLSource" OrderIndex="5" DecimalP

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\InputType\is-CD496.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (640), with CRLF line terminators
Category:	dropped
Size (bytes):	4239
Entropy (8bit):	5.436301562724847
Encrypted:	false
SSDEEP:	48:c0Wi27kcgf47QjP+NNEJ+fEv1vvDJv1uvFovFgvvDZvWLFWUb+NNEJ+2bSNUD5aV:4lT6INNEcfedJ+AFSJwT6NNEcra6
MD5:	E2FCB1188757E7CF94F98C90761F34C7
SHA1:	F86993508C2FDFBE1C6D2266FE5F23417B301E1A
SHA-256:	82167C4824AB71201745EB0C3B9B47DBDB8F54F2DBAAB455045E27DA7E1CA368
SHA-512:	194C480865455BBEF6CD3E699090526AD894D61A4802631453618062A80FDC7F6992D2B2EB3920BB1E719A50FA4FD121915ED28C6EB0E1F21B31072E2575E97B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="InputType" GUID="{1A72FEB9-F9FA-4DD9-8076-215EF4F5F057}">.. <Properties>.. <Property Class="Type" GUID="{49795F8C-CE30-4256-952F-6B3D66528B28}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{25843CC0-D011-41FD-ADAE-90F73997E663}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">InputType</Property>.. <Property Class="Number" GUID="{1CDD8899-4A4A-4EF4-B85B-37A91E656DD7}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">15</Property>.. <Property Class="Text" GUID="{49EC7C56-68B1-4429-9E00-8B10C7131D08}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{1A72FEB9-F9FA-4DD9-8076-215EF4F5F057}</Property>.. <Property Class="Memo" GUID="{6988ED82-1F79-4C08-AFD2-C1A2B3C2FB11}" Name="HTMLSource" OrderIndex="5" DecimalP

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\InputUnits\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (531), with CRLF line terminators
Category:	dropped
Size (bytes):	3251
Entropy (8bit):	5.530079449573602
Encrypted:	false
SSDEEP:	48:cdFJRmkWaVSJw39QJSEfmEKuVovFgvvDuEgvW5v4BAbVL9QpC+9UD5anK87ClJA:2TgEVSJwxEuEKMyFSyEqVBApcC+9a6
MD5:	E1D89A891723905D91F512B18A157FBC
SHA1:	917C550582C3F5CC5D96D255A86C2FF2D71098FC
SHA-256:	7403CF562F80604360DB87D82DDDB9D4A57B3AD52F6AE6EA1096086FE41772C1
SHA-512:	C6E1F46DA3B96E2D0E7DB06548D84F7ED853D5519115B4C2282549B5966A73000C83A5F58E57EE16C3E76B80B7D25C6002B5B21A50D72A39D834D41CBB2C4904
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="InputUnits" GUID="{CA9E1674-6B1E-46BE-BA61-07E1D558DCB3}">.. <Properties>.. <Property Class="Type" GUID="{3F8FFBE7-FC27-45A8-8153-70969062D959}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{E3176261-0872-444F-BDAC-660321621B4E}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">InputUnits</Property>.. <Property Class="Number" GUID="{33F11455-7AA0-425D-B5D8-417561617B14}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">16</Property>.. <Property Class="Text" GUID="{3506917C-1E7E-4EB1-8AB7-AFA79CD9EF01}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{CA9E1674-6B1E-46BE-BA61-07E1D558DCB3}</Property>.. <Property Class="Memo" GUID="{4391F768-6D71-480F-8ACC-A16262FFCFC4}" Name="HTMLSource" OrderIndex="5" Decima

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\InputUnits\is-1CVUL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (531), with CRLF line terminators
Category:	dropped
Size (bytes):	3251
Entropy (8bit):	5.530079449573602
Encrypted:	false
SSDEEP:	48:cdFJRmkWaVSJw39QJSEfmEKuVovFgvvDuEgvW5v4BAbVL9QpC+9UD5anK87ClJA:2TgEVSJwxEuEKMyFSyEqVBApcC+9a6
MD5:	E1D89A891723905D91F512B18A157FBC
SHA1:	917C550582C3F5CC5D96D255A86C2FF2D71098FC
SHA-256:	7403CF562F80604360DB87D82DDDB9D4A57B3AD52F6AE6EA1096086FE41772C1
SHA-512:	C6E1F46DA3B96E2D0E7DB06548D84F7ED853D5519115B4C2282549B5966A73000C83A5F58E57EE16C3E76B80B7D25C6002B5B21A50D72A39D834D41CBB2C4904
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="InputUnits" GUID="{CA9E1674-6B1E-46BE-BA61-07E1D558DCB3}">.. <Properties>.. <Property Class="Type" GUID="{3F8FFBE7-FC27-45A8-8153-70969062D959}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{E3176261-0872-444F-BDAC-660321621B4E}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">InputUnits</Property>.. <Property Class="Number" GUID="{33F11455-7AA0-425D-B5D8-417561617B14}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">16</Property>.. <Property Class="Text" GUID="{3506917C-1E7E-4EB1-8AB7-AFA79CD9EF01}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{CA9E1674-6B1E-46BE-BA61-07E1D558DCB3}</Property>.. <Property Class="Memo" GUID="{4391F768-6D71-480F-8ACC-A16262FFCFC4}" Name="HTMLSource" OrderIndex="5" Decima

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\IsInherited\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (532), with CRLF line terminators
Category:	dropped
Size (bytes):	3265
Entropy (8bit):	5.524379979348702
Encrypted:	false
SSDEEP:	48:c1O2S2oCzzlqVyoRgvFgvvDjvW/XdnhbRDfFUD5anK87ClJA:HuoC0qFS/0th9pa6
MD5:	2EB1F2E9C0A09D793B427E7056E02E60
SHA1:	8CFFCC470D287BE1A8097CAD72F90E23ACD372F9
SHA-256:	9B1D66C6EC02EB0B455732514FDDA99CFD1DB68BC3D255ACBF89B46DC28D7356
SHA-512:	C0BD5A2A79E346BA24A23A9C1CEBE26722D99B5B9E7144D523D551BD973958FB86A9B9D1A312D3E3401DB3A21BCC8B30C946FE1AF4458F101A96FD7545B044E3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="IsInherited" GUID="{1F3B8285-BB0D-448E-86BC-42AF09B25E09}">.. <Properties>.. <Property Class="Type" GUID="{F230C964-78AF-41DD-9719-89835C0050CE}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{2549CE31-16DC-438C-90A2-451CBF4B89DF}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">IsInherited</Property>.. <Property Class="Number" GUID="{FCF9B540-1024-461B-8ED7-948D356D59A3}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">17</Property>.. <Property Class="Text" GUID="{C7955B05-028D-495D-823D-F50063629B79}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{1F3B8285-BB0D-448E-86BC-42AF09B25E09}</Property>.. <Property Class="Memo" GUID="{30C8DC1A-578B-49FA-96FE-844A0EC2C0F6}" Name="HTMLSource" OrderIndex="5" Deci

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\IsInherited\is-02GL9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (532), with CRLF line terminators
Category:	dropped
Size (bytes):	3265
Entropy (8bit):	5.524379979348702
Encrypted:	false
SSDEEP:	48:c1O2S2oCzzlqVyoRgvFgvvDjvW/XdnhbRDfFUD5anK87ClJA:HuoC0qFS/0th9pa6
MD5:	2EB1F2E9C0A09D793B427E7056E02E60
SHA1:	8CFFCC470D287BE1A8097CAD72F90E23ACD372F9
SHA-256:	9B1D66C6EC02EB0B455732514FDDA99CFD1DB68BC3D255ACBF89B46DC28D7356
SHA-512:	C0BD5A2A79E346BA24A23A9C1CEBE26722D99B5B9E7144D523D551BD973958FB86A9B9D1A312D3E3401DB3A21BCC8B30C946FE1AF4458F101A96FD7545B044E3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="IsInherited" GUID="{1F3B8285-BB0D-448E-86BC-42AF09B25E09}">.. <Properties>.. <Property Class="Type" GUID="{F230C964-78AF-41DD-9719-89835C0050CE}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{2549CE31-16DC-438C-90A2-451CBF4B89DF}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">IsInherited</Property>.. <Property Class="Number" GUID="{FCF9B540-1024-461B-8ED7-948D356D59A3}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">17</Property>.. <Property Class="Text" GUID="{C7955B05-028D-495D-823D-F50063629B79}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{1F3B8285-BB0D-448E-86BC-42AF09B25E09}</Property>.. <Property Class="Memo" GUID="{30C8DC1A-578B-49FA-96FE-844A0EC2C0F6}" Name="HTMLSource" OrderIndex="5" Deci

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\IsInput\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (528), with CRLF line terminators
Category:	dropped
Size (bytes):	3223
Entropy (8bit):	5.5243672772193015
Encrypted:	false
SSDEEP:	48:ck0J8ZjRRvWsLZg/URU6vFgvvDJvWLLUbRUF8ORpizHdiUD5anK87ClJA:u8BWsLdUYFSJYLU9Uawa6
MD5:	8A9C08212568B00C96E4C6571AA3973F
SHA1:	BCD49B76A1F2C3880A8F7840C90453F4C4BEA317
SHA-256:	E7014FB45B984204AF8EF46827359C47D8B2E352F72178B4F06D41E0F4F7541C
SHA-512:	85C69BFE67571B2D6749146418B821CB23E7A1B1D618C4115CC84047F6D9818A4D63249B6F8615E665F63120C31CF96FE419848013B9E2CE2CAD4FAEAF620F7D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="IsInput" GUID="{C1CBA8F6-8BB3-49CD-B620-5E9FC4E8BD23}">.. <Properties>.. <Property Class="Type" GUID="{0BB66E5C-D145-463F-9DB1-929C55035D6D}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{3E815A03-4396-4ABA-AEA2-A1B4DDD40460}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">IsInput</Property>.. <Property Class="Number" GUID="{8D02E877-552D-4DC0-AB33-A6EF69BAC133}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">18</Property>.. <Property Class="Text" GUID="{5AAC31D0-39A8-4A20-ACA9-D0771F255457}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{C1CBA8F6-8BB3-49CD-B620-5E9FC4E8BD23}</Property>.. <Property Class="Memo" GUID="{EEEFF1AB-C3E5-42B1-8E5A-2D9756681F13}" Name="HTMLSource" OrderIndex="5" DecimalPlace

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\IsInput\is-BGBUI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (528), with CRLF line terminators
Category:	dropped
Size (bytes):	3223
Entropy (8bit):	5.5243672772193015
Encrypted:	false
SSDEEP:	48:ck0J8ZjRRvWsLZg/URU6vFgvvDJvWLLUbRUF8ORpizHdiUD5anK87ClJA:u8BWsLdUYFSJYLU9Uawa6
MD5:	8A9C08212568B00C96E4C6571AA3973F
SHA1:	BCD49B76A1F2C3880A8F7840C90453F4C4BEA317
SHA-256:	E7014FB45B984204AF8EF46827359C47D8B2E352F72178B4F06D41E0F4F7541C
SHA-512:	85C69BFE67571B2D6749146418B821CB23E7A1B1D618C4115CC84047F6D9818A4D63249B6F8615E665F63120C31CF96FE419848013B9E2CE2CAD4FAEAF620F7D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="IsInput" GUID="{C1CBA8F6-8BB3-49CD-B620-5E9FC4E8BD23}">.. <Properties>.. <Property Class="Type" GUID="{0BB66E5C-D145-463F-9DB1-929C55035D6D}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{3E815A03-4396-4ABA-AEA2-A1B4DDD40460}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">IsInput</Property>.. <Property Class="Number" GUID="{8D02E877-552D-4DC0-AB33-A6EF69BAC133}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">18</Property>.. <Property Class="Text" GUID="{5AAC31D0-39A8-4A20-ACA9-D0771F255457}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{C1CBA8F6-8BB3-49CD-B620-5E9FC4E8BD23}</Property>.. <Property Class="Memo" GUID="{EEEFF1AB-C3E5-42B1-8E5A-2D9756681F13}" Name="HTMLSource" OrderIndex="5" DecimalPlace

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ListColumnAutoWidth\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (561), with CRLF line terminators
Category:	dropped
Size (bytes):	3339
Entropy (8bit):	5.543114115010328
Encrypted:	false
SSDEEP:	48:cq8o8ZbnJjNCcgZfvThjTVTEC4vDrTivFglvWHAfobCqxmuNUD5anK87ClJA:Xb83NCcgZDt57i7gFYkMouMNa6
MD5:	8116A7B426928A0F744E9AC9DB283657
SHA1:	B25A45745D071FBD4E819BABBEC53314DB61FAEC
SHA-256:	688759B25A9D92EBBF0FF82ED346C4CB221E9708D671215DF3FEDA0982185F7B
SHA-512:	16A3A2CCF603FAC04513C130A07F47A92FDD90342D630688A7E103E21C54E04ED405FB3C00FA7A082B1E98553D03EECEC03D35F5405739FF4F843D1FA07262C4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ListColumnAutoWidth" GUID="{511585CD-2BB7-457E-9A58-73FB11585668}">.. <Properties>.. <Property Class="Type" GUID="{05E51796-BB9B-46EA-9123-D47E1AFEFC4A}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{8E4FB299-DFC3-4CB0-A5F1-AA90CB2FF5D7}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ListColumnAutoWidth</Property>.. <Property Class="Number" GUID="{64DE897A-4F3A-4F8D-95B7-4A91D37C5763}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">20</Property>.. <Property Class="Text" GUID="{41E176EF-21E9-491F-A9B9-C1A5D683FF6B}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{511585CD-2BB7-457E-9A58-73FB11585668}</Property>.. <Property Class="Memo" GUID="{D4ED00C3-1529-44DD-89D6-55B02EE429EE}" Name="HTMLSource" Ord

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ListColumnAutoWidth\is-CF9B9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (561), with CRLF line terminators
Category:	dropped
Size (bytes):	3339
Entropy (8bit):	5.543114115010328
Encrypted:	false
SSDEEP:	48:cq8o8ZbnJjNCcgZfvThjTVTEC4vDrTivFglvWHAfobCqxmuNUD5anK87ClJA:Xb83NCcgZDt57i7gFYkMouMNa6
MD5:	8116A7B426928A0F744E9AC9DB283657
SHA1:	B25A45745D071FBD4E819BABBEC53314DB61FAEC
SHA-256:	688759B25A9D92EBBF0FF82ED346C4CB221E9708D671215DF3FEDA0982185F7B
SHA-512:	16A3A2CCF603FAC04513C130A07F47A92FDD90342D630688A7E103E21C54E04ED405FB3C00FA7A082B1E98553D03EECEC03D35F5405739FF4F843D1FA07262C4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ListColumnAutoWidth" GUID="{511585CD-2BB7-457E-9A58-73FB11585668}">.. <Properties>.. <Property Class="Type" GUID="{05E51796-BB9B-46EA-9123-D47E1AFEFC4A}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{8E4FB299-DFC3-4CB0-A5F1-AA90CB2FF5D7}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ListColumnAutoWidth</Property>.. <Property Class="Number" GUID="{64DE897A-4F3A-4F8D-95B7-4A91D37C5763}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">20</Property>.. <Property Class="Text" GUID="{41E176EF-21E9-491F-A9B9-C1A5D683FF6B}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{511585CD-2BB7-457E-9A58-73FB11585668}</Property>.. <Property Class="Memo" GUID="{D4ED00C3-1529-44DD-89D6-55B02EE429EE}" Name="HTMLSource" Ord

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ListFromProperty\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (549), with CRLF line terminators
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	5.505158311928074
Encrypted:	false
SSDEEP:	48:c4Tn2CqyCFOVODjaVvFgvvDgvWiRkXbbsRldsUD5anK87ClJA:xTneQVOsFSeJRG36Ya6
MD5:	D87BC371775E7096C153D5F355D21B08
SHA1:	4B64D0D4E8A9640300FF9C88B6E4784D0966A77C
SHA-256:	6A0E443F42ED21D6D37DEC3A4CAEA2F0F1168E37D49AB7E9E4316F3B9F70E518
SHA-512:	78F3E5F0FA0EF0BFC2EB6A76456DEA9A2EAE7958837500601C33A914D5EAC4675FD9E5AF9ED2AE2C892AD67EBDC5AEBF6B67968C5970A83D9B28029150231585
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ListFromProperty" GUID="{8A603AF4-5138-4E41-9A21-BA701920226B}">.. <Properties>.. <Property Class="Type" GUID="{1FE04583-6D27-4E54-9715-EFD7A69FB62D}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{C2015BBE-580C-4EC4-9164-D73BD5407B14}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ListFromProperty</Property>.. <Property Class="Number" GUID="{A6293EDB-BC8B-43BC-A381-E16ED041F49D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">21</Property>.. <Property Class="Text" GUID="{B49FDD5B-8781-4CBE-BD9B-5F31CD09B3B2}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{8A603AF4-5138-4E41-9A21-BA701920226B}</Property>.. <Property Class="Memo" GUID="{05F9D217-3484-4EF5-BEF5-39852F9FC8BD}" Name="HTMLSource" OrderInde

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ListFromProperty\is-J19R9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (549), with CRLF line terminators
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	5.505158311928074
Encrypted:	false
SSDEEP:	48:c4Tn2CqyCFOVODjaVvFgvvDgvWiRkXbbsRldsUD5anK87ClJA:xTneQVOsFSeJRG36Ya6
MD5:	D87BC371775E7096C153D5F355D21B08
SHA1:	4B64D0D4E8A9640300FF9C88B6E4784D0966A77C
SHA-256:	6A0E443F42ED21D6D37DEC3A4CAEA2F0F1168E37D49AB7E9E4316F3B9F70E518
SHA-512:	78F3E5F0FA0EF0BFC2EB6A76456DEA9A2EAE7958837500601C33A914D5EAC4675FD9E5AF9ED2AE2C892AD67EBDC5AEBF6B67968C5970A83D9B28029150231585
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ListFromProperty" GUID="{8A603AF4-5138-4E41-9A21-BA701920226B}">.. <Properties>.. <Property Class="Type" GUID="{1FE04583-6D27-4E54-9715-EFD7A69FB62D}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{C2015BBE-580C-4EC4-9164-D73BD5407B14}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ListFromProperty</Property>.. <Property Class="Number" GUID="{A6293EDB-BC8B-43BC-A381-E16ED041F49D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">21</Property>.. <Property Class="Text" GUID="{B49FDD5B-8781-4CBE-BD9B-5F31CD09B3B2}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{8A603AF4-5138-4E41-9A21-BA701920226B}</Property>.. <Property Class="Memo" GUID="{05F9D217-3484-4EF5-BEF5-39852F9FC8BD}" Name="HTMLSource" OrderInde

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ListPropertiesToSet\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (561), with CRLF line terminators
Category:	dropped
Size (bytes):	3343
Entropy (8bit):	5.510027036693988
Encrypted:	false
SSDEEP:	48:crWYn4xmmCgbAvFgvvDRvWm6fbj/gCUD5anK87ClJA:MpwmRFSJRsHa6
MD5:	FFE94D1042BF7E723AA3BD0E0F786D72
SHA1:	632C01B7E3F4970722770205D3217299DF63C437
SHA-256:	0D8C3149477533CA6F93648FF1D712791D2D14D78B006B1597FF87CD4D048E14
SHA-512:	6632B69F882291838B06FE963BB82DFD9D00EA42E45502977769640901C21F70A66226EDA80AB8AD49C0D7922AF17AD005EF423CF8F926618B356C86709ED82A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ListPropertiesToSet" GUID="{A18FE663-7CB1-4683-B462-F6229EE494E6}">.. <Properties>.. <Property Class="Type" GUID="{8E992DC7-8AD5-4F84-B077-217006D7BBA8}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{7D5C5E28-CD2D-4B93-88F3-55D9209DACC6}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ListPropertiesToSet</Property>.. <Property Class="Number" GUID="{131E2311-B59C-4341-A808-395FED45A512}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">22</Property>.. <Property Class="Text" GUID="{FC96CE45-E919-4F7A-A919-C83C76D05AC2}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{A18FE663-7CB1-4683-B462-F6229EE494E6}</Property>.. <Property Class="Memo" GUID="{B24A3E94-9E9D-43B0-A40A-FD2A0E80FECA}" Name="HTMLSource" Ord

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ListPropertiesToSet\is-LHSVJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (561), with CRLF line terminators
Category:	dropped
Size (bytes):	3343
Entropy (8bit):	5.510027036693988
Encrypted:	false
SSDEEP:	48:crWYn4xmmCgbAvFgvvDRvWm6fbj/gCUD5anK87ClJA:MpwmRFSJRsHa6
MD5:	FFE94D1042BF7E723AA3BD0E0F786D72
SHA1:	632C01B7E3F4970722770205D3217299DF63C437
SHA-256:	0D8C3149477533CA6F93648FF1D712791D2D14D78B006B1597FF87CD4D048E14
SHA-512:	6632B69F882291838B06FE963BB82DFD9D00EA42E45502977769640901C21F70A66226EDA80AB8AD49C0D7922AF17AD005EF423CF8F926618B356C86709ED82A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ListPropertiesToSet" GUID="{A18FE663-7CB1-4683-B462-F6229EE494E6}">.. <Properties>.. <Property Class="Type" GUID="{8E992DC7-8AD5-4F84-B077-217006D7BBA8}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{7D5C5E28-CD2D-4B93-88F3-55D9209DACC6}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ListPropertiesToSet</Property>.. <Property Class="Number" GUID="{131E2311-B59C-4341-A808-395FED45A512}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">22</Property>.. <Property Class="Text" GUID="{FC96CE45-E919-4F7A-A919-C83C76D05AC2}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{A18FE663-7CB1-4683-B462-F6229EE494E6}</Property>.. <Property Class="Memo" GUID="{B24A3E94-9E9D-43B0-A40A-FD2A0E80FECA}" Name="HTMLSource" Ord

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ListResultColumn\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (807), with CRLF line terminators
Category:	dropped
Size (bytes):	4241
Entropy (8bit):	5.471789805155995
Encrypted:	false
SSDEEP:	48:ckKeUIEGUow/qSpjBdXfEv1vvD9v1iFv1OvFIvFguvWcX+bdXNAQUD5anK87ClJA:9KeUfxNreddAegFR/+Hva6
MD5:	AB3163A012C8BE680C98593C5520B59D
SHA1:	D94B31B1A13E0AC89196450B06BF45118B241997
SHA-256:	A9567DABFEF701B3E6EBFB9D0D7FD22B9804B0FD5D5FD0F2EA442EB5BF261FD2
SHA-512:	C1AD3C29DE5F226F6436A4261DA87FB21FB9B38ADAF4B89342205FE7592105CFADC25E9E9CC813590E1837DB1ED2DBBE2CBBA3BCE7F1364ED007AB4D606C8155
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ListResultColumn" GUID="{6859CA90-080E-40E7-A5C2-FE07C8459331}">.. <Properties>.. <Property Class="Type" GUID="{FAA7B507-F541-4BAD-8BA5-7E3B747116D1}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{A86B61CD-7D63-459A-949C-6E5F67BFE3C9}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ListResultColumn</Property>.. <Property Class="Number" GUID="{8612C560-495D-454E-8CB2-006E6607D935}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">23</Property>.. <Property Class="Text" GUID="{8B287FF3-7E9C-490D-9EB7-B3F87C84AE30}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{6859CA90-080E-40E7-A5C2-FE07C8459331}</Property>.. <Property Class="Memo" GUID="{8E227525-18DF-4186-8CE6-8C8E894CD57E}" Name="HTMLSource" OrderInde

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ListResultColumn\is-JHNQC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (807), with CRLF line terminators
Category:	dropped
Size (bytes):	4241
Entropy (8bit):	5.471789805155995
Encrypted:	false
SSDEEP:	48:ckKeUIEGUow/qSpjBdXfEv1vvD9v1iFv1OvFIvFguvWcX+bdXNAQUD5anK87ClJA:9KeUfxNreddAegFR/+Hva6
MD5:	AB3163A012C8BE680C98593C5520B59D
SHA1:	D94B31B1A13E0AC89196450B06BF45118B241997
SHA-256:	A9567DABFEF701B3E6EBFB9D0D7FD22B9804B0FD5D5FD0F2EA442EB5BF261FD2
SHA-512:	C1AD3C29DE5F226F6436A4261DA87FB21FB9B38ADAF4B89342205FE7592105CFADC25E9E9CC813590E1837DB1ED2DBBE2CBBA3BCE7F1364ED007AB4D606C8155
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ListResultColumn" GUID="{6859CA90-080E-40E7-A5C2-FE07C8459331}">.. <Properties>.. <Property Class="Type" GUID="{FAA7B507-F541-4BAD-8BA5-7E3B747116D1}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{A86B61CD-7D63-459A-949C-6E5F67BFE3C9}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ListResultColumn</Property>.. <Property Class="Number" GUID="{8612C560-495D-454E-8CB2-006E6607D935}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">23</Property>.. <Property Class="Text" GUID="{8B287FF3-7E9C-490D-9EB7-B3F87C84AE30}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{6859CA90-080E-40E7-A5C2-FE07C8459331}</Property>.. <Property Class="Memo" GUID="{8E227525-18DF-4186-8CE6-8C8E894CD57E}" Name="HTMLSource" OrderInde

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ListReturnFullPath\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (548), with CRLF line terminators
Category:	dropped
Size (bytes):	3315
Entropy (8bit):	5.527965690369072
Encrypted:	false
SSDEEP:	48:cEI+lhf2rj8xmP50JoJyVYv8DvFgvvD93vWJAub8K46oiWUD5anK87ClJA:C+4X50JfFSl61nWa6
MD5:	B296B4369B7E9642535C6C4700105E18
SHA1:	5425E412F589F4FCF3C892B939AE06956BBAFBD8
SHA-256:	532837A1116D276216D16EC190138D0F9AAFDEBAC2443286686751827FE78DE7
SHA-512:	9CE7596570340AAE8233AF6D1508459E41CBA853C75474A08D753DC58AB3319E4963994BC6D2AF7885D6400346D5E9E1D215D9C6813BCC272A83E61E3A941B0D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ListReturnFullPath" GUID="{6FED942B-F1AB-43E6-9F2D-B891C8833D5C}">.. <Properties>.. <Property Class="Type" GUID="{419293C3-56CA-4784-B5DF-55C6603A5833}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{151A79EE-0F6D-4956-950A-34512C322EBC}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ListReturnFullPath</Property>.. <Property Class="Number" GUID="{316149FA-7308-410F-9CF5-688FE6F2A9A8}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">24</Property>.. <Property Class="Text" GUID="{18BD2F7F-3090-48F2-BF96-84DF6A851349}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{6FED942B-F1AB-43E6-9F2D-B891C8833D5C}</Property>.. <Property Class="Memo" GUID="{D5846639-3217-4065-BB4F-A965EA7EAE58}" Name="HTMLSource" Order

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ListReturnFullPath\is-KUDQK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (548), with CRLF line terminators
Category:	dropped
Size (bytes):	3315
Entropy (8bit):	5.527965690369072
Encrypted:	false
SSDEEP:	48:cEI+lhf2rj8xmP50JoJyVYv8DvFgvvD93vWJAub8K46oiWUD5anK87ClJA:C+4X50JfFSl61nWa6
MD5:	B296B4369B7E9642535C6C4700105E18
SHA1:	5425E412F589F4FCF3C892B939AE06956BBAFBD8
SHA-256:	532837A1116D276216D16EC190138D0F9AAFDEBAC2443286686751827FE78DE7
SHA-512:	9CE7596570340AAE8233AF6D1508459E41CBA853C75474A08D753DC58AB3319E4963994BC6D2AF7885D6400346D5E9E1D215D9C6813BCC272A83E61E3A941B0D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ListReturnFullPath" GUID="{6FED942B-F1AB-43E6-9F2D-B891C8833D5C}">.. <Properties>.. <Property Class="Type" GUID="{419293C3-56CA-4784-B5DF-55C6603A5833}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{151A79EE-0F6D-4956-950A-34512C322EBC}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ListReturnFullPath</Property>.. <Property Class="Number" GUID="{316149FA-7308-410F-9CF5-688FE6F2A9A8}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">24</Property>.. <Property Class="Text" GUID="{18BD2F7F-3090-48F2-BF96-84DF6A851349}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{6FED942B-F1AB-43E6-9F2D-B891C8833D5C}</Property>.. <Property Class="Memo" GUID="{D5846639-3217-4065-BB4F-A965EA7EAE58}" Name="HTMLSource" Order

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ListShow1Level\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (542), with CRLF line terminators
Category:	dropped
Size (bytes):	3295
Entropy (8bit):	5.5619586830838985
Encrypted:	false
SSDEEP:	48:cwtShh6+9IlEt/WzM7ovFgvvD7AmvWcwBFbLGTkMDUD5anK87ClJA:pQ6uIlE9iMmFSfAU3wBFWva6
MD5:	17CBBFD59CA88D7895BA913B498E96EE
SHA1:	1FD8A4FC8BDC9F6302FD1665DE03E563FFB23D77
SHA-256:	54EBBC67BAD7D7F3833C2C40A191B2CA4E8F922700732EB3BF1D369147B21974
SHA-512:	76B91801DEB1F2490E5E8C36FDFDAB721CCA653B4171C6481706B7F32AF28C83447242A613484CBC51784F9287BA7EA8EBC85529E32A612EC91C0362E681238D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ListShow1Level" GUID="{4FAB5824-1363-462F-8FB3-1410B8832995}">.. <Properties>.. <Property Class="Type" GUID="{11327DDD-219E-4FB7-9DF3-F47305D11676}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{B28133DB-0B8D-4F60-ADDF-A810DAB40577}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ListShow1Level</Property>.. <Property Class="Number" GUID="{5DC114FD-83EF-42C0-A891-6FD19A826917}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">25</Property>.. <Property Class="Text" GUID="{22D4CF53-63D5-49CA-8F98-CA3AEE29DFA4}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{4FAB5824-1363-462F-8FB3-1410B8832995}</Property>.. <Property Class="Memo" GUID="{0C1BDAB3-67BC-42BC-8E9B-306DEB2CCC29}" Name="HTMLSource" OrderIndex="5

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ListShow1Level\is-33IV4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (542), with CRLF line terminators
Category:	dropped
Size (bytes):	3295
Entropy (8bit):	5.5619586830838985
Encrypted:	false
SSDEEP:	48:cwtShh6+9IlEt/WzM7ovFgvvD7AmvWcwBFbLGTkMDUD5anK87ClJA:pQ6uIlE9iMmFSfAU3wBFWva6
MD5:	17CBBFD59CA88D7895BA913B498E96EE
SHA1:	1FD8A4FC8BDC9F6302FD1665DE03E563FFB23D77
SHA-256:	54EBBC67BAD7D7F3833C2C40A191B2CA4E8F922700732EB3BF1D369147B21974
SHA-512:	76B91801DEB1F2490E5E8C36FDFDAB721CCA653B4171C6481706B7F32AF28C83447242A613484CBC51784F9287BA7EA8EBC85529E32A612EC91C0362E681238D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ListShow1Level" GUID="{4FAB5824-1363-462F-8FB3-1410B8832995}">.. <Properties>.. <Property Class="Type" GUID="{11327DDD-219E-4FB7-9DF3-F47305D11676}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{B28133DB-0B8D-4F60-ADDF-A810DAB40577}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ListShow1Level</Property>.. <Property Class="Number" GUID="{5DC114FD-83EF-42C0-A891-6FD19A826917}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">25</Property>.. <Property Class="Text" GUID="{22D4CF53-63D5-49CA-8F98-CA3AEE29DFA4}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{4FAB5824-1363-462F-8FB3-1410B8832995}</Property>.. <Property Class="Memo" GUID="{0C1BDAB3-67BC-42BC-8E9B-306DEB2CCC29}" Name="HTMLSource" OrderIndex="5

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ListShowOnlyTypes\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (553), with CRLF line terminators
Category:	dropped
Size (bytes):	3323
Entropy (8bit):	5.563968884706815
Encrypted:	false
SSDEEP:	48:cj54wnTo79Ue/8zG08vFgvvD7pvW2Y5rUbHjRUD5anK87ClJA:0hn0mwEGZFSflpYWha6
MD5:	7B0CF982F79F0BD4DCCB3C7B46BA08F1
SHA1:	AD04BAC99D0C394A5CD5A8B8268410EDCBA120CC
SHA-256:	7090E36362E9CB5EC42CCAD9F3D363958E337E61D414A3A6D6F989621864605E
SHA-512:	0F2882130046B8CAF747469D0E807E013CD7C6E4F59423E9D1DAFB8C5B22D0AF7CE604764CC875BA6604842DFBF9C96D5AB4208E5839232707F1ECF54F5CC8F4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ListShowOnlyTypes" GUID="{C40956B6-3B97-45A7-BB29-339670116481}">.. <Properties>.. <Property Class="Type" GUID="{632E1BE5-75EE-42AD-8F99-A01D72500433}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{9B8E7266-7793-4DF6-A199-DC271CC1ED66}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ListShowOnlyTypes</Property>.. <Property Class="Number" GUID="{7A094183-66EA-4B1B-84B9-B50650D8CD03}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">26</Property>.. <Property Class="Text" GUID="{30B69F2C-6B61-4F9D-9EA2-F2A799B08501}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{C40956B6-3B97-45A7-BB29-339670116481}</Property>.. <Property Class="Memo" GUID="{796CADE6-A394-49B7-AABB-3AA6AADC097A}" Name="HTMLSource" OrderIn

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ListShowOnlyTypes\is-S585O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (553), with CRLF line terminators
Category:	dropped
Size (bytes):	3323
Entropy (8bit):	5.563968884706815
Encrypted:	false
SSDEEP:	48:cj54wnTo79Ue/8zG08vFgvvD7pvW2Y5rUbHjRUD5anK87ClJA:0hn0mwEGZFSflpYWha6
MD5:	7B0CF982F79F0BD4DCCB3C7B46BA08F1
SHA1:	AD04BAC99D0C394A5CD5A8B8268410EDCBA120CC
SHA-256:	7090E36362E9CB5EC42CCAD9F3D363958E337E61D414A3A6D6F989621864605E
SHA-512:	0F2882130046B8CAF747469D0E807E013CD7C6E4F59423E9D1DAFB8C5B22D0AF7CE604764CC875BA6604842DFBF9C96D5AB4208E5839232707F1ECF54F5CC8F4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ListShowOnlyTypes" GUID="{C40956B6-3B97-45A7-BB29-339670116481}">.. <Properties>.. <Property Class="Type" GUID="{632E1BE5-75EE-42AD-8F99-A01D72500433}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{9B8E7266-7793-4DF6-A199-DC271CC1ED66}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ListShowOnlyTypes</Property>.. <Property Class="Number" GUID="{7A094183-66EA-4B1B-84B9-B50650D8CD03}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">26</Property>.. <Property Class="Text" GUID="{30B69F2C-6B61-4F9D-9EA2-F2A799B08501}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{C40956B6-3B97-45A7-BB29-339670116481}</Property>.. <Property Class="Memo" GUID="{796CADE6-A394-49B7-AABB-3AA6AADC097A}" Name="HTMLSource" OrderIn

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ListShowSearch\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (540), with CRLF line terminators
Category:	dropped
Size (bytes):	3289
Entropy (8bit):	5.548580741743984
Encrypted:	false
SSDEEP:	96:idTLd55D4iGFaWOWgWznfWHFddeAXZnXrq1Aa6:idfd/0rvBfzneHteKnXG1s
MD5:	58EDCE6E905191874159C271EC3145BE
SHA1:	C55AC05FFE652ECB727DE532F9950A596335DCC0
SHA-256:	171AC8A620014AD0CB76E586FD49E719158A6A35FA6E8BD2ED3B197DC74663A0
SHA-512:	6379CBD98874E4E42992384266CF1D551744A991A587BD9BB1A570D5D0FC13253113C19ADFA6A6EDE309C3CE596E69959D88D4079B33038048413C3F68081D7A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ListShowSearch" GUID="{4A731DBE-6F78-45E1-A9A6-19FF17C89F95}">.. <Properties>.. <Property Class="Type" GUID="{BB6B842C-ED57-4E59-8618-E3BEF7B29F13}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{88199E19-1A99-4B5D-ACDF-FBF251C1B67A}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ListShowSearch</Property>.. <Property Class="Number" GUID="{7923F26D-D16C-4CC4-9B6F-A1DF03B014A1}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">27</Property>.. <Property Class="Text" GUID="{02FFADE9-C623-4B95-B82E-F0CD5A30A0DE}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{4A731DBE-6F78-45E1-A9A6-19FF17C89F95}</Property>.. <Property Class="Memo" GUID="{3E05F6A0-121F-4CEB-AC97-1CD49694E485}" Name="HTMLSource" OrderIndex="5

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ListShowSearch\is-4D3O5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (540), with CRLF line terminators
Category:	dropped
Size (bytes):	3289
Entropy (8bit):	5.548580741743984
Encrypted:	false
SSDEEP:	96:idTLd55D4iGFaWOWgWznfWHFddeAXZnXrq1Aa6:idfd/0rvBfzneHteKnXG1s
MD5:	58EDCE6E905191874159C271EC3145BE
SHA1:	C55AC05FFE652ECB727DE532F9950A596335DCC0
SHA-256:	171AC8A620014AD0CB76E586FD49E719158A6A35FA6E8BD2ED3B197DC74663A0
SHA-512:	6379CBD98874E4E42992384266CF1D551744A991A587BD9BB1A570D5D0FC13253113C19ADFA6A6EDE309C3CE596E69959D88D4079B33038048413C3F68081D7A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ListShowSearch" GUID="{4A731DBE-6F78-45E1-A9A6-19FF17C89F95}">.. <Properties>.. <Property Class="Type" GUID="{BB6B842C-ED57-4E59-8618-E3BEF7B29F13}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{88199E19-1A99-4B5D-ACDF-FBF251C1B67A}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ListShowSearch</Property>.. <Property Class="Number" GUID="{7923F26D-D16C-4CC4-9B6F-A1DF03B014A1}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">27</Property>.. <Property Class="Text" GUID="{02FFADE9-C623-4B95-B82E-F0CD5A30A0DE}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{4A731DBE-6F78-45E1-A9A6-19FF17C89F95}</Property>.. <Property Class="Memo" GUID="{3E05F6A0-121F-4CEB-AC97-1CD49694E485}" Name="HTMLSource" OrderIndex="5

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ListType\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (529), with CRLF line terminators
Category:	dropped
Size (bytes):	3625
Entropy (8bit):	5.461902365764577
Encrypted:	false
SSDEEP:	96:RiEwSit6RPwEqpDyFSdj0lYRPwEqpDZa6:P5fcDyAd4l+fcDD
MD5:	9405F59842E31445BF4C77E50665AB20
SHA1:	072141E4591F2BBE2D0AA430F148806B12B62D0F
SHA-256:	3E26EA2F61D58DA5B858C831CAD29EE8E67F9AD316EC970B51549601D6D757A6
SHA-512:	ADF213B2B51422C39F8057B56B9DFCEFC969832C4D44EECB581CAED9B65FF303183200B10FFF96CAE00754A9206B93BEFEB2F57A3585F4B87D67DD674575AAA0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ListType" GUID="{E302075E-AE3E-4CF5-8E58-0E2B7CB99234}">.. <Properties>.. <Property Class="Type" GUID="{E602C4D2-FB08-4C49-902C-BD6314FB1256}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{2F257290-88CF-4CB9-AA96-C9504225CB67}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ListType</Property>.. <Property Class="Number" GUID="{60DE774E-CB35-47A3-AC59-DE2425D1ED17}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">28</Property>.. <Property Class="Text" GUID="{1E99D569-4924-4EA4-9077-4FDE559CCECF}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{E302075E-AE3E-4CF5-8E58-0E2B7CB99234}</Property>.. <Property Class="Memo" GUID="{48F6300A-8CC2-4AA7-AE08-BEBE1B1840C1}" Name="HTMLSource" OrderIndex="5" DecimalPla

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ListType\is-RBDAH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (529), with CRLF line terminators
Category:	dropped
Size (bytes):	3625
Entropy (8bit):	5.461902365764577
Encrypted:	false
SSDEEP:	96:RiEwSit6RPwEqpDyFSdj0lYRPwEqpDZa6:P5fcDyAd4l+fcDD
MD5:	9405F59842E31445BF4C77E50665AB20
SHA1:	072141E4591F2BBE2D0AA430F148806B12B62D0F
SHA-256:	3E26EA2F61D58DA5B858C831CAD29EE8E67F9AD316EC970B51549601D6D757A6
SHA-512:	ADF213B2B51422C39F8057B56B9DFCEFC969832C4D44EECB581CAED9B65FF303183200B10FFF96CAE00754A9206B93BEFEB2F57A3585F4B87D67DD674575AAA0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ListType" GUID="{E302075E-AE3E-4CF5-8E58-0E2B7CB99234}">.. <Properties>.. <Property Class="Type" GUID="{E602C4D2-FB08-4C49-902C-BD6314FB1256}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{2F257290-88CF-4CB9-AA96-C9504225CB67}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ListType</Property>.. <Property Class="Number" GUID="{60DE774E-CB35-47A3-AC59-DE2425D1ED17}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">28</Property>.. <Property Class="Text" GUID="{1E99D569-4924-4EA4-9077-4FDE559CCECF}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{E302075E-AE3E-4CF5-8E58-0E2B7CB99234}</Property>.. <Property Class="Memo" GUID="{48F6300A-8CC2-4AA7-AE08-BEBE1B1840C1}" Name="HTMLSource" OrderIndex="5" DecimalPla

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ListVisibleColumnsInDropdown\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1185), with CRLF line terminators
Category:	dropped
Size (bytes):	8543
Entropy (8bit):	5.219391256672502
Encrypted:	false
SSDEEP:	192:XNdO2z0dODzdOudO6dOzJl2PNKTLQdOGGpgdO/edODiEdOc:XNdOY0dODzdOudO6dOzJl2FEQdOGGpgm
MD5:	12D05351468CCE268DBF7574E0F59BD1
SHA1:	7C32FFF3A789E812ABF302BFCB070B16ACDAFC5C
SHA-256:	554328260FBDC8B81223B7D1632A7B627B7E720C75456871352B71C8C41B9AFA
SHA-512:	006261867FB4C9FBB66A3BC0E6A44252F43E4037B9BAEE843FAFFF38F61852B503A558152EDA68478F9A1A264032F64D27CD8D34CC85D01EC049385A74E2A5D5
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="ListVisibleColumnsInDropdown" GUID="{A3B07DAC-74A5-4B31-9058-CC56A21B1EF4}">.. <Properties>.. <Property Class="Type" GUID="{2169AA59-0088-4D9C-9562-08EBB0672914}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Property</Property>.. <Property Class="Text" GUID="{051BAC31-6F2A-4277-857D-0092FF930D37}" Name="Name" inheritaction="Ignore

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ListVisibleColumnsInDropdown\is-5CROP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1185), with CRLF line terminators
Category:	dropped
Size (bytes):	8543
Entropy (8bit):	5.219391256672502
Encrypted:	false
SSDEEP:	192:XNdO2z0dODzdOudO6dOzJl2PNKTLQdOGGpgdO/edODiEdOc:XNdOY0dODzdOudO6dOzJl2FEQdOGGpgm
MD5:	12D05351468CCE268DBF7574E0F59BD1
SHA1:	7C32FFF3A789E812ABF302BFCB070B16ACDAFC5C
SHA-256:	554328260FBDC8B81223B7D1632A7B627B7E720C75456871352B71C8C41B9AFA
SHA-512:	006261867FB4C9FBB66A3BC0E6A44252F43E4037B9BAEE843FAFFF38F61852B503A558152EDA68478F9A1A264032F64D27CD8D34CC85D01EC049385A74E2A5D5
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="ListVisibleColumnsInDropdown" GUID="{A3B07DAC-74A5-4B31-9058-CC56A21B1EF4}">.. <Properties>.. <Property Class="Type" GUID="{2169AA59-0088-4D9C-9562-08EBB0672914}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Property</Property>.. <Property Class="Text" GUID="{051BAC31-6F2A-4277-857D-0092FF930D37}" Name="Name" inheritaction="Ignore

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ListVisibleColumnsIn\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (597), with CRLF line terminators
Category:	dropped
Size (bytes):	3453
Entropy (8bit):	5.552971663768387
Encrypted:	false
SSDEEP:	48:cwS2Tx5F5cieSOj0/YpHtSeBScbSuISkvDpSDvFgivWgAZSHiMSbIS+oNeSdGUDM:Rn/zDe1+YpNJ1b2PNKFBHCGmcWeiGa6
MD5:	6D20885826129830C2F7EE7436C11C66
SHA1:	8075AA717A48F918A04BC9E685E647352EE10CD4
SHA-256:	545DA0069A7CFB052B8C2077957A0F63FC699701E36A7C970995B8ABE598228D
SHA-512:	4AA51D70E47CDEE1FF15DF3A9A2AE8CC5DC9886DDF0D58D0B95973DD81562D90C3D0BA0E129AD5B2D6B21ABB05CA6C62BC8C854A204541292869E06E3B843FE2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ListVisibleColumnsInDropdown" GUID="{A3B07DAC-74A5-4B31-9058-CC56A21B1EF4}">.. <Properties>.. <Property Class="Type" GUID="{2169AA59-0088-4D9C-9562-08EBB0672914}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{051BAC31-6F2A-4277-857D-0092FF930D37}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ListVisibleColumnsInDropdown</Property>.. <Property Class="Number" GUID="{D465E422-C69E-4FE4-83C5-7349479A3A73}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">29</Property>.. <Property Class="Text" GUID="{FC89E621-39E4-44F7-BA55-0999D1200E90}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{A3B07DAC-74A5-4B31-9058-CC56A21B1EF4}</Property>.. <Property Class="Memo" GUID="{91E62B5B-FBDB-43D4-9F72-48EF9C2EFEA7}" Nam

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ListVisibleColumnsIn\is-CK3LH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (597), with CRLF line terminators
Category:	dropped
Size (bytes):	3453
Entropy (8bit):	5.552971663768387
Encrypted:	false
SSDEEP:	48:cwS2Tx5F5cieSOj0/YpHtSeBScbSuISkvDpSDvFgivWgAZSHiMSbIS+oNeSdGUDM:Rn/zDe1+YpNJ1b2PNKFBHCGmcWeiGa6
MD5:	6D20885826129830C2F7EE7436C11C66
SHA1:	8075AA717A48F918A04BC9E685E647352EE10CD4
SHA-256:	545DA0069A7CFB052B8C2077957A0F63FC699701E36A7C970995B8ABE598228D
SHA-512:	4AA51D70E47CDEE1FF15DF3A9A2AE8CC5DC9886DDF0D58D0B95973DD81562D90C3D0BA0E129AD5B2D6B21ABB05CA6C62BC8C854A204541292869E06E3B843FE2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ListVisibleColumnsInDropdown" GUID="{A3B07DAC-74A5-4B31-9058-CC56A21B1EF4}">.. <Properties>.. <Property Class="Type" GUID="{2169AA59-0088-4D9C-9562-08EBB0672914}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{051BAC31-6F2A-4277-857D-0092FF930D37}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ListVisibleColumnsInDropdown</Property>.. <Property Class="Number" GUID="{D465E422-C69E-4FE4-83C5-7349479A3A73}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">29</Property>.. <Property Class="Text" GUID="{FC89E621-39E4-44F7-BA55-0999D1200E90}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{A3B07DAC-74A5-4B31-9058-CC56A21B1EF4}</Property>.. <Property Class="Memo" GUID="{91E62B5B-FBDB-43D4-9F72-48EF9C2EFEA7}" Nam

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\List\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (807), with CRLF line terminators
Category:	dropped
Size (bytes):	4455
Entropy (8bit):	5.456705280639846
Encrypted:	false
SSDEEP:	96:HpuMAtTTKXSzJGeddA+gFSVoyAzJIGWa6:EnFVddA+gAVNA25
MD5:	EBD5C535879BBAB69B34A555EC7B4164
SHA1:	E78AE7AD1262DFD198973E311ABBC6A68DAE7DE1
SHA-256:	265E8C1C4F479EF2BE599E822F5951E116B13AE97154F2166A9E70060C4D5C86
SHA-512:	C67B5BE334DF00FBFE0B605306A8F15CB6DB5CA7C4CA7D9AFA6C29D2657E6EF4FC03BA8697C66BB55B2759FCAF838F11AC469B67B772C23D2E19DF5967502F93
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="List" GUID="{F1E3D278-CBD6-4CB8-B8A3-6D1A380A31C9}">.. <Properties>.. <Property Class="Type" GUID="{72B5166D-FD6A-4A98-903A-712496ECA962}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{CD7E7428-FF1B-41A1-B25B-354A09727D9A}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">List</Property>.. <Property Class="Number" GUID="{50D7E822-2FBE-4B44-8AE5-AA00FF205B50}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">19</Property>.. <Property Class="Text" GUID="{E2FAB92B-E21F-4FAE-9A73-CFE73D8B1184}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{F1E3D278-CBD6-4CB8-B8A3-6D1A380A31C9}</Property>.. <Property Class="Memo" GUID="{A3B9C4D9-954B-45BF-A931-4362EFA1E7C5}" Name="HTMLSource" OrderIndex="5" DecimalPlaces="">&

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\List\is-3136A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (807), with CRLF line terminators
Category:	dropped
Size (bytes):	4455
Entropy (8bit):	5.456705280639846
Encrypted:	false
SSDEEP:	96:HpuMAtTTKXSzJGeddA+gFSVoyAzJIGWa6:EnFVddA+gAVNA25
MD5:	EBD5C535879BBAB69B34A555EC7B4164
SHA1:	E78AE7AD1262DFD198973E311ABBC6A68DAE7DE1
SHA-256:	265E8C1C4F479EF2BE599E822F5951E116B13AE97154F2166A9E70060C4D5C86
SHA-512:	C67B5BE334DF00FBFE0B605306A8F15CB6DB5CA7C4CA7D9AFA6C29D2657E6EF4FC03BA8697C66BB55B2759FCAF838F11AC469B67B772C23D2E19DF5967502F93
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="List" GUID="{F1E3D278-CBD6-4CB8-B8A3-6D1A380A31C9}">.. <Properties>.. <Property Class="Type" GUID="{72B5166D-FD6A-4A98-903A-712496ECA962}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{CD7E7428-FF1B-41A1-B25B-354A09727D9A}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">List</Property>.. <Property Class="Number" GUID="{50D7E822-2FBE-4B44-8AE5-AA00FF205B50}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">19</Property>.. <Property Class="Text" GUID="{E2FAB92B-E21F-4FAE-9A73-CFE73D8B1184}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{F1E3D278-CBD6-4CB8-B8A3-6D1A380A31C9}</Property>.. <Property Class="Memo" GUID="{A3B9C4D9-954B-45BF-A931-4362EFA1E7C5}" Name="HTMLSource" OrderIndex="5" DecimalPlaces="">&

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\MeetsInputCondition\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (540), with CRLF line terminators
Category:	dropped
Size (bytes):	3291
Entropy (8bit):	5.526247803221016
Encrypted:	false
SSDEEP:	48:cY9jsI0zylPtTYD5anK87ClJDv13puvFgvvDkvWA/S8V9qL+A1c:l9oZzyhtTWpzcFSiLS8V9qK9
MD5:	DC6BC8E7152246A30F94AE0ABA8B1DE6
SHA1:	BF92EAD0487E1181B7447B82DBDB92E8D55F8127
SHA-256:	0B7723FB530F245373ACADAB4E96DC68D0D1859F67776D35B85E2E73F953FE8D
SHA-512:	402CBDC78E78006592E5803408D18E9209B7F21189B0259D384AFD82164F42D1E908383BB4ABC3EED0D5B222A5F9693EC0A20689F7BE6CC78E64062410DB3AF7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="MeetsInputCondition" GUID="{18BABC0D-B042-41A8-AF05-1D2C55E820DA}">.. <Properties>.. <Property Class="Type" GUID="{C39F469F-E395-4FA5-8EE3-93113A517A89}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{258E25E0-265B-4DC1-ADAF-A27022D9B448}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">MeetsInputCondition</Property>.. <Property Class="Number" GUID="{433E5E40-9642-42C7-81E3-3B599C6487BA}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">30</Property>.. <Property Class="Text" GUID="{11A71194-FB32-4597-88AC-D21743B60555}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{18BABC0D-B042-41A8-AF05-1D2C55E820DA}</Property>.. <Property Class="Memo" GUID="{7F8A4607-8F5A-4FCD-A345-4B23B1E3496A}" Name="Form Layout" sy

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\MeetsInputCondition\is-5V66D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (540), with CRLF line terminators
Category:	dropped
Size (bytes):	3291
Entropy (8bit):	5.526247803221016
Encrypted:	false
SSDEEP:	48:cY9jsI0zylPtTYD5anK87ClJDv13puvFgvvDkvWA/S8V9qL+A1c:l9oZzyhtTWpzcFSiLS8V9qK9
MD5:	DC6BC8E7152246A30F94AE0ABA8B1DE6
SHA1:	BF92EAD0487E1181B7447B82DBDB92E8D55F8127
SHA-256:	0B7723FB530F245373ACADAB4E96DC68D0D1859F67776D35B85E2E73F953FE8D
SHA-512:	402CBDC78E78006592E5803408D18E9209B7F21189B0259D384AFD82164F42D1E908383BB4ABC3EED0D5B222A5F9693EC0A20689F7BE6CC78E64062410DB3AF7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="MeetsInputCondition" GUID="{18BABC0D-B042-41A8-AF05-1D2C55E820DA}">.. <Properties>.. <Property Class="Type" GUID="{C39F469F-E395-4FA5-8EE3-93113A517A89}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{258E25E0-265B-4DC1-ADAF-A27022D9B448}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">MeetsInputCondition</Property>.. <Property Class="Number" GUID="{433E5E40-9642-42C7-81E3-3B599C6487BA}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">30</Property>.. <Property Class="Text" GUID="{11A71194-FB32-4597-88AC-D21743B60555}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{18BABC0D-B042-41A8-AF05-1D2C55E820DA}</Property>.. <Property Class="Memo" GUID="{7F8A4607-8F5A-4FCD-A345-4B23B1E3496A}" Name="Form Layout" sy

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\Name\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (525), with CRLF line terminators
Category:	dropped
Size (bytes):	3191
Entropy (8bit):	5.520178637010845
Encrypted:	false
SSDEEP:	48:c/15TYcSch6HOBj4uevFgvvDGvWgLw43bh7lRBUD5anKcl7mJA:eT0csTBFSgjwSJZaG
MD5:	AA4181177D52173255DFA948C806685B
SHA1:	11490AB3C923C32B7EAABF72EAC6A2644A7890B4
SHA-256:	6C94E4C3011FFC79B7184629B4FA4CE5EAD2665A4310CCBD9496BA22A6FAB987
SHA-512:	2CB2948E57C8D043D760D77549FCAB69C4648B6CB5A376BA919089EED54F07EF1A791E559E096B437988C3C45EACDCB71C35F7ED2C89953AB89B0B027C3CD37C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Name" GUID="{7C8F8E79-6E0B-491C-9FD9-45A05E8D3549}">.. <Properties>.. <Property Class="Type" GUID="{7BCCA755-00CC-442C-9558-E3F1035F1328}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{0E041752-F063-432A-B16C-32E35C4DC119}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">Name</Property>.. <Property Class="Number" GUID="{71D0A3DF-E5CC-4BF2-AB45-86614D19E7DB}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">31</Property>.. <Property Class="Text" GUID="{A344EBEA-0EDD-4CB7-90BB-321EF6663228}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{7C8F8E79-6E0B-491C-9FD9-45A05E8D3549}</Property>.. <Property Class="Memo" GUID="{AF9E46AE-A896-475F-A68C-97B704BC6B93}" Name="HTMLSource" OrderIndex="5" DecimalPlaces="">&

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\Name\is-3GRSL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (525), with CRLF line terminators
Category:	dropped
Size (bytes):	3191
Entropy (8bit):	5.520178637010845
Encrypted:	false
SSDEEP:	48:c/15TYcSch6HOBj4uevFgvvDGvWgLw43bh7lRBUD5anKcl7mJA:eT0csTBFSgjwSJZaG
MD5:	AA4181177D52173255DFA948C806685B
SHA1:	11490AB3C923C32B7EAABF72EAC6A2644A7890B4
SHA-256:	6C94E4C3011FFC79B7184629B4FA4CE5EAD2665A4310CCBD9496BA22A6FAB987
SHA-512:	2CB2948E57C8D043D760D77549FCAB69C4648B6CB5A376BA919089EED54F07EF1A791E559E096B437988C3C45EACDCB71C35F7ED2C89953AB89B0B027C3CD37C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Name" GUID="{7C8F8E79-6E0B-491C-9FD9-45A05E8D3549}">.. <Properties>.. <Property Class="Type" GUID="{7BCCA755-00CC-442C-9558-E3F1035F1328}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{0E041752-F063-432A-B16C-32E35C4DC119}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">Name</Property>.. <Property Class="Number" GUID="{71D0A3DF-E5CC-4BF2-AB45-86614D19E7DB}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">31</Property>.. <Property Class="Text" GUID="{A344EBEA-0EDD-4CB7-90BB-321EF6663228}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{7C8F8E79-6E0B-491C-9FD9-45A05E8D3549}</Property>.. <Property Class="Memo" GUID="{AF9E46AE-A896-475F-A68C-97B704BC6B93}" Name="HTMLSource" OrderIndex="5" DecimalPlaces="">&

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\PlugInToExecuteButto\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (597), with CRLF line terminators
Category:	dropped
Size (bytes):	3433
Entropy (8bit):	5.518287084673074
Encrypted:	false
SSDEEP:	48:c03IPKmY6Ukt8p5JlP7/sivFgvvDtKvWKJ2A1yEQbsNwy163MUD5anK87ClJA:1mQTkt8XfFS+n22ylcra6
MD5:	998C9D4443CA5D9BC88BB4236FF48D8F
SHA1:	C221F8D75CB41587F9D18A4E490E7FFBAAA1FA0D
SHA-256:	0E1DDAEEA2943D4E6DF9B7619A2FFDF0ABF691771A419A1ADB613C0770EA7454
SHA-512:	CA8460D7FE7BB29CF29E7031FB3FCDA935A7B750E84719D438B75E5D6DFC89E3FE36D8A449FAA86F285317661DD4F04DD45DA151F50D36CB3CC3A251A8DB0B8F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="PlugInToExecuteButtonCaption" GUID="{D7622CAA-D331-42A3-9358-805044EDD9BD}">.. <Properties>.. <Property Class="Type" GUID="{6455E125-479F-4E08-9B06-72BBD29F3453}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{BA94BA09-2F68-4CAE-8537-A0F89A293A2D}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">PlugInToExecuteButtonCaption</Property>.. <Property Class="Number" GUID="{A92812A4-2723-4083-ADC4-FF16E5B41B0D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">33</Property>.. <Property Class="Text" GUID="{33A7F990-C8F1-4E72-9DE8-497C08BFDBE5}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{D7622CAA-D331-42A3-9358-805044EDD9BD}</Property>.. <Property Class="Memo" GUID="{7071A746-C6A9-437D-92A0-87D65923285C}" Nam

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\PlugInToExecuteButto\is-R3T4F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (597), with CRLF line terminators
Category:	dropped
Size (bytes):	3433
Entropy (8bit):	5.518287084673074
Encrypted:	false
SSDEEP:	48:c03IPKmY6Ukt8p5JlP7/sivFgvvDtKvWKJ2A1yEQbsNwy163MUD5anK87ClJA:1mQTkt8XfFS+n22ylcra6
MD5:	998C9D4443CA5D9BC88BB4236FF48D8F
SHA1:	C221F8D75CB41587F9D18A4E490E7FFBAAA1FA0D
SHA-256:	0E1DDAEEA2943D4E6DF9B7619A2FFDF0ABF691771A419A1ADB613C0770EA7454
SHA-512:	CA8460D7FE7BB29CF29E7031FB3FCDA935A7B750E84719D438B75E5D6DFC89E3FE36D8A449FAA86F285317661DD4F04DD45DA151F50D36CB3CC3A251A8DB0B8F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="PlugInToExecuteButtonCaption" GUID="{D7622CAA-D331-42A3-9358-805044EDD9BD}">.. <Properties>.. <Property Class="Type" GUID="{6455E125-479F-4E08-9B06-72BBD29F3453}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{BA94BA09-2F68-4CAE-8537-A0F89A293A2D}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">PlugInToExecuteButtonCaption</Property>.. <Property Class="Number" GUID="{A92812A4-2723-4083-ADC4-FF16E5B41B0D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">33</Property>.. <Property Class="Text" GUID="{33A7F990-C8F1-4E72-9DE8-497C08BFDBE5}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{D7622CAA-D331-42A3-9358-805044EDD9BD}</Property>.. <Property Class="Memo" GUID="{7071A746-C6A9-437D-92A0-87D65923285C}" Nam

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\PlugInToExecuteButtonCaption\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1185), with CRLF line terminators
Category:	dropped
Size (bytes):	8523
Entropy (8bit):	5.218679246753529
Encrypted:	false
SSDEEP:	192:XdOrdO48dO7dOgdOrA+YQdOggdOhdO2dOc:XdOrdO48dO7dOgdOUQdOggdOhdO2dOc
MD5:	87FA2B265A1D8BAC9AEFA299CAA89E5D
SHA1:	E6E29029C3AE06778ADFFEA3AB9C305BC8109E7C
SHA-256:	A87DE4723EE6DFAD79E241158FCADCAC96EBE14EB63D6C7F99C29B23DC407696
SHA-512:	473C469D7BAF4DE8883E332B0898ECAF66BB1CAD509CABD567E16A4AA4C9021F5C2F00B7655361D454CA525553EF677B50C99C4E72B34D61D0BE6E028F3614E2
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="PlugInToExecuteButtonCaption" GUID="{D7622CAA-D331-42A3-9358-805044EDD9BD}">.. <Properties>.. <Property Class="Type" GUID="{6455E125-479F-4E08-9B06-72BBD29F3453}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Property</Property>.. <Property Class="Text" GUID="{BA94BA09-2F68-4CAE-8537-A0F89A293A2D}" Name="Name" inheritaction="Ignore

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\PlugInToExecuteButtonCaption\is-MJHVQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1185), with CRLF line terminators
Category:	dropped
Size (bytes):	8523
Entropy (8bit):	5.218679246753529
Encrypted:	false
SSDEEP:	192:XdOrdO48dO7dOgdOrA+YQdOggdOhdO2dOc:XdOrdO48dO7dOgdOUQdOggdOhdO2dOc
MD5:	87FA2B265A1D8BAC9AEFA299CAA89E5D
SHA1:	E6E29029C3AE06778ADFFEA3AB9C305BC8109E7C
SHA-256:	A87DE4723EE6DFAD79E241158FCADCAC96EBE14EB63D6C7F99C29B23DC407696
SHA-512:	473C469D7BAF4DE8883E332B0898ECAF66BB1CAD509CABD567E16A4AA4C9021F5C2F00B7655361D454CA525553EF677B50C99C4E72B34D61D0BE6E028F3614E2
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="PlugInToExecuteButtonCaption" GUID="{D7622CAA-D331-42A3-9358-805044EDD9BD}">.. <Properties>.. <Property Class="Type" GUID="{6455E125-479F-4E08-9B06-72BBD29F3453}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Property</Property>.. <Property Class="Text" GUID="{BA94BA09-2F68-4CAE-8537-A0F89A293A2D}" Name="Name" inheritaction="Ignore

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\PlugInToExecute\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (545), with CRLF line terminators
Category:	dropped
Size (bytes):	3303
Entropy (8bit):	5.524065685413384
Encrypted:	false
SSDEEP:	48:cf4CDYTF4iGUKedgGqj64hvFgvvDSjvWLlf44b4ebK1uUD5anK87ClJA:W456iGUKedfv2FSmLWf37mua6
MD5:	71A08B92828B0CC80667CFF0AD7CA9CD
SHA1:	9AA8EC7179D3B4BD233B3EDA7027ED2F18C344B0
SHA-256:	E22D019ECE1098519F5ECED5FD1779B8EC2DBE0C254C059B90A9AEDC03B21F37
SHA-512:	6DEBCA3C7D4B2E6A482D49A272BA5358ABCDF60BEBBC0BF658C84B1FF19CB89C6E20EE9E43A4AC2004233848FD3FF0085261F099CE400910A65BC2BA9202793E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="PlugInToExecute" GUID="{1B1FA0BF-F926-48FA-8286-CF343A4FE54D}">.. <Properties>.. <Property Class="Type" GUID="{558974F2-CEDE-409D-9A44-206ACC547178}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{A3C3CA3D-EC9B-4079-B4F7-7BEC4D8E0C43}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">PlugInToExecute</Property>.. <Property Class="Number" GUID="{24B29D77-8936-414E-BF0C-0BEED261CF87}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">32</Property>.. <Property Class="Text" GUID="{806F087B-C9FA-40F7-BEC2-132E2539831F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{1B1FA0BF-F926-48FA-8286-CF343A4FE54D}</Property>.. <Property Class="Memo" GUID="{A16A4842-1836-424C-B5F1-81B89A6D889D}" Name="HTMLSource" OrderIndex=

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\PlugInToExecute\is-KHO78.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (545), with CRLF line terminators
Category:	dropped
Size (bytes):	3303
Entropy (8bit):	5.524065685413384
Encrypted:	false
SSDEEP:	48:cf4CDYTF4iGUKedgGqj64hvFgvvDSjvWLlf44b4ebK1uUD5anK87ClJA:W456iGUKedfv2FSmLWf37mua6
MD5:	71A08B92828B0CC80667CFF0AD7CA9CD
SHA1:	9AA8EC7179D3B4BD233B3EDA7027ED2F18C344B0
SHA-256:	E22D019ECE1098519F5ECED5FD1779B8EC2DBE0C254C059B90A9AEDC03B21F37
SHA-512:	6DEBCA3C7D4B2E6A482D49A272BA5358ABCDF60BEBBC0BF658C84B1FF19CB89C6E20EE9E43A4AC2004233848FD3FF0085261F099CE400910A65BC2BA9202793E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="PlugInToExecute" GUID="{1B1FA0BF-F926-48FA-8286-CF343A4FE54D}">.. <Properties>.. <Property Class="Type" GUID="{558974F2-CEDE-409D-9A44-206ACC547178}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{A3C3CA3D-EC9B-4079-B4F7-7BEC4D8E0C43}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">PlugInToExecute</Property>.. <Property Class="Number" GUID="{24B29D77-8936-414E-BF0C-0BEED261CF87}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">32</Property>.. <Property Class="Text" GUID="{806F087B-C9FA-40F7-BEC2-132E2539831F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{1B1FA0BF-F926-48FA-8286-CF343A4FE54D}</Property>.. <Property Class="Memo" GUID="{A16A4842-1836-424C-B5F1-81B89A6D889D}" Name="HTMLSource" OrderIndex=

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\PropertyType\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (533), with CRLF line terminators
Category:	dropped
Size (bytes):	3245
Entropy (8bit):	5.522724280901619
Encrypted:	false
SSDEEP:	48:cHUpdQGzIoeH5DYD5anK87ClJE/jzvFgvvDgvWqVgwJkh6Gh:2M/IrxWUFSGBVgw8
MD5:	809878D1763FEFF6AFF90E72BA2A3553
SHA1:	23726AF2F84E06286E7DAEA2476DAABA9D96352F
SHA-256:	D7A20FA26BA3359FE52ADD60C8E8B61CDF2E408E833C286E2B6F324ACE8A459B
SHA-512:	4F5B6B4E7A13C040A69E39220AE863761011672EAD1CAFA5FFB71330DFFC3564DA1C305A29D4061404208E6A1793BE568A5A41AB672C8D56FD015BE951174050
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="PropertyType" GUID="{52C4792F-4EC6-4869-AF64-0948D241F611}">.. <Properties>.. <Property Class="Type" GUID="{8AD02CB2-B31F-433D-B550-95D887C8094D}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{844A1605-9CA5-4AB4-A60E-EC3DE5570E42}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">PropertyType</Property>.. <Property Class="Number" GUID="{85896431-3BC0-4D6C-B695-1F8F6E628F81}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">34</Property>.. <Property Class="Text" GUID="{7E16478E-52F6-4E14-B4E1-3AC3CEC92F99}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{52C4792F-4EC6-4869-AF64-0948D241F611}</Property>.. <Property Class="Memo" GUID="{6EFEB6A9-5E03-432D-A271-3C969E5C6FFD}" Name="Form Layout" systemhidden="Tr

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\PropertyType\is-URFMQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (533), with CRLF line terminators
Category:	dropped
Size (bytes):	3245
Entropy (8bit):	5.522724280901619
Encrypted:	false
SSDEEP:	48:cHUpdQGzIoeH5DYD5anK87ClJE/jzvFgvvDgvWqVgwJkh6Gh:2M/IrxWUFSGBVgw8
MD5:	809878D1763FEFF6AFF90E72BA2A3553
SHA1:	23726AF2F84E06286E7DAEA2476DAABA9D96352F
SHA-256:	D7A20FA26BA3359FE52ADD60C8E8B61CDF2E408E833C286E2B6F324ACE8A459B
SHA-512:	4F5B6B4E7A13C040A69E39220AE863761011672EAD1CAFA5FFB71330DFFC3564DA1C305A29D4061404208E6A1793BE568A5A41AB672C8D56FD015BE951174050
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="PropertyType" GUID="{52C4792F-4EC6-4869-AF64-0948D241F611}">.. <Properties>.. <Property Class="Type" GUID="{8AD02CB2-B31F-433D-B550-95D887C8094D}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{844A1605-9CA5-4AB4-A60E-EC3DE5570E42}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">PropertyType</Property>.. <Property Class="Number" GUID="{85896431-3BC0-4D6C-B695-1F8F6E628F81}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">34</Property>.. <Property Class="Text" GUID="{7E16478E-52F6-4E14-B4E1-3AC3CEC92F99}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{52C4792F-4EC6-4869-AF64-0948D241F611}</Property>.. <Property Class="Memo" GUID="{6EFEB6A9-5E03-432D-A271-3C969E5C6FFD}" Name="Form Layout" systemhidden="Tr

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ResultAsFloat\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (534), with CRLF line terminators
Category:	dropped
Size (bytes):	3245
Entropy (8bit):	5.515410509526674
Encrypted:	false
SSDEEP:	48:cc3mExPRJ/YD5anK87ClJnDVivFgvvDovWaXV3qmH2DW:n3tpJ/WzgFS+nXV3SW
MD5:	A86D0B60F51FBDC8A3336D6E617BA53E
SHA1:	E418E5C6A56296706C0119EC76D50AB021C6AE6C
SHA-256:	781622774CD57D3F1124516A73AB0D62E462C85DF24FFDE8E9F1F33A1F1AE0F0
SHA-512:	C4B9EB2A705F2F43B6FAFE3CBEA0ADFFE905DF272CA03CE1B01B3B5871A6AD6624C6E58F1B74B4400B1FD477DF600FEBA72E7A775D444A5FCBE3F4DAB0C821F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ResultAsFloat" GUID="{B511BC64-A727-44D0-ADA2-89A0D6BBC23F}">.. <Properties>.. <Property Class="Type" GUID="{8068C951-8A32-4A97-BD60-DA85503F4620}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{221AD76D-D7F0-4371-BF96-ECFE1EC2F30B}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ResultAsFloat</Property>.. <Property Class="Number" GUID="{8EF4C82A-0144-41B2-B1A5-B18DA6F211FA}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">37</Property>.. <Property Class="Text" GUID="{7E1B9DD9-BFB4-4B00-ABDA-AC24565AB742}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{B511BC64-A727-44D0-ADA2-89A0D6BBC23F}</Property>.. <Property Class="Memo" GUID="{9DDF303D-12AE-4A87-973E-A5C344662B05}" Name="Form Layout" systemhidden="

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ResultAsFloat\is-9PNH2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (534), with CRLF line terminators
Category:	dropped
Size (bytes):	3245
Entropy (8bit):	5.515410509526674
Encrypted:	false
SSDEEP:	48:cc3mExPRJ/YD5anK87ClJnDVivFgvvDovWaXV3qmH2DW:n3tpJ/WzgFS+nXV3SW
MD5:	A86D0B60F51FBDC8A3336D6E617BA53E
SHA1:	E418E5C6A56296706C0119EC76D50AB021C6AE6C
SHA-256:	781622774CD57D3F1124516A73AB0D62E462C85DF24FFDE8E9F1F33A1F1AE0F0
SHA-512:	C4B9EB2A705F2F43B6FAFE3CBEA0ADFFE905DF272CA03CE1B01B3B5871A6AD6624C6E58F1B74B4400B1FD477DF600FEBA72E7A775D444A5FCBE3F4DAB0C821F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ResultAsFloat" GUID="{B511BC64-A727-44D0-ADA2-89A0D6BBC23F}">.. <Properties>.. <Property Class="Type" GUID="{8068C951-8A32-4A97-BD60-DA85503F4620}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{221AD76D-D7F0-4371-BF96-ECFE1EC2F30B}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ResultAsFloat</Property>.. <Property Class="Number" GUID="{8EF4C82A-0144-41B2-B1A5-B18DA6F211FA}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">37</Property>.. <Property Class="Text" GUID="{7E1B9DD9-BFB4-4B00-ABDA-AC24565AB742}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{B511BC64-A727-44D0-ADA2-89A0D6BBC23F}</Property>.. <Property Class="Memo" GUID="{9DDF303D-12AE-4A87-973E-A5C344662B05}" Name="Form Layout" systemhidden="

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ResultAsInteger\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (539), with CRLF line terminators
Category:	dropped
Size (bytes):	3291
Entropy (8bit):	5.514404352791113
Encrypted:	false
SSDEEP:	48:cS6AxJQxXm76o0YD5anK87ClJvDKvFgvvDQvWKKJVbbZ:D6AoW76dWiFS+ZgVbF
MD5:	7132EFF93C0724AC229555E8F48D55AD
SHA1:	9AA86B22366E1898A31E392CAE0C6D46F7C1D26E
SHA-256:	70CDEB06B26A6B3C81CB46A3571423B55D393D4C8569A4E7364ABB5AC522CE1F
SHA-512:	E6CAE30FA08AC56AC48B0A72AADE7020F9D4DF21B8E322FDD11923F5A250BB289E19A90C26F870900168E0E3935A3270A3879BFC3821CA3FE4E8270F370B4C68
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ResultAsInteger" GUID="{D8EDD07C-270B-4521-A6C9-0FBBB3E88D48}">.. <Properties>.. <Property Class="Type" GUID="{603FFA09-842E-4FC9-ACF2-EB7077E1C17F}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{45DB6D4F-E84D-49E7-BBC4-8FA1582CA471}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ResultAsInteger</Property>.. <Property Class="Number" GUID="{27F54816-2CB5-4C06-903B-8A82FB32F985}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">36</Property>.. <Property Class="Text" GUID="{E80B9252-B374-4C5C-9DE0-57684C0A6515}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{D8EDD07C-270B-4521-A6C9-0FBBB3E88D48}</Property>.. <Property Class="Memo" GUID="{51C3A7C3-54B7-413C-92AB-35635879B610}" Name="Form Layout" systemhidd

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ResultAsInteger\is-NH6OI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (539), with CRLF line terminators
Category:	dropped
Size (bytes):	3291
Entropy (8bit):	5.514404352791113
Encrypted:	false
SSDEEP:	48:cS6AxJQxXm76o0YD5anK87ClJvDKvFgvvDQvWKKJVbbZ:D6AoW76dWiFS+ZgVbF
MD5:	7132EFF93C0724AC229555E8F48D55AD
SHA1:	9AA86B22366E1898A31E392CAE0C6D46F7C1D26E
SHA-256:	70CDEB06B26A6B3C81CB46A3571423B55D393D4C8569A4E7364ABB5AC522CE1F
SHA-512:	E6CAE30FA08AC56AC48B0A72AADE7020F9D4DF21B8E322FDD11923F5A250BB289E19A90C26F870900168E0E3935A3270A3879BFC3821CA3FE4E8270F370B4C68
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ResultAsInteger" GUID="{D8EDD07C-270B-4521-A6C9-0FBBB3E88D48}">.. <Properties>.. <Property Class="Type" GUID="{603FFA09-842E-4FC9-ACF2-EB7077E1C17F}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{45DB6D4F-E84D-49E7-BBC4-8FA1582CA471}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ResultAsInteger</Property>.. <Property Class="Number" GUID="{27F54816-2CB5-4C06-903B-8A82FB32F985}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">36</Property>.. <Property Class="Text" GUID="{E80B9252-B374-4C5C-9DE0-57684C0A6515}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{D8EDD07C-270B-4521-A6C9-0FBBB3E88D48}</Property>.. <Property Class="Memo" GUID="{51C3A7C3-54B7-413C-92AB-35635879B610}" Name="Form Layout" systemhidd

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ResultAsString\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (535), with CRLF line terminators
Category:	dropped
Size (bytes):	3261
Entropy (8bit):	5.529888131081604
Encrypted:	false
SSDEEP:	48:cdXnNXrQoHuIYD5anK87ClJSIzvFgvvDpvWTkRVCIJgl9:MXpHuIWzFSRMkRVLM
MD5:	382CDA441E0DBE7521D86DCA20D06BCA
SHA1:	A877698CD904173DE867A6D990245F81C3E2584D
SHA-256:	16889C8340C800A76584E221FA12C1B95DB93EE7FD6F141636EA553045A8798C
SHA-512:	81EBE815A894DFBCA6C73D1AF40E40317F334F0A5C4A5703AABF9276776E3935FEA7E2CD2E8B7911013515EBD48E913060D58065921D1CC9BF223C96388B992C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ResultAsString" GUID="{78DF2674-F8FD-4141-9675-6EE7A2096DE8}">.. <Properties>.. <Property Class="Type" GUID="{8A686CF8-6DFA-4409-97C7-6C26EE45A980}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{3C54AD02-453D-4DDA-B4B4-5734E0F40429}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ResultAsString</Property>.. <Property Class="Number" GUID="{5E2A7D68-0796-4122-9ED0-3516955A8E87}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">35</Property>.. <Property Class="Text" GUID="{F88065A8-49F3-4010-AD4E-377362282723}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{78DF2674-F8FD-4141-9675-6EE7A2096DE8}</Property>.. <Property Class="Memo" GUID="{E21CD515-F0E5-4B5C-9FAD-611EE0ABCDAB}" Name="Form Layout" systemhidden

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ResultAsString\is-VK3J7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (535), with CRLF line terminators
Category:	dropped
Size (bytes):	3261
Entropy (8bit):	5.529888131081604
Encrypted:	false
SSDEEP:	48:cdXnNXrQoHuIYD5anK87ClJSIzvFgvvDpvWTkRVCIJgl9:MXpHuIWzFSRMkRVLM
MD5:	382CDA441E0DBE7521D86DCA20D06BCA
SHA1:	A877698CD904173DE867A6D990245F81C3E2584D
SHA-256:	16889C8340C800A76584E221FA12C1B95DB93EE7FD6F141636EA553045A8798C
SHA-512:	81EBE815A894DFBCA6C73D1AF40E40317F334F0A5C4A5703AABF9276776E3935FEA7E2CD2E8B7911013515EBD48E913060D58065921D1CC9BF223C96388B992C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ResultAsString" GUID="{78DF2674-F8FD-4141-9675-6EE7A2096DE8}">.. <Properties>.. <Property Class="Type" GUID="{8A686CF8-6DFA-4409-97C7-6C26EE45A980}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{3C54AD02-453D-4DDA-B4B4-5734E0F40429}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ResultAsString</Property>.. <Property Class="Number" GUID="{5E2A7D68-0796-4122-9ED0-3516955A8E87}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">35</Property>.. <Property Class="Text" GUID="{F88065A8-49F3-4010-AD4E-377362282723}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{78DF2674-F8FD-4141-9675-6EE7A2096DE8}</Property>.. <Property Class="Memo" GUID="{E21CD515-F0E5-4B5C-9FAD-611EE0ABCDAB}" Name="Form Layout" systemhidden

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ResultAsVariant\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (536), with CRLF line terminators
Category:	dropped
Size (bytes):	3265
Entropy (8bit):	5.524059353913528
Encrypted:	false
SSDEEP:	48:crclAOK8YD5anK87ClJJJitvFgvvDzvW2QVT/:PlZK8W4FSPyVT
MD5:	C2261DDF39A8864803F08D33308DEEBB
SHA1:	F3606C8613BE746104DE65D43229CBC4310417D2
SHA-256:	C87DF8B9CE9AE19B120C9D44854A3A644894C89C39D1AD7927EE9327BC301A8A
SHA-512:	9A0D5AFCC22259FC66D0C4D16C3CE28A1079FD42C2E6835176C9951AEE8F1C9384C6CAD314EBC97A1FA255B077299818F6914AB9C80F962DE5CF928339CE24CC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ResultAsVariant" GUID="{72A4EDD4-0947-4E9D-8CE9-DB07FD681E56}">.. <Properties>.. <Property Class="Type" GUID="{59033C29-45C1-40BF-B658-1707D86BC97F}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{CFE7626A-04A3-40FC-8873-826CE338B231}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ResultAsVariant</Property>.. <Property Class="Number" GUID="{1AB920F3-1D11-4A1B-983F-BA037F679B6C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">38</Property>.. <Property Class="Text" GUID="{D041C1ED-0F71-4B9C-AF40-223F6D06E0DD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{72A4EDD4-0947-4E9D-8CE9-DB07FD681E56}</Property>.. <Property Class="Memo" GUID="{6B640E48-7F2B-4B93-B103-8FDA04F05766}" Name="Form Layout" systemhidd

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ResultAsVariant\is-J3F2O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (536), with CRLF line terminators
Category:	dropped
Size (bytes):	3265
Entropy (8bit):	5.524059353913528
Encrypted:	false
SSDEEP:	48:crclAOK8YD5anK87ClJJJitvFgvvDzvW2QVT/:PlZK8W4FSPyVT
MD5:	C2261DDF39A8864803F08D33308DEEBB
SHA1:	F3606C8613BE746104DE65D43229CBC4310417D2
SHA-256:	C87DF8B9CE9AE19B120C9D44854A3A644894C89C39D1AD7927EE9327BC301A8A
SHA-512:	9A0D5AFCC22259FC66D0C4D16C3CE28A1079FD42C2E6835176C9951AEE8F1C9384C6CAD314EBC97A1FA255B077299818F6914AB9C80F962DE5CF928339CE24CC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ResultAsVariant" GUID="{72A4EDD4-0947-4E9D-8CE9-DB07FD681E56}">.. <Properties>.. <Property Class="Type" GUID="{59033C29-45C1-40BF-B658-1707D86BC97F}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{CFE7626A-04A3-40FC-8873-826CE338B231}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ResultAsVariant</Property>.. <Property Class="Number" GUID="{1AB920F3-1D11-4A1B-983F-BA037F679B6C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">38</Property>.. <Property Class="Text" GUID="{D041C1ED-0F71-4B9C-AF40-223F6D06E0DD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{72A4EDD4-0947-4E9D-8CE9-DB07FD681E56}</Property>.. <Property Class="Memo" GUID="{6B640E48-7F2B-4B93-B103-8FDA04F05766}" Name="Form Layout" systemhidd

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ScriptLanguage\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (699), with CRLF line terminators
Category:	dropped
Size (bytes):	3609
Entropy (8bit):	5.474588164785975
Encrypted:	false
SSDEEP:	96:zk8g1cZvE/z+rEfDpJFSKqw4+rEfDpPRQa6:zhl+z+YdJAKF4+YdW
MD5:	28C1297E18C0F773BA27DBFF77151758
SHA1:	1C69677BDEF8AEB4E0AD605E76AF5F65CCF60BD5
SHA-256:	4137A80511FD53B5691FF9C8A3121B716C6CEE21BE213B7F558C4AA3680A2B82
SHA-512:	BB69E135094D64F15F1ED3A003A7B52826C9677A1A58976988CE5007F389A958ED4F1CC50BD493B1101FBC257222BD584BEDCB69D16E5CC913A955261FB54AC9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ScriptLanguage" GUID="{FFCF7C45-9E9A-438C-8B35-C7CA8B2AAA78}">.. <Properties>.. <Property Class="Type" GUID="{0C746D8E-8DFA-47C8-BC7D-506B86C1F935}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{C0EFD4B1-2CFA-40B9-A63E-FF24A679425E}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ScriptLanguage</Property>.. <Property Class="Number" GUID="{AC85EED4-BDA8-415F-8100-200ED581E2F2}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">40</Property>.. <Property Class="Text" GUID="{CE48EAFE-8D9D-480E-A8BE-42FEB5DFABBB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{FFCF7C45-9E9A-438C-8B35-C7CA8B2AAA78}</Property>.. <Property Class="Memo" GUID="{F44FA853-83F1-4876-B768-64B541F835CD}" Name="HTMLSource" OrderIndex="5

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ScriptLanguage\is-L6P3N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (699), with CRLF line terminators
Category:	dropped
Size (bytes):	3609
Entropy (8bit):	5.474588164785975
Encrypted:	false
SSDEEP:	96:zk8g1cZvE/z+rEfDpJFSKqw4+rEfDpPRQa6:zhl+z+YdJAKF4+YdW
MD5:	28C1297E18C0F773BA27DBFF77151758
SHA1:	1C69677BDEF8AEB4E0AD605E76AF5F65CCF60BD5
SHA-256:	4137A80511FD53B5691FF9C8A3121B716C6CEE21BE213B7F558C4AA3680A2B82
SHA-512:	BB69E135094D64F15F1ED3A003A7B52826C9677A1A58976988CE5007F389A958ED4F1CC50BD493B1101FBC257222BD584BEDCB69D16E5CC913A955261FB54AC9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ScriptLanguage" GUID="{FFCF7C45-9E9A-438C-8B35-C7CA8B2AAA78}">.. <Properties>.. <Property Class="Type" GUID="{0C746D8E-8DFA-47C8-BC7D-506B86C1F935}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{C0EFD4B1-2CFA-40B9-A63E-FF24A679425E}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ScriptLanguage</Property>.. <Property Class="Number" GUID="{AC85EED4-BDA8-415F-8100-200ED581E2F2}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">40</Property>.. <Property Class="Text" GUID="{CE48EAFE-8D9D-480E-A8BE-42FEB5DFABBB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{FFCF7C45-9E9A-438C-8B35-C7CA8B2AAA78}</Property>.. <Property Class="Memo" GUID="{F44FA853-83F1-4876-B768-64B541F835CD}" Name="HTMLSource" OrderIndex="5

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ScriptParameters\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (808), with CRLF line terminators
Category:	dropped
Size (bytes):	7657
Entropy (8bit):	5.265157463792282
Encrypted:	false
SSDEEP:	192:aRZxvZc6EAoIXQdVXQXVXQC8oREG6Th74VU:abXukK4VU
MD5:	5960B556B6FAC7802201FC47DA50F692
SHA1:	285C0CBB7C4AB135E736E3D9DBEE669758CFFBC6
SHA-256:	C6652D17C129C3BF9501AC4D20052B0DBD8AA09D2194469F5B264E7F08730FCE
SHA-512:	361864FE816F0A84425C6545B5F3B1EB6078FA921A7CF2B4AB60285F54EDF810FD7F3EDE77AB0FB7A407CEA75C728180E38084D3828F39F7ECB948AEB1D95394
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ScriptParameters" GUID="{24CBD684-D986-48A1-801A-FF049921F1E1}">.. <Properties>.. <Property Class="Type" GUID="{AFCE6626-72EA-4D37-B701-1120E9A8D28D}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{4C0AC422-9BDD-4D84-83C1-EFD3B531C0A2}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ScriptParameters</Property>.. <Property Class="Number" GUID="{4F237FF2-4DDA-4122-ABA3-1BC49EDCE14F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">41</Property>.. <Property Class="Text" GUID="{92F34D4B-BD25-4139-8576-08A262D037D5}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{24CBD684-D986-48A1-801A-FF049921F1E1}</Property>.. <Property Class="Memo" GUID="{95CFD466-D88A-4A5B-8E86-BAE0128354EA}" Name="HTMLSource" OrderInde

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ScriptParameters\is-R368P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (808), with CRLF line terminators
Category:	dropped
Size (bytes):	7657
Entropy (8bit):	5.265157463792282
Encrypted:	false
SSDEEP:	192:aRZxvZc6EAoIXQdVXQXVXQC8oREG6Th74VU:abXukK4VU
MD5:	5960B556B6FAC7802201FC47DA50F692
SHA1:	285C0CBB7C4AB135E736E3D9DBEE669758CFFBC6
SHA-256:	C6652D17C129C3BF9501AC4D20052B0DBD8AA09D2194469F5B264E7F08730FCE
SHA-512:	361864FE816F0A84425C6545B5F3B1EB6078FA921A7CF2B4AB60285F54EDF810FD7F3EDE77AB0FB7A407CEA75C728180E38084D3828F39F7ECB948AEB1D95394
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ScriptParameters" GUID="{24CBD684-D986-48A1-801A-FF049921F1E1}">.. <Properties>.. <Property Class="Type" GUID="{AFCE6626-72EA-4D37-B701-1120E9A8D28D}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{4C0AC422-9BDD-4D84-83C1-EFD3B531C0A2}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ScriptParameters</Property>.. <Property Class="Number" GUID="{4F237FF2-4DDA-4122-ABA3-1BC49EDCE14F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">41</Property>.. <Property Class="Text" GUID="{92F34D4B-BD25-4139-8576-08A262D037D5}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{24CBD684-D986-48A1-801A-FF049921F1E1}</Property>.. <Property Class="Memo" GUID="{95CFD466-D88A-4A5B-8E86-BAE0128354EA}" Name="HTMLSource" OrderInde

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ScriptType\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (643), with CRLF line terminators
Category:	dropped
Size (bytes):	3489
Entropy (8bit):	5.492049812110518
Encrypted:	false
SSDEEP:	48:cHy+jiRuzh0WERe8Ltjvxc8qL5EM+vFgvvDHuvWPQErb8qL5EM4CcUD5anK87ClS:Ey+mR6/OeOqL5EMMFSYIr4qL5EM8a6
MD5:	D0930D9055EAD26A08058D9E3BDACA22
SHA1:	697F89B31AC219CFE403C0C11FBF201491DB351E
SHA-256:	D60F6BC265343EC626E1EEDE843401919E914BC17D815B77AD5006B0546C3DE1
SHA-512:	A706F0C3C2D1BB85AFC5A7C329B4959C93BCC63BA3EB9A3CA6B0E1891B9DDDF518821DCE7FF0813155F059E33E297D870914C20067536DCA4AA032BF38BD42E6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ScriptType" GUID="{C9E23280-267E-4BE4-9B37-8E550E6F5C56}">.. <Properties>.. <Property Class="Type" GUID="{C2139143-D1B9-4890-8DB7-745D62257EA9}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{6B9744C4-292E-4A8A-B1A3-EE22F5F4CE8B}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ScriptType</Property>.. <Property Class="Number" GUID="{FBBCD630-BE8C-4196-956C-2E83261E9F0E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">39</Property>.. <Property Class="Text" GUID="{AEDA7E39-29CE-4EAD-872F-FABC9B56EA32}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{C9E23280-267E-4BE4-9B37-8E550E6F5C56}</Property>.. <Property Class="Memo" GUID="{EA86EB9A-D0FC-44B2-AAA0-A4DA47692F53}" Name="HTMLSource" OrderIndex="5" Decima

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\ScriptType\is-0KN3A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (643), with CRLF line terminators
Category:	dropped
Size (bytes):	3489
Entropy (8bit):	5.492049812110518
Encrypted:	false
SSDEEP:	48:cHy+jiRuzh0WERe8Ltjvxc8qL5EM+vFgvvDHuvWPQErb8qL5EM4CcUD5anK87ClS:Ey+mR6/OeOqL5EMMFSYIr4qL5EM8a6
MD5:	D0930D9055EAD26A08058D9E3BDACA22
SHA1:	697F89B31AC219CFE403C0C11FBF201491DB351E
SHA-256:	D60F6BC265343EC626E1EEDE843401919E914BC17D815B77AD5006B0546C3DE1
SHA-512:	A706F0C3C2D1BB85AFC5A7C329B4959C93BCC63BA3EB9A3CA6B0E1891B9DDDF518821DCE7FF0813155F059E33E297D870914C20067536DCA4AA032BF38BD42E6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ScriptType" GUID="{C9E23280-267E-4BE4-9B37-8E550E6F5C56}">.. <Properties>.. <Property Class="Type" GUID="{C2139143-D1B9-4890-8DB7-745D62257EA9}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{6B9744C4-292E-4A8A-B1A3-EE22F5F4CE8B}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">ScriptType</Property>.. <Property Class="Number" GUID="{FBBCD630-BE8C-4196-956C-2E83261E9F0E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">39</Property>.. <Property Class="Text" GUID="{AEDA7E39-29CE-4EAD-872F-FABC9B56EA32}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{C9E23280-267E-4BE4-9B37-8E550E6F5C56}</Property>.. <Property Class="Memo" GUID="{EA86EB9A-D0FC-44B2-AAA0-A4DA47692F53}" Name="HTMLSource" OrderIndex="5" Decima

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\SimpleList\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1253), with CRLF line terminators
Category:	dropped
Size (bytes):	8963
Entropy (8bit):	5.217103751011139
Encrypted:	false
SSDEEP:	192:ml9XddibHYvZc6EA7IXQnVXQsVXQd87REG6Thzz0sd:zsZMAO
MD5:	86779A0816ED655FD16DCFBEEEDC8FF6
SHA1:	BB1B1B44199E7039FC110AE00CFAB410793F8F20
SHA-256:	8B8E087EC5EF92CB9A652FDD7554542072DD80DF4E2FC511405EECFE2D876207
SHA-512:	F01EC1107D126B28579613FA50FE76C50E4E85E022443D51CFE4EBFF7BC6F2A785AA1683C02B0C6C8118448DC00B437B1CAF411BA23A78E99F5C7415BEADF5C8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SimpleList" GUID="{1C9ABB09-4A9E-49E5-BF76-C4906620AB1B}">.. <Properties>.. <Property Class="Type" GUID="{167A2944-3B87-4C49-B72D-A40E04D5BEFB}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{723EA240-1527-4511-8464-BC0B09697107}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SimpleList</Property>.. <Property Class="Number" GUID="{FD89E0AC-CA65-42EF-BFC3-C3BF8081E11D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">42</Property>.. <Property Class="Text" GUID="{6B91FD9E-2E10-49EA-BE6B-CD2631FF3C72}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{1C9ABB09-4A9E-49E5-BF76-C4906620AB1B}</Property>.. <Property Class="Memo" GUID="{9B009224-A0C7-41D9-982D-114E7F2689E7}" Name="HTMLSource" OrderIndex="5" Decima

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\SimpleList\is-96UE6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1253), with CRLF line terminators
Category:	dropped
Size (bytes):	8963
Entropy (8bit):	5.217103751011139
Encrypted:	false
SSDEEP:	192:ml9XddibHYvZc6EA7IXQnVXQsVXQd87REG6Thzz0sd:zsZMAO
MD5:	86779A0816ED655FD16DCFBEEEDC8FF6
SHA1:	BB1B1B44199E7039FC110AE00CFAB410793F8F20
SHA-256:	8B8E087EC5EF92CB9A652FDD7554542072DD80DF4E2FC511405EECFE2D876207
SHA-512:	F01EC1107D126B28579613FA50FE76C50E4E85E022443D51CFE4EBFF7BC6F2A785AA1683C02B0C6C8118448DC00B437B1CAF411BA23A78E99F5C7415BEADF5C8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SimpleList" GUID="{1C9ABB09-4A9E-49E5-BF76-C4906620AB1B}">.. <Properties>.. <Property Class="Type" GUID="{167A2944-3B87-4C49-B72D-A40E04D5BEFB}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{723EA240-1527-4511-8464-BC0B09697107}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SimpleList</Property>.. <Property Class="Number" GUID="{FD89E0AC-CA65-42EF-BFC3-C3BF8081E11D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">42</Property>.. <Property Class="Text" GUID="{6B91FD9E-2E10-49EA-BE6B-CD2631FF3C72}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{1C9ABB09-4A9E-49E5-BF76-C4906620AB1B}</Property>.. <Property Class="Memo" GUID="{9B009224-A0C7-41D9-982D-114E7F2689E7}" Name="HTMLSource" OrderIndex="5" Decima

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\SliderMax\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (530), with CRLF line terminators
Category:	dropped
Size (bytes):	3243
Entropy (8bit):	5.536604516680205
Encrypted:	false
SSDEEP:	48:cIcGW2PlU4TVyZtqbD8yvFgvvDIvWuhE3tb9LAWZtUD5anK87ClJA:4GWxL4FS+xq3tV9ta6
MD5:	1944F2E24A8F004BD44F209BF2047130
SHA1:	32C7B09E0EEAC241ACDED654CEEC474FA8CCAE75
SHA-256:	006CA140F79A9B576D59BFDF103BC39C1B258914974C8ADFDDFB095398A9E7E5
SHA-512:	8B2F9C890AAEB1AD77A8042FE0D5C32356FE9620A9F71E145A93627470FE7544E52EEEC7E9DC97985792ED8B95250F355CB0FB30397E2EE420DA493364600212
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SliderMax" GUID="{4C4B3B27-81C7-450F-A391-08BCD86F1A11}">.. <Properties>.. <Property Class="Type" GUID="{77C6DF60-484F-4126-B77C-454171956AED}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{75F9DB76-E041-45D9-A656-077DC3306116}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SliderMax</Property>.. <Property Class="Number" GUID="{B6CF6E41-5103-407A-86D9-0FD69A5DDC43}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">43</Property>.. <Property Class="Text" GUID="{AF659059-C2D2-49CC-B330-0697290A5145}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{4C4B3B27-81C7-450F-A391-08BCD86F1A11}</Property>.. <Property Class="Memo" GUID="{480CC0AD-DA42-4AE4-9B5F-571C6CAFEDC3}" Name="HTMLSource" OrderIndex="5" DecimalP

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\SliderMax\is-HLB3U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (530), with CRLF line terminators
Category:	dropped
Size (bytes):	3243
Entropy (8bit):	5.536604516680205
Encrypted:	false
SSDEEP:	48:cIcGW2PlU4TVyZtqbD8yvFgvvDIvWuhE3tb9LAWZtUD5anK87ClJA:4GWxL4FS+xq3tV9ta6
MD5:	1944F2E24A8F004BD44F209BF2047130
SHA1:	32C7B09E0EEAC241ACDED654CEEC474FA8CCAE75
SHA-256:	006CA140F79A9B576D59BFDF103BC39C1B258914974C8ADFDDFB095398A9E7E5
SHA-512:	8B2F9C890AAEB1AD77A8042FE0D5C32356FE9620A9F71E145A93627470FE7544E52EEEC7E9DC97985792ED8B95250F355CB0FB30397E2EE420DA493364600212
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SliderMax" GUID="{4C4B3B27-81C7-450F-A391-08BCD86F1A11}">.. <Properties>.. <Property Class="Type" GUID="{77C6DF60-484F-4126-B77C-454171956AED}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{75F9DB76-E041-45D9-A656-077DC3306116}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SliderMax</Property>.. <Property Class="Number" GUID="{B6CF6E41-5103-407A-86D9-0FD69A5DDC43}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">43</Property>.. <Property Class="Text" GUID="{AF659059-C2D2-49CC-B330-0697290A5145}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{4C4B3B27-81C7-450F-A391-08BCD86F1A11}</Property>.. <Property Class="Memo" GUID="{480CC0AD-DA42-4AE4-9B5F-571C6CAFEDC3}" Name="HTMLSource" OrderIndex="5" DecimalP

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\SliderMin\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (530), with CRLF line terminators
Category:	dropped
Size (bytes):	3245
Entropy (8bit):	5.537628267675204
Encrypted:	false
SSDEEP:	48:ckVNzi2hT49kt/zVOgGtH0/vFgvvDqvWdFiX+TcW1UD5anK87ClJA:hVNziV9khzVOgy8FS8gFiYa6
MD5:	188BF4CA98373E8764598794E9250C78
SHA1:	B0D521D373A74AE2FCFA1B440F096E374AF560ED
SHA-256:	E863496EB716F1E6C63208E7AD99E2A6F1541E73650240B3D9E23AEC4C12D72D
SHA-512:	DEAEE0B3AFBB1D90BD4D33A2F5F682B2EBAD65400E0B26CF12EC4B212499362A661E691ACB73EAB523623C639205D6F342587984EF11EE381B7BA5D7B9A3F54F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SliderMin" GUID="{B27A6697-0961-40F4-8B08-ADE8BCCC07A2}">.. <Properties>.. <Property Class="Type" GUID="{B9BD911F-9F24-4074-AC59-53B298B7A0ED}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{87540D0E-F1B5-4E4F-9BD9-F1E63968557D}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SliderMin</Property>.. <Property Class="Number" GUID="{0C24335D-81AF-407E-A580-8BF847F6E647}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">44</Property>.. <Property Class="Text" GUID="{E7AF3075-54A7-4484-9FA3-91AE8793AD70}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{B27A6697-0961-40F4-8B08-ADE8BCCC07A2}</Property>.. <Property Class="Memo" GUID="{DA50CA42-6D57-46F3-A99D-B0EC51512493}" Name="HTMLSource" OrderIndex="5" DecimalP

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\SliderMin\is-B4QCS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (530), with CRLF line terminators
Category:	dropped
Size (bytes):	3245
Entropy (8bit):	5.537628267675204
Encrypted:	false
SSDEEP:	48:ckVNzi2hT49kt/zVOgGtH0/vFgvvDqvWdFiX+TcW1UD5anK87ClJA:hVNziV9khzVOgy8FS8gFiYa6
MD5:	188BF4CA98373E8764598794E9250C78
SHA1:	B0D521D373A74AE2FCFA1B440F096E374AF560ED
SHA-256:	E863496EB716F1E6C63208E7AD99E2A6F1541E73650240B3D9E23AEC4C12D72D
SHA-512:	DEAEE0B3AFBB1D90BD4D33A2F5F682B2EBAD65400E0B26CF12EC4B212499362A661E691ACB73EAB523623C639205D6F342587984EF11EE381B7BA5D7B9A3F54F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SliderMin" GUID="{B27A6697-0961-40F4-8B08-ADE8BCCC07A2}">.. <Properties>.. <Property Class="Type" GUID="{B9BD911F-9F24-4074-AC59-53B298B7A0ED}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{87540D0E-F1B5-4E4F-9BD9-F1E63968557D}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SliderMin</Property>.. <Property Class="Number" GUID="{0C24335D-81AF-407E-A580-8BF847F6E647}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">44</Property>.. <Property Class="Text" GUID="{E7AF3075-54A7-4484-9FA3-91AE8793AD70}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{B27A6697-0961-40F4-8B08-ADE8BCCC07A2}</Property>.. <Property Class="Memo" GUID="{DA50CA42-6D57-46F3-A99D-B0EC51512493}" Name="HTMLSource" OrderIndex="5" DecimalP

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\SliderShowTicks\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (546), with CRLF line terminators
Category:	dropped
Size (bytes):	3305
Entropy (8bit):	5.5568551993048345
Encrypted:	false
SSDEEP:	48:cH8PTWRTecNAwQlTkFZ+MmvFgvvDHvWT54sbJj5WRt9UD5anK87ClJA:U8bqmFuuFSr0Ng9a6
MD5:	68332640061B1703F5F43E809E82384D
SHA1:	D1D1E9AEDD332693417A2695527B173C506F7407
SHA-256:	94A6FA3F96784033721A72C9A68CB4A444759AE3E7C02DA5EA2AC0A9B07FD6B4
SHA-512:	46CD9E94AA5B574BB8E6823CEA94AFAFB3F6F73F979B9E7F8804D1F95A3E5F9F6D532905217D23AC36A464A2E0BFC29ED07FBDAC826000221127C2074D9B8E0A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SliderShowTicks" GUID="{6D7B0FDB-B440-40E0-BBDA-1A31D29F7C38}">.. <Properties>.. <Property Class="Type" GUID="{082C9FF5-B947-4843-9E95-ECB0E4B1E4E1}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{55DB6F44-A51F-4895-AB4A-261079D7F140}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SliderShowTicks</Property>.. <Property Class="Number" GUID="{0B48875A-4C9B-4A42-AB43-4BBB850FFB0B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">45</Property>.. <Property Class="Text" GUID="{5C2E7DF7-D95D-48E2-8EF4-541766EF7FCA}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{6D7B0FDB-B440-40E0-BBDA-1A31D29F7C38}</Property>.. <Property Class="Memo" GUID="{1E68AA9A-9793-46EA-829F-2E4CC163514B}" Name="HTMLSource" OrderIndex=

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\SliderShowTicks\is-6RU6R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (546), with CRLF line terminators
Category:	dropped
Size (bytes):	3305
Entropy (8bit):	5.5568551993048345
Encrypted:	false
SSDEEP:	48:cH8PTWRTecNAwQlTkFZ+MmvFgvvDHvWT54sbJj5WRt9UD5anK87ClJA:U8bqmFuuFSr0Ng9a6
MD5:	68332640061B1703F5F43E809E82384D
SHA1:	D1D1E9AEDD332693417A2695527B173C506F7407
SHA-256:	94A6FA3F96784033721A72C9A68CB4A444759AE3E7C02DA5EA2AC0A9B07FD6B4
SHA-512:	46CD9E94AA5B574BB8E6823CEA94AFAFB3F6F73F979B9E7F8804D1F95A3E5F9F6D532905217D23AC36A464A2E0BFC29ED07FBDAC826000221127C2074D9B8E0A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SliderShowTicks" GUID="{6D7B0FDB-B440-40E0-BBDA-1A31D29F7C38}">.. <Properties>.. <Property Class="Type" GUID="{082C9FF5-B947-4843-9E95-ECB0E4B1E4E1}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{55DB6F44-A51F-4895-AB4A-261079D7F140}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SliderShowTicks</Property>.. <Property Class="Number" GUID="{0B48875A-4C9B-4A42-AB43-4BBB850FFB0B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">45</Property>.. <Property Class="Text" GUID="{5C2E7DF7-D95D-48E2-8EF4-541766EF7FCA}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{6D7B0FDB-B440-40E0-BBDA-1A31D29F7C38}</Property>.. <Property Class="Memo" GUID="{1E68AA9A-9793-46EA-829F-2E4CC163514B}" Name="HTMLSource" OrderIndex=

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\SliderTickFrequency\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (562), with CRLF line terminators
Category:	dropped
Size (bytes):	3345
Entropy (8bit):	5.530902670140054
Encrypted:	false
SSDEEP:	48:cNzkaHIT0ErjScjwrcsMVkvFgvvD0svWZ3E5nYbVv8W0aUD5anK87ClJA:SVojScaFSPm0GNa6
MD5:	39856D5CEB315636A69A2F8E803D0D64
SHA1:	EB4C96A88C288E8ECBE935816617F963671317BD
SHA-256:	B4BF4D891EDA91C99D1683DED8536DB813C8F8F456B4BBFE8F32ACD826400DD9
SHA-512:	8A11378C74EA1D7B7BEF20423E689D5CC39FCA6107663DC240949B6AC9655CEBF6D4727CA2E8272E67E2843730B318A336A3173B28D6C8A13992B02B9D3CBA45
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SliderTickFrequency" GUID="{5A6F936B-ED37-44EC-8765-A5D44B7E9250}">.. <Properties>.. <Property Class="Type" GUID="{A1B1F2C8-C74C-40F8-9877-63D36363F7D9}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{EE985BC7-2EC8-4DAB-B5E1-AC0194813A1F}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SliderTickFrequency</Property>.. <Property Class="Number" GUID="{73037590-7DB8-4C45-BAB7-88E631E55108}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">46</Property>.. <Property Class="Text" GUID="{0DBC02BB-D988-4F71-A925-1CE424B98ABD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{5A6F936B-ED37-44EC-8765-A5D44B7E9250}</Property>.. <Property Class="Memo" GUID="{B1252FCC-8F95-45D8-8865-15985FB57E63}" Name="HTMLSource" Ord

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\SliderTickFrequency\is-NLEAT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (562), with CRLF line terminators
Category:	dropped
Size (bytes):	3345
Entropy (8bit):	5.530902670140054
Encrypted:	false
SSDEEP:	48:cNzkaHIT0ErjScjwrcsMVkvFgvvD0svWZ3E5nYbVv8W0aUD5anK87ClJA:SVojScaFSPm0GNa6
MD5:	39856D5CEB315636A69A2F8E803D0D64
SHA1:	EB4C96A88C288E8ECBE935816617F963671317BD
SHA-256:	B4BF4D891EDA91C99D1683DED8536DB813C8F8F456B4BBFE8F32ACD826400DD9
SHA-512:	8A11378C74EA1D7B7BEF20423E689D5CC39FCA6107663DC240949B6AC9655CEBF6D4727CA2E8272E67E2843730B318A336A3173B28D6C8A13992B02B9D3CBA45
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SliderTickFrequency" GUID="{5A6F936B-ED37-44EC-8765-A5D44B7E9250}">.. <Properties>.. <Property Class="Type" GUID="{A1B1F2C8-C74C-40F8-9877-63D36363F7D9}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{EE985BC7-2EC8-4DAB-B5E1-AC0194813A1F}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SliderTickFrequency</Property>.. <Property Class="Number" GUID="{73037590-7DB8-4C45-BAB7-88E631E55108}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">46</Property>.. <Property Class="Text" GUID="{0DBC02BB-D988-4F71-A925-1CE424B98ABD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{5A6F936B-ED37-44EC-8765-A5D44B7E9250}</Property>.. <Property Class="Memo" GUID="{B1252FCC-8F95-45D8-8865-15985FB57E63}" Name="HTMLSource" Ord

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\SystemHidden\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (533), with CRLF line terminators
Category:	dropped
Size (bytes):	3265
Entropy (8bit):	5.536981790879561
Encrypted:	false
SSDEEP:	48:ccuW/s2cf0QSIZbf9YD5anK87ClJ+3P7F1SLvFgvvDjQvWBVFUDOaVV:ru9l0N8b1WmTF1gFSX6KVFUtV
MD5:	CFD7A48973D2F13A935A52FB2E114B64
SHA1:	BCDEEE8AEF6B7CA1D7D833B98CF38D182E96EF8F
SHA-256:	5988C9272E1130D751C70C86CAA2AFCAE1BA6B76365C5EA7937D27C0837770DE
SHA-512:	CD39353D7C03078D75D534B1F2EF714EF75200133DAD37847C4BB361AD65D1638A8DE32821133881B902B6E7DC888804A5F35E4C0AE24FC7087A0E8B20430F1E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SystemHidden" GUID="{081754BE-B4F9-452C-8EC0-BD014546A0AE}">.. <Properties>.. <Property Class="Type" GUID="{C7166952-CD90-48FD-9F4D-5D3A792C8CE7}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{31AEFDF3-C29F-424C-99AF-740E3B3F6BDD}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SystemHidden</Property>.. <Property Class="Number" GUID="{8A4B842B-E28B-468F-965D-1F7C7758E4E0}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">47</Property>.. <Property Class="Text" GUID="{1398FEBF-C946-4AB5-9FAC-6060EDF83EB3}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{081754BE-B4F9-452C-8EC0-BD014546A0AE}</Property>.. <Property Class="Memo" GUID="{22C8B853-90DE-4EC5-9147-9FC6F111B7E4}" Name="Form Layout" systemhidden="Tr

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\SystemHidden\is-DSOAG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (533), with CRLF line terminators
Category:	dropped
Size (bytes):	3265
Entropy (8bit):	5.536981790879561
Encrypted:	false
SSDEEP:	48:ccuW/s2cf0QSIZbf9YD5anK87ClJ+3P7F1SLvFgvvDjQvWBVFUDOaVV:ru9l0N8b1WmTF1gFSX6KVFUtV
MD5:	CFD7A48973D2F13A935A52FB2E114B64
SHA1:	BCDEEE8AEF6B7CA1D7D833B98CF38D182E96EF8F
SHA-256:	5988C9272E1130D751C70C86CAA2AFCAE1BA6B76365C5EA7937D27C0837770DE
SHA-512:	CD39353D7C03078D75D534B1F2EF714EF75200133DAD37847C4BB361AD65D1638A8DE32821133881B902B6E7DC888804A5F35E4C0AE24FC7087A0E8B20430F1E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SystemHidden" GUID="{081754BE-B4F9-452C-8EC0-BD014546A0AE}">.. <Properties>.. <Property Class="Type" GUID="{C7166952-CD90-48FD-9F4D-5D3A792C8CE7}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{31AEFDF3-C29F-424C-99AF-740E3B3F6BDD}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SystemHidden</Property>.. <Property Class="Number" GUID="{8A4B842B-E28B-468F-965D-1F7C7758E4E0}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">47</Property>.. <Property Class="Text" GUID="{1398FEBF-C946-4AB5-9FAC-6060EDF83EB3}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{081754BE-B4F9-452C-8EC0-BD014546A0AE}</Property>.. <Property Class="Memo" GUID="{22C8B853-90DE-4EC5-9147-9FC6F111B7E4}" Name="Form Layout" systemhidden="Tr

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\SystemLocked\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (533), with CRLF line terminators
Category:	dropped
Size (bytes):	3265
Entropy (8bit):	5.54381283055651
Encrypted:	false
SSDEEP:	48:c7HqKwij2o1xYD5anK87ClJot0vFgvvDyvWvaVBJZ:CqKjjxjWbFS8RVF
MD5:	F5F005233AE43BA1A1F0D001142CA2EE
SHA1:	DCDCA48607E33B836BF459D1C92DA7736784AA8B
SHA-256:	1AD6066C8C21E8925AF85655E1492491C2AA90D85A8BC8744AC6424BCE567278
SHA-512:	8F5AA810525B95D4B0441FC4252BCFE9B3EA3879F514A2FF1E3A840AE6F1DDC1B2DEA84C3B663B97AAA168F97DE5A0041F4DA4866C399EA9A4E7F47DCF317ACE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SystemLocked" GUID="{316E635F-B50E-43A7-B289-EC9CEE6B4117}">.. <Properties>.. <Property Class="Type" GUID="{B64E433B-3287-4781-BDBE-A1595DE2078A}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{EF963566-C8CE-4FF8-88BF-5C033F42F251}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SystemLocked</Property>.. <Property Class="Number" GUID="{6CA82B84-91BE-49A4-A868-A5B90F994AAA}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">48</Property>.. <Property Class="Text" GUID="{58683A80-BAB3-42B9-8199-0226733B9BBB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{316E635F-B50E-43A7-B289-EC9CEE6B4117}</Property>.. <Property Class="Memo" GUID="{F099E930-3704-4325-A0AA-BFF9E23006BC}" Name="Form Layout" systemhidden="Tr

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\SystemLocked\is-0RH0K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (533), with CRLF line terminators
Category:	dropped
Size (bytes):	3265
Entropy (8bit):	5.54381283055651
Encrypted:	false
SSDEEP:	48:c7HqKwij2o1xYD5anK87ClJot0vFgvvDyvWvaVBJZ:CqKjjxjWbFS8RVF
MD5:	F5F005233AE43BA1A1F0D001142CA2EE
SHA1:	DCDCA48607E33B836BF459D1C92DA7736784AA8B
SHA-256:	1AD6066C8C21E8925AF85655E1492491C2AA90D85A8BC8744AC6424BCE567278
SHA-512:	8F5AA810525B95D4B0441FC4252BCFE9B3EA3879F514A2FF1E3A840AE6F1DDC1B2DEA84C3B663B97AAA168F97DE5A0041F4DA4866C399EA9A4E7F47DCF317ACE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SystemLocked" GUID="{316E635F-B50E-43A7-B289-EC9CEE6B4117}">.. <Properties>.. <Property Class="Type" GUID="{B64E433B-3287-4781-BDBE-A1595DE2078A}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{EF963566-C8CE-4FF8-88BF-5C033F42F251}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SystemLocked</Property>.. <Property Class="Number" GUID="{6CA82B84-91BE-49A4-A868-A5B90F994AAA}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">48</Property>.. <Property Class="Text" GUID="{58683A80-BAB3-42B9-8199-0226733B9BBB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{316E635F-B50E-43A7-B289-EC9CEE6B4117}</Property>.. <Property Class="Memo" GUID="{F099E930-3704-4325-A0AA-BFF9E23006BC}" Name="Form Layout" systemhidden="Tr

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\TreeList\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (811), with CRLF line terminators
Category:	dropped
Size (bytes):	4431
Entropy (8bit):	5.42992037659197
Encrypted:	false
SSDEEP:	48:cdVynE5V575fQchvwGWBEv1vvD9v1idv1uvFovFgvvDtvW2w/+bwG03XZ5UD5anV:gVgSV5NZrWBedd0+AFSltDv4na6
MD5:	6226EB1950A5EB53FE9FA0DF36544714
SHA1:	6F1CC83CDFD0278A905AFD60A947244D5FBE1556
SHA-256:	AD96BC75BEB88C979F3EF13231772A1E838EA3A7BD0D602C87EB7C32FAE11419
SHA-512:	1E675978CFD381EFE5E1481A828CA8BB7761F679E6A086C3DFFE25F0C6832F225E0C614AC59153C8A67C0EE9D2B516C2514D014BC97A3B03E26982C99D827575
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="TreeList" GUID="{14BD8191-B608-4CF8-AEB0-BF05AAFC2A81}">.. <Properties>.. <Property Class="Type" GUID="{F38F1C7F-6B61-4ADF-AAD9-455DEF44E0FF}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{2F4B1671-5E7D-4421-8DA0-9D2471585795}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">TreeList</Property>.. <Property Class="Number" GUID="{E8D30FDE-6B79-4391-A3DA-4ACA1CC374ED}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">49</Property>.. <Property Class="Text" GUID="{DFA261F6-7E53-4EBC-919A-ECE2D65DF785}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{14BD8191-B608-4CF8-AEB0-BF05AAFC2A81}</Property>.. <Property Class="Memo" GUID="{19615AA3-6144-4110-A3AA-98100BC4B3BB}" Name="HTMLSource" OrderIndex="5" DecimalPla

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\TreeList\is-LOM8J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (811), with CRLF line terminators
Category:	dropped
Size (bytes):	4431
Entropy (8bit):	5.42992037659197
Encrypted:	false
SSDEEP:	48:cdVynE5V575fQchvwGWBEv1vvD9v1idv1uvFovFgvvDtvW2w/+bwG03XZ5UD5anV:gVgSV5NZrWBedd0+AFSltDv4na6
MD5:	6226EB1950A5EB53FE9FA0DF36544714
SHA1:	6F1CC83CDFD0278A905AFD60A947244D5FBE1556
SHA-256:	AD96BC75BEB88C979F3EF13231772A1E838EA3A7BD0D602C87EB7C32FAE11419
SHA-512:	1E675978CFD381EFE5E1481A828CA8BB7761F679E6A086C3DFFE25F0C6832F225E0C614AC59153C8A67C0EE9D2B516C2514D014BC97A3B03E26982C99D827575
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="TreeList" GUID="{14BD8191-B608-4CF8-AEB0-BF05AAFC2A81}">.. <Properties>.. <Property Class="Type" GUID="{F38F1C7F-6B61-4ADF-AAD9-455DEF44E0FF}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{2F4B1671-5E7D-4421-8DA0-9D2471585795}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">TreeList</Property>.. <Property Class="Number" GUID="{E8D30FDE-6B79-4391-A3DA-4ACA1CC374ED}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">49</Property>.. <Property Class="Text" GUID="{DFA261F6-7E53-4EBC-919A-ECE2D65DF785}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{14BD8191-B608-4CF8-AEB0-BF05AAFC2A81}</Property>.. <Property Class="Memo" GUID="{19615AA3-6144-4110-A3AA-98100BC4B3BB}" Name="HTMLSource" OrderIndex="5" DecimalPla

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\Units\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (526), with CRLF line terminators
Category:	dropped
Size (bytes):	3201
Entropy (8bit):	5.530156052542279
Encrypted:	false
SSDEEP:	48:cW6o+m5lvhzfNHxvovFgvvDavWXzbvL5/doUD5anK87ClJA:b6wBhzyFSc4zMa6
MD5:	C8E448AD4D0D0F6D934FA334F7A7CAB3
SHA1:	F7A8B98532C6F2E3D6FDD328D7BC961EBE52FFB1
SHA-256:	E3E9FC35B9D037417F22EA5789CD8A0636E4ECBE30FD0FC66694CF7D38F5CD2D
SHA-512:	5C47324E8E5F37A40C3DD20AC09E26B894CCB27279A2A03FC809EEA6924CF2F007B2A84A178F2918068A7299CB9EF639634A729404893ABB6CCDD8103713E61E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Units" GUID="{300928E4-033F-40C6-B517-EB7F171BE966}">.. <Properties>.. <Property Class="Type" GUID="{BEC6EBC9-EF9C-4C74-A026-CA8F3EF73B2D}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{FBBAFBB9-01F7-418C-936E-77A29BC58C75}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">Units</Property>.. <Property Class="Number" GUID="{A33B2A0A-B36D-45C7-958F-967151481005}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">50</Property>.. <Property Class="Text" GUID="{FA33BD49-7122-4F3F-A585-0E547A7530F9}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{300928E4-033F-40C6-B517-EB7F171BE966}</Property>.. <Property Class="Memo" GUID="{05C39C99-830A-4A53-85CF-410AE5A53A82}" Name="HTMLSource" OrderIndex="5" DecimalPlaces=""

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\Units\is-3S9EK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (526), with CRLF line terminators
Category:	dropped
Size (bytes):	3201
Entropy (8bit):	5.530156052542279
Encrypted:	false
SSDEEP:	48:cW6o+m5lvhzfNHxvovFgvvDavWXzbvL5/doUD5anK87ClJA:b6wBhzyFSc4zMa6
MD5:	C8E448AD4D0D0F6D934FA334F7A7CAB3
SHA1:	F7A8B98532C6F2E3D6FDD328D7BC961EBE52FFB1
SHA-256:	E3E9FC35B9D037417F22EA5789CD8A0636E4ECBE30FD0FC66694CF7D38F5CD2D
SHA-512:	5C47324E8E5F37A40C3DD20AC09E26B894CCB27279A2A03FC809EEA6924CF2F007B2A84A178F2918068A7299CB9EF639634A729404893ABB6CCDD8103713E61E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Units" GUID="{300928E4-033F-40C6-B517-EB7F171BE966}">.. <Properties>.. <Property Class="Type" GUID="{BEC6EBC9-EF9C-4C74-A026-CA8F3EF73B2D}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{FBBAFBB9-01F7-418C-936E-77A29BC58C75}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">Units</Property>.. <Property Class="Number" GUID="{A33B2A0A-B36D-45C7-958F-967151481005}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">50</Property>.. <Property Class="Text" GUID="{FA33BD49-7122-4F3F-A585-0E547A7530F9}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{300928E4-033F-40C6-B517-EB7F171BE966}</Property>.. <Property Class="Memo" GUID="{05C39C99-830A-4A53-85CF-410AE5A53A82}" Name="HTMLSource" OrderIndex="5" DecimalPlaces=""

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\UserHidden\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (531), with CRLF line terminators
Category:	dropped
Size (bytes):	3253
Entropy (8bit):	5.531171509535605
Encrypted:	false
SSDEEP:	48:cbFOLALf4d0Da5LOkZbvFgvvDGvWpQHyIgbkZCweW9UD5anK87ClJA:GMmNOrlFS4hHyIgQ/eKa6
MD5:	24F125077395DCCF0B2048C1CF27B3F9
SHA1:	19628E474B4142F0181CF54547B925B90F65E382
SHA-256:	E5AA8426CC92455962A3FCF181869E3C06407901A53532EF1FE7ADE9748D6D44
SHA-512:	40A374564EDE01F38CD82AA480AB0DA04A49978E4490061C23FB9AFE95DFA077DF6B8CB593E2612C23CAE4526031A068B92FBBC314F5FF1E6ACE84B98DD1A3E0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="UserHidden" GUID="{9E69DD20-7299-4F5F-AA8F-53F478AFD520}">.. <Properties>.. <Property Class="Type" GUID="{C4EDD6A3-0995-44A2-8410-6C67A6361EA9}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{211BF6FF-5FE3-4BDC-894A-F036D7211E83}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">UserHidden</Property>.. <Property Class="Number" GUID="{F82ED152-F17B-49B2-8E7A-280E78B60A2E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">51</Property>.. <Property Class="Text" GUID="{369F19EB-2209-4FCA-8DA4-EAC86A586EF6}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{9E69DD20-7299-4F5F-AA8F-53F478AFD520}</Property>.. <Property Class="Memo" GUID="{B0403BBC-373F-4FA4-96F8-DF7FE9C6C11A}" Name="HTMLSource" OrderIndex="5" Decima

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\UserHidden\is-1DE44.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (531), with CRLF line terminators
Category:	dropped
Size (bytes):	3253
Entropy (8bit):	5.531171509535605
Encrypted:	false
SSDEEP:	48:cbFOLALf4d0Da5LOkZbvFgvvDGvWpQHyIgbkZCweW9UD5anK87ClJA:GMmNOrlFS4hHyIgQ/eKa6
MD5:	24F125077395DCCF0B2048C1CF27B3F9
SHA1:	19628E474B4142F0181CF54547B925B90F65E382
SHA-256:	E5AA8426CC92455962A3FCF181869E3C06407901A53532EF1FE7ADE9748D6D44
SHA-512:	40A374564EDE01F38CD82AA480AB0DA04A49978E4490061C23FB9AFE95DFA077DF6B8CB593E2612C23CAE4526031A068B92FBBC314F5FF1E6ACE84B98DD1A3E0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="UserHidden" GUID="{9E69DD20-7299-4F5F-AA8F-53F478AFD520}">.. <Properties>.. <Property Class="Type" GUID="{C4EDD6A3-0995-44A2-8410-6C67A6361EA9}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{211BF6FF-5FE3-4BDC-894A-F036D7211E83}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">UserHidden</Property>.. <Property Class="Number" GUID="{F82ED152-F17B-49B2-8E7A-280E78B60A2E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">51</Property>.. <Property Class="Text" GUID="{369F19EB-2209-4FCA-8DA4-EAC86A586EF6}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{9E69DD20-7299-4F5F-AA8F-53F478AFD520}</Property>.. <Property Class="Memo" GUID="{B0403BBC-373F-4FA4-96F8-DF7FE9C6C11A}" Name="HTMLSource" OrderIndex="5" Decima

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\UserLocked\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (531), with CRLF line terminators
Category:	dropped
Size (bytes):	3251
Entropy (8bit):	5.53798758377977
Encrypted:	false
SSDEEP:	48:cfNCTKprJ6QpvCk/vFgvvDMvWSN6bk+nYFUD5anK87ClJA:qEiJ6EHFS69N6Qha6
MD5:	95816179B089955D0F9515EA5F68BAAC
SHA1:	8BC5C6D9DCF51D08B0F978D03CAD08F56C0BF8C9
SHA-256:	0D92968C418D39C8C333DFA85E75FDFFE2FFFBF74CF84A81A476E6600CD34BC8
SHA-512:	063314D3A8C44EAE66428A2D7AAA730D50820314C919FE72DD06075CB189AFA13D2A97B78382A5473DB1ACB9E89B444706DF3834FD26A2E5293AA1A969D12CC1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="UserLocked" GUID="{0DA46C94-D16C-433A-B780-A8332DF8823F}">.. <Properties>.. <Property Class="Type" GUID="{3FC48F25-794D-4F11-8EFE-B875AEF7D886}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{AF93A78E-BD75-42A7-9E9B-C08802324786}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">UserLocked</Property>.. <Property Class="Number" GUID="{CF8C3EAC-A644-4F55-B534-0E2179B81111}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">52</Property>.. <Property Class="Text" GUID="{6DF93372-F886-4592-81AB-FE49BEE82E91}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{0DA46C94-D16C-433A-B780-A8332DF8823F}</Property>.. <Property Class="Memo" GUID="{9E4A5F09-6CB7-444B-883A-AC95CEFC3A33}" Name="HTMLSource" OrderIndex="5" Decima

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\UserLocked\is-NU53P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (531), with CRLF line terminators
Category:	dropped
Size (bytes):	3251
Entropy (8bit):	5.53798758377977
Encrypted:	false
SSDEEP:	48:cfNCTKprJ6QpvCk/vFgvvDMvWSN6bk+nYFUD5anK87ClJA:qEiJ6EHFS69N6Qha6
MD5:	95816179B089955D0F9515EA5F68BAAC
SHA1:	8BC5C6D9DCF51D08B0F978D03CAD08F56C0BF8C9
SHA-256:	0D92968C418D39C8C333DFA85E75FDFFE2FFFBF74CF84A81A476E6600CD34BC8
SHA-512:	063314D3A8C44EAE66428A2D7AAA730D50820314C919FE72DD06075CB189AFA13D2A97B78382A5473DB1ACB9E89B444706DF3834FD26A2E5293AA1A969D12CC1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="UserLocked" GUID="{0DA46C94-D16C-433A-B780-A8332DF8823F}">.. <Properties>.. <Property Class="Type" GUID="{3FC48F25-794D-4F11-8EFE-B875AEF7D886}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Property</Property>.. <Property Class="Text" GUID="{AF93A78E-BD75-42A7-9E9B-C08802324786}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">UserLocked</Property>.. <Property Class="Number" GUID="{CF8C3EAC-A644-4F55-B534-0E2179B81111}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">52</Property>.. <Property Class="Text" GUID="{6DF93372-F886-4592-81AB-FE49BEE82E91}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{0DA46C94-D16C-433A-B780-A8332DF8823F}</Property>.. <Property Class="Memo" GUID="{9E4A5F09-6CB7-444B-883A-AC95CEFC3A33}" Name="HTMLSource" OrderIndex="5" Decima

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IPropertyObject\is-ATLOE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (744), with CRLF line terminators
Category:	dropped
Size (bytes):	3950
Entropy (8bit):	5.4816495369680265
Encrypted:	false
SSDEEP:	48:c8t6p1m8mhpt+O8daNtVtIvFgvvDGvWKB8O8daNtVtqE3EgJg94XJZD5anKreBuO:P+m8C8dGMFSgTBr8dGE9g44XJrPqb86
MD5:	95B5A83EB3B33D6012B646C02049E075
SHA1:	1DEC0ECC3F5CB4A5938FC8227958B8C319FFB8CB
SHA-256:	EDAB92140385C8205F90DDCEEB9A7A59C213B9D603D782E7BE1D228C59327CBD
SHA-512:	1CFA00F7E82F725055E24F0F422DBAA557ED1EF3707A6711AA5EAB5C9F1F299DAD07A6687A3D9847E2A306D854B012AF0A2609D4CBD528B6D98B605F40F2E906
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="IPropertyObject" GUID="{BB937A58-11F6-4282-AA44-17D1D63CBA46}">.. <Properties>.. <Property Class="Type" GUID="{263C1CC8-B867-4CB0-A9E8-12B1C070CD91}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Object</Property>.. <Property Class="Text" GUID="{E32FD0F0-674B-41DB-A817-6788421F2185}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">IPropertyObject</Property>.. <Property Class="Script" GUID="{5FE46B5A-5CB0-498B-85F6-34FFF5E71709}" Name="Source Code" input="True" group="Help" OrderIndex="3" DecimalPlaces="" List="cmbList" PluginToExecute="cmbList" Expression="True" ScriptType="Method" ScriptLanguage="Pascal" Parameters="">Result := Property.Name;</Property>.. <Property Class="Text" GUID="{3D39AEBE-A5C9-4A65-ADF5-CF22D5A11985}" Name="HtmlSource" group="Help" OrderIndex="4" DecimalPlaces="" List="cmbList" PluginToExecute="cmbList"><HTML>

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\ISelectionList\Count\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (699), with CRLF line terminators
Category:	dropped
Size (bytes):	3326
Entropy (8bit):	5.508072476855755
Encrypted:	false
SSDEEP:	48:c+xr4Wf1uWdD51NOrl8QXPRygt7NfvFgHvDLvDyvW51VOQi2h:X5duWnkPRPNnFAPcW1VOVg
MD5:	5A1ACDF660DFFACF6055634E9CEAAC68
SHA1:	B1DB7BAF20D1049FF2EC44406C356A5C84EC202C
SHA-256:	FFE7D532F9E0264C313BAE7ED7E84500D0ED55E1706441FC543F37911A54BE19
SHA-512:	3C9DE3063BC3509FC546A4CC7813781D7B1D2D27FE5E7F790E06D32533C2CA5889AC911A51405E030C142B44ED5D771D0EEA38B9CE49836CAC3D5E9683CBEC2F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Count" GUID="{E3B4025D-9CB8-4586-A769-74FF0EC106A7}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Count</Property>.. <Property Class="Type" GUID="{93E1E4AF-43EF-404E-AC40-C2A4C9CB8614}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{8554A8D9-B151-49A5-89D2-52A0D9C70534}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{5077EAE6-01DF-4667-A62F-D04D6EEF6499}" Name="Form Layout" systemhidden="True" OrderIndex="4" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="Help String" Order=&q

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\ISelectionList\Count\is-642HI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (699), with CRLF line terminators
Category:	dropped
Size (bytes):	3326
Entropy (8bit):	5.508072476855755
Encrypted:	false
SSDEEP:	48:c+xr4Wf1uWdD51NOrl8QXPRygt7NfvFgHvDLvDyvW51VOQi2h:X5duWnkPRPNnFAPcW1VOVg
MD5:	5A1ACDF660DFFACF6055634E9CEAAC68
SHA1:	B1DB7BAF20D1049FF2EC44406C356A5C84EC202C
SHA-256:	FFE7D532F9E0264C313BAE7ED7E84500D0ED55E1706441FC543F37911A54BE19
SHA-512:	3C9DE3063BC3509FC546A4CC7813781D7B1D2D27FE5E7F790E06D32533C2CA5889AC911A51405E030C142B44ED5D771D0EEA38B9CE49836CAC3D5E9683CBEC2F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Count" GUID="{E3B4025D-9CB8-4586-A769-74FF0EC106A7}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Count</Property>.. <Property Class="Type" GUID="{93E1E4AF-43EF-404E-AC40-C2A4C9CB8614}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{8554A8D9-B151-49A5-89D2-52A0D9C70534}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{5077EAE6-01DF-4667-A62F-D04D6EEF6499}" Name="Form Layout" systemhidden="True" OrderIndex="4" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="Help String" Order=&q

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\ISelectionList\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (525), with CRLF line terminators
Category:	dropped
Size (bytes):	3135
Entropy (8bit):	5.522896673370798
Encrypted:	false
SSDEEP:	48:c44DUm2LdD51NOrl8x/BNanzPvFgnvDLvW74Vxgkhlcz4po:522LnZ/inz3FgPDVljczd
MD5:	25ACA7E34722951018B57BED32CF8FD8
SHA1:	928837CB07A60E50F934A28FA059583D071A8E7E
SHA-256:	0E185B3B509FC3062C188C324A181BEEF7593AFD42D719856D3C6DCFC3111F48
SHA-512:	80E55449515B5C477A394442FB1E364C2E32C17A45601AB22C05B57DE7E66B5B274793D5F64D78FB9A8BB6B8BEDFAAFD1F9EBC9FA4C9661CB1F5E0A75D110329
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ISelectionList" GUID="{86B8FD55-E1A3-44B1-92A9-A3C5B2077135}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">ISelectionList</Property>.. <Property Class="Type" GUID="{A5D3FA72-F8B1-4007-8ABF-9AA581BBA758}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Object</Property>.. <Property Class="Number" GUID="{8DC9651E-9E22-400F-9D21-BE226A1176C6}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">46</Property>.. <Property Class="Memo" GUID="{AB91CE0A-4F6F-40C3-80A8-CFA8B9DF0DAA}" Name="Form Layout" systemhidden="True" OrderIndex="4" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="Help Stri

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\ISelectionList\Items\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1001), with CRLF line terminators
Category:	dropped
Size (bytes):	3743
Entropy (8bit):	5.4964994504575815
Encrypted:	false
SSDEEP:	48:clw4GnXmrek9VhoMvFgHvDLvDRvtviFvlAV3UktGRsXD51NOrl8A:97XmFBFAPRZGK281Y
MD5:	635CF84B29B793264CDF932456716212
SHA1:	EE76838CF98EE127A9E248B3D0079E304737923C
SHA-256:	7EA4D8B184043DBF20B9A02A01A5A1A8BBB3A3C0C29F493D89D15E30C4DC20B7
SHA-512:	EB115EDDC20F7787952952A2EFF09E9FCA3FD4D142970E91C95C8D6F093F343BB5E7AAB4DF87DE3B10112822CBC835EE4DA09B3CFC839E8A5208D419A1FB2527
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Items" GUID="{1C41A9FE-22CA-48AE-8143-4A99AE6F43F8}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Items</Property>.. <Property Class="Type" GUID="{B3EE9C4D-D4A5-4E6E-B7F3-6FD8FD3DBFA2}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Property</Property>.. <Property Class="Number" GUID="{E40616E9-D66E-4CBC-A4F2-B2316ED6F244}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Text" GUID="{D1C175F4-E92D-4CB1-96D6-46CD9732FC45}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{1C41A9FE-22CA-48AE-8143-4A99AE6F43F8}</Property>.. <Property Class="Memo" GUID="{4A6BF495-6594-4C1C-AF21-87F8FFF07152}" Name="HTMLSource" OrderIndex="5" DecimalPlaces="2"><HTML><HEAD><TITLE

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\ISelectionList\Items\is-KKSQ2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1001), with CRLF line terminators
Category:	dropped
Size (bytes):	3743
Entropy (8bit):	5.4964994504575815
Encrypted:	false
SSDEEP:	48:clw4GnXmrek9VhoMvFgHvDLvDRvtviFvlAV3UktGRsXD51NOrl8A:97XmFBFAPRZGK281Y
MD5:	635CF84B29B793264CDF932456716212
SHA1:	EE76838CF98EE127A9E248B3D0079E304737923C
SHA-256:	7EA4D8B184043DBF20B9A02A01A5A1A8BBB3A3C0C29F493D89D15E30C4DC20B7
SHA-512:	EB115EDDC20F7787952952A2EFF09E9FCA3FD4D142970E91C95C8D6F093F343BB5E7AAB4DF87DE3B10112822CBC835EE4DA09B3CFC839E8A5208D419A1FB2527
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Items" GUID="{1C41A9FE-22CA-48AE-8143-4A99AE6F43F8}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Items</Property>.. <Property Class="Type" GUID="{B3EE9C4D-D4A5-4E6E-B7F3-6FD8FD3DBFA2}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Property</Property>.. <Property Class="Number" GUID="{E40616E9-D66E-4CBC-A4F2-B2316ED6F244}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Text" GUID="{D1C175F4-E92D-4CB1-96D6-46CD9732FC45}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{1C41A9FE-22CA-48AE-8143-4A99AE6F43F8}</Property>.. <Property Class="Memo" GUID="{4A6BF495-6594-4C1C-AF21-87F8FFF07152}" Name="HTMLSource" OrderIndex="5" DecimalPlaces="2"><HTML><HEAD><TITLE

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\ISelectionList\is-U42J4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (525), with CRLF line terminators
Category:	dropped
Size (bytes):	3135
Entropy (8bit):	5.522896673370798
Encrypted:	false
SSDEEP:	48:c44DUm2LdD51NOrl8x/BNanzPvFgnvDLvW74Vxgkhlcz4po:522LnZ/inz3FgPDVljczd
MD5:	25ACA7E34722951018B57BED32CF8FD8
SHA1:	928837CB07A60E50F934A28FA059583D071A8E7E
SHA-256:	0E185B3B509FC3062C188C324A181BEEF7593AFD42D719856D3C6DCFC3111F48
SHA-512:	80E55449515B5C477A394442FB1E364C2E32C17A45601AB22C05B57DE7E66B5B274793D5F64D78FB9A8BB6B8BEDFAAFD1F9EBC9FA4C9661CB1F5E0A75D110329
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ISelectionList" GUID="{86B8FD55-E1A3-44B1-92A9-A3C5B2077135}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">ISelectionList</Property>.. <Property Class="Type" GUID="{A5D3FA72-F8B1-4007-8ABF-9AA581BBA758}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Object</Property>.. <Property Class="Number" GUID="{8DC9651E-9E22-400F-9D21-BE226A1176C6}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">46</Property>.. <Property Class="Memo" GUID="{AB91CE0A-4F6F-40C3-80A8-CFA8B9DF0DAA}" Name="Form Layout" systemhidden="True" OrderIndex="4" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="Help Stri

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IsBeta\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (552), with CRLF line terminators
Category:	dropped
Size (bytes):	3483
Entropy (8bit):	5.526670562384044
Encrypted:	false
SSDEEP:	48:cR6i2mdSWWRlGYD5anK87SZ09lJAIZBvih52FYE0UOmKDp+yvFgiEvD7vWR:c6iXTWRlGWFYdihEFYbsQFleXa
MD5:	F8071F4E22D39EF3B14C776F1AE67DB6
SHA1:	67FAA1EB570CF8C2481C64D26E4FF72286AC606A
SHA-256:	FC784D3F9C2A5019C80838B64FA6263C07C2771E30800DCB1A39418E39B05E6D
SHA-512:	ABC2A3D26264E0BE4269DE33F559565A3098215D923D20FFEDC81F62BD4843B94FA2E60963D1650A77A1C808096EFB692D262851DA5D64DBAEB2E1275F4041E0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="IsBeta" GUID="{86BE48BE-9204-4F73-96DD-3B8DEFF92014}">.. <Properties>.. <Property Class="Type" GUID="{B2E62FA0-0EE5-4E95-A26B-EF620787A2D6}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{20AA829F-5888-41EA-89A2-43158B110204}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">IsBeta</Property>.. <Property Class="Number" GUID="{48DC1AD5-30CF-44A6-A5AE-6A4542A3659C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">20</Property>.. <Property Class="Text" GUID="{28BD4B44-7487-4A26-97D8-E4D1303884C6}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{86BE48BE-9204-4F73-96DD-3B8DEFF92014}</Property>.. <Property Class="Memo" GUID="{9C671E4C-5D10-4139-B491-26483DAC1DAC}" Name="Form Layout" systemhidden="True" OrderInd

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IsBeta\is-EKU79.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (552), with CRLF line terminators
Category:	dropped
Size (bytes):	3483
Entropy (8bit):	5.526670562384044
Encrypted:	false
SSDEEP:	48:cR6i2mdSWWRlGYD5anK87SZ09lJAIZBvih52FYE0UOmKDp+yvFgiEvD7vWR:c6iXTWRlGWFYdihEFYbsQFleXa
MD5:	F8071F4E22D39EF3B14C776F1AE67DB6
SHA1:	67FAA1EB570CF8C2481C64D26E4FF72286AC606A
SHA-256:	FC784D3F9C2A5019C80838B64FA6263C07C2771E30800DCB1A39418E39B05E6D
SHA-512:	ABC2A3D26264E0BE4269DE33F559565A3098215D923D20FFEDC81F62BD4843B94FA2E60963D1650A77A1C808096EFB692D262851DA5D64DBAEB2E1275F4041E0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="IsBeta" GUID="{86BE48BE-9204-4F73-96DD-3B8DEFF92014}">.. <Properties>.. <Property Class="Type" GUID="{B2E62FA0-0EE5-4E95-A26B-EF620787A2D6}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{20AA829F-5888-41EA-89A2-43158B110204}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">IsBeta</Property>.. <Property Class="Number" GUID="{48DC1AD5-30CF-44A6-A5AE-6A4542A3659C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">20</Property>.. <Property Class="Text" GUID="{28BD4B44-7487-4A26-97D8-E4D1303884C6}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{86BE48BE-9204-4F73-96DD-3B8DEFF92014}</Property>.. <Property Class="Memo" GUID="{9C671E4C-5D10-4139-B491-26483DAC1DAC}" Name="Form Layout" systemhidden="True" OrderInd

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IsJobOpen\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (621), with CRLF line terminators
Category:	dropped
Size (bytes):	4223
Entropy (8bit):	5.475327298436102
Encrypted:	false
SSDEEP:	48:cXQ4k9F/YD51NOrl8ITRQumlnHJ9vFJQvzpDvWEqvFJQvFgiEvDKvWEpvWaKyXFZ:6Qh9hWQTRQuGHfT6tr8T6FleUBZKEFES
MD5:	28562ECF8D064DF055D9792CE385C247
SHA1:	BCF1D1716B1F84C6824A12C63D868ACC273980BA
SHA-256:	6B1B62F4013B93A759403CA31435A1E949A7FC7757BF7BCAF3EA9F04ECA8A224
SHA-512:	E17EB8BC86ED323D0D5872C879AAB68E8906B3B047B0DB8C3139B7656E35DB1B2B1465398D1265C59074B2EC9B243A2B42C82FC98550106D1E15DFBFEEEDD60E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="IsJobOpen" GUID="{64B97FDE-8260-442B-BD64-8B84D4BC568D}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">IsJobOpen</Property>.. <Property Class="Type" GUID="{98247E46-2098-4345-AB80-D704F11ED11E}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{80186796-9D1E-4225-959B-1285579A1CB7}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">20.25</Property>.. <Property Class="Memo" GUID="{496725BD-C317-48BE-8050-2BDFCFAE6507}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="Help String&qu

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IsJobOpen\is-CLCLM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (621), with CRLF line terminators
Category:	dropped
Size (bytes):	4223
Entropy (8bit):	5.475327298436102
Encrypted:	false
SSDEEP:	48:cXQ4k9F/YD51NOrl8ITRQumlnHJ9vFJQvzpDvWEqvFJQvFgiEvDKvWEpvWaKyXFZ:6Qh9hWQTRQuGHfT6tr8T6FleUBZKEFES
MD5:	28562ECF8D064DF055D9792CE385C247
SHA1:	BCF1D1716B1F84C6824A12C63D868ACC273980BA
SHA-256:	6B1B62F4013B93A759403CA31435A1E949A7FC7757BF7BCAF3EA9F04ECA8A224
SHA-512:	E17EB8BC86ED323D0D5872C879AAB68E8906B3B047B0DB8C3139B7656E35DB1B2B1465398D1265C59074B2EC9B243A2B42C82FC98550106D1E15DFBFEEEDD60E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="IsJobOpen" GUID="{64B97FDE-8260-442B-BD64-8B84D4BC568D}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">IsJobOpen</Property>.. <Property Class="Type" GUID="{98247E46-2098-4345-AB80-D704F11ED11E}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{80186796-9D1E-4225-959B-1285579A1CB7}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">20.25</Property>.. <Property Class="Memo" GUID="{496725BD-C317-48BE-8050-2BDFCFAE6507}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="Help String&qu

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IsUnlocked\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1531), with CRLF line terminators
Category:	dropped
Size (bytes):	5265
Entropy (8bit):	5.420432477301873
Encrypted:	false
SSDEEP:	96:oH1tvtjrna/6HmA3AeiMNjNGvFe3REVJ7o7k:oVtRc6GA3AeiMNjNGvFe3RSJ7l
MD5:	D8931E4F2944B5C000DFA92EC2B7F149
SHA1:	998228F7A2DF3169F68DA10159E7CD5B79547D1A
SHA-256:	BF1FBB7F23EB3F9CE9201D91C45E4FB8644E6B9824FE5320ACBD8BFD8409C9B7
SHA-512:	354515264174A0445A5F4CB9004E90BB83571DEC4F8453696970820D13DF8611340D0BDE377A08DB476A5C80ACCD7A75E172CE941B9B1FE7D3A8D98507FB4921
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="IsUnlocked" GUID="{F8E37FDB-17C2-467D-9194-0F0AF32154C1}">.. <Properties>.. <Property Class="Text" GUID="{0ADF628C-CC59-42EA-A42B-E2F406720CE6}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">IsUnlocked</Property>.. <Property Class="Type" GUID="{B5A40722-EB30-4114-874A-FF024D058DF8}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{5CA83695-98AF-4C92-A8D9-B0CA2F8BB710}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">20.5</Property>.. <Property Class="Memo" GUID="{3BC0E02C-EF7D-4506-94BC-7576F2D4F3A8}" Name="Form Layout" systemhidden="True" OrderIndex="4" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\IsUnlocked\is-3F2M4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1531), with CRLF line terminators
Category:	dropped
Size (bytes):	5265
Entropy (8bit):	5.420432477301873
Encrypted:	false
SSDEEP:	96:oH1tvtjrna/6HmA3AeiMNjNGvFe3REVJ7o7k:oVtRc6GA3AeiMNjNGvFe3RSJ7l
MD5:	D8931E4F2944B5C000DFA92EC2B7F149
SHA1:	998228F7A2DF3169F68DA10159E7CD5B79547D1A
SHA-256:	BF1FBB7F23EB3F9CE9201D91C45E4FB8644E6B9824FE5320ACBD8BFD8409C9B7
SHA-512:	354515264174A0445A5F4CB9004E90BB83571DEC4F8453696970820D13DF8611340D0BDE377A08DB476A5C80ACCD7A75E172CE941B9B1FE7D3A8D98507FB4921
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="IsUnlocked" GUID="{F8E37FDB-17C2-467D-9194-0F0AF32154C1}">.. <Properties>.. <Property Class="Text" GUID="{0ADF628C-CC59-42EA-A42B-E2F406720CE6}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">IsUnlocked</Property>.. <Property Class="Type" GUID="{B5A40722-EB30-4114-874A-FF024D058DF8}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{5CA83695-98AF-4C92-A8D9-B0CA2F8BB710}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">20.5</Property>.. <Property Class="Memo" GUID="{3BC0E02C-EF7D-4506-94BC-7576F2D4F3A8}" Name="Form Layout" systemhidden="True" OrderIndex="4" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\NewBlankPage\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1420), with CRLF line terminators
Category:	dropped
Size (bytes):	9249
Entropy (8bit):	5.221071535155584
Encrypted:	false
SSDEEP:	192:T7g51nK3ZHH3w38/FHKE/Z0SHEzws1jeUXMvFOUAkV9e:TtPI
MD5:	14EE11F74EF6FC3E0FD3A1838B1453E3
SHA1:	E2673D10BB9BD4841FCD2F66769E09C212270A0D
SHA-256:	08E6F542FF57C51CF14FBA94A097A2C78EFCE5B59EF7DE926F921E222A91053F
SHA-512:	553227FCE30559F458D65D580EB7C68101944AF841FF278C76A170CF10BC8C1EC1CFC2B4DA80DB707E9B50D0D7495988F6E441925C44522E19A2DDD4998156A4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewBlankPage" GUID="{A68D11AF-22E8-426A-9187-9DE5F1AC0839}">.. <Properties>.. <Property Class="Text" GUID="{E772C8F9-4FB2-452A-B3BC-124F39F507AC}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">NewBlankPage</Property>.. <Property Class="Type" GUID="{FB5AE229-6218-4F26-83DD-BE3ADFE127A7}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{5144CC4A-CCD2-4539-83DD-5F9520A1267C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">20.75</Property>.. <Property Class="Memo" GUID="{A1879C87-6F42-45C7-A709-159188C0ABE1}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1&

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\NewBlankPage\is-G1Q7J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1420), with CRLF line terminators
Category:	dropped
Size (bytes):	9249
Entropy (8bit):	5.221071535155584
Encrypted:	false
SSDEEP:	192:T7g51nK3ZHH3w38/FHKE/Z0SHEzws1jeUXMvFOUAkV9e:TtPI
MD5:	14EE11F74EF6FC3E0FD3A1838B1453E3
SHA1:	E2673D10BB9BD4841FCD2F66769E09C212270A0D
SHA-256:	08E6F542FF57C51CF14FBA94A097A2C78EFCE5B59EF7DE926F921E222A91053F
SHA-512:	553227FCE30559F458D65D580EB7C68101944AF841FF278C76A170CF10BC8C1EC1CFC2B4DA80DB707E9B50D0D7495988F6E441925C44522E19A2DDD4998156A4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewBlankPage" GUID="{A68D11AF-22E8-426A-9187-9DE5F1AC0839}">.. <Properties>.. <Property Class="Text" GUID="{E772C8F9-4FB2-452A-B3BC-124F39F507AC}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">NewBlankPage</Property>.. <Property Class="Type" GUID="{FB5AE229-6218-4F26-83DD-BE3ADFE127A7}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{5144CC4A-CCD2-4539-83DD-5F9520A1267C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">20.75</Property>.. <Property Class="Memo" GUID="{A1879C87-6F42-45C7-A709-159188C0ABE1}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1&

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\NewChangeGroup\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (557), with CRLF line terminators
Category:	dropped
Size (bytes):	3955
Entropy (8bit):	5.52970975896949
Encrypted:	false
SSDEEP:	96:9X8VTqsdWslCjwsb6exE4veM0VRbETVHT:yV9l7eC4veMiRbSVz
MD5:	40E398D89F48618DB599ACB00A965D8D
SHA1:	AD9A049532A398C5A0736DA8CFE0EBA8D1FCE924
SHA-256:	FCDE97378D71343ADEDC62030BD837F59A3CB514188B2D690E35305B3B5CF4C8
SHA-512:	90F2849D3BAA56704A72A7D754F119F18DB401FD6EEA8A482D0BD4F8A1722D72592CD30DD4C38B0D9B37F89D0E3174EB7BCA6C267710F65A52F45D1E775CFFAF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewChangeGroup" GUID="{837D23E8-0771-4968-8F22-069E54771F52}">.. <Properties>.. <Property Class="Type" GUID="{041E79CC-DF1B-4630-AEC9-8A982ECDF092}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Procedure</Property>.. <Property Class="Text" GUID="{455DD6D4-4EBC-4CE7-A0BD-76C69524179B}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">NewChangeGroup</Property>.. <Property Class="Number" GUID="{7D736FD3-49CA-4FA9-BD27-46C3D39E4EEF}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">21</Property>.. <Property Class="Text" GUID="{62632B2B-79BE-4F59-99CD-C32ECC776F18}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{837D23E8-0771-4968-8F22-069E54771F52}</Property>.. <Property Class="Memo" GUID="{05FDE233-7D14-4A82-B9A7-EBEFF49C16B9}" Name="Form Layout" systemhidde

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\NewChangeGroup\is-0I7B7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (557), with CRLF line terminators
Category:	dropped
Size (bytes):	3955
Entropy (8bit):	5.52970975896949
Encrypted:	false
SSDEEP:	96:9X8VTqsdWslCjwsb6exE4veM0VRbETVHT:yV9l7eC4veMiRbSVz
MD5:	40E398D89F48618DB599ACB00A965D8D
SHA1:	AD9A049532A398C5A0736DA8CFE0EBA8D1FCE924
SHA-256:	FCDE97378D71343ADEDC62030BD837F59A3CB514188B2D690E35305B3B5CF4C8
SHA-512:	90F2849D3BAA56704A72A7D754F119F18DB401FD6EEA8A482D0BD4F8A1722D72592CD30DD4C38B0D9B37F89D0E3174EB7BCA6C267710F65A52F45D1E775CFFAF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewChangeGroup" GUID="{837D23E8-0771-4968-8F22-069E54771F52}">.. <Properties>.. <Property Class="Type" GUID="{041E79CC-DF1B-4630-AEC9-8A982ECDF092}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Procedure</Property>.. <Property Class="Text" GUID="{455DD6D4-4EBC-4CE7-A0BD-76C69524179B}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">NewChangeGroup</Property>.. <Property Class="Number" GUID="{7D736FD3-49CA-4FA9-BD27-46C3D39E4EEF}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">21</Property>.. <Property Class="Text" GUID="{62632B2B-79BE-4F59-99CD-C32ECC776F18}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{837D23E8-0771-4968-8F22-069E54771F52}</Property>.. <Property Class="Memo" GUID="{05FDE233-7D14-4A82-B9A7-EBEFF49C16B9}" Name="Form Layout" systemhidde

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\NewItemEx\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1366), with CRLF line terminators
Category:	dropped
Size (bytes):	7486
Entropy (8bit):	5.325842856420854
Encrypted:	false
SSDEEP:	192:XnFdtkwjdFWh4t4ebOfjeyW6IJKFAghsAla:Xrtkwha1M
MD5:	18CF8E8FE2759D1E28F4C3244C59917A
SHA1:	0D971B07D4289C4573A930664E7317E9D3398C8A
SHA-256:	009870FBD8E727C5D02E97C5EFC72E8E910AD13942569C0849CB131929543D7D
SHA-512:	CC1F79A76FA396996254291758DBA060D591621AE3B585526CDD541F1FC30157478CF2319A9857B930A0471599356EB81FB350CA7AA63B1CF300619C1105F17C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewItemEx" GUID="{4CD42DE6-5359-4E65-9010-3D5174D5FC1C}">.. <Properties>.. <Property Class="Type" GUID="{2B99C79A-4C6C-416F-9AB6-166C6D959A34}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{350B4F51-6E87-48C7-A980-F0D1D8F66240}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="2" DecimalPlaces="">NewItemEx</Property>.. <Property Class="Text" GUID="{540B6D07-D537-45B3-BC33-E9C5CB616199}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{4CD42DE6-5359-4E65-9010-3D5174D5FC1C}</Property>.. <Property Class="Number" GUID="{DEA06EB1-A23C-4959-BB6A-F1F3A009B52C}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">23</Property>.. <Property Class="Memo" GUID="{F52717F3-C00D-4996-8415-31B34893FA09}" Name="Form Layout" systemhidden="True"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\NewItemEx\is-P8MPD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1366), with CRLF line terminators
Category:	dropped
Size (bytes):	7486
Entropy (8bit):	5.325842856420854
Encrypted:	false
SSDEEP:	192:XnFdtkwjdFWh4t4ebOfjeyW6IJKFAghsAla:Xrtkwha1M
MD5:	18CF8E8FE2759D1E28F4C3244C59917A
SHA1:	0D971B07D4289C4573A930664E7317E9D3398C8A
SHA-256:	009870FBD8E727C5D02E97C5EFC72E8E910AD13942569C0849CB131929543D7D
SHA-512:	CC1F79A76FA396996254291758DBA060D591621AE3B585526CDD541F1FC30157478CF2319A9857B930A0471599356EB81FB350CA7AA63B1CF300619C1105F17C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewItemEx" GUID="{4CD42DE6-5359-4E65-9010-3D5174D5FC1C}">.. <Properties>.. <Property Class="Type" GUID="{2B99C79A-4C6C-416F-9AB6-166C6D959A34}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{350B4F51-6E87-48C7-A980-F0D1D8F66240}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="2" DecimalPlaces="">NewItemEx</Property>.. <Property Class="Text" GUID="{540B6D07-D537-45B3-BC33-E9C5CB616199}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{4CD42DE6-5359-4E65-9010-3D5174D5FC1C}</Property>.. <Property Class="Number" GUID="{DEA06EB1-A23C-4959-BB6A-F1F3A009B52C}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">23</Property>.. <Property Class="Memo" GUID="{F52717F3-C00D-4996-8415-31B34893FA09}" Name="Form Layout" systemhidden="True"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\NewItem\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1191), with CRLF line terminators
Category:	dropped
Size (bytes):	6999
Entropy (8bit):	5.336656904699976
Encrypted:	false
SSDEEP:	96:9xxCbuO50WFmpbAijdh85xjf/FdddeebOfFleyW6IJFF2ghsAFva:CvmFfjdcV/t4ebOfjeyW6IJFAghsAla
MD5:	0EA7117D1BFF909FC438BE79BBE8C022
SHA1:	69025954AAE8625E28BE383CE90EEC3ADE480BCC
SHA-256:	0FE905C2EC195C87B1BD1BD9227A2816183D45DFFE1B17A1C36A80FEA91809ED
SHA-512:	370DBDBD30682C671F9C5A6339332C20FAE4FA2BADE31EF5D554C1CB2F04A6283B700FC01A9F39DC8C5414B556F7C2FD5DB7ADFAD299EF11E1543D06BA0DAA55
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewItem" GUID="{49D8E12C-57AB-4B86-9EC5-7A6CB92D7B7F}">.. <Properties>.. <Property Class="Type" GUID="{6892363F-26FA-42D0-A3E6-E12F2E8E4CEF}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{C4B4C969-1D27-4C54-95D9-5236D84B259A}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">NewItem</Property>.. <Property Class="Number" GUID="{E5CFF2B3-2AA8-47F1-A24E-2A1AAEE087C6}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">22</Property>.. <Property Class="Text" GUID="{4EFDF9F3-26FB-4793-9C9C-CD1DE487BDAC}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{49D8E12C-57AB-4B86-9EC5-7A6CB92D7B7F}</Property>.. <Property Class="Memo" GUID="{E376E19F-2901-4B6D-AB94-AED16EA7D662}" Name="Form Layout" systemhidden="True" OrderI

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\NewItem\is-IM5QH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1191), with CRLF line terminators
Category:	dropped
Size (bytes):	6999
Entropy (8bit):	5.336656904699976
Encrypted:	false
SSDEEP:	96:9xxCbuO50WFmpbAijdh85xjf/FdddeebOfFleyW6IJFF2ghsAFva:CvmFfjdcV/t4ebOfjeyW6IJFAghsAla
MD5:	0EA7117D1BFF909FC438BE79BBE8C022
SHA1:	69025954AAE8625E28BE383CE90EEC3ADE480BCC
SHA-256:	0FE905C2EC195C87B1BD1BD9227A2816183D45DFFE1B17A1C36A80FEA91809ED
SHA-512:	370DBDBD30682C671F9C5A6339332C20FAE4FA2BADE31EF5D554C1CB2F04A6283B700FC01A9F39DC8C5414B556F7C2FD5DB7ADFAD299EF11E1543D06BA0DAA55
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewItem" GUID="{49D8E12C-57AB-4B86-9EC5-7A6CB92D7B7F}">.. <Properties>.. <Property Class="Type" GUID="{6892363F-26FA-42D0-A3E6-E12F2E8E4CEF}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{C4B4C969-1D27-4C54-95D9-5236D84B259A}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">NewItem</Property>.. <Property Class="Number" GUID="{E5CFF2B3-2AA8-47F1-A24E-2A1AAEE087C6}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">22</Property>.. <Property Class="Text" GUID="{4EFDF9F3-26FB-4793-9C9C-CD1DE487BDAC}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{49D8E12C-57AB-4B86-9EC5-7A6CB92D7B7F}</Property>.. <Property Class="Memo" GUID="{E376E19F-2901-4B6D-AB94-AED16EA7D662}" Name="Form Layout" systemhidden="True" OrderI

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\NewJobEx\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (624), with CRLF line terminators
Category:	dropped
Size (bytes):	4284
Entropy (8bit):	5.508575350168636
Encrypted:	false
SSDEEP:	48:c+C2vEDFYD51NOrl87cS7mmoP0avFbvzpDvWEqvFbvFgiEvDZvWEpvWaKhPGXFwm:efDFWDcmmF04Vtr8VFlexBtKYXFwnm
MD5:	35A25F499BD456489C3204BA8E6CF041
SHA1:	7426222B6BBB51C32C3FAEE13DA0396BCFFBE624
SHA-256:	61E4AF5D5A47FAF21F5E815C20550F2D6280E3555A4CEC2AB3C98BD223C6F10F
SHA-512:	CC821CD1A5AC24A016C9C722CADFCA45EB72080FC75A864E3C2FC57FE0FD0E7C2D7532F27EEB0EA9CC17B927E10FE91733E22A2A438E1A8D16FB988C1A51C67A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewJobEx" GUID="{4088CB5F-ADA3-420F-9E3F-8BAB1C95FD59}">.. <Properties>.. <Property Class="Text" GUID="{9530919C-9F96-4306-AC6D-C42BEC17C413}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">NewJobEx</Property>.. <Property Class="Type" GUID="{9EDF8096-79C5-4B16-A6B4-350D16EA34B5}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{351663B7-08F5-4D8C-BFF1-A1086B89DA95}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">23.5</Property>.. <Property Class="Memo" GUID="{A6784133-F060-4F57-A02A-720325710CBD}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/&gt

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\NewJobEx\is-4PEEV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (624), with CRLF line terminators
Category:	dropped
Size (bytes):	4284
Entropy (8bit):	5.508575350168636
Encrypted:	false
SSDEEP:	48:c+C2vEDFYD51NOrl87cS7mmoP0avFbvzpDvWEqvFbvFgiEvDZvWEpvWaKhPGXFwm:efDFWDcmmF04Vtr8VFlexBtKYXFwnm
MD5:	35A25F499BD456489C3204BA8E6CF041
SHA1:	7426222B6BBB51C32C3FAEE13DA0396BCFFBE624
SHA-256:	61E4AF5D5A47FAF21F5E815C20550F2D6280E3555A4CEC2AB3C98BD223C6F10F
SHA-512:	CC821CD1A5AC24A016C9C722CADFCA45EB72080FC75A864E3C2FC57FE0FD0E7C2D7532F27EEB0EA9CC17B927E10FE91733E22A2A438E1A8D16FB988C1A51C67A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewJobEx" GUID="{4088CB5F-ADA3-420F-9E3F-8BAB1C95FD59}">.. <Properties>.. <Property Class="Text" GUID="{9530919C-9F96-4306-AC6D-C42BEC17C413}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">NewJobEx</Property>.. <Property Class="Type" GUID="{9EDF8096-79C5-4B16-A6B4-350D16EA34B5}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{351663B7-08F5-4D8C-BFF1-A1086B89DA95}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">23.5</Property>.. <Property Class="Memo" GUID="{A6784133-F060-4F57-A02A-720325710CBD}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/&gt

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\NewPoint\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (899), with CRLF line terminators
Category:	dropped
Size (bytes):	8132
Entropy (8bit):	5.293150295461054
Encrypted:	false
SSDEEP:	192:C3R6CDjeaHceNHNzNYSjeaHvWoeeASSeAtRl6ByOU:CAxz
MD5:	ED2DCEE22C95B9AC973B9D3D4DEB41A2
SHA1:	4D7946D8FBEA51EE7B7FD23D6B689DA6A2E0657C
SHA-256:	6FEEAB608E0C486C377BBA9EA6C7C5916F1C52B7578A7B8E976EEEA87AC80024
SHA-512:	3E9C2FA73567FCC517501F773C870380D2DD9DF865BF1ED521D19785B9083B92C1AEF60EF0C421BABDD23B1B2E118107118954A3F237B4181705FD8D2010C42B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewPoint" GUID="{7F201131-4FF1-4A45-A0BA-F8691ADEE461}">.. <Properties>.. <Property Class="Type" GUID="{EB705118-1227-465C-9D72-D63E47D5E6BC}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Procedure</Property>.. <Property Class="Text" GUID="{CD9A0328-70C4-4716-AAC4-78655572E23C}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">NewPoint</Property>.. <Property Class="Number" GUID="{0154D4FD-6B0C-48B2-93D8-610E96065112}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">24</Property>.. <Property Class="Text" GUID="{EBD6D4C4-F6EA-42AC-B11D-C5BAAB3BBB63}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{7F201131-4FF1-4A45-A0BA-F8691ADEE461}</Property>.. <Property Class="Memo" GUID="{6B894892-BD13-4E78-B81C-F5488E8EAC57}" Name="Form Layout" systemhidden="True" Ord

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\NewPoint\is-5KR31.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (899), with CRLF line terminators
Category:	dropped
Size (bytes):	8132
Entropy (8bit):	5.293150295461054
Encrypted:	false
SSDEEP:	192:C3R6CDjeaHceNHNzNYSjeaHvWoeeASSeAtRl6ByOU:CAxz
MD5:	ED2DCEE22C95B9AC973B9D3D4DEB41A2
SHA1:	4D7946D8FBEA51EE7B7FD23D6B689DA6A2E0657C
SHA-256:	6FEEAB608E0C486C377BBA9EA6C7C5916F1C52B7578A7B8E976EEEA87AC80024
SHA-512:	3E9C2FA73567FCC517501F773C870380D2DD9DF865BF1ED521D19785B9083B92C1AEF60EF0C421BABDD23B1B2E118107118954A3F237B4181705FD8D2010C42B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewPoint" GUID="{7F201131-4FF1-4A45-A0BA-F8691ADEE461}">.. <Properties>.. <Property Class="Type" GUID="{EB705118-1227-465C-9D72-D63E47D5E6BC}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Procedure</Property>.. <Property Class="Text" GUID="{CD9A0328-70C4-4716-AAC4-78655572E23C}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">NewPoint</Property>.. <Property Class="Number" GUID="{0154D4FD-6B0C-48B2-93D8-610E96065112}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">24</Property>.. <Property Class="Text" GUID="{EBD6D4C4-F6EA-42AC-B11D-C5BAAB3BBB63}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{7F201131-4FF1-4A45-A0BA-F8691ADEE461}</Property>.. <Property Class="Memo" GUID="{6B894892-BD13-4E78-B81C-F5488E8EAC57}" Name="Form Layout" systemhidden="True" Ord

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\NewSection\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (890), with CRLF line terminators
Category:	dropped
Size (bytes):	4373
Entropy (8bit):	5.465069669925345
Encrypted:	false
SSDEEP:	48:cTVRv/oDOuMV4bYD5anK87SZ09lJ5mVFlRZTI6qyTFFGStmLtEGqy1vFgSvD8vtx:mvADOuFWFlzBTI6JFFjaEGPFFijia
MD5:	6313F14DDE8F2622F37B72086427B639
SHA1:	0DFA12ECF7BB565EB9FA39F470F0D0DAC168FC94
SHA-256:	69E608FBC3027E61029C312A9C52022A20529A0662938D5EFB9675CE242EB524
SHA-512:	A5439BD11B2BC56182242A24AD2A8BC830DB0F46F63A02306EB7B4204A69B33C323F368F73AC8B116935D5650A9AE53D2CEC3C11990A887CDCF9BF9FA2AA6D15
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewSection" GUID="{7BAA67FC-079F-49FB-B8FB-965623098B02}">.. <Properties>.. <Property Class="Type" GUID="{92A71E9B-3F08-428D-9BB2-93646FA2A788}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{5C9035F2-1063-4CDE-9DC4-24BFD73ED858}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">NewSection</Property>.. <Property Class="Number" GUID="{D9A0EAAB-BB25-437D-A1DF-0C746A67C18D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">25</Property>.. <Property Class="Text" GUID="{6E31DAEF-E007-414F-8F1D-76FD4D7BC202}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{7BAA67FC-079F-49FB-B8FB-965623098B02}</Property>.. <Property Class="Memo" GUID="{3C6041AF-7273-49D9-8B4A-41E535FF85E7}" Name="Form Layout" systemhidden="True"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\NewSection\is-GKHGJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (890), with CRLF line terminators
Category:	dropped
Size (bytes):	4373
Entropy (8bit):	5.465069669925345
Encrypted:	false
SSDEEP:	48:cTVRv/oDOuMV4bYD5anK87SZ09lJ5mVFlRZTI6qyTFFGStmLtEGqy1vFgSvD8vtx:mvADOuFWFlzBTI6JFFjaEGPFFijia
MD5:	6313F14DDE8F2622F37B72086427B639
SHA1:	0DFA12ECF7BB565EB9FA39F470F0D0DAC168FC94
SHA-256:	69E608FBC3027E61029C312A9C52022A20529A0662938D5EFB9675CE242EB524
SHA-512:	A5439BD11B2BC56182242A24AD2A8BC830DB0F46F63A02306EB7B4204A69B33C323F368F73AC8B116935D5650A9AE53D2CEC3C11990A887CDCF9BF9FA2AA6D15
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewSection" GUID="{7BAA67FC-079F-49FB-B8FB-965623098B02}">.. <Properties>.. <Property Class="Type" GUID="{92A71E9B-3F08-428D-9BB2-93646FA2A788}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{5C9035F2-1063-4CDE-9DC4-24BFD73ED858}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">NewSection</Property>.. <Property Class="Number" GUID="{D9A0EAAB-BB25-437D-A1DF-0C746A67C18D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">25</Property>.. <Property Class="Text" GUID="{6E31DAEF-E007-414F-8F1D-76FD4D7BC202}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{7BAA67FC-079F-49FB-B8FB-965623098B02}</Property>.. <Property Class="Memo" GUID="{3C6041AF-7273-49D9-8B4A-41E535FF85E7}" Name="Form Layout" systemhidden="True"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnClose\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (533), with CRLF line terminators
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	5.473179885299901
Encrypted:	false
SSDEEP:	48:ci2Ebzm7IGIF2zq50YD5anKMumPZ09lJwNjkUq5iv16vWEKvFVvJvWXiEvD6vFgP:KEbzlGIg+KWsk6+cXdJecF7DVe2Cw2V
MD5:	43C283AD0574EEFAF9D9A7F3F6459884
SHA1:	272A04374EB7F9BD05F087EC88D4C9122EEBBBC3
SHA-256:	8FDCAB79E9EB09D021D6D0876739F6C03FB3006B440C2CD8758CF850D0FFD04A
SHA-512:	A59B6169DB60A45ADBAB26FC65A8C573CD1F65E87DEAEBB0BE5A2B3F432D2CF6A4001D165D77B989AB91CB136B4E2091D19842679340F07BB8AE223CFB497B8C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnClose" GUID="{E565F693-FA3C-4AF3-8DB7-B4BF6C674985}">.. <Properties>.. <Property Class="Type" GUID="{BC0D87C7-15EC-474C-B0B9-9A6DD61F7877}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Event</Property>.. <Property Class="Text" GUID="{D55520A2-1AC3-460E-A839-9EEAB331D64E}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">OnClose</Property>.. <Property Class="Number" GUID="{CF208A84-48F6-4D41-A84A-813AA7291588}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">26</Property>.. <Property Class="Text" GUID="{4D83FFD7-4191-421D-BA9D-80CE647BCED1}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{E565F693-FA3C-4AF3-8DB7-B4BF6C674985}</Property>.. <Property Class="Memo" GUID="{6EE48C93-10B0-4496-B417-7495165BBBF0}" Name="Form Layout" systemhidden="True" OrderInde

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnClose\is-TLU2M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (533), with CRLF line terminators
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	5.473179885299901
Encrypted:	false
SSDEEP:	48:ci2Ebzm7IGIF2zq50YD5anKMumPZ09lJwNjkUq5iv16vWEKvFVvJvWXiEvD6vFgP:KEbzlGIg+KWsk6+cXdJecF7DVe2Cw2V
MD5:	43C283AD0574EEFAF9D9A7F3F6459884
SHA1:	272A04374EB7F9BD05F087EC88D4C9122EEBBBC3
SHA-256:	8FDCAB79E9EB09D021D6D0876739F6C03FB3006B440C2CD8758CF850D0FFD04A
SHA-512:	A59B6169DB60A45ADBAB26FC65A8C573CD1F65E87DEAEBB0BE5A2B3F432D2CF6A4001D165D77B989AB91CB136B4E2091D19842679340F07BB8AE223CFB497B8C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnClose" GUID="{E565F693-FA3C-4AF3-8DB7-B4BF6C674985}">.. <Properties>.. <Property Class="Type" GUID="{BC0D87C7-15EC-474C-B0B9-9A6DD61F7877}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Event</Property>.. <Property Class="Text" GUID="{D55520A2-1AC3-460E-A839-9EEAB331D64E}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">OnClose</Property>.. <Property Class="Number" GUID="{CF208A84-48F6-4D41-A84A-813AA7291588}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">26</Property>.. <Property Class="Text" GUID="{4D83FFD7-4191-421D-BA9D-80CE647BCED1}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{E565F693-FA3C-4AF3-8DB7-B4BF6C674985}</Property>.. <Property Class="Memo" GUID="{6EE48C93-10B0-4496-B417-7495165BBBF0}" Name="Form Layout" systemhidden="True" OrderInde

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnCopyItem\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (539), with CRLF line terminators
Category:	dropped
Size (bytes):	4119
Entropy (8bit):	5.482278500415734
Encrypted:	false
SSDEEP:	48:c4cD460o53C7nYD51NOrl8sgKEdmx7nt7ReZUqriv1l7IvWEKvFVvJvWXiEvDl7O:CD7I7nWZKY11U2cXdJeUFVsPX2JCW0C
MD5:	07425AD216E3ED697C6C08522D0BE4B5
SHA1:	4B9CC07F895DC5C49071B1D306D823F622096B88
SHA-256:	B1E35A5FFF1AB3022072E8284689DAE7A8B6C033861F3EC25D4036BD27FCE1B7
SHA-512:	0C22F17D83AD05F7A7B509565CB53529CAB1B63D9D6C2FF3C7B9EDF71BE94FF0FD22AEC4C5E8595CF3DFD2A966C8CC4C5C1B9AC665542028A669B4198A380773
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnCopyItem" GUID="{C22176CC-277E-4AA6-9F01-0E84EE1A702D}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">OnCopyItem</Property>.. <Property Class="Type" GUID="{5A5A38AD-4FA9-4089-871B-2AB90F5B13FA}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Event</Property>.. <Property Class="Number" GUID="{2B5BB896-C6B3-42DF-838D-08C1C9630443}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">26.5</Property>.. <Property Class="Memo" GUID="{3C7FA18F-E6F0-4267-A548-C27726E1B3EB}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="Help String&quot

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnCopyItem\is-S1J4D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (539), with CRLF line terminators
Category:	dropped
Size (bytes):	4119
Entropy (8bit):	5.482278500415734
Encrypted:	false
SSDEEP:	48:c4cD460o53C7nYD51NOrl8sgKEdmx7nt7ReZUqriv1l7IvWEKvFVvJvWXiEvDl7O:CD7I7nWZKY11U2cXdJeUFVsPX2JCW0C
MD5:	07425AD216E3ED697C6C08522D0BE4B5
SHA1:	4B9CC07F895DC5C49071B1D306D823F622096B88
SHA-256:	B1E35A5FFF1AB3022072E8284689DAE7A8B6C033861F3EC25D4036BD27FCE1B7
SHA-512:	0C22F17D83AD05F7A7B509565CB53529CAB1B63D9D6C2FF3C7B9EDF71BE94FF0FD22AEC4C5E8595CF3DFD2A966C8CC4C5C1B9AC665542028A669B4198A380773
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnCopyItem" GUID="{C22176CC-277E-4AA6-9F01-0E84EE1A702D}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">OnCopyItem</Property>.. <Property Class="Type" GUID="{5A5A38AD-4FA9-4089-871B-2AB90F5B13FA}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Event</Property>.. <Property Class="Number" GUID="{2B5BB896-C6B3-42DF-838D-08C1C9630443}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">26.5</Property>.. <Property Class="Memo" GUID="{3C7FA18F-E6F0-4267-A548-C27726E1B3EB}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="Help String&quot

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnDigitizerSectionCh\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (575), with CRLF line terminators
Category:	dropped
Size (bytes):	4324
Entropy (8bit):	5.4958357885677085
Encrypted:	false
SSDEEP:	48:cD4dVIcYD51NOrl8L+zXm3xLUUqx3iv1TyvWEKvFVvJvWXiEvDTyvFgTyvWjN7dI:AQhWz+zxKWcXdJegFDCR2DyWX
MD5:	1112E54A345321BB203561290DFA34C6
SHA1:	015E11628DBAA845F9087EAA20DEC2C496EF06FA
SHA-256:	3A3C9FEEB2222A74A0E442E437ED5C790D05931DC971EDC5891B3092DF943A22
SHA-512:	1C091F85AE997CE0261EA2A2F94CE43929FED7F053B9C7CEEAA7532DA941693591996C4267E15232174D6E70101AC70321556DBF5102D2C31AA2B51AB230BA3E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnDigitizerSectionChanged" GUID="{36EC7629-2FD4-4679-9B31-E37524E62CBB}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">OnDigitizerSectionChanged</Property>.. <Property Class="Type" GUID="{A773D7FB-7AB8-4007-873B-9E46AEABEC6A}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Event</Property>.. <Property Class="Number" GUID="{7CA080B2-BA94-4497-94F0-88166940103F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">26.75</Property>.. <Property Class="Memo" GUID="{AFDE7BDB-ACE5-44E5-99EE-43D27446F16E}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><I

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnDigitizerSectionCh\is-N2JH8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (575), with CRLF line terminators
Category:	dropped
Size (bytes):	4324
Entropy (8bit):	5.4958357885677085
Encrypted:	false
SSDEEP:	48:cD4dVIcYD51NOrl8L+zXm3xLUUqx3iv1TyvWEKvFVvJvWXiEvDTyvFgTyvWjN7dI:AQhWz+zxKWcXdJegFDCR2DyWX
MD5:	1112E54A345321BB203561290DFA34C6
SHA1:	015E11628DBAA845F9087EAA20DEC2C496EF06FA
SHA-256:	3A3C9FEEB2222A74A0E442E437ED5C790D05931DC971EDC5891B3092DF943A22
SHA-512:	1C091F85AE997CE0261EA2A2F94CE43929FED7F053B9C7CEEAA7532DA941693591996C4267E15232174D6E70101AC70321556DBF5102D2C31AA2B51AB230BA3E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnDigitizerSectionChanged" GUID="{36EC7629-2FD4-4679-9B31-E37524E62CBB}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">OnDigitizerSectionChanged</Property>.. <Property Class="Type" GUID="{A773D7FB-7AB8-4007-873B-9E46AEABEC6A}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Event</Property>.. <Property Class="Number" GUID="{7CA080B2-BA94-4497-94F0-88166940103F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">26.75</Property>.. <Property Class="Memo" GUID="{AFDE7BDB-ACE5-44E5-99EE-43D27446F16E}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><I

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnDoneRecordingDigit1\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (732), with CRLF line terminators
Category:	dropped
Size (bytes):	4816
Entropy (8bit):	5.466661478198222
Encrypted:	false
SSDEEP:	96:8dg+LIKqrWF1NN74GOlHHR+M4lFpl3Vg/Nbq4vY:8VLdLN74GOlHHR+M4ljlFg/Ne4vY
MD5:	CAE4A816A8C1F47B63B537179011C5B6
SHA1:	34627151E6435F51CD0C0705894E3BF505613043
SHA-256:	C4E1AAF59C9356581F49A9B0986C4206D223A0ABA3F21AB564D8B2656938EEC5
SHA-512:	624BD93D4E94836FBA44E464301FA06ABBC2CCEBD4E785DDD7234FB3B839358690094A4620358F570502BFABD3E26FCBC9FCD23DF7F51A4E47274C78F9601F8B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnDoneRecordingDigitizer" GUID="{2528D2BD-A542-4285-BD17-7BF39030DBC6}">.. <Properties>.. <Property Class="Type" GUID="{E68AFD86-B59A-4A34-979A-928411F4D50E}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Event</Property>.. <Property Class="Text" GUID="{884CB39B-2D06-47CA-B305-28774BE7AE4F}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">OnDoneRecordingDigitizer</Property>.. <Property Class="Number" GUID="{73F5A1D5-CDC5-4CE8-A394-CD5AA8CAD5EE}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">28</Property>.. <Property Class="Text" GUID="{17F7F5BD-E94F-4C6C-B21B-33FB0B4777DD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{2528D2BD-A542-4285-BD17-7BF39030DBC6}</Property>.. <Property Class="Memo" GUID="{BD663529-70E7-462D-A3B0-629759455538}" Name="Form Lay

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnDoneRecordingDigit1\is-QRSOM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (732), with CRLF line terminators
Category:	dropped
Size (bytes):	4816
Entropy (8bit):	5.466661478198222
Encrypted:	false
SSDEEP:	96:8dg+LIKqrWF1NN74GOlHHR+M4lFpl3Vg/Nbq4vY:8VLdLN74GOlHHR+M4ljlFg/Ne4vY
MD5:	CAE4A816A8C1F47B63B537179011C5B6
SHA1:	34627151E6435F51CD0C0705894E3BF505613043
SHA-256:	C4E1AAF59C9356581F49A9B0986C4206D223A0ABA3F21AB564D8B2656938EEC5
SHA-512:	624BD93D4E94836FBA44E464301FA06ABBC2CCEBD4E785DDD7234FB3B839358690094A4620358F570502BFABD3E26FCBC9FCD23DF7F51A4E47274C78F9601F8B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnDoneRecordingDigitizer" GUID="{2528D2BD-A542-4285-BD17-7BF39030DBC6}">.. <Properties>.. <Property Class="Type" GUID="{E68AFD86-B59A-4A34-979A-928411F4D50E}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Event</Property>.. <Property Class="Text" GUID="{884CB39B-2D06-47CA-B305-28774BE7AE4F}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">OnDoneRecordingDigitizer</Property>.. <Property Class="Number" GUID="{73F5A1D5-CDC5-4CE8-A394-CD5AA8CAD5EE}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">28</Property>.. <Property Class="Text" GUID="{17F7F5BD-E94F-4C6C-B21B-33FB0B4777DD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{2528D2BD-A542-4285-BD17-7BF39030DBC6}</Property>.. <Property Class="Memo" GUID="{BD663529-70E7-462D-A3B0-629759455538}" Name="Form Lay

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnDoneRecordingDigit\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (732), with CRLF line terminators
Category:	dropped
Size (bytes):	4812
Entropy (8bit):	5.46539913576764
Encrypted:	false
SSDEEP:	96:8dg+LIKqrWFiNN74GOlHHR+M4lFpl3Vg/NIq4vY:8VLd4N74GOlHHR+M4ljlFg/Nr4vY
MD5:	8202FA126439775C34F82FDAF145F857
SHA1:	3DDDFC972BA3361048D24CDEC4FCEADE32FCE3CD
SHA-256:	53D2A7EA0C553976B1897E0EF6612E6DE0012A020BDC257F464AA1A709CD3F1C
SHA-512:	7DE444161A2D6A6500C663B0F5319133A1DDD8DDC9A932045FD2A345D6F014FE13704BA2A80DA92675EE840CED225566AE07A3EBB4B76EDFF54483B83148814F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnDoneRecordingDigitizer" GUID="{2528D2BD-A542-4285-BD17-7BF39030DBC6}">.. <Properties>.. <Property Class="Type" GUID="{E68AFD86-B59A-4A34-979A-928411F4D50E}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Event</Property>.. <Property Class="Text" GUID="{884CB39B-2D06-47CA-B305-28774BE7AE4F}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">OnDoneRecordingDigitizer</Property>.. <Property Class="Number" GUID="{73F5A1D5-CDC5-4CE8-A394-CD5AA8CAD5EE}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">28</Property>.. <Property Class="Text" GUID="{17F7F5BD-E94F-4C6C-B21B-33FB0B4777DD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{2528D2BD-A542-4285-BD17-7BF39030DBC6}</Property>.. <Property Class="Memo" GUID="{BD663529-70E7-462D-A3B0-629759455538}" Name="Form Lay

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnDoneRecordingDigit\is-GMNRO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (732), with CRLF line terminators
Category:	dropped
Size (bytes):	4812
Entropy (8bit):	5.46539913576764
Encrypted:	false
SSDEEP:	96:8dg+LIKqrWFiNN74GOlHHR+M4lFpl3Vg/NIq4vY:8VLd4N74GOlHHR+M4ljlFg/Nr4vY
MD5:	8202FA126439775C34F82FDAF145F857
SHA1:	3DDDFC972BA3361048D24CDEC4FCEADE32FCE3CD
SHA-256:	53D2A7EA0C553976B1897E0EF6612E6DE0012A020BDC257F464AA1A709CD3F1C
SHA-512:	7DE444161A2D6A6500C663B0F5319133A1DDD8DDC9A932045FD2A345D6F014FE13704BA2A80DA92675EE840CED225566AE07A3EBB4B76EDFF54483B83148814F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnDoneRecordingDigitizer" GUID="{2528D2BD-A542-4285-BD17-7BF39030DBC6}">.. <Properties>.. <Property Class="Type" GUID="{E68AFD86-B59A-4A34-979A-928411F4D50E}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Event</Property>.. <Property Class="Text" GUID="{884CB39B-2D06-47CA-B305-28774BE7AE4F}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">OnDoneRecordingDigitizer</Property>.. <Property Class="Number" GUID="{73F5A1D5-CDC5-4CE8-A394-CD5AA8CAD5EE}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">28</Property>.. <Property Class="Text" GUID="{17F7F5BD-E94F-4C6C-B21B-33FB0B4777DD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{2528D2BD-A542-4285-BD17-7BF39030DBC6}</Property>.. <Property Class="Memo" GUID="{BD663529-70E7-462D-A3B0-629759455538}" Name="Form Lay

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnDoneRecordingDigitizer\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1159), with CRLF line terminators
Category:	dropped
Size (bytes):	9904
Entropy (8bit):	5.2813066972662845
Encrypted:	false
SSDEEP:	192:uVCdOqdOKodOUdOXdOS/dO6N74GOlHHR+M4ljl7WgdOl/NeFdOPTdOKY:pdOqdOldOUdOXdOS/dO+WgdO6dObdO9
MD5:	C95B09A9CCEAAFB29ACC79E714E9DE3A
SHA1:	056AE69CD2B36FDA90DDF4CAA34F25127E5C3461
SHA-256:	25DAFBD109ABAE7064660FD0323EB66935BC26FA7ABCAE8E59B2A8313A25A603
SHA-512:	20094D7F1864D5E5BC4CBB77649F8E4E7D43DDD37B23F06A3CEF13B0F46E6B176F3EEBC8C03DDE45F949B98163E51E57F3D115C030466A424CE84AC9621546BE
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="OnDoneRecordingDigitizer" GUID="{2528D2BD-A542-4285-BD17-7BF39030DBC6}">.. <Properties>.. <Property Class="Type" GUID="{E68AFD86-B59A-4A34-979A-928411F4D50E}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Event</Property>.. <Property Class="Text" GUID="{884CB39B-2D06-47CA-B305-28774BE7AE4F}" Name="Name" inheritaction="Ignore" calcu

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnDoneRecordingDigitizer\is-VCF9I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1159), with CRLF line terminators
Category:	dropped
Size (bytes):	9904
Entropy (8bit):	5.2813066972662845
Encrypted:	false
SSDEEP:	192:uVCdOqdOKodOUdOXdOS/dO6N74GOlHHR+M4ljl7WgdOl/NeFdOPTdOKY:pdOqdOldOUdOXdOS/dO+WgdO6dObdO9
MD5:	C95B09A9CCEAAFB29ACC79E714E9DE3A
SHA1:	056AE69CD2B36FDA90DDF4CAA34F25127E5C3461
SHA-256:	25DAFBD109ABAE7064660FD0323EB66935BC26FA7ABCAE8E59B2A8313A25A603
SHA-512:	20094D7F1864D5E5BC4CBB77649F8E4E7D43DDD37B23F06A3CEF13B0F46E6B176F3EEBC8C03DDE45F949B98163E51E57F3D115C030466A424CE84AC9621546BE
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="OnDoneRecordingDigitizer" GUID="{2528D2BD-A542-4285-BD17-7BF39030DBC6}">.. <Properties>.. <Property Class="Type" GUID="{E68AFD86-B59A-4A34-979A-928411F4D50E}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Event</Property>.. <Property Class="Text" GUID="{884CB39B-2D06-47CA-B305-28774BE7AE4F}" Name="Name" inheritaction="Ignore" calcu

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnDoneRecording\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (723), with CRLF line terminators
Category:	dropped
Size (bytes):	4696
Entropy (8bit):	5.464909877712375
Encrypted:	false
SSDEEP:	96:8C1ul/lcWF0yeGOcHHR+Je4cFpcmuVgkDwk5:8ogR0yeGOcHHR+Je4cjcrgkDwk5
MD5:	40E7D36847953D5CCD19D55F716D10BF
SHA1:	0265A126037A9F5C66CDCB0E9EBF51B8D17D4986
SHA-256:	8F163C3FBA667658041ADF193821AC434E604F176B8F724A6A302E6A52A395BE
SHA-512:	E1634EEEC8ED4FEFAA762857BE6660D4D06FABF3F93E8C372104E63674F0AA2F07116B7828482FCEFB5DAD0B23DD05104360058045B804ADB9B16542926FEBAA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnDoneRecording" GUID="{F918C66A-313D-49E1-B530-4593E3E34B76}">.. <Properties>.. <Property Class="Type" GUID="{43AB9F7B-F01A-43BD-844B-4C15646EBEC2}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Event</Property>.. <Property Class="Text" GUID="{ACFA5849-A025-48A6-BA6E-537825BF4DBD}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">OnDoneRecording</Property>.. <Property Class="Number" GUID="{51F0B9AF-DA78-42A3-8407-7CE2A6EAE7B7}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">27</Property>.. <Property Class="Text" GUID="{CF808558-3A89-4D3E-B350-5EC7FF3ECFDC}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{F918C66A-313D-49E1-B530-4593E3E34B76}</Property>.. <Property Class="Memo" GUID="{5704E37D-FDAF-451D-97A3-DAA11D5E6E9E}" Name="Form Layout" systemhidden=

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnDoneRecording\is-DLH6K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (723), with CRLF line terminators
Category:	dropped
Size (bytes):	4696
Entropy (8bit):	5.464909877712375
Encrypted:	false
SSDEEP:	96:8C1ul/lcWF0yeGOcHHR+Je4cFpcmuVgkDwk5:8ogR0yeGOcHHR+Je4cjcrgkDwk5
MD5:	40E7D36847953D5CCD19D55F716D10BF
SHA1:	0265A126037A9F5C66CDCB0E9EBF51B8D17D4986
SHA-256:	8F163C3FBA667658041ADF193821AC434E604F176B8F724A6A302E6A52A395BE
SHA-512:	E1634EEEC8ED4FEFAA762857BE6660D4D06FABF3F93E8C372104E63674F0AA2F07116B7828482FCEFB5DAD0B23DD05104360058045B804ADB9B16542926FEBAA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnDoneRecording" GUID="{F918C66A-313D-49E1-B530-4593E3E34B76}">.. <Properties>.. <Property Class="Type" GUID="{43AB9F7B-F01A-43BD-844B-4C15646EBEC2}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Event</Property>.. <Property Class="Text" GUID="{ACFA5849-A025-48A6-BA6E-537825BF4DBD}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">OnDoneRecording</Property>.. <Property Class="Number" GUID="{51F0B9AF-DA78-42A3-8407-7CE2A6EAE7B7}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">27</Property>.. <Property Class="Text" GUID="{CF808558-3A89-4D3E-B350-5EC7FF3ECFDC}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{F918C66A-313D-49E1-B530-4593E3E34B76}</Property>.. <Property Class="Memo" GUID="{5704E37D-FDAF-451D-97A3-DAA11D5E6E9E}" Name="Form Layout" systemhidden=

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnItemChange\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (719), with CRLF line terminators
Category:	dropped
Size (bytes):	4690
Entropy (8bit):	5.467717995046214
Encrypted:	false
SSDEEP:	48:cnBnDCujfpHYD5anK87SZ09lJIzTK7jWK+UZiv1x/yvtVvzLvSKvFHOJvWXiEvDl:stjBWFjxcHHR+JezFxKV+JBl
MD5:	F5AF3D5C394F50FBF3DA2F362F4DFA4D
SHA1:	B6CEBC4184CEBCBCA05E84E5ECC0EBDDB9CD82F5
SHA-256:	F150F4913486B4E4BC1EE208FD224858614069CF16FCCC4E4DB285DA97BEE4D2
SHA-512:	F7A7A387BDF52AD99D3BE3B853ABD32446AEA0F15336BB01E43379F401A45E1E1D5EFD49CDB78740715E5176BD8A0BAC5DB1AC95C3D4E1248625704C8E492671
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnItemChange" GUID="{E21AB2CA-D0DD-46F4-8B41-DB466155620F}">.. <Properties>.. <Property Class="Type" GUID="{64BD8749-3980-49F1-ABEE-6CDB0911E2D4}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Event</Property>.. <Property Class="Text" GUID="{8D88F402-6286-4723-9F85-4DFE66CAC084}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">OnItemChange</Property>.. <Property Class="Number" GUID="{751E1A1F-090D-411F-8B0E-9B9ABA27E30F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">29</Property>.. <Property Class="Text" GUID="{B7F0560D-0785-44BC-930A-641253B590D5}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{E21AB2CA-D0DD-46F4-8B41-DB466155620F}</Property>.. <Property Class="Memo" GUID="{A82AAE96-D725-443E-B124-79B3006E26FE}" Name="Form Layout" systemhidden="True"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnItemChange\is-CPLVA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (719), with CRLF line terminators
Category:	dropped
Size (bytes):	4690
Entropy (8bit):	5.467717995046214
Encrypted:	false
SSDEEP:	48:cnBnDCujfpHYD5anK87SZ09lJIzTK7jWK+UZiv1x/yvtVvzLvSKvFHOJvWXiEvDl:stjBWFjxcHHR+JezFxKV+JBl
MD5:	F5AF3D5C394F50FBF3DA2F362F4DFA4D
SHA1:	B6CEBC4184CEBCBCA05E84E5ECC0EBDDB9CD82F5
SHA-256:	F150F4913486B4E4BC1EE208FD224858614069CF16FCCC4E4DB285DA97BEE4D2
SHA-512:	F7A7A387BDF52AD99D3BE3B853ABD32446AEA0F15336BB01E43379F401A45E1E1D5EFD49CDB78740715E5176BD8A0BAC5DB1AC95C3D4E1248625704C8E492671
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnItemChange" GUID="{E21AB2CA-D0DD-46F4-8B41-DB466155620F}">.. <Properties>.. <Property Class="Type" GUID="{64BD8749-3980-49F1-ABEE-6CDB0911E2D4}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Event</Property>.. <Property Class="Text" GUID="{8D88F402-6286-4723-9F85-4DFE66CAC084}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">OnItemChange</Property>.. <Property Class="Number" GUID="{751E1A1F-090D-411F-8B0E-9B9ABA27E30F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">29</Property>.. <Property Class="Text" GUID="{B7F0560D-0785-44BC-930A-641253B590D5}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{E21AB2CA-D0DD-46F4-8B41-DB466155620F}</Property>.. <Property Class="Memo" GUID="{A82AAE96-D725-443E-B124-79B3006E26FE}" Name="Form Layout" systemhidden="True"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnItemDelete\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (719), with CRLF line terminators
Category:	dropped
Size (bytes):	4718
Entropy (8bit):	5.439765568658089
Encrypted:	false
SSDEEP:	48:c5CxEu5aVUscYD5anK87SZ09lJlbjiU0Xiv1lvtVvzLvSKvFHsJvWXiEvDMvFglg:pCP6rWF8jHHRwJeyFiUVtp
MD5:	D0594D8155CA15381EFC5DF781908602
SHA1:	D8362E1C86836A183A1F11DC7E0E9106B0CB87F3
SHA-256:	D5F43DA80DEEBB97CC227C8E04D9CDFDFA2F6BDB8A85DB926B2568941DE05B52
SHA-512:	83D701514DAF515DF0B3D92DC9EDF072D595E31F69FBF2AFD7840699685477A74741CF2D3A02165A7642F6F77C7B24B7B7320C04E0BC3599CD27250EEDC1660D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnItemDelete" GUID="{E3FEF2E6-A22D-4804-96E6-63E5FBF83345}">.. <Properties>.. <Property Class="Type" GUID="{6859E0E9-8DF0-46AA-9F9B-8FAA081ACA7F}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Event</Property>.. <Property Class="Text" GUID="{78AFD91B-148A-473C-AE35-3455F5E30C2F}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">OnItemDelete</Property>.. <Property Class="Number" GUID="{F726D368-9538-47C4-BB1F-490A0DCE8132}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">30</Property>.. <Property Class="Text" GUID="{BDFF672E-F3EE-4531-B70E-3A7165093738}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{E3FEF2E6-A22D-4804-96E6-63E5FBF83345}</Property>.. <Property Class="Memo" GUID="{D49F6981-CCDD-48B1-806A-2830163C7D2C}" Name="Form Layout" systemhidden="True"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnItemDelete\is-18HIA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (719), with CRLF line terminators
Category:	dropped
Size (bytes):	4718
Entropy (8bit):	5.439765568658089
Encrypted:	false
SSDEEP:	48:c5CxEu5aVUscYD5anK87SZ09lJlbjiU0Xiv1lvtVvzLvSKvFHsJvWXiEvDMvFglg:pCP6rWF8jHHRwJeyFiUVtp
MD5:	D0594D8155CA15381EFC5DF781908602
SHA1:	D8362E1C86836A183A1F11DC7E0E9106B0CB87F3
SHA-256:	D5F43DA80DEEBB97CC227C8E04D9CDFDFA2F6BDB8A85DB926B2568941DE05B52
SHA-512:	83D701514DAF515DF0B3D92DC9EDF072D595E31F69FBF2AFD7840699685477A74741CF2D3A02165A7642F6F77C7B24B7B7320C04E0BC3599CD27250EEDC1660D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnItemDelete" GUID="{E3FEF2E6-A22D-4804-96E6-63E5FBF83345}">.. <Properties>.. <Property Class="Type" GUID="{6859E0E9-8DF0-46AA-9F9B-8FAA081ACA7F}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Event</Property>.. <Property Class="Text" GUID="{78AFD91B-148A-473C-AE35-3455F5E30C2F}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">OnItemDelete</Property>.. <Property Class="Number" GUID="{F726D368-9538-47C4-BB1F-490A0DCE8132}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">30</Property>.. <Property Class="Text" GUID="{BDFF672E-F3EE-4531-B70E-3A7165093738}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{E3FEF2E6-A22D-4804-96E6-63E5FBF83345}</Property>.. <Property Class="Memo" GUID="{D49F6981-CCDD-48B1-806A-2830163C7D2C}" Name="Form Layout" systemhidden="True"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnJobClose\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (539), with CRLF line terminators
Category:	dropped
Size (bytes):	4200
Entropy (8bit):	5.485462753695756
Encrypted:	false
SSDEEP:	48:cRY2AtnofLYD5anK87SZ09lJSb24jgUdEiv1BvWEKvFHsJvWXiEvDBvFgBvWPVCn:UbUULWFfZrcwJehFIgVCGK
MD5:	BBCCC4E697585ED31475CC65C2D2167A
SHA1:	5D76882761576F29D096DC4FFF67348B937BA4A6
SHA-256:	7DB79A8FAA54F1A689BF3022FD425C3663B33DF22765319B2080B4BB903913A7
SHA-512:	68C2ECB8493080E143EA0D043CA5F3AEEC5933AF66D7B62DFBA35696BCAADADD8F2F788E07BD7FC1885838989C7061931189AB378FAD325CA0F0511A49DBD057
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnJobClose" GUID="{76586A76-ACD9-434A-9D19-90E0D40846B5}">.. <Properties>.. <Property Class="Type" GUID="{24B1D8E0-523F-400A-AF59-E3C1B293B0B5}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Event</Property>.. <Property Class="Text" GUID="{304E0C02-EA93-4752-928F-EE465B1683BA}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">OnJobClose</Property>.. <Property Class="Number" GUID="{27C45D0E-85EF-4C19-BC65-2CDD2B736B7F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">31</Property>.. <Property Class="Text" GUID="{11C3E1FF-AA8D-4002-BD8E-EB7FF14D6AAB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{76586A76-ACD9-434A-9D19-90E0D40846B5}</Property>.. <Property Class="Memo" GUID="{7F7C3B08-FC76-4B13-A036-6E3B291BE9DD}" Name="Form Layout" systemhidden="True" Ord

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnJobClose\is-316GH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (539), with CRLF line terminators
Category:	dropped
Size (bytes):	4200
Entropy (8bit):	5.485462753695756
Encrypted:	false
SSDEEP:	48:cRY2AtnofLYD5anK87SZ09lJSb24jgUdEiv1BvWEKvFHsJvWXiEvDBvFgBvWPVCn:UbUULWFfZrcwJehFIgVCGK
MD5:	BBCCC4E697585ED31475CC65C2D2167A
SHA1:	5D76882761576F29D096DC4FFF67348B937BA4A6
SHA-256:	7DB79A8FAA54F1A689BF3022FD425C3663B33DF22765319B2080B4BB903913A7
SHA-512:	68C2ECB8493080E143EA0D043CA5F3AEEC5933AF66D7B62DFBA35696BCAADADD8F2F788E07BD7FC1885838989C7061931189AB378FAD325CA0F0511A49DBD057
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnJobClose" GUID="{76586A76-ACD9-434A-9D19-90E0D40846B5}">.. <Properties>.. <Property Class="Type" GUID="{24B1D8E0-523F-400A-AF59-E3C1B293B0B5}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Event</Property>.. <Property Class="Text" GUID="{304E0C02-EA93-4752-928F-EE465B1683BA}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">OnJobClose</Property>.. <Property Class="Number" GUID="{27C45D0E-85EF-4C19-BC65-2CDD2B736B7F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">31</Property>.. <Property Class="Text" GUID="{11C3E1FF-AA8D-4002-BD8E-EB7FF14D6AAB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{76586A76-ACD9-434A-9D19-90E0D40846B5}</Property>.. <Property Class="Memo" GUID="{7F7C3B08-FC76-4B13-A036-6E3B291BE9DD}" Name="Form Layout" systemhidden="True" Ord

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnJobOpen\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (537), with CRLF line terminators
Category:	dropped
Size (bytes):	4196
Entropy (8bit):	5.504975566183957
Encrypted:	false
SSDEEP:	48:cTVEsogW0W/bcYD5anK87SZ09lJB/kWDUzoiv11vWEKvFHcJvWXiEvD1vFg1vWse:OVEtgW0wbcWFQVgLvcgJeNF+MVCsnt
MD5:	2E4340E1028D47B64B84F3A0DB1852BB
SHA1:	D2C2B6E5D5EFCC985B6B24507B81080B6D3AA1A4
SHA-256:	8161D8ED8F5D796BB02DBEF508E3747A62D59E2D751D5989C0FA6B29D415F75A
SHA-512:	6625B8D9DC231B457740CB19296920072E1A7106AE048076DE189C5801864455D461F5E9BE1F56B0DE00DDF1EA577578EF885F690D7ED19895C2072B995AAD76
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnJobOpen" GUID="{1F104422-FC10-4B9B-A656-77EC46866176}">.. <Properties>.. <Property Class="Type" GUID="{F44E3E42-5B5F-46EC-871A-0243622B3DD1}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Event</Property>.. <Property Class="Text" GUID="{35EABC1D-064A-4D55-97EB-C91812EFF8F8}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">OnJobOpen</Property>.. <Property Class="Number" GUID="{563ADC45-421E-45C5-9806-DEFCD0424C6D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">32</Property>.. <Property Class="Text" GUID="{02A8D4D8-9AB2-44C4-AABF-6AFA0A0D06B0}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{1F104422-FC10-4B9B-A656-77EC46866176}</Property>.. <Property Class="Memo" GUID="{5F5612A4-CCB5-49F6-98AE-B78152230052}" Name="Form Layout" systemhidden="True" Order

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnJobOpen\is-JBE3Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (537), with CRLF line terminators
Category:	dropped
Size (bytes):	4196
Entropy (8bit):	5.504975566183957
Encrypted:	false
SSDEEP:	48:cTVEsogW0W/bcYD5anK87SZ09lJB/kWDUzoiv11vWEKvFHcJvWXiEvD1vFg1vWse:OVEtgW0wbcWFQVgLvcgJeNF+MVCsnt
MD5:	2E4340E1028D47B64B84F3A0DB1852BB
SHA1:	D2C2B6E5D5EFCC985B6B24507B81080B6D3AA1A4
SHA-256:	8161D8ED8F5D796BB02DBEF508E3747A62D59E2D751D5989C0FA6B29D415F75A
SHA-512:	6625B8D9DC231B457740CB19296920072E1A7106AE048076DE189C5801864455D461F5E9BE1F56B0DE00DDF1EA577578EF885F690D7ED19895C2072B995AAD76
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnJobOpen" GUID="{1F104422-FC10-4B9B-A656-77EC46866176}">.. <Properties>.. <Property Class="Type" GUID="{F44E3E42-5B5F-46EC-871A-0243622B3DD1}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Event</Property>.. <Property Class="Text" GUID="{35EABC1D-064A-4D55-97EB-C91812EFF8F8}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">OnJobOpen</Property>.. <Property Class="Number" GUID="{563ADC45-421E-45C5-9806-DEFCD0424C6D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">32</Property>.. <Property Class="Text" GUID="{02A8D4D8-9AB2-44C4-AABF-6AFA0A0D06B0}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{1F104422-FC10-4B9B-A656-77EC46866176}</Property>.. <Property Class="Memo" GUID="{5F5612A4-CCB5-49F6-98AE-B78152230052}" Name="Form Layout" systemhidden="True" Order

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnNewItem\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (719), with CRLF line terminators
Category:	dropped
Size (bytes):	4662
Entropy (8bit):	5.467279615633365
Encrypted:	false
SSDEEP:	48:cbHtOLmWgTW2VYD5anK87SZ09lJFlzJknIxUviv1YvtVvzLvSKvFHOJvWXiEvDAg:oHgLLyWWWFClj8HHR+Je7FdVVqk
MD5:	2B745124B191556F940506FE89C9A933
SHA1:	0BE2DC9BA9E558EE13CA99B05A2A4554766DD0F6
SHA-256:	F7DEC3CAE1E10EE613572AC5BC74577860D7FA877D931ADA7C52A5712DBEC3E6
SHA-512:	A5CC5AB089DB7DC84DF76C60EDB8539823BD9E6403C650E7E33D8354418D7D75AC58F3AB67ED72258A71A615876AE18C2D550AB928886E9612E9F07ACB5CDC69
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnNewItem" GUID="{B222D1DA-8FA1-4E58-897C-8238927E240B}">.. <Properties>.. <Property Class="Type" GUID="{C4E8055E-EBEB-449E-8F8D-D2F21BFC173F}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Event</Property>.. <Property Class="Text" GUID="{131D7959-0ACC-4B9C-853F-B1B26D1FB6BF}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">OnNewItem</Property>.. <Property Class="Number" GUID="{FC91E3E4-564F-4DEC-9B41-FB94F625DAAB}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">33</Property>.. <Property Class="Text" GUID="{9C6A5521-1960-47BF-BE71-BCCE73DD3B79}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{B222D1DA-8FA1-4E58-897C-8238927E240B}</Property>.. <Property Class="Memo" GUID="{DC935EBB-15BC-4870-B222-E75E415B999A}" Name="Form Layout" systemhidden="True" Order

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnNewItem\is-9DMHG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (719), with CRLF line terminators
Category:	dropped
Size (bytes):	4662
Entropy (8bit):	5.467279615633365
Encrypted:	false
SSDEEP:	48:cbHtOLmWgTW2VYD5anK87SZ09lJFlzJknIxUviv1YvtVvzLvSKvFHOJvWXiEvDAg:oHgLLyWWWFClj8HHR+Je7FdVVqk
MD5:	2B745124B191556F940506FE89C9A933
SHA1:	0BE2DC9BA9E558EE13CA99B05A2A4554766DD0F6
SHA-256:	F7DEC3CAE1E10EE613572AC5BC74577860D7FA877D931ADA7C52A5712DBEC3E6
SHA-512:	A5CC5AB089DB7DC84DF76C60EDB8539823BD9E6403C650E7E33D8354418D7D75AC58F3AB67ED72258A71A615876AE18C2D550AB928886E9612E9F07ACB5CDC69
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnNewItem" GUID="{B222D1DA-8FA1-4E58-897C-8238927E240B}">.. <Properties>.. <Property Class="Type" GUID="{C4E8055E-EBEB-449E-8F8D-D2F21BFC173F}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Event</Property>.. <Property Class="Text" GUID="{131D7959-0ACC-4B9C-853F-B1B26D1FB6BF}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">OnNewItem</Property>.. <Property Class="Number" GUID="{FC91E3E4-564F-4DEC-9B41-FB94F625DAAB}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">33</Property>.. <Property Class="Text" GUID="{9C6A5521-1960-47BF-BE71-BCCE73DD3B79}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{B222D1DA-8FA1-4E58-897C-8238927E240B}</Property>.. <Property Class="Memo" GUID="{DC935EBB-15BC-4870-B222-E75E415B999A}" Name="Form Layout" systemhidden="True" Order

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnNewJob\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (535), with CRLF line terminators
Category:	dropped
Size (bytes):	4123
Entropy (8bit):	5.505636705983616
Encrypted:	false
SSDEEP:	48:c/43VSHS3YD51NOrl8ncp+mwQUq3iv15vWEKvFVvJvWXiEvD5vFg5vWmSd2tjtLt:6U3W/s+OQvcXdJe5FkZ22thWE
MD5:	5B9B181F1B09F3E668202D3C994D6539
SHA1:	0BA986E47E6F55F22DAE0B15E5F0D0D052BCBEBB
SHA-256:	7B0878BB63D627507D60C27DBF6A7356754D2028E4A670A0E3BCCFE945DA6152
SHA-512:	6D057A30FC818CA6471DE6D4A34A5F52D76F4471400C68C30EC0DF25DD4CCFCFAEB246DF32521774E04CF8354E6EFF69DCF2E05B0AB7603AB3AE51F1A6D749C6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnNewJob" GUID="{B6B487BD-809A-495D-901D-BFB55B00D25E}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">OnNewJob</Property>.. <Property Class="Type" GUID="{C4983009-0D24-45A9-8870-743E516545C3}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Event</Property>.. <Property Class="Number" GUID="{771FD652-6135-4B17-BC54-23F32FD3BB20}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">33.5</Property>.. <Property Class="Memo" GUID="{F893A832-797C-47AA-A554-418A967D609C}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="Help String" Or

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnNewJob\is-HPKO5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (535), with CRLF line terminators
Category:	dropped
Size (bytes):	4123
Entropy (8bit):	5.505636705983616
Encrypted:	false
SSDEEP:	48:c/43VSHS3YD51NOrl8ncp+mwQUq3iv15vWEKvFVvJvWXiEvD5vFg5vWmSd2tjtLt:6U3W/s+OQvcXdJe5FkZ22thWE
MD5:	5B9B181F1B09F3E668202D3C994D6539
SHA1:	0BA986E47E6F55F22DAE0B15E5F0D0D052BCBEBB
SHA-256:	7B0878BB63D627507D60C27DBF6A7356754D2028E4A670A0E3BCCFE945DA6152
SHA-512:	6D057A30FC818CA6471DE6D4A34A5F52D76F4471400C68C30EC0DF25DD4CCFCFAEB246DF32521774E04CF8354E6EFF69DCF2E05B0AB7603AB3AE51F1A6D749C6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnNewJob" GUID="{B6B487BD-809A-495D-901D-BFB55B00D25E}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">OnNewJob</Property>.. <Property Class="Type" GUID="{C4983009-0D24-45A9-8870-743E516545C3}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Event</Property>.. <Property Class="Number" GUID="{771FD652-6135-4B17-BC54-23F32FD3BB20}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">33.5</Property>.. <Property Class="Memo" GUID="{F893A832-797C-47AA-A554-418A967D609C}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name="Help String" Or

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnSelectedPageChange\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (578), with CRLF line terminators
Category:	dropped
Size (bytes):	4300
Entropy (8bit):	5.474750816238956
Encrypted:	false
SSDEEP:	48:cXr4y7sB+pYD51NOrl811NvmVjwVUq9iv1qvWEKvFVvJvWXiEvDqvFgqvWg2dd2t:ErMBYWt1pxheWcXdJeUFdx232CWz
MD5:	41AC38360B0CF598DAEB794280741F64
SHA1:	42B20159AF1EE96844978BEBE1BB78ADD7F583D5
SHA-256:	0B76A6796059B0E90779DCC694F1C254B31226A20E2AE3E7FF695B99E1DA791B
SHA-512:	06D553BCB6B83E4805B8E67015C453B1910B4FC830ED6CC097F2631282A85F381E4DF5508717D00D760A4DAADDCC3CA4E5A94650B0F30705B026D374B1D54745
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnSelectedPageChange" GUID="{D6F16452-9276-499E-8E74-C20F32E21971}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">OnSelectedPageChange</Property>.. <Property Class="Type" GUID="{DEF9ACDF-0383-4896-AD36-51E74B03D984}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Event</Property>.. <Property Class="Number" GUID="{3441021D-D685-4AF5-B40D-5141093BFD1C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">33.75</Property>.. <Property Class="Memo" GUID="{CE201571-C85B-4912-A461-1EAECAEB59C4}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name=&

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnSelectedPageChange\is-O2O4M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (578), with CRLF line terminators
Category:	dropped
Size (bytes):	4300
Entropy (8bit):	5.474750816238956
Encrypted:	false
SSDEEP:	48:cXr4y7sB+pYD51NOrl811NvmVjwVUq9iv1qvWEKvFVvJvWXiEvDqvFgqvWg2dd2t:ErMBYWt1pxheWcXdJeUFdx232CWz
MD5:	41AC38360B0CF598DAEB794280741F64
SHA1:	42B20159AF1EE96844978BEBE1BB78ADD7F583D5
SHA-256:	0B76A6796059B0E90779DCC694F1C254B31226A20E2AE3E7FF695B99E1DA791B
SHA-512:	06D553BCB6B83E4805B8E67015C453B1910B4FC830ED6CC097F2631282A85F381E4DF5508717D00D760A4DAADDCC3CA4E5A94650B0F30705B026D374B1D54745
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnSelectedPageChange" GUID="{D6F16452-9276-499E-8E74-C20F32E21971}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">OnSelectedPageChange</Property>.. <Property Class="Type" GUID="{DEF9ACDF-0383-4896-AD36-51E74B03D984}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Event</Property>.. <Property Class="Number" GUID="{3441021D-D685-4AF5-B40D-5141093BFD1C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">33.75</Property>.. <Property Class="Memo" GUID="{CE201571-C85B-4912-A461-1EAECAEB59C4}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name=&

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnSelectedSelectionC\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (578), with CRLF line terminators
Category:	dropped
Size (bytes):	4337
Entropy (8bit):	5.460973914321589
Encrypted:	false
SSDEEP:	48:cuac4G/z2YD51NOrl8Q0ajfqmcxIFUq1iv1gyvWEKvFVvJvWXiEvDgyvFggyvWP2:3l2WIjfqcWlcXdJefFKGtA24W5Ty
MD5:	5248ADFD8AB7BD47B5A3102143823F0B
SHA1:	3FD00E4B73738D9911E12E63E77DDFC4E2BDC655
SHA-256:	4611051EDC39913E781F127B7E80A28201DE67DDB446B78C667C8152D3F916B0
SHA-512:	5D4936C750F6C7AC40706715ACF9E6C929C5E0A679A95C3B06CCEC832E63787FB10F5E81B3F45C6C96B616E108EEB28E8081D2159708D6BC0199F731E4D34970
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnSelectedSelectionChanged" GUID="{DEA66FA2-4F66-4203-9172-62B46F26C954}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">OnSelectedSelectionChanged</Property>.. <Property Class="Type" GUID="{55E4C479-8C03-4460-8244-30BF01BE261D}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Event</Property>.. <Property Class="Number" GUID="{35A49D69-287C-4135-90ED-A98A4DB1FDB4}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">33.875</Property>.. <Property Class="Memo" GUID="{1F0CFF14-17F7-43A9-92C9-EA8908262AA3}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/>&l

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnSelectedSelectionC\is-H6ERM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (578), with CRLF line terminators
Category:	dropped
Size (bytes):	4337
Entropy (8bit):	5.460973914321589
Encrypted:	false
SSDEEP:	48:cuac4G/z2YD51NOrl8Q0ajfqmcxIFUq1iv1gyvWEKvFVvJvWXiEvDgyvFggyvWP2:3l2WIjfqcWlcXdJefFKGtA24W5Ty
MD5:	5248ADFD8AB7BD47B5A3102143823F0B
SHA1:	3FD00E4B73738D9911E12E63E77DDFC4E2BDC655
SHA-256:	4611051EDC39913E781F127B7E80A28201DE67DDB446B78C667C8152D3F916B0
SHA-512:	5D4936C750F6C7AC40706715ACF9E6C929C5E0A679A95C3B06CCEC832E63787FB10F5E81B3F45C6C96B616E108EEB28E8081D2159708D6BC0199F731E4D34970
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnSelectedSelectionChanged" GUID="{DEA66FA2-4F66-4203-9172-62B46F26C954}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">OnSelectedSelectionChanged</Property>.. <Property Class="Type" GUID="{55E4C479-8C03-4460-8244-30BF01BE261D}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Event</Property>.. <Property Class="Number" GUID="{35A49D69-287C-4135-90ED-A98A4DB1FDB4}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">33.875</Property>.. <Property Class="Memo" GUID="{1F0CFF14-17F7-43A9-92C9-EA8908262AA3}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/>&l

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnSelectionChanged\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (592), with CRLF line terminators
Category:	dropped
Size (bytes):	4318
Entropy (8bit):	5.467436813004028
Encrypted:	false
SSDEEP:	48:cjw4ORP5YD51NOrl8sq2lmjx/YUqmChiv1HyvWEKvFVvJvWXiEvDHyvFgHyvW7rr:ZrZ5W0lr+6cXdJekFd8rH2ZWll
MD5:	B78BE74B7045E7B006D35F88AB178919
SHA1:	AB440B67DEBB4AA22761FC5CB49E4DE3AC339AFC
SHA-256:	0D2269E5457A27E80AA6360DD805578BEF6A083F89AE9326B142000F8F246159
SHA-512:	13C1E5C95BFA656FEDA0CAE639BA9A53F9EF7D4B19AFF1E77FB5EE2F11FDBB7ED7DA75C3194D0F89CCF5B309D5D856AE413C682C348F97362C6814E8C9F3BFBE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnSelectionChanged" GUID="{F83A8AA4-F482-4029-BD50-8A0E51D9D079}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">OnSelectionChanged</Property>.. <Property Class="Type" GUID="{1ED3E934-2755-4E81-B56D-946A708057EC}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Event</Property>.. <Property Class="Number" GUID="{DEBEF733-56F1-4296-A803-CB458FB453B2}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">33.9375</Property>.. <Property Class="Memo" GUID="{1CBBE135-930E-4A51-9B26-F295D9DBDACE}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name=&qu

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OnSelectionChanged\is-H857S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (592), with CRLF line terminators
Category:	dropped
Size (bytes):	4318
Entropy (8bit):	5.467436813004028
Encrypted:	false
SSDEEP:	48:cjw4ORP5YD51NOrl8sq2lmjx/YUqmChiv1HyvWEKvFVvJvWXiEvDHyvFgHyvW7rr:ZrZ5W0lr+6cXdJekFd8rH2ZWll
MD5:	B78BE74B7045E7B006D35F88AB178919
SHA1:	AB440B67DEBB4AA22761FC5CB49E4DE3AC339AFC
SHA-256:	0D2269E5457A27E80AA6360DD805578BEF6A083F89AE9326B142000F8F246159
SHA-512:	13C1E5C95BFA656FEDA0CAE639BA9A53F9EF7D4B19AFF1E77FB5EE2F11FDBB7ED7DA75C3194D0F89CCF5B309D5D856AE413C682C348F97362C6814E8C9F3BFBE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OnSelectionChanged" GUID="{F83A8AA4-F482-4029-BD50-8A0E51D9D079}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">OnSelectionChanged</Property>.. <Property Class="Type" GUID="{1ED3E934-2755-4E81-B56D-946A708057EC}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Event</Property>.. <Property Class="Number" GUID="{DEBEF733-56F1-4296-A803-CB458FB453B2}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">33.9375</Property>.. <Property Class="Memo" GUID="{1CBBE135-930E-4A51-9B26-F295D9DBDACE}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name=&qu

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OpenJobEx\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (585), with CRLF line terminators
Category:	dropped
Size (bytes):	5351
Entropy (8bit):	5.446241884061012
Encrypted:	false
SSDEEP:	96:VhCnYqWShKWsN9WEAFddzyeewezR3F3FIA6LctD2fys:jkfpoNQEAtzyeewezR3JF9ZKys
MD5:	34DE35ED480F20F12062686706D685A5
SHA1:	57CEA50047BA71FDE8D621B694282C645C2CAC91
SHA-256:	799023B1E0F6E5C84ACE9456790E296092031D32F697F6263B7D9032A8CF9F7E
SHA-512:	F0C2F1D5A3E0248BBEA09D92B22B786FE23B71E1B804CCF28B1D67C2ABF082DD48031888DC43721D260CC5B7307452B2D3B1357230432945C6AF3E73EF8116DA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OpenJobEx" GUID="{A706B5FF-E5B1-494A-9F0D-12824DD26A57}">.. <Properties>.. <Property Class="Type" GUID="{29B547AE-919B-413D-B460-7346D79C08DB}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Procedure</Property>.. <Property Class="Text" GUID="{A72CE405-5B27-44BF-87B3-DC79D42E3097}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">OpenJobEx</Property>.. <Property Class="Number" GUID="{835D8822-F0BA-4221-BAED-7A0EA304E2DE}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">35</Property>.. <Property Class="Text" GUID="{74AC5A8E-4B19-4D55-83BE-08E61A0604D0}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{A706B5FF-E5B1-494A-9F0D-12824DD26A57}</Property>.. <Property Class="Memo" GUID="{3EF57E6E-C20C-4D34-BB0B-688A8A9665A5}" Name="Form Layout" systemhidden="True" O

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OpenJobEx\is-3GC1U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (585), with CRLF line terminators
Category:	dropped
Size (bytes):	5351
Entropy (8bit):	5.446241884061012
Encrypted:	false
SSDEEP:	96:VhCnYqWShKWsN9WEAFddzyeewezR3F3FIA6LctD2fys:jkfpoNQEAtzyeewezR3JF9ZKys
MD5:	34DE35ED480F20F12062686706D685A5
SHA1:	57CEA50047BA71FDE8D621B694282C645C2CAC91
SHA-256:	799023B1E0F6E5C84ACE9456790E296092031D32F697F6263B7D9032A8CF9F7E
SHA-512:	F0C2F1D5A3E0248BBEA09D92B22B786FE23B71E1B804CCF28B1D67C2ABF082DD48031888DC43721D260CC5B7307452B2D3B1357230432945C6AF3E73EF8116DA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OpenJobEx" GUID="{A706B5FF-E5B1-494A-9F0D-12824DD26A57}">.. <Properties>.. <Property Class="Type" GUID="{29B547AE-919B-413D-B460-7346D79C08DB}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Procedure</Property>.. <Property Class="Text" GUID="{A72CE405-5B27-44BF-87B3-DC79D42E3097}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">OpenJobEx</Property>.. <Property Class="Number" GUID="{835D8822-F0BA-4221-BAED-7A0EA304E2DE}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">35</Property>.. <Property Class="Text" GUID="{74AC5A8E-4B19-4D55-83BE-08E61A0604D0}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{A706B5FF-E5B1-494A-9F0D-12824DD26A57}</Property>.. <Property Class="Memo" GUID="{3EF57E6E-C20C-4D34-BB0B-688A8A9665A5}" Name="Form Layout" systemhidden="True" O

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OpenJob\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (728), with CRLF line terminators
Category:	dropped
Size (bytes):	6625
Entropy (8bit):	5.3777017528598
Encrypted:	false
SSDEEP:	96:kkiG9JLWF5Ui9v8g0FmIyXfFddSoeewe8GFleYU7eAFddRa:kkix9UGPtSoeewe8GjeYU7eAtRa
MD5:	A8F9C8AE7632DB49C687E70EEEB0EFB5
SHA1:	F39E0EBD507F0382B8CEFB20EFB44C801DB80079
SHA-256:	94707841D0C80134D590A208BCE44292DA8CFE4003151DC3FE43B375EB143E2C
SHA-512:	770A05A677E833B7667C7A8BCEA6F513D12F1B2D19360959F6173B8FB09323C6A6F95563D582761A84664832E502C46C19535DCBC6362BF2B697AF1C5BC94C07
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OpenJob" GUID="{0B470C3F-71A1-4EA0-BBDC-01CA315004B4}">.. <Properties>.. <Property Class="Type" GUID="{9C8743F3-0D5B-4661-8BBD-8115AE9C7F05}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{9F0770B8-8497-4D6E-A370-EA5400FED279}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">OpenJob</Property>.. <Property Class="Number" GUID="{64B757BC-3284-42E0-840E-330AE439C555}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">34</Property>.. <Property Class="Text" GUID="{AFF4CAAC-3D0D-4610-934D-29853302FD27}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{0B470C3F-71A1-4EA0-BBDC-01CA315004B4}</Property>.. <Property Class="Memo" GUID="{1F4F3656-3C2B-490F-AF6E-817B12ABE191}" Name="Form Layout" systemhidden="True" OrderI

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\OpenJob\is-FTL30.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (728), with CRLF line terminators
Category:	dropped
Size (bytes):	6625
Entropy (8bit):	5.3777017528598
Encrypted:	false
SSDEEP:	96:kkiG9JLWF5Ui9v8g0FmIyXfFddSoeewe8GFleYU7eAFddRa:kkix9UGPtSoeewe8GjeYU7eAtRa
MD5:	A8F9C8AE7632DB49C687E70EEEB0EFB5
SHA1:	F39E0EBD507F0382B8CEFB20EFB44C801DB80079
SHA-256:	94707841D0C80134D590A208BCE44292DA8CFE4003151DC3FE43B375EB143E2C
SHA-512:	770A05A677E833B7667C7A8BCEA6F513D12F1B2D19360959F6173B8FB09323C6A6F95563D582761A84664832E502C46C19535DCBC6362BF2B697AF1C5BC94C07
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="OpenJob" GUID="{0B470C3F-71A1-4EA0-BBDC-01CA315004B4}">.. <Properties>.. <Property Class="Type" GUID="{9C8743F3-0D5B-4661-8BBD-8115AE9C7F05}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{9F0770B8-8497-4D6E-A370-EA5400FED279}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">OpenJob</Property>.. <Property Class="Number" GUID="{64B757BC-3284-42E0-840E-330AE439C555}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">34</Property>.. <Property Class="Text" GUID="{AFF4CAAC-3D0D-4610-934D-29853302FD27}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{0B470C3F-71A1-4EA0-BBDC-01CA315004B4}</Property>.. <Property Class="Memo" GUID="{1F4F3656-3C2B-490F-AF6E-817B12ABE191}" Name="Form Layout" systemhidden="True" OrderI

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\PointCount\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (700), with CRLF line terminators
Category:	dropped
Size (bytes):	3777
Entropy (8bit):	5.517818702912116
Encrypted:	false
SSDEEP:	48:cMmHadORzMNiTDYD5anK87SZ09lJ0ZaihcnEmPW6vFgiEvDkvtVvD:B2adYMNiTDWFbaihcnE1YFleaHD
MD5:	059E27D6CCAE586F4F9A9AE5FFA68B3B
SHA1:	CAF2501145EE3DCB321CA71BC8EA9594AD35D416
SHA-256:	A30E5E72CC707CC63EB90B736E11037751F1B643F7A2595BDC3D59CC3F146F4B
SHA-512:	BA691196E6C40F2597B79DFCA31F80FAC8F3B4E6CD03A07364083C0B3D1D16A35B646C51EC9D536CF88E918C95ADAA2CD0590B25687E54801EA0BA3F65418F02
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="PointCount" GUID="{84C303FA-D9E6-451C-8115-7A8E6ED8BDE0}">.. <Properties>.. <Property Class="Type" GUID="{5739B99C-3266-424C-8B2B-1079971781A8}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{779B4736-2CA0-47B5-8164-43DB5FF033C0}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">PointCount</Property>.. <Property Class="Number" GUID="{9FF04526-7E76-4B2D-948F-BABD64D69EAF}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">36</Property>.. <Property Class="Text" GUID="{0FBBFF65-249D-47D7-A81D-E6B0FD545BA1}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{84C303FA-D9E6-451C-8115-7A8E6ED8BDE0}</Property>.. <Property Class="Memo" GUID="{95C784B0-2AB4-44E2-8B69-F700DC99F136}" Name="Form Layout" systemhidden="True"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\PointCount\is-RHDGU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (700), with CRLF line terminators
Category:	dropped
Size (bytes):	3777
Entropy (8bit):	5.517818702912116
Encrypted:	false
SSDEEP:	48:cMmHadORzMNiTDYD5anK87SZ09lJ0ZaihcnEmPW6vFgiEvDkvtVvD:B2adYMNiTDWFbaihcnE1YFleaHD
MD5:	059E27D6CCAE586F4F9A9AE5FFA68B3B
SHA1:	CAF2501145EE3DCB321CA71BC8EA9594AD35D416
SHA-256:	A30E5E72CC707CC63EB90B736E11037751F1B643F7A2595BDC3D59CC3F146F4B
SHA-512:	BA691196E6C40F2597B79DFCA31F80FAC8F3B4E6CD03A07364083C0B3D1D16A35B646C51EC9D536CF88E918C95ADAA2CD0590B25687E54801EA0BA3F65418F02
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="PointCount" GUID="{84C303FA-D9E6-451C-8115-7A8E6ED8BDE0}">.. <Properties>.. <Property Class="Type" GUID="{5739B99C-3266-424C-8B2B-1079971781A8}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{779B4736-2CA0-47B5-8164-43DB5FF033C0}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">PointCount</Property>.. <Property Class="Number" GUID="{9FF04526-7E76-4B2D-948F-BABD64D69EAF}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">36</Property>.. <Property Class="Text" GUID="{0FBBFF65-249D-47D7-A81D-E6B0FD545BA1}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{84C303FA-D9E6-451C-8115-7A8E6ED8BDE0}</Property>.. <Property Class="Memo" GUID="{95C784B0-2AB4-44E2-8B69-F700DC99F136}" Name="Form Layout" systemhidden="True"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\PostChanges\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (511), with CRLF line terminators
Category:	dropped
Size (bytes):	3163
Entropy (8bit):	5.537937207139494
Encrypted:	false
SSDEEP:	48:ciqu9VHV4fIYD5anKMumPZ09lJMLh1d14/6EvDqvWObVRbjcY15:xjj1WIWshLo/6eMPbVRbjt
MD5:	5D3ED2337DF546E7706A9CC12C53D82D
SHA1:	DE003BD96D9794F2B794C7F1E9C0D7785853167E
SHA-256:	D2C54984D6D94B57905B1C74C0F736BBB06F4C923DB3054D275B5DFBD1813A0D
SHA-512:	9DCF760A694852FEC35C6717981204EC6BA2370B27468CC32345ABB058F56D88EBEB9D0D6FD70794DF158A03947DB4A3D1668E61CF12A1A192451458CA063E30
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="PostChanges" GUID="{14AB60C8-84BA-434D-A83F-2ACA5585968A}">.. <Properties>.. <Property Class="Type" GUID="{7241E55B-3A80-4800-B743-57D88F0E5937}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Procedure</Property>.. <Property Class="Text" GUID="{24E8CA1E-49C5-45B9-BAF7-D27E12C43B62}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">PostChanges</Property>.. <Property Class="Number" GUID="{CF6C269B-8D6E-4281-AF50-1838427336BE}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">37</Property>.. <Property Class="Text" GUID="{C1A677E3-6C77-4E43-9749-1D010CE43269}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{14AB60C8-84BA-434D-A83F-2ACA5585968A}</Property>.. <Property Class="Memo" GUID="{67D0CEC6-A9FC-4F69-B7A4-EEBAEA5B6A91}" Name="Form Layout" systemhidden="Tru

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\PostChanges\is-94616.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (511), with CRLF line terminators
Category:	dropped
Size (bytes):	3163
Entropy (8bit):	5.537937207139494
Encrypted:	false
SSDEEP:	48:ciqu9VHV4fIYD5anKMumPZ09lJMLh1d14/6EvDqvWObVRbjcY15:xjj1WIWshLo/6eMPbVRbjt
MD5:	5D3ED2337DF546E7706A9CC12C53D82D
SHA1:	DE003BD96D9794F2B794C7F1E9C0D7785853167E
SHA-256:	D2C54984D6D94B57905B1C74C0F736BBB06F4C923DB3054D275B5DFBD1813A0D
SHA-512:	9DCF760A694852FEC35C6717981204EC6BA2370B27468CC32345ABB058F56D88EBEB9D0D6FD70794DF158A03947DB4A3D1668E61CF12A1A192451458CA063E30
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="PostChanges" GUID="{14AB60C8-84BA-434D-A83F-2ACA5585968A}">.. <Properties>.. <Property Class="Type" GUID="{7241E55B-3A80-4800-B743-57D88F0E5937}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Procedure</Property>.. <Property Class="Text" GUID="{24E8CA1E-49C5-45B9-BAF7-D27E12C43B62}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">PostChanges</Property>.. <Property Class="Number" GUID="{CF6C269B-8D6E-4281-AF50-1838427336BE}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">37</Property>.. <Property Class="Text" GUID="{C1A677E3-6C77-4E43-9749-1D010CE43269}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{14AB60C8-84BA-434D-A83F-2ACA5585968A}</Property>.. <Property Class="Memo" GUID="{67D0CEC6-A9FC-4F69-B7A4-EEBAEA5B6A91}" Name="Form Layout" systemhidden="Tru

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\Root\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1067), with CRLF line terminators
Category:	dropped
Size (bytes):	4063
Entropy (8bit):	5.498216566558133
Encrypted:	false
SSDEEP:	96:hg0YvNIsViCUWFKjCUihcxlRZNLAFletiGI2a:hgBxv9h6vZxAjetiGI2a
MD5:	2B7808CA76F534B0201824CAC176B7BF
SHA1:	D759D0701CB15E3D7369F089FAFD6D2D5AE163D5
SHA-256:	B6EFEE27AABE00698C34117662076E30090F4BBBF7AF990D70821FED1795D946
SHA-512:	CA909881F7C8210977D95BF31ADC1B722C61D5AF5AD5C6E68E86E23C9947565016A82D2D2CF9E938927BBBBC1E7F04FAFC9D020CB90E8714BBD0A52CA6D3A994
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Root" GUID="{C43B0E9C-AB66-458E-B675-63E35B1715C7}">.. <Properties>.. <Property Class="Type" GUID="{7A8EB507-9AD6-4993-A38B-6C23C8FA0711}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{3B100C17-8CA6-494C-A80E-3AC8FD70EF74}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">Root</Property>.. <Property Class="Number" GUID="{5447AF37-64C5-44C2-8688-4D89B4EFCD5B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">38</Property>.. <Property Class="Text" GUID="{6B455915-9738-43FA-9101-86F70FD9D7AD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{C43B0E9C-AB66-458E-B675-63E35B1715C7}</Property>.. <Property Class="Memo" GUID="{BB002563-9DEF-4798-B789-0307FAD6CC4D}" Name="Form Layout" systemhidden="True" OrderIndex="

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\Root\is-2IUCK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1067), with CRLF line terminators
Category:	dropped
Size (bytes):	4063
Entropy (8bit):	5.498216566558133
Encrypted:	false
SSDEEP:	96:hg0YvNIsViCUWFKjCUihcxlRZNLAFletiGI2a:hgBxv9h6vZxAjetiGI2a
MD5:	2B7808CA76F534B0201824CAC176B7BF
SHA1:	D759D0701CB15E3D7369F089FAFD6D2D5AE163D5
SHA-256:	B6EFEE27AABE00698C34117662076E30090F4BBBF7AF990D70821FED1795D946
SHA-512:	CA909881F7C8210977D95BF31ADC1B722C61D5AF5AD5C6E68E86E23C9947565016A82D2D2CF9E938927BBBBC1E7F04FAFC9D020CB90E8714BBD0A52CA6D3A994
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Root" GUID="{C43B0E9C-AB66-458E-B675-63E35B1715C7}">.. <Properties>.. <Property Class="Type" GUID="{7A8EB507-9AD6-4993-A38B-6C23C8FA0711}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{3B100C17-8CA6-494C-A80E-3AC8FD70EF74}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">Root</Property>.. <Property Class="Number" GUID="{5447AF37-64C5-44C2-8688-4D89B4EFCD5B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">38</Property>.. <Property Class="Text" GUID="{6B455915-9738-43FA-9101-86F70FD9D7AD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{C43B0E9C-AB66-458E-B675-63E35B1715C7}</Property>.. <Property Class="Memo" GUID="{BB002563-9DEF-4798-B789-0307FAD6CC4D}" Name="Form Layout" systemhidden="True" OrderIndex="

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\SaveScreenShot\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (814), with CRLF line terminators
Category:	dropped
Size (bytes):	4538
Entropy (8bit):	5.483127974368667
Encrypted:	false
SSDEEP:	96:3UpRYWSWJEnbvgpD9r8DFle1EfEXXKu0gQ:kYuEnbYpD9r8Dje1EfEqu5Q
MD5:	A36635A4D7E19CEEE916F8A62285EF88
SHA1:	921F278D77AF091951AE58594ED86BA180B4730B
SHA-256:	194EDBA9CFB11487BF5F913965D95D4F80BFDF3E7F916471EAE731EF508455EC
SHA-512:	265D09564E885B53BBAC73F0606E350AA277F2E8E0DFB1556F3FA6CC463EBC88CD101C197153168C4F0E0AEA94898BB34979F26DCDE5691DABB5BBBE1F5B3E35
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SaveScreenShot" GUID="{2AB67C35-06F0-4D24-8CCD-3C21A089DACA}">.. <Properties>.. <Property Class="Text" GUID="{D9311472-E7B8-44BE-915F-97006BAB6A6C}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">SaveScreenShot</Property>.. <Property Class="Type" GUID="{460E0970-8DB7-4BEA-96C2-60FF2DF1C829}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{61DC8B0F-2623-4BB8-8F80-FFBB88660C98}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">38.5</Property>.. <Property Class="Memo" GUID="{C5D33B08-692E-4110-A7A5-71C3245B0E35}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order=&quot

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\SaveScreenShot\is-9JL91.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (814), with CRLF line terminators
Category:	dropped
Size (bytes):	4538
Entropy (8bit):	5.483127974368667
Encrypted:	false
SSDEEP:	96:3UpRYWSWJEnbvgpD9r8DFle1EfEXXKu0gQ:kYuEnbYpD9r8Dje1EfEqu5Q
MD5:	A36635A4D7E19CEEE916F8A62285EF88
SHA1:	921F278D77AF091951AE58594ED86BA180B4730B
SHA-256:	194EDBA9CFB11487BF5F913965D95D4F80BFDF3E7F916471EAE731EF508455EC
SHA-512:	265D09564E885B53BBAC73F0606E350AA277F2E8E0DFB1556F3FA6CC463EBC88CD101C197153168C4F0E0AEA94898BB34979F26DCDE5691DABB5BBBE1F5B3E35
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SaveScreenShot" GUID="{2AB67C35-06F0-4D24-8CCD-3C21A089DACA}">.. <Properties>.. <Property Class="Text" GUID="{D9311472-E7B8-44BE-915F-97006BAB6A6C}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">SaveScreenShot</Property>.. <Property Class="Type" GUID="{460E0970-8DB7-4BEA-96C2-60FF2DF1C829}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{61DC8B0F-2623-4BB8-8F80-FFBB88660C98}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">38.5</Property>.. <Property Class="Memo" GUID="{C5D33B08-692E-4110-A7A5-71C3245B0E35}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order=&quot

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\SelectItemDialog\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1103), with CRLF line terminators
Category:	dropped
Size (bytes):	5579
Entropy (8bit):	5.393289980608809
Encrypted:	false
SSDEEP:	96:5+yB2mlnIv99hOFAgWHCa3h3Fr3AZ2V1yI:5+ui99hOSgWHCa3h3Fr3Ay1yI
MD5:	D4E5CD35C0123572F0F3FBFC73C2C839
SHA1:	BEF54193A2D57632F15FEECE86775EDC9AC2987C
SHA-256:	CAED39F9A4E8D0727DF50F31190B5A9085D84CAA285185BDD260F88AF0C3C140
SHA-512:	C461D876AA63B08036BCD516EC1C32DA9E1A9601F25FD68B7515757B19BDC3A3F1F16918CCDE66EF5B06D0D82F83A59E37151516F3E729AC48CE451B71ACCFE2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SelectItemDialog" GUID="{1B1DC6D9-F289-4C78-83AB-9754671928FD}">.. <Properties>.. <Property Class="Text" GUID="{D4025B1E-04DF-4634-8804-BC4D714C6CB7}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">SelectItemDialog</Property>.. <Property Class="Type" GUID="{4D942393-FE3F-42C6-B3B4-0F2C7FBCD5EA}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{204A5A81-3EC3-4E63-9987-286A32FE6A51}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">41</Property>.. <Property Class="Memo" GUID="{70FDB366-41FC-4212-8539-102A1EFADBE8}" Name="Form Layout" systemhidden="True" OrderIndex="4" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order=&qu

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\SelectItemDialog\is-8G5EM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1103), with CRLF line terminators
Category:	dropped
Size (bytes):	5579
Entropy (8bit):	5.393289980608809
Encrypted:	false
SSDEEP:	96:5+yB2mlnIv99hOFAgWHCa3h3Fr3AZ2V1yI:5+ui99hOSgWHCa3h3Fr3Ay1yI
MD5:	D4E5CD35C0123572F0F3FBFC73C2C839
SHA1:	BEF54193A2D57632F15FEECE86775EDC9AC2987C
SHA-256:	CAED39F9A4E8D0727DF50F31190B5A9085D84CAA285185BDD260F88AF0C3C140
SHA-512:	C461D876AA63B08036BCD516EC1C32DA9E1A9601F25FD68B7515757B19BDC3A3F1F16918CCDE66EF5B06D0D82F83A59E37151516F3E729AC48CE451B71ACCFE2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SelectItemDialog" GUID="{1B1DC6D9-F289-4C78-83AB-9754671928FD}">.. <Properties>.. <Property Class="Text" GUID="{D4025B1E-04DF-4634-8804-BC4D714C6CB7}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">SelectItemDialog</Property>.. <Property Class="Type" GUID="{4D942393-FE3F-42C6-B3B4-0F2C7FBCD5EA}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{204A5A81-3EC3-4E63-9987-286A32FE6A51}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">41</Property>.. <Property Class="Memo" GUID="{70FDB366-41FC-4212-8539-102A1EFADBE8}" Name="Form Layout" systemhidden="True" OrderIndex="4" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order=&qu

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\SelectedItem\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (987), with CRLF line terminators
Category:	dropped
Size (bytes):	5459
Entropy (8bit):	5.390067233843757
Encrypted:	false
SSDEEP:	96:KrdHZhkXyWFmporjir2LUbe3B4eHFgFleHYgFxa:KVK5pr+r2V3B4eHFgjeHYgPa
MD5:	D58A642DBFA2F799C1BF4698097E7334
SHA1:	C34D13C60799E13BD285D29AEC98303F9B9FFBDE
SHA-256:	2404B3C9F9D0E82193AA36BA6ED5D056F2E4FED29EF26EB0A7016DB3DC223D53
SHA-512:	746D37131FE7EB0641786C560D3D70853A8A81A327DB3287A4EB6DEA58521F53F7B7EEEFABB7AD8B76ADA3C1E0BD8393E560A2A1F47659C7452B38AB84AA61B6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SelectedItem" GUID="{5C1EFBAC-5130-4B6B-A968-DF0BF39C56A5}">.. <Properties>.. <Property Class="Type" GUID="{58C0F2F8-F4A0-4B9D-975A-AC2C279EAF2F}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{E4BD7293-5E8B-4439-BED4-C1777AEA4300}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SelectedItem</Property>.. <Property Class="Number" GUID="{909DCA8E-D2EC-4B8C-B3F0-9E73C4BFA190}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">39</Property>.. <Property Class="Text" GUID="{8631A691-F93F-4315-AECF-46A33FDA28A6}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{5C1EFBAC-5130-4B6B-A968-DF0BF39C56A5}</Property>.. <Property Class="Memo" GUID="{17585D03-5C6A-41E7-92F2-4BB029697335}" Name="Form Layout" systemhidden="Tr

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\SelectedItem\is-7L17B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (987), with CRLF line terminators
Category:	dropped
Size (bytes):	5459
Entropy (8bit):	5.390067233843757
Encrypted:	false
SSDEEP:	96:KrdHZhkXyWFmporjir2LUbe3B4eHFgFleHYgFxa:KVK5pr+r2V3B4eHFgjeHYgPa
MD5:	D58A642DBFA2F799C1BF4698097E7334
SHA1:	C34D13C60799E13BD285D29AEC98303F9B9FFBDE
SHA-256:	2404B3C9F9D0E82193AA36BA6ED5D056F2E4FED29EF26EB0A7016DB3DC223D53
SHA-512:	746D37131FE7EB0641786C560D3D70853A8A81A327DB3287A4EB6DEA58521F53F7B7EEEFABB7AD8B76ADA3C1E0BD8393E560A2A1F47659C7452B38AB84AA61B6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SelectedItem" GUID="{5C1EFBAC-5130-4B6B-A968-DF0BF39C56A5}">.. <Properties>.. <Property Class="Type" GUID="{58C0F2F8-F4A0-4B9D-975A-AC2C279EAF2F}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{E4BD7293-5E8B-4439-BED4-C1777AEA4300}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SelectedItem</Property>.. <Property Class="Number" GUID="{909DCA8E-D2EC-4B8C-B3F0-9E73C4BFA190}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">39</Property>.. <Property Class="Text" GUID="{8631A691-F93F-4315-AECF-46A33FDA28A6}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{5C1EFBAC-5130-4B6B-A968-DF0BF39C56A5}</Property>.. <Property Class="Memo" GUID="{17585D03-5C6A-41E7-92F2-4BB029697335}" Name="Form Layout" systemhidden="Tr

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\SelectedPage\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (987), with CRLF line terminators
Category:	dropped
Size (bytes):	5429
Entropy (8bit):	5.3873378947412345
Encrypted:	false
SSDEEP:	96:Hl13vAqWFTviryV/HI+1e3B4e3FgFle3YgFpa:HQGryVq3B4e3Fgje3YgDa
MD5:	28F79CD6507320A90CAD12AD1C066594
SHA1:	5DA11B9B1140B2FB419620C33C8F8E9CD1AC0AD8
SHA-256:	EEB00C2695F4C69C256E52E2EB054AF1520E8839C7777C82D4F3287D80191B6D
SHA-512:	6C116F86142D1D371250B2F6D2F70570EAF884B1AB0ED1CC5C2885AB4C4078D1D42A1B455AE2E3DB0F2E9F3593216556BE479B8A3F2AD8926651B95741FB39E8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SelectedPage" GUID="{0EE6061B-91F8-4E43-83EC-CAAD44F3384A}">.. <Properties>.. <Property Class="Type" GUID="{650AFA3B-BC53-4052-B3BA-04C2C7C3B4CC}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{28167A08-A844-4B0A-AAA3-8EDFDCDCB86C}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SelectedPage</Property>.. <Property Class="Number" GUID="{A384CA3F-E7C0-4AF9-B060-5152DC49A8C1}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">40</Property>.. <Property Class="Text" GUID="{78830034-D809-468C-85D2-83D3B10D20AB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{0EE6061B-91F8-4E43-83EC-CAAD44F3384A}</Property>.. <Property Class="Memo" GUID="{ED0F88AB-6478-465B-BD84-ED21F5BFA014}" Name="Form Layout" systemhidden="Tr

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\SelectedPage\is-I94G7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (987), with CRLF line terminators
Category:	dropped
Size (bytes):	5429
Entropy (8bit):	5.3873378947412345
Encrypted:	false
SSDEEP:	96:Hl13vAqWFTviryV/HI+1e3B4e3FgFle3YgFpa:HQGryVq3B4e3Fgje3YgDa
MD5:	28F79CD6507320A90CAD12AD1C066594
SHA1:	5DA11B9B1140B2FB419620C33C8F8E9CD1AC0AD8
SHA-256:	EEB00C2695F4C69C256E52E2EB054AF1520E8839C7777C82D4F3287D80191B6D
SHA-512:	6C116F86142D1D371250B2F6D2F70570EAF884B1AB0ED1CC5C2885AB4C4078D1D42A1B455AE2E3DB0F2E9F3593216556BE479B8A3F2AD8926651B95741FB39E8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SelectedPage" GUID="{0EE6061B-91F8-4E43-83EC-CAAD44F3384A}">.. <Properties>.. <Property Class="Type" GUID="{650AFA3B-BC53-4052-B3BA-04C2C7C3B4CC}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{28167A08-A844-4B0A-AAA3-8EDFDCDCB86C}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SelectedPage</Property>.. <Property Class="Number" GUID="{A384CA3F-E7C0-4AF9-B060-5152DC49A8C1}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">40</Property>.. <Property Class="Text" GUID="{78830034-D809-468C-85D2-83D3B10D20AB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{0EE6061B-91F8-4E43-83EC-CAAD44F3384A}</Property>.. <Property Class="Memo" GUID="{ED0F88AB-6478-465B-BD84-ED21F5BFA014}" Name="Form Layout" systemhidden="Tr

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\SelectionList\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1848), with CRLF line terminators
Category:	dropped
Size (bytes):	7209
Entropy (8bit):	5.245644658487558
Encrypted:	false
SSDEEP:	192:6aHUSPXd0GxJUcAjQk7hlJURlXhlacqHrMaK8:yt
MD5:	C6415389926A5B7F1CE9F100C632B401
SHA1:	B1AA659DEA4E260CB61971D45B033CD0B1DC7EB3
SHA-256:	2EB5E49DF242DDFB948EE08E98C1A014D3AAE4D24278EA8EA2AE1D96A7F7973E
SHA-512:	42D9A2CA44F293E71C4B98157A1781979FD17DBC7D9E6B7D2865C264A1D5FA2DA38D1CA23AECAAA6FA5238CB74E09A403495A0BB411593DE9C2C68ADD86D695F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SelectionList" GUID="{5FC97424-9706-4D44-BAFD-E16AECF4680C}">.. <Properties>.. <Property Class="Text" GUID="{31268883-1A5C-407B-AF74-0AA221F3B931}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">SelectionList</Property>.. <Property Class="Type" GUID="{90C2D6A2-4405-4426-A08C-4227945F15DD}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{22473D4D-E377-47C7-879E-52458A077459}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">42</Property>.. <Property Class="Memo" GUID="{A945299D-AEB9-44FE-89AA-B8CC4DFD6EB4}" Name="Form Layout" systemhidden="True" OrderIndex="4" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1&q

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\SelectionList\is-Q92IO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1848), with CRLF line terminators
Category:	dropped
Size (bytes):	7209
Entropy (8bit):	5.245644658487558
Encrypted:	false
SSDEEP:	192:6aHUSPXd0GxJUcAjQk7hlJURlXhlacqHrMaK8:yt
MD5:	C6415389926A5B7F1CE9F100C632B401
SHA1:	B1AA659DEA4E260CB61971D45B033CD0B1DC7EB3
SHA-256:	2EB5E49DF242DDFB948EE08E98C1A014D3AAE4D24278EA8EA2AE1D96A7F7973E
SHA-512:	42D9A2CA44F293E71C4B98157A1781979FD17DBC7D9E6B7D2865C264A1D5FA2DA38D1CA23AECAAA6FA5238CB74E09A403495A0BB411593DE9C2C68ADD86D695F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SelectionList" GUID="{5FC97424-9706-4D44-BAFD-E16AECF4680C}">.. <Properties>.. <Property Class="Text" GUID="{31268883-1A5C-407B-AF74-0AA221F3B931}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">SelectionList</Property>.. <Property Class="Type" GUID="{90C2D6A2-4405-4426-A08C-4227945F15DD}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{22473D4D-E377-47C7-879E-52458A077459}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">42</Property>.. <Property Class="Memo" GUID="{A945299D-AEB9-44FE-89AA-B8CC4DFD6EB4}" Name="Form Layout" systemhidden="True" OrderIndex="4" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1&q

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\SetPoint\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (899), with CRLF line terminators
Category:	dropped
Size (bytes):	7023
Entropy (8bit):	5.30252229596568
Encrypted:	false
SSDEEP:	192:MEJ7jeaH/eNHNzNYdjeaHKWoegeAtXXZNPxu:HJkXM
MD5:	B2A84AE071D0071C8932FFB015F1830D
SHA1:	607B8D90F81D7D368AC12395F9AAAFD98EA1BEAB
SHA-256:	D94095FA68FE998B96A59BC9A44097E5E51716E930793D36BBCA963A5C35508C
SHA-512:	901C54D424D30C9E9763D4361365E7A618AEB72B33D0D416F7336931D54290948C6E7331D8F4A5A45C111487A07C289848099CD5F853BB7599276746A1B42231
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SetPoint" GUID="{3D889DB6-F3C7-4008-8936-171458CAD980}">.. <Properties>.. <Property Class="Type" GUID="{172F8BCC-299C-4C2D-BC8B-1D5F87E3DC67}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Procedure</Property>.. <Property Class="Text" GUID="{D5B56E06-6F69-45FA-8548-3504EC98A162}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SetPoint</Property>.. <Property Class="Number" GUID="{049E21A0-5BAA-4815-9503-CD2CE228561C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">43</Property>.. <Property Class="Text" GUID="{444AEE00-4574-4150-844E-572293A7098F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{3D889DB6-F3C7-4008-8936-171458CAD980}</Property>.. <Property Class="Memo" GUID="{54FE69B9-0519-44BD-B165-66153310C22A}" Name="Form Layout" systemhidden="True" Ord

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\SetPoint\is-UFQ6L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (899), with CRLF line terminators
Category:	dropped
Size (bytes):	7023
Entropy (8bit):	5.30252229596568
Encrypted:	false
SSDEEP:	192:MEJ7jeaH/eNHNzNYdjeaHKWoegeAtXXZNPxu:HJkXM
MD5:	B2A84AE071D0071C8932FFB015F1830D
SHA1:	607B8D90F81D7D368AC12395F9AAAFD98EA1BEAB
SHA-256:	D94095FA68FE998B96A59BC9A44097E5E51716E930793D36BBCA963A5C35508C
SHA-512:	901C54D424D30C9E9763D4361365E7A618AEB72B33D0D416F7336931D54290948C6E7331D8F4A5A45C111487A07C289848099CD5F853BB7599276746A1B42231
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SetPoint" GUID="{3D889DB6-F3C7-4008-8936-171458CAD980}">.. <Properties>.. <Property Class="Type" GUID="{172F8BCC-299C-4C2D-BC8B-1D5F87E3DC67}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Procedure</Property>.. <Property Class="Text" GUID="{D5B56E06-6F69-45FA-8548-3504EC98A162}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SetPoint</Property>.. <Property Class="Number" GUID="{049E21A0-5BAA-4815-9503-CD2CE228561C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">43</Property>.. <Property Class="Text" GUID="{444AEE00-4574-4150-844E-572293A7098F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{3D889DB6-F3C7-4008-8936-171458CAD980}</Property>.. <Property Class="Memo" GUID="{54FE69B9-0519-44BD-B165-66153310C22A}" Name="Form Layout" systemhidden="True" Ord

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\SetPropertyFormula\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (837), with CRLF line terminators
Category:	dropped
Size (bytes):	5247
Entropy (8bit):	5.404923253269859
Encrypted:	false
SSDEEP:	96:NRDnujRWskZZJ7FddcVeMHOkEF8kjVt0XJ4:zW4ZZtcVeMHOkEK4t0Xe
MD5:	9387FEA788ED31573E9A767D88CA761F
SHA1:	F9C970B9256996D6DC6A870B8C433602B775D95D
SHA-256:	76BEB15EB3A57365B41DA506A7002152F8DD5982B4B0821A73CB544BF52E0B83
SHA-512:	DAFC02A23FC166D602A749C627817ACD7CF514797141E1844786BECCC544A54B0B6CEEB60706808DB1766066640391AB1AB43120B4FCDD1C1B398B038E89845C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SetPropertyFormula" GUID="{E05EB74A-F976-44C8-ACC7-D5565F797595}">.. <Properties>.. <Property Class="Type" GUID="{396D4252-104F-4814-9A3E-93B326A58B5F}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Procedure</Property>.. <Property Class="Text" GUID="{25F39619-0535-4F4D-B2D3-1243448D71EF}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SetPropertyFormula</Property>.. <Property Class="Number" GUID="{FDC09376-1502-4435-8406-9BCFCEE7807D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">44</Property>.. <Property Class="Text" GUID="{F08C4F97-9F91-437C-8654-1E0356928D1B}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{E05EB74A-F976-44C8-ACC7-D5565F797595}</Property>.. <Property Class="Memo" GUID="{515DF0C1-A238-451E-AF60-09F921DEB13B}" Name="Form Layout" sys

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\SetPropertyFormula\is-DF9RM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (837), with CRLF line terminators
Category:	dropped
Size (bytes):	5247
Entropy (8bit):	5.404923253269859
Encrypted:	false
SSDEEP:	96:NRDnujRWskZZJ7FddcVeMHOkEF8kjVt0XJ4:zW4ZZtcVeMHOkEK4t0Xe
MD5:	9387FEA788ED31573E9A767D88CA761F
SHA1:	F9C970B9256996D6DC6A870B8C433602B775D95D
SHA-256:	76BEB15EB3A57365B41DA506A7002152F8DD5982B4B0821A73CB544BF52E0B83
SHA-512:	DAFC02A23FC166D602A749C627817ACD7CF514797141E1844786BECCC544A54B0B6CEEB60706808DB1766066640391AB1AB43120B4FCDD1C1B398B038E89845C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SetPropertyFormula" GUID="{E05EB74A-F976-44C8-ACC7-D5565F797595}">.. <Properties>.. <Property Class="Type" GUID="{396D4252-104F-4814-9A3E-93B326A58B5F}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Procedure</Property>.. <Property Class="Text" GUID="{25F39619-0535-4F4D-B2D3-1243448D71EF}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">SetPropertyFormula</Property>.. <Property Class="Number" GUID="{FDC09376-1502-4435-8406-9BCFCEE7807D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">44</Property>.. <Property Class="Text" GUID="{F08C4F97-9F91-437C-8654-1E0356928D1B}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{E05EB74A-F976-44C8-ACC7-D5565F797595}</Property>.. <Property Class="Memo" GUID="{515DF0C1-A238-451E-AF60-09F921DEB13B}" Name="Form Layout" sys

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\SetSelected\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (726), with CRLF line terminators
Category:	dropped
Size (bytes):	3660
Entropy (8bit):	5.542845799807321
Encrypted:	false
SSDEEP:	48:cPx61ytc9YD51NOrl8E4nk8mD/wb+Zb6CEvDovtivRGgkvjob/WZb6pbwC:+7c9W9NoQ+x6Ce+Ocdjobux6Z/
MD5:	CE5272A659B3659629703D2518E8DFDD
SHA1:	8718FA0E15118F91F25CE99C261E850976451399
SHA-256:	A4CA9EFF77D631C32C9581C8BBD092B55556644A004AC9743C70CD962961C119
SHA-512:	216869F623472CB387648A34F33F1A70614CCD1AD3F70E89089E4D71E36614E7667AA3BE9096D8DE5E0F5313DFE89AC65734DB4271FF08B94252AFEA0E6B210F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SetSelected" GUID="{91D83264-0292-48DC-974C-CDB54B13BBB2}">.. <Properties>.. <Property Class="Text" GUID="{7BC78DC8-53CD-45C3-B210-903F9FBA37DE}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">SetSelected</Property>.. <Property Class="Type" GUID="{1E3EC91C-F1FB-475E-8002-F995CF144097}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{E7D59432-95F4-49BC-A46C-42DF1F47E9E6}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">45</Property>.. <Property Class="Memo" GUID="{AB96217A-4FF9-44B9-A003-9375CBD5152F}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\SetSelected\is-MO7N5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (726), with CRLF line terminators
Category:	dropped
Size (bytes):	3660
Entropy (8bit):	5.542845799807321
Encrypted:	false
SSDEEP:	48:cPx61ytc9YD51NOrl8E4nk8mD/wb+Zb6CEvDovtivRGgkvjob/WZb6pbwC:+7c9W9NoQ+x6Ce+Ocdjobux6Z/
MD5:	CE5272A659B3659629703D2518E8DFDD
SHA1:	8718FA0E15118F91F25CE99C261E850976451399
SHA-256:	A4CA9EFF77D631C32C9581C8BBD092B55556644A004AC9743C70CD962961C119
SHA-512:	216869F623472CB387648A34F33F1A70614CCD1AD3F70E89089E4D71E36614E7667AA3BE9096D8DE5E0F5313DFE89AC65734DB4271FF08B94252AFEA0E6B210F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SetSelected" GUID="{91D83264-0292-48DC-974C-CDB54B13BBB2}">.. <Properties>.. <Property Class="Text" GUID="{7BC78DC8-53CD-45C3-B210-903F9FBA37DE}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">SetSelected</Property>.. <Property Class="Type" GUID="{1E3EC91C-F1FB-475E-8002-F995CF144097}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{E7D59432-95F4-49BC-A46C-42DF1F47E9E6}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">45</Property>.. <Property Class="Memo" GUID="{AB96217A-4FF9-44B9-A003-9375CBD5152F}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\SetZoom\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (623), with CRLF line terminators
Category:	dropped
Size (bytes):	4228
Entropy (8bit):	5.496617169550164
Encrypted:	false
SSDEEP:	48:ccWyv9ejdvDYD51NOrl8FqXZmhfgvFGvz8vWEqvFiEvDbvtGvSpvWDKbTx30VBd:zWy1exDW8XZcqGi8we3+UgKXxE7d
MD5:	D90F96BDC529D0857A39F93C38718765
SHA1:	A15354BDD75353B419868F4AFBA48F91E048E9F9
SHA-256:	810E47F42958A4D671F13088938DCCC7EE91003ACCC3A26F4F29418B3F18387B
SHA-512:	DE11048DDC7F6869CE19135F121F589554B72135A6249DB69AE5266DB884A6D1F6DA08B00EE6883D2B43C5C7FC492810FE1D5E4551402A629C89AE480B16E123
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SetZoom" GUID="{CE254FD0-AE8B-4D8D-BD27-5C308169C879}">.. <Properties>.. <Property Class="Text" GUID="{64259C2D-3984-432A-A522-C141A92A6B21}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">SetZoom</Property>.. <Property Class="Type" GUID="{8328E08B-A338-4F34-A387-D9F797A44567}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{5208B8C9-1FD6-47CB-9F06-AA6D2626E4F7}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">45.5</Property>.. <Property Class="Memo" GUID="{733DC1A1-BED3-4896-BAF6-421E35B4EDF7}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/>&

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\SetZoom\is-2OIRM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (623), with CRLF line terminators
Category:	dropped
Size (bytes):	4228
Entropy (8bit):	5.496617169550164
Encrypted:	false
SSDEEP:	48:ccWyv9ejdvDYD51NOrl8FqXZmhfgvFGvz8vWEqvFiEvDbvtGvSpvWDKbTx30VBd:zWy1exDW8XZcqGi8we3+UgKXxE7d
MD5:	D90F96BDC529D0857A39F93C38718765
SHA1:	A15354BDD75353B419868F4AFBA48F91E048E9F9
SHA-256:	810E47F42958A4D671F13088938DCCC7EE91003ACCC3A26F4F29418B3F18387B
SHA-512:	DE11048DDC7F6869CE19135F121F589554B72135A6249DB69AE5266DB884A6D1F6DA08B00EE6883D2B43C5C7FC492810FE1D5E4551402A629C89AE480B16E123
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SetZoom" GUID="{CE254FD0-AE8B-4D8D-BD27-5C308169C879}">.. <Properties>.. <Property Class="Text" GUID="{64259C2D-3984-432A-A522-C141A92A6B21}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">SetZoom</Property>.. <Property Class="Type" GUID="{8328E08B-A338-4F34-A387-D9F797A44567}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{5208B8C9-1FD6-47CB-9F06-AA6D2626E4F7}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">45.5</Property>.. <Property Class="Memo" GUID="{733DC1A1-BED3-4896-BAF6-421E35B4EDF7}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/>&

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\is-77M75.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (646), with CRLF line terminators
Category:	dropped
Size (bytes):	5926
Entropy (8bit):	5.422235286571373
Encrypted:	false
SSDEEP:	96:6PHg/0SJne+bzoo0eSe80FlIVSmFTUB6L+bzoa346rPf:b0Sh8o0eSe80DIVSm5UB78dkf
MD5:	601E078A0C296314D14FF16F9FC447F9
SHA1:	0D2567492444FB9C6D27CEC4826AEA2A082D1503
SHA-256:	8AA4D28B5C50C9C18325D12D8D1050EBF0EB80B21FEA236057FBC5DD31D7403E
SHA-512:	E5AA676256214048FAFF92D20803BF2047C9A436BD40B26F996807F7D2EC1DE0892BED875FF85C9005EFBB7DA96079A88B54B3D412E5C1F37F262B3395589D19
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="IPlanswift" GUID="{1DC326E7-A03A-441E-AD5A-2C1DF1E163AD}">.. <Properties>.. <Property Class="Text" GUID="{85B1026D-E634-4EC9-AC7D-82CD12D789B9}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">IPlanswift</Property>.. <Property Class="Type" GUID="{5BD96935-68CF-4195-B465-B189EFE8660E}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Object</Property>.. <Property Class="Script" GUID="{489AF711-0171-473B-85B6-363305E95A11}" Name="Source Code" input="True" group="Help" OrderIndex="3" DecimalPlaces="" List="cmbList" PluginToExecute="cmbList" ScriptType="Method" ScriptLanguage="Pascal" Parameters="">var.. pc: IPlanSwift;..begin.. pc := createoleobject('Planswift9.Planswift');.. pc.about;.. pc := nil;..end;</Property>.. <Property Class="Memo" GUID="{58B982D4-1501-4088-8904-91FE774236DC}" Name="HTMLSource" group="Help" OrderIndex="4"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\is-HTPDG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (412), with CRLF line terminators
Category:	dropped
Size (bytes):	2266
Entropy (8bit):	5.571542502704049
Encrypted:	false
SSDEEP:	48:cM5KTK+ZUs1OzRz1PD5anKkjangxLgGfFlfRlSFt:fps10RJdFcLgGjfUt
MD5:	DD65FB9EA8DC153640B2E973816F2B65
SHA1:	09E9C5C2E48E60A692DB900DB00F6FEE1945207F
SHA-256:	CC644F7297F77041B6481CE41DD5F5B4960A53A693F113E9A96F31D928D8D495
SHA-512:	4DFB238B7B8C9F9551BD409CAF35ED962121F69AEEF2DB9E09986E429C8097BE703B9E199CCA4B37E7A047CFB79C94B7BD7C49631D69D2085B7FE52076D0F260
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="COM Object Model" GUID="{DAD97FD5-E4B5-4E09-874A-51749BFD6D0E}">.. <Properties>.. <Property Class="Text" GUID="{9898B794-B208-4843-A102-960FCECA0AC6}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">COM Object Model</Property>.. <Property Class="Type" GUID="{2D483A9F-E509-48C8-BE40-F66A5C8ABD71}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Topic</Property>.. <Property Class="Memo" GUID="{E85CE22E-EE61-4C6E-8A29-7B90BAC269F7}" Name="Help String" input="True" group="Item" OrderIndex="3" DecimalPlaces="" List="cmbList" PluginToExecute="cmbList">Planswift COM object interface.</Property>.. <Property Class="Text" GUID="{33AA502A-8A24-46EF-9E4D-1BBA6854F777}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{DAD97FD5-E4B5-4E09-874A-51749BFD6D0E}</Property>.. <Property Class="Number"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (958), with CRLF line terminators
Category:	dropped
Size (bytes):	7262
Entropy (8bit):	5.136702060712245
Encrypted:	false
SSDEEP:	192:kaddOZkdOsdORdOXdOvdOEWgdOmdORdOpiY:/dOudOsdORdOXdOvdOEWgdOmdORdOH
MD5:	98F456764752C2DDE915483F5899607E
SHA1:	CFF088AF08C25A05AC864B00378F2A382FAD7632
SHA-256:	86ABA14FA38538FF669067CF7D51D433B82B7293CE3B7D783E1BB4537EBC61FD
SHA-512:	51819AD586DF7037CADA90B8EB4D50C3FFBE5BA3F48DA8E9BDDB65ACBCA3680D051266419A5CA45F53BE2017E3DD85F43A999821164FDF387ED845EACB358ADB
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="_PlanSwift Help" GUID="{BFB127A6-DAD6-47BD-92EC-80226C317034}">.. <Properties>.. <Property Class="Text" GUID="{0D5A97E5-7232-4EFD-9A5F-FEFE3B2FE0FB}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_PlanSwift Help</Property>.. <Property Class="Type" GUID="{634AE062-8E6E-4568-9657-C6B835CA30B5}" Name="Type" inheritaction="" calc

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (974), with CRLF line terminators
Category:	dropped
Size (bytes):	7275
Entropy (8bit):	5.125883511661624
Encrypted:	false
SSDEEP:	192:ddO0dOCFSdOCAdOddOIdO4gdOsdOMhwodOB:ddO0dOCAdOjdOddOIdO4gdOsdOMhwodg
MD5:	D02527EDAA39DCF91B10F6B66D2458DE
SHA1:	69C43A88DD0133B698D879295194435C985C065A
SHA-256:	DE25A5BC7175D86808E9A6660CB355F3E14AE759C014F99C42814EB0340806D8
SHA-512:	7B3FF115D81FDC8D78733AFD7E65B35652CCC3E6DD142D2F0BC52C7080A041F8654361EFF793208A572948E4ED4F123388642312BD37DF6E1B683419984F8A76
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Scripting" GUID="{53DF5316-8F88-441C-AF57-F8A1A6662ED1}">.. <Properties>.. <Property Class="Text" GUID="{BCD2129E-C502-4B90-B0CF-8EA57DE4A479}" Name="Name" inheritaction="" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Scripting</Property>.. <Property Class="Type" GUID="{BE039451-4DE5-4B14-B67D-42E3977C8646}" Name="Type" inheritaction="" calculatebefore="0" inhe

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Dialogs\Custom Dialogs\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1192), with CRLF line terminators
Category:	dropped
Size (bytes):	12684
Entropy (8bit):	5.245141901323626
Encrypted:	false
SSDEEP:	192:pdOqdOpdOhdOcdOk1dOMVnH/XLVDjJTGH49Sa/FVk/Nc9U7W8dOOiXdO5z1dO6:pdOqdOpdOhdOcdOSdO1W8dOLdOfdO6
MD5:	207B86C7B9DBC91EB0527695FAF06E46
SHA1:	D4FB62E83D702B8E151ECC80D3C7B75D33E7DD24
SHA-256:	FAEF74EDA913A193B85C3653AEA06F836BC576AE08E1A92426318D3E8342FE57
SHA-512:	91E68535395E5945E407E1BBE8F6CF10C97D8082F5B5DE9420E6BEC18BA453BD8E98A96C719D56CC47B4577F02DDA2CC6ACA816AD46E6A04B29551A85BB0E096
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Custom Dialogs" GUID="{A306E90A-E012-4572-9767-EFB804D33319}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Custom Dialogs</Property>.. <Property Class="Type" GUID="{34DEA545-3954-4BE3-B933-02F9E28C0F5A}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Dialogs\Custom Dialogs\is-TPLVI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1192), with CRLF line terminators
Category:	dropped
Size (bytes):	12684
Entropy (8bit):	5.245141901323626
Encrypted:	false
SSDEEP:	192:pdOqdOpdOhdOcdOk1dOMVnH/XLVDjJTGH49Sa/FVk/Nc9U7W8dOOiXdO5z1dO6:pdOqdOpdOhdOcdOSdO1W8dOLdOfdO6
MD5:	207B86C7B9DBC91EB0527695FAF06E46
SHA1:	D4FB62E83D702B8E151ECC80D3C7B75D33E7DD24
SHA-256:	FAEF74EDA913A193B85C3653AEA06F836BC576AE08E1A92426318D3E8342FE57
SHA-512:	91E68535395E5945E407E1BBE8F6CF10C97D8082F5B5DE9420E6BEC18BA453BD8E98A96C719D56CC47B4577F02DDA2CC6ACA816AD46E6A04B29551A85BB0E096
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Custom Dialogs" GUID="{A306E90A-E012-4572-9767-EFB804D33319}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Custom Dialogs</Property>.. <Property Class="Type" GUID="{34DEA545-3954-4BE3-B933-02F9E28C0F5A}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Dialogs\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1077), with CRLF line terminators
Category:	dropped
Size (bytes):	7481
Entropy (8bit):	5.127654841171352
Encrypted:	false
SSDEEP:	192:DdOcWdO0dO4BdOldOWdOPW8dOxdOMXdO6:DdOtdO0dOwdOldOWdOPW8dOxdOGdO6
MD5:	1DA5C6AC4FA94352B1329345BE190DB2
SHA1:	A8DA56B640DE22DE82760DE117879C1296AABBC9
SHA-256:	37C8A8A4763768FDE2664BE507CD763582F60A1E16148EF8BF44857DFE74E2B1
SHA-512:	42B2BA10C3BEBC23BDF53FB7D63B5AAB36680554E86276439F17E2F4E25BBA457CF26FD244495F08236F891F9591D8B873FB9C877F8BD04A8D1DEBE664D26B30
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Dialogs" GUID="{3CDF89F3-0F5B-4FCE-9C1C-D49B2AC21F16}">.. <Properties>.. <Property Class="Text" GUID="{2DDB279C-417F-4EEB-8EF8-70F65A6C95B7}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Dialogs</Property>.. <Property Class="Type" GUID="{CE3F6242-A451-4AB5-85A4-4D2A98F40FDF}" Name="Type" inheritaction="" calc

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Dialogs\EditItem\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1116), with CRLF line terminators
Category:	dropped
Size (bytes):	7685
Entropy (8bit):	5.19788347174325
Encrypted:	false
SSDEEP:	192:9dOVcdOBdOKgdO9dOdKfvHSW8dO6dOTKNdOn:9dOKdOBdOhdO9dOdKCW8dO6dOTKNdOn
MD5:	F36433D025B02F692CEC959FBD8C60E3
SHA1:	AD17B638AAD368D5FA4F21E74B7006EBAAC5614A
SHA-256:	B9BA3CA1C51CEC8D4E1E952E8FBEB767A7A4F5EBE4C70BDD43D9D67EDC41A73F
SHA-512:	C43186C8D1E8BE53525784FBAB5E6BA8FA27315E730C3E9D717681A203A4EED176B17AB904E813E47BFD128FC1FB0002CC713D221CD5FD1238CA14FC4973AD43
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="EditItem" GUID="{EC777593-A953-4B5D-8A86-BDDEB7C738B4}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">EditItem</Property>.. <Property Class="Type" GUID="{1A4BDE19-C666-47C6-877A-E5D0A24D9D99}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" in

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Dialogs\EditItem\is-V8UCO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1116), with CRLF line terminators
Category:	dropped
Size (bytes):	7685
Entropy (8bit):	5.19788347174325
Encrypted:	false
SSDEEP:	192:9dOVcdOBdOKgdO9dOdKfvHSW8dO6dOTKNdOn:9dOKdOBdOhdO9dOdKCW8dO6dOTKNdOn
MD5:	F36433D025B02F692CEC959FBD8C60E3
SHA1:	AD17B638AAD368D5FA4F21E74B7006EBAAC5614A
SHA-256:	B9BA3CA1C51CEC8D4E1E952E8FBEB767A7A4F5EBE4C70BDD43D9D67EDC41A73F
SHA-512:	C43186C8D1E8BE53525784FBAB5E6BA8FA27315E730C3E9D717681A203A4EED176B17AB904E813E47BFD128FC1FB0002CC713D221CD5FD1238CA14FC4973AD43
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="EditItem" GUID="{EC777593-A953-4B5D-8A86-BDDEB7C738B4}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">EditItem</Property>.. <Property Class="Type" GUID="{1A4BDE19-C666-47C6-877A-E5D0A24D9D99}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" in

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Dialogs\EditScriptProperty\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1219), with CRLF line terminators
Category:	dropped
Size (bytes):	8803
Entropy (8bit):	5.202066630477868
Encrypted:	false
SSDEEP:	192:KoadOOdOUdO3dOjdO+dOOHRAxW8dOYRdOqdO6:4dOOdOUdO3dOjdO+dOFW8dO8dOqdO6
MD5:	27B9C71619400E6378C3CCF2D6E7952C
SHA1:	2A059A4596930ED4E66ADDB6CBFE87D31504C987
SHA-256:	108E4E07E7046E754050D6729BDDA95F12C5008B79193E716281D604BF3C804E
SHA-512:	3ED947F41C7592E76896F8AF9FBA60B5D2DDD40E2A7F726650FB99EF8EC698AD78F12C3938D2F129E45B7E535B73C536B67EFA9138CA999850FABBF7E160F0D1
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="EditScriptProperty" GUID="{0906A907-7C66-45F8-9EF4-974287506FCE}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">EditScriptProperty</Property>.. <Property Class="Type" GUID="{9D03638D-7874-4DF6-8932-3DE33388B1F1}" Name="Type" inheritaction="" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Dialogs\EditScriptProperty\is-06EIT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1219), with CRLF line terminators
Category:	dropped
Size (bytes):	8803
Entropy (8bit):	5.202066630477868
Encrypted:	false
SSDEEP:	192:KoadOOdOUdO3dOjdO+dOOHRAxW8dOYRdOqdO6:4dOOdOUdO3dOjdO+dOFW8dO8dOqdO6
MD5:	27B9C71619400E6378C3CCF2D6E7952C
SHA1:	2A059A4596930ED4E66ADDB6CBFE87D31504C987
SHA-256:	108E4E07E7046E754050D6729BDDA95F12C5008B79193E716281D604BF3C804E
SHA-512:	3ED947F41C7592E76896F8AF9FBA60B5D2DDD40E2A7F726650FB99EF8EC698AD78F12C3938D2F129E45B7E535B73C536B67EFA9138CA999850FABBF7E160F0D1
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="EditScriptProperty" GUID="{0906A907-7C66-45F8-9EF4-974287506FCE}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">EditScriptProperty</Property>.. <Property Class="Type" GUID="{9D03638D-7874-4DF6-8932-3DE33388B1F1}" Name="Type" inheritaction="" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Dialogs\MessageDialog\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (492), with CRLF line terminators
Category:	dropped
Size (bytes):	2390
Entropy (8bit):	5.538390053536378
Encrypted:	false
SSDEEP:	24:2dFDXFX2KI/CApWLPzEfgAWgPQ1OcEYkz4fqcGqD51NOr9P8H33f2WAdOch15ib5:cD9gAoLH1TYD51NOrl8dmkmxRRHSh
MD5:	0696F139B36CEBE4A51E65AFCEEBBBD4
SHA1:	10F831A08A695A7D646D3E1BFD69A9087CFB36B7
SHA-256:	BBCE41D730B209D37FDF2DE08B4AF1904D6E946E304552B5FF6E773D68848597
SHA-512:	1E5D2D9DBD9C61227925929503D3A856E98279C9E4F260ABE8ACEDCBD3C5AFF99540930CE7C5E053D9F0BB973FCBAED7F26D060AE962BE44323F8AFBC14CBE5E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="MessageDialog" GUID="{EEFFCE1B-5B01-43D2-98E8-9F483854C8C9}">.. <Properties>.. <Property Class="Text" GUID="{1C816451-3E88-4204-AA2F-98958D52234B}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">MessageDialog</Property>.. <Property Class="Type" GUID="{831F21C5-7334-4048-8D75-00BB68AEE7EC}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{33B06CAA-9F46-4402-8E97-1D2EFBE1E644}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2.5</Property>.. <Property Class="Memo" GUID="{D0B19BF8-3CBB-43DC-8904-75276BA16F04}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1&

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Dialogs\MessageDialog\is-IS670.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (492), with CRLF line terminators
Category:	dropped
Size (bytes):	2390
Entropy (8bit):	5.538390053536378
Encrypted:	false
SSDEEP:	24:2dFDXFX2KI/CApWLPzEfgAWgPQ1OcEYkz4fqcGqD51NOr9P8H33f2WAdOch15ib5:cD9gAoLH1TYD51NOrl8dmkmxRRHSh
MD5:	0696F139B36CEBE4A51E65AFCEEBBBD4
SHA1:	10F831A08A695A7D646D3E1BFD69A9087CFB36B7
SHA-256:	BBCE41D730B209D37FDF2DE08B4AF1904D6E946E304552B5FF6E773D68848597
SHA-512:	1E5D2D9DBD9C61227925929503D3A856E98279C9E4F260ABE8ACEDCBD3C5AFF99540930CE7C5E053D9F0BB973FCBAED7F26D060AE962BE44323F8AFBC14CBE5E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="MessageDialog" GUID="{EEFFCE1B-5B01-43D2-98E8-9F483854C8C9}">.. <Properties>.. <Property Class="Text" GUID="{1C816451-3E88-4204-AA2F-98958D52234B}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">MessageDialog</Property>.. <Property Class="Type" GUID="{831F21C5-7334-4048-8D75-00BB68AEE7EC}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{33B06CAA-9F46-4402-8E97-1D2EFBE1E644}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2.5</Property>.. <Property Class="Memo" GUID="{D0B19BF8-3CBB-43DC-8904-75276BA16F04}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1&

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Dialogs\My Color Dialog\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1001), with CRLF line terminators
Category:	dropped
Size (bytes):	8385
Entropy (8bit):	5.107425633813952
Encrypted:	false
SSDEEP:	192:idO2dONdOmdOFdOgQzdOlx8dOhdOt+dOfdO4C:idO2dONdOmdOFdOVdOlx8dOhdOodOfdQ
MD5:	245A71C4E627984D84878FD445399439
SHA1:	FFFBC57A68316DEF0534CC71A14A2B08F2B10C21
SHA-256:	C7504D8B35C27BCEF6F101CFF391D93E43E34D2E21E2CC9464D7B6E7491FC26E
SHA-512:	8C8560F77AFE6FF053C0A216F5483AF15AC63A9CFE17479240D9648B3C4D52704F501F6B1D81F2DCA3A96E3DE0793BF79EF8A02246614718AE107A8702C9DD54
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="My Color Dialog" GUID="{C6E95E08-D3A1-40AA-97A8-8A1472F132F3}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">My Color Dialog</Property>.. <Property Class="Type" GUID="{D2D4C665-EB93-464B-90D4-F2719C700DA3}" Name="Type" inheritaction="" calculatebefore="0" inher

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Dialogs\My Color Dialog\is-6H5LO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1001), with CRLF line terminators
Category:	dropped
Size (bytes):	8385
Entropy (8bit):	5.107425633813952
Encrypted:	false
SSDEEP:	192:idO2dONdOmdOFdOgQzdOlx8dOhdOt+dOfdO4C:idO2dONdOmdOFdOVdOlx8dOhdOodOfdQ
MD5:	245A71C4E627984D84878FD445399439
SHA1:	FFFBC57A68316DEF0534CC71A14A2B08F2B10C21
SHA-256:	C7504D8B35C27BCEF6F101CFF391D93E43E34D2E21E2CC9464D7B6E7491FC26E
SHA-512:	8C8560F77AFE6FF053C0A216F5483AF15AC63A9CFE17479240D9648B3C4D52704F501F6B1D81F2DCA3A96E3DE0793BF79EF8A02246614718AE107A8702C9DD54
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="My Color Dialog" GUID="{C6E95E08-D3A1-40AA-97A8-8A1472F132F3}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">My Color Dialog</Property>.. <Property Class="Type" GUID="{D2D4C665-EB93-464B-90D4-F2719C700DA3}" Name="Type" inheritaction="" calculatebefore="0" inher

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Dialogs\ScriptMessageDialog\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (492), with CRLF line terminators
Category:	dropped
Size (bytes):	2667
Entropy (8bit):	5.5299649670256485
Encrypted:	false
SSDEEP:	48:cEs45BhRIEs0YD51NOrl8YrQEmLGv8Q43E0h:zs6AExW8QEu3j
MD5:	5145C0274700A61492D1CE272F3BF3E7
SHA1:	E2A23E683975DAEF72C08336A16813E21D4CD268
SHA-256:	50A8D6BAE8CDF8C09A91357959E5CE1172E23FD3A1DBC4BB2C2DDD3368875702
SHA-512:	FD824CBBC4A56AE622158C7F05A0150E97053775C28669F328841285D8E9E5C8F551AD1769DCB4BAD2412B88E2021287CADBE05E54259153C607B0B8DF7014A3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ScriptMessageDialog" GUID="{B9196591-9FC6-434F-AD7A-AA87B9B02BED}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">ScriptMessageDialog</Property>.. <Property Class="Type" GUID="{2D9B5763-9E1E-4B7E-B902-E0C7FA6279F0}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{DFFB5772-45B2-453F-B61C-204B8C3779F2}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Memo" GUID="{2021B0E0-8903-4A4B-99F1-3A799FC42860}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name=&quo

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Dialogs\ScriptMessageDialog\is-FLPIK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (492), with CRLF line terminators
Category:	dropped
Size (bytes):	2667
Entropy (8bit):	5.5299649670256485
Encrypted:	false
SSDEEP:	48:cEs45BhRIEs0YD51NOrl8YrQEmLGv8Q43E0h:zs6AExW8QEu3j
MD5:	5145C0274700A61492D1CE272F3BF3E7
SHA1:	E2A23E683975DAEF72C08336A16813E21D4CD268
SHA-256:	50A8D6BAE8CDF8C09A91357959E5CE1172E23FD3A1DBC4BB2C2DDD3368875702
SHA-512:	FD824CBBC4A56AE622158C7F05A0150E97053775C28669F328841285D8E9E5C8F551AD1769DCB4BAD2412B88E2021287CADBE05E54259153C607B0B8DF7014A3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ScriptMessageDialog" GUID="{B9196591-9FC6-434F-AD7A-AA87B9B02BED}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">ScriptMessageDialog</Property>.. <Property Class="Type" GUID="{2D9B5763-9E1E-4B7E-B902-E0C7FA6279F0}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{DFFB5772-45B2-453F-B61C-204B8C3779F2}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Memo" GUID="{2021B0E0-8903-4A4B-99F1-3A799FC42860}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order="1"/><Item Name=&quo

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Dialogs\SelectItemDialog\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (766), with CRLF line terminators
Category:	dropped
Size (bytes):	3839
Entropy (8bit):	5.517905040571031
Encrypted:	false
SSDEEP:	48:cQQnK4ncN15Q0YD51NOrl8ufmFDJhX5d6HbEvtJJvRuvRGvbt2/f5d6HGhhI:5QK4KXQ0Wmfc9hJd67enFKebt2/Bd6mK
MD5:	705ACB9A13A0356383DDAD443583D9B6
SHA1:	F6891CF294BF2C0B576E9E301B1199F93052D92C
SHA-256:	A620864AF5404C25C3880979CBD5C81528AFAFD6E712A23FF6AA20372447039C
SHA-512:	35B5D98BBEBBC71552333507C1DC7C6AF06369EA5800007820A481C11EDCF09C6318F01DB3913FF6C637102F64F40D6F08C246B380FB3D34546DA76B8EFB1AF7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SelectItemDialog" GUID="{60916D69-6997-41B1-A186-D1423158CD52}">.. <Properties>.. <Property Class="Text" GUID="{17B19BFF-7217-4B49-98F6-BA04BF4BF29D}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">SelectItemDialog</Property>.. <Property Class="Type" GUID="{43925954-51F2-45DA-A655-5C5B7D7F3753}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{58AFF683-38D9-4032-BA31-D56C82D85705}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">5</Property>.. <Property Class="Memo" GUID="{2FC8AC4C-C825-424F-8FC3-5A31884F4A67}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order=&quo

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Dialogs\SelectItemDialog\is-TIM3C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (766), with CRLF line terminators
Category:	dropped
Size (bytes):	3839
Entropy (8bit):	5.517905040571031
Encrypted:	false
SSDEEP:	48:cQQnK4ncN15Q0YD51NOrl8ufmFDJhX5d6HbEvtJJvRuvRGvbt2/f5d6HGhhI:5QK4KXQ0Wmfc9hJd67enFKebt2/Bd6mK
MD5:	705ACB9A13A0356383DDAD443583D9B6
SHA1:	F6891CF294BF2C0B576E9E301B1199F93052D92C
SHA-256:	A620864AF5404C25C3880979CBD5C81528AFAFD6E712A23FF6AA20372447039C
SHA-512:	35B5D98BBEBBC71552333507C1DC7C6AF06369EA5800007820A481C11EDCF09C6318F01DB3913FF6C637102F64F40D6F08C246B380FB3D34546DA76B8EFB1AF7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="SelectItemDialog" GUID="{60916D69-6997-41B1-A186-D1423158CD52}">.. <Properties>.. <Property Class="Text" GUID="{17B19BFF-7217-4B49-98F6-BA04BF4BF29D}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">SelectItemDialog</Property>.. <Property Class="Type" GUID="{43925954-51F2-45DA-A655-5C5B7D7F3753}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{58AFF683-38D9-4032-BA31-D56C82D85705}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">5</Property>.. <Property Class="Memo" GUID="{2FC8AC4C-C825-424F-8FC3-5A31884F4A67}" Name="Form Layout" systemhidden="True" OrderIndex="5" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="Declaration" Order=&quo

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Dialogs\is-1HIUC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1077), with CRLF line terminators
Category:	dropped
Size (bytes):	7481
Entropy (8bit):	5.127654841171352
Encrypted:	false
SSDEEP:	192:DdOcWdO0dO4BdOldOWdOPW8dOxdOMXdO6:DdOtdO0dOwdOldOWdOPW8dOxdOGdO6
MD5:	1DA5C6AC4FA94352B1329345BE190DB2
SHA1:	A8DA56B640DE22DE82760DE117879C1296AABBC9
SHA-256:	37C8A8A4763768FDE2664BE507CD763582F60A1E16148EF8BF44857DFE74E2B1
SHA-512:	42B2BA10C3BEBC23BDF53FB7D63B5AAB36680554E86276439F17E2F4E25BBA457CF26FD244495F08236F891F9591D8B873FB9C877F8BD04A8D1DEBE664D26B30
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Dialogs" GUID="{3CDF89F3-0F5B-4FCE-9C1C-D49B2AC21F16}">.. <Properties>.. <Property Class="Text" GUID="{2DDB279C-417F-4EEB-8EF8-70F65A6C95B7}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Dialogs</Property>.. <Property Class="Type" GUID="{CE3F6242-A451-4AB5-85A4-4D2A98F40FDF}" Name="Type" inheritaction="" calc

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Forms\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (963), with CRLF line terminators
Category:	dropped
Size (bytes):	7401
Entropy (8bit):	5.139670586625744
Encrypted:	false
SSDEEP:	192:DldOgdOtdOodOWdOAdOhaWgdOhdOU8dO6:xdOgdOtdOodOWdOAdOkWgdOhdOJdO6
MD5:	0381E5AEECAE815FA98FE8BBC476D9B0
SHA1:	DF466A4D07B295C8B6CC7803938C894328A81F2D
SHA-256:	FA4D596F89D870BF3C4F292274F91FD2CA1AFAC9E332A1CEDC7D4593B55541E9
SHA-512:	6B2C4CDD4C242D786BD7383EA6B7F8B38C13CD6DBF1474128FE16AA28CE5490B41BEC45726DE5BACC9B819C61976B1CBD225B8C293632D31671B38BA038F00D1
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Forms" GUID="{7BA46A77-CE77-43A2-AD6D-C5CD5F3CBF2A}">.. <Properties>.. <Property Class="Type" GUID="{5025CD7C-9703-46F2-93DA-528786C10AFD}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Object</Property>.. <Property Class="Text" GUID="{4A94A15B-952E-4A19-99B8-0AAF66DA6B0C}" Name="Name" inheritaction="Ignore" calculatebefore="0" inh

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Forms\NewButton\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1163), with CRLF line terminators
Category:	dropped
Size (bytes):	33486
Entropy (8bit):	4.919187250653643
Encrypted:	false
SSDEEP:	192:jqOEZ6o5nPyI0IRrkjUFLU0nek0G9ck0GXpkj/FnM80lhV4BHCIsU0UT90w4MRwQ:jqvhE3q51HU
MD5:	F30934DD8B97F0F52A2EA20ED9BEB326
SHA1:	5635911350E777CFEA4BBD6587B3571A2456CBE8
SHA-256:	2337B299390CBE2ECCB3B1E47FDEFE3FF0D367D865379A41F1E1F1A7263A750C
SHA-512:	C0BD7A5271B16D02673902A1515DF3B5012E3A5CA81B06DAE88ADDDE410C6F5E1F155C1F0DBA96F79F592B4BBCB682C1A52A754E744B156721CFEDFA0B686D4F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewButton" GUID="{91516CC4-CE74-4BDE-A90D-4A021EB250C4}">.. <Properties>.. <Property Class="Type" GUID="{C4689797-1C1A-4D96-95C0-F6C885D40833}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="2">Function</Property>.. <Property Class="Text" GUID="{3316A87A-C62F-4590-918F-600AB80621A4}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">NewButton</Property>.. <Property Class="Number" GUID="{447C1435-36B0-4A6D-AB38-FB2B2FE853A9}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">-2</Property>.. <Property Class="Text" GUID="{12A493C5-8130-4F5C-B242-5ACFFD4A3751}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{91516CC4-CE74-4BDE-A90D-4A021EB250C4}</Property>.. <Property Class="Memo" GUID="{96B7C6A8-E689-45E5-88FF-AA81E4FF42AE}" Name="Form Layout" systemhidden="True

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Forms\NewButton\is-4ND7E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1163), with CRLF line terminators
Category:	dropped
Size (bytes):	33486
Entropy (8bit):	4.919187250653643
Encrypted:	false
SSDEEP:	192:jqOEZ6o5nPyI0IRrkjUFLU0nek0G9ck0GXpkj/FnM80lhV4BHCIsU0UT90w4MRwQ:jqvhE3q51HU
MD5:	F30934DD8B97F0F52A2EA20ED9BEB326
SHA1:	5635911350E777CFEA4BBD6587B3571A2456CBE8
SHA-256:	2337B299390CBE2ECCB3B1E47FDEFE3FF0D367D865379A41F1E1F1A7263A750C
SHA-512:	C0BD7A5271B16D02673902A1515DF3B5012E3A5CA81B06DAE88ADDDE410C6F5E1F155C1F0DBA96F79F592B4BBCB682C1A52A754E744B156721CFEDFA0B686D4F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewButton" GUID="{91516CC4-CE74-4BDE-A90D-4A021EB250C4}">.. <Properties>.. <Property Class="Type" GUID="{C4689797-1C1A-4D96-95C0-F6C885D40833}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="2">Function</Property>.. <Property Class="Text" GUID="{3316A87A-C62F-4590-918F-600AB80621A4}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">NewButton</Property>.. <Property Class="Number" GUID="{447C1435-36B0-4A6D-AB38-FB2B2FE853A9}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">-2</Property>.. <Property Class="Text" GUID="{12A493C5-8130-4F5C-B242-5ACFFD4A3751}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{91516CC4-CE74-4BDE-A90D-4A021EB250C4}</Property>.. <Property Class="Memo" GUID="{96B7C6A8-E689-45E5-88FF-AA81E4FF42AE}" Name="Form Layout" systemhidden="True

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Forms\NewCheckBox\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1163), with CRLF line terminators
Category:	dropped
Size (bytes):	33500
Entropy (8bit):	4.925216794350976
Encrypted:	false
SSDEEP:	192:imuKnPyI0IRrkjUFLU0nek0G9ck0GXpkj/FnM80lhV4BHCIsU0UT90w4MRwfNSk3:imukE3q5UDU
MD5:	F5BBECFFB3B9306D09764A64CC55DEDA
SHA1:	23D24025C765F3594B5D061D845DF329502F433C
SHA-256:	4AD88F107D8F1DB7BE092B9685FDFDAF62062248BFCB8434718FE9F9077BA353
SHA-512:	33CA26F63C58C37EDC6310EBCC28CF69CE901A069B10A2ADAF875C1A4174BF6747B51D1A54FA1BBF3B74DFF96AB579379D769975C154DB226B1821080E8FC6EE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewCheckBox" GUID="{CF230544-9C74-4413-8CEB-36F8F6DD37E0}">.. <Properties>.. <Property Class="Type" GUID="{C4689797-1C1A-4D96-95C0-F6C885D40833}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="2">Function</Property>.. <Property Class="Text" GUID="{3316A87A-C62F-4590-918F-600AB80621A4}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">NewCheckBox</Property>.. <Property Class="Number" GUID="{447C1435-36B0-4A6D-AB38-FB2B2FE853A9}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">-1.5</Property>.. <Property Class="Text" GUID="{12A493C5-8130-4F5C-B242-5ACFFD4A3751}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{CF230544-9C74-4413-8CEB-36F8F6DD37E0}</Property>.. <Property Class="Memo" GUID="{96B7C6A8-E689-45E5-88FF-AA81E4FF42AE}" Name="Form Layout" systemhidden

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Forms\NewCheckBox\is-N0CI4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1163), with CRLF line terminators
Category:	dropped
Size (bytes):	33500
Entropy (8bit):	4.925216794350976
Encrypted:	false
SSDEEP:	192:imuKnPyI0IRrkjUFLU0nek0G9ck0GXpkj/FnM80lhV4BHCIsU0UT90w4MRwfNSk3:imukE3q5UDU
MD5:	F5BBECFFB3B9306D09764A64CC55DEDA
SHA1:	23D24025C765F3594B5D061D845DF329502F433C
SHA-256:	4AD88F107D8F1DB7BE092B9685FDFDAF62062248BFCB8434718FE9F9077BA353
SHA-512:	33CA26F63C58C37EDC6310EBCC28CF69CE901A069B10A2ADAF875C1A4174BF6747B51D1A54FA1BBF3B74DFF96AB579379D769975C154DB226B1821080E8FC6EE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewCheckBox" GUID="{CF230544-9C74-4413-8CEB-36F8F6DD37E0}">.. <Properties>.. <Property Class="Type" GUID="{C4689797-1C1A-4D96-95C0-F6C885D40833}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="2">Function</Property>.. <Property Class="Text" GUID="{3316A87A-C62F-4590-918F-600AB80621A4}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">NewCheckBox</Property>.. <Property Class="Number" GUID="{447C1435-36B0-4A6D-AB38-FB2B2FE853A9}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">-1.5</Property>.. <Property Class="Text" GUID="{12A493C5-8130-4F5C-B242-5ACFFD4A3751}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{CF230544-9C74-4413-8CEB-36F8F6DD37E0}</Property>.. <Property Class="Memo" GUID="{96B7C6A8-E689-45E5-88FF-AA81E4FF42AE}" Name="Form Layout" systemhidden

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Forms\NewColorBox\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1163), with CRLF line terminators
Category:	dropped
Size (bytes):	33454
Entropy (8bit):	4.918864009258801
Encrypted:	false
SSDEEP:	192:xmyEnPyI0IRrkjUFLU0nek0G9ck0GXpkj/FnM80lhV4BHCIsU0UT90w4MRwfNSk4:xmySE3q5ZqD
MD5:	14A7E64002F356E357573AA5A8AE52DF
SHA1:	0C2F558484A6362C418FC7C25B78E7FD34A57EB5
SHA-256:	B7566088C74B33746D4934D4CB50AB64C3F6EFDD07D011474607FB2D17E5BD7C
SHA-512:	1CC7A2799012B41ADB841F3C90DE846D35C5152C259B27BFCB4FFBDFF01012FA5379C8E1AE89271065E6902BC7C2F2AC9231151303EA89F136DC331DF9F4CAB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewColorBox" GUID="{EBF1A0AF-ED9D-400E-8892-DE50F965B3EC}">.. <Properties>.. <Property Class="Type" GUID="{C4689797-1C1A-4D96-95C0-F6C885D40833}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="2">Function</Property>.. <Property Class="Text" GUID="{3316A87A-C62F-4590-918F-600AB80621A4}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">NewColorBox</Property>.. <Property Class="Number" GUID="{447C1435-36B0-4A6D-AB38-FB2B2FE853A9}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">-1.375</Property>.. <Property Class="Text" GUID="{12A493C5-8130-4F5C-B242-5ACFFD4A3751}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{EBF1A0AF-ED9D-400E-8892-DE50F965B3EC}</Property>.. <Property Class="Memo" GUID="{96B7C6A8-E689-45E5-88FF-AA81E4FF42AE}" Name="Form Layout" systemhidd

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Forms\NewColorBox\is-O7N3O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1163), with CRLF line terminators
Category:	dropped
Size (bytes):	33454
Entropy (8bit):	4.918864009258801
Encrypted:	false
SSDEEP:	192:xmyEnPyI0IRrkjUFLU0nek0G9ck0GXpkj/FnM80lhV4BHCIsU0UT90w4MRwfNSk4:xmySE3q5ZqD
MD5:	14A7E64002F356E357573AA5A8AE52DF
SHA1:	0C2F558484A6362C418FC7C25B78E7FD34A57EB5
SHA-256:	B7566088C74B33746D4934D4CB50AB64C3F6EFDD07D011474607FB2D17E5BD7C
SHA-512:	1CC7A2799012B41ADB841F3C90DE846D35C5152C259B27BFCB4FFBDFF01012FA5379C8E1AE89271065E6902BC7C2F2AC9231151303EA89F136DC331DF9F4CAB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewColorBox" GUID="{EBF1A0AF-ED9D-400E-8892-DE50F965B3EC}">.. <Properties>.. <Property Class="Type" GUID="{C4689797-1C1A-4D96-95C0-F6C885D40833}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="2">Function</Property>.. <Property Class="Text" GUID="{3316A87A-C62F-4590-918F-600AB80621A4}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">NewColorBox</Property>.. <Property Class="Number" GUID="{447C1435-36B0-4A6D-AB38-FB2B2FE853A9}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">-1.375</Property>.. <Property Class="Text" GUID="{12A493C5-8130-4F5C-B242-5ACFFD4A3751}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{EBF1A0AF-ED9D-400E-8892-DE50F965B3EC}</Property>.. <Property Class="Memo" GUID="{96B7C6A8-E689-45E5-88FF-AA81E4FF42AE}" Name="Form Layout" systemhidd

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Forms\NewComboBox\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1163), with CRLF line terminators
Category:	dropped
Size (bytes):	33435
Entropy (8bit):	4.921779693653392
Encrypted:	false
SSDEEP:	192:Dd3MnPyI0IRrkjUFLU0nek0G9ck0GXpkj/FnM80lhV4BHCIsU0UT90w4MRwfNSki:Dd3aE3q5unp
MD5:	2B11A4E8C0C813FE358A18D5C0C48975
SHA1:	9EA43812B853027AA66CF0DC87342E53E6C4D654
SHA-256:	49D0147D2E82970981455BDF14DB39BC84E60B021827F92A18AD9D4C1248670B
SHA-512:	1113C316D00CD05D5E0856AC6A898CFCD7E8FC98FCB5C236E2CA536A7683015B8F93B2576D642B897F7F9795A8978885D07D59C0858492F94844EAA35C7A2C2A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewComboBox" GUID="{1F57042E-E620-47C4-99F8-A61F7CE4943A}">.. <Properties>.. <Property Class="Type" GUID="{C4689797-1C1A-4D96-95C0-F6C885D40833}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="2">Function</Property>.. <Property Class="Text" GUID="{3316A87A-C62F-4590-918F-600AB80621A4}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">NewComboBox</Property>.. <Property Class="Number" GUID="{447C1435-36B0-4A6D-AB38-FB2B2FE853A9}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">-1.25</Property>.. <Property Class="Text" GUID="{12A493C5-8130-4F5C-B242-5ACFFD4A3751}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{1F57042E-E620-47C4-99F8-A61F7CE4943A}</Property>.. <Property Class="Memo" GUID="{96B7C6A8-E689-45E5-88FF-AA81E4FF42AE}" Name="Form Layout" systemhidde

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Forms\NewComboBox\is-9KP95.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1163), with CRLF line terminators
Category:	dropped
Size (bytes):	33435
Entropy (8bit):	4.921779693653392
Encrypted:	false
SSDEEP:	192:Dd3MnPyI0IRrkjUFLU0nek0G9ck0GXpkj/FnM80lhV4BHCIsU0UT90w4MRwfNSki:Dd3aE3q5unp
MD5:	2B11A4E8C0C813FE358A18D5C0C48975
SHA1:	9EA43812B853027AA66CF0DC87342E53E6C4D654
SHA-256:	49D0147D2E82970981455BDF14DB39BC84E60B021827F92A18AD9D4C1248670B
SHA-512:	1113C316D00CD05D5E0856AC6A898CFCD7E8FC98FCB5C236E2CA536A7683015B8F93B2576D642B897F7F9795A8978885D07D59C0858492F94844EAA35C7A2C2A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewComboBox" GUID="{1F57042E-E620-47C4-99F8-A61F7CE4943A}">.. <Properties>.. <Property Class="Type" GUID="{C4689797-1C1A-4D96-95C0-F6C885D40833}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="2">Function</Property>.. <Property Class="Text" GUID="{3316A87A-C62F-4590-918F-600AB80621A4}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">NewComboBox</Property>.. <Property Class="Number" GUID="{447C1435-36B0-4A6D-AB38-FB2B2FE853A9}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">-1.25</Property>.. <Property Class="Text" GUID="{12A493C5-8130-4F5C-B242-5ACFFD4A3751}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{1F57042E-E620-47C4-99F8-A61F7CE4943A}</Property>.. <Property Class="Memo" GUID="{96B7C6A8-E689-45E5-88FF-AA81E4FF42AE}" Name="Form Layout" systemhidde

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Forms\NewEdit\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1163), with CRLF line terminators
Category:	dropped
Size (bytes):	33367
Entropy (8bit):	4.919139594564614
Encrypted:	false
SSDEEP:	192:3huWhPanPyI0IRrkjUFLU0nek0G9ck0GXpkj/FnM80lhV4BHCIsU0UT90w4MRwf7:3huWhPUE3i5RY0
MD5:	FB4B2F27C66798E0DDC77312799D3AEC
SHA1:	7DE51BB8E045DB051908167077DD1EF7406E87FD
SHA-256:	3D17DB99F66DB4733879BC838BC1C76C6FA973ADE48A5C58C1C3DFFF74DC3480
SHA-512:	47BFB4BDE9E052C08B14A8709CE70133B24EBC0CEB6CB9D0F5AB90BBC6DFB4E64AC72C2C992061701D7E9102FFD9CBD870747EB8FC303806E2C0527AB4A1990C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewEdit" GUID="{826820AA-C235-494A-98EE-32A0B15D0BB5}">.. <Properties>.. <Property Class="Type" GUID="{C4689797-1C1A-4D96-95C0-F6C885D40833}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{3316A87A-C62F-4590-918F-600AB80621A4}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">NewEdit</Property>.. <Property Class="Number" GUID="{447C1435-36B0-4A6D-AB38-FB2B2FE853A9}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">-1</Property>.. <Property Class="Text" GUID="{12A493C5-8130-4F5C-B242-5ACFFD4A3751}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{826820AA-C235-494A-98EE-32A0B15D0BB5}</Property>.. <Property Class="Memo" GUID="{96B7C6A8-E689-45E5-88FF-AA81E4FF42AE}" Name="Form Layout" systemhidden="True" OrderI

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Forms\NewEdit\is-7LF6D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1163), with CRLF line terminators
Category:	dropped
Size (bytes):	33367
Entropy (8bit):	4.919139594564614
Encrypted:	false
SSDEEP:	192:3huWhPanPyI0IRrkjUFLU0nek0G9ck0GXpkj/FnM80lhV4BHCIsU0UT90w4MRwf7:3huWhPUE3i5RY0
MD5:	FB4B2F27C66798E0DDC77312799D3AEC
SHA1:	7DE51BB8E045DB051908167077DD1EF7406E87FD
SHA-256:	3D17DB99F66DB4733879BC838BC1C76C6FA973ADE48A5C58C1C3DFFF74DC3480
SHA-512:	47BFB4BDE9E052C08B14A8709CE70133B24EBC0CEB6CB9D0F5AB90BBC6DFB4E64AC72C2C992061701D7E9102FFD9CBD870747EB8FC303806E2C0527AB4A1990C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="NewEdit" GUID="{826820AA-C235-494A-98EE-32A0B15D0BB5}">.. <Properties>.. <Property Class="Type" GUID="{C4689797-1C1A-4D96-95C0-F6C885D40833}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Function</Property>.. <Property Class="Text" GUID="{3316A87A-C62F-4590-918F-600AB80621A4}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">NewEdit</Property>.. <Property Class="Number" GUID="{447C1435-36B0-4A6D-AB38-FB2B2FE853A9}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="">-1</Property>.. <Property Class="Text" GUID="{12A493C5-8130-4F5C-B242-5ACFFD4A3751}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="">{826820AA-C235-494A-98EE-32A0B15D0BB5}</Property>.. <Property Class="Memo" GUID="{96B7C6A8-E689-45E5-88FF-AA81E4FF42AE}" Name="Form Layout" systemhidden="True" OrderI

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Forms\NewForm\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1246), with CRLF line terminators
Category:	dropped
Size (bytes):	38630
Entropy (8bit):	5.050301793697835
Encrypted:	false
SSDEEP:	384:QlSdOFdOUdOJdOWdOLdOVE/W8dO55kdOHdOG:QlDOZafgVEi5bkG
MD5:	8DBE9300B3C2EB38B64A8AEDD51636D9
SHA1:	4A5A9E370BD005B0307BD62C080A67649B619710
SHA-256:	A0B4D1C23073EBAEEA2AE94169A304B231F54A737278D2298831FAEBDFABF816
SHA-512:	C9A5E1D0211592D4F8328540621C7C951CEE44A5FE0945ACBB608E36F7F09510AEECD6E5F5DB027A0250E99B35D4E599CE40E36635F78285020A443232251232
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="NewForm" GUID="{6273FBC6-B7E0-4E5B-8ED3-F89966EC8B51}">.. <Properties>.. <Property Class="Type" GUID="{6B9E5AC8-BE1A-4B3F-8570-4E89FC9F2426}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{D6CDCF68-27B8-432C-9603-7B99997B84F0}" Name="Name" inheritaction="Ignore" c

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Forms\NewForm\is-HVS3T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1246), with CRLF line terminators
Category:	dropped
Size (bytes):	38630
Entropy (8bit):	5.050301793697835
Encrypted:	false
SSDEEP:	384:QlSdOFdOUdOJdOWdOLdOVE/W8dO55kdOHdOG:QlDOZafgVEi5bkG
MD5:	8DBE9300B3C2EB38B64A8AEDD51636D9
SHA1:	4A5A9E370BD005B0307BD62C080A67649B619710
SHA-256:	A0B4D1C23073EBAEEA2AE94169A304B231F54A737278D2298831FAEBDFABF816
SHA-512:	C9A5E1D0211592D4F8328540621C7C951CEE44A5FE0945ACBB608E36F7F09510AEECD6E5F5DB027A0250E99B35D4E599CE40E36635F78285020A443232251232
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="NewForm" GUID="{6273FBC6-B7E0-4E5B-8ED3-F89966EC8B51}">.. <Properties>.. <Property Class="Type" GUID="{6B9E5AC8-BE1A-4B3F-8570-4E89FC9F2426}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{D6CDCF68-27B8-432C-9603-7B99997B84F0}" Name="Name" inheritaction="Ignore" c

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Forms\NewLabel\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1238), with CRLF line terminators
Category:	dropped
Size (bytes):	38488
Entropy (8bit):	5.04579350841747
Encrypted:	false
SSDEEP:	384:uzdOQdOHdOqdO+0dOydORjbTESWgdO556dOPqdOzV:btkbcjJHE35tzJ
MD5:	481C6AF3978CC6F1227FE7FDB0C8DEDF
SHA1:	8E2B5046FFA3678F0AF50AC6B3AE047E8B467DDF
SHA-256:	33B2DEA80338CE61882037B3F7497312DE895A01953121C90F9FEBEC88A77B19
SHA-512:	3F6C5CBC7E50A4108DBD3115174D7F100A04FDC664945ABB8BC944D4F57FDE5E43FCAD9035C1849FA0694A5A8914539CDD5C25F9EF06B772164B14CE2E3B1851
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="NewLabel" GUID="{EBB4FCFB-1FC9-4E13-8DAD-199D58059BD3}">.. <Properties>.. <Property Class="Type" GUID="{9463FFA6-9A81-476E-A0F5-76FEB6C1E07C}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{0361C350-A6CD-4ED6-8829-22C85D2FE846}" Name="Name" inheritaction="Ignore" calculatebefore="0

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Forms\NewLabel\is-9A1FO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1238), with CRLF line terminators
Category:	dropped
Size (bytes):	38488
Entropy (8bit):	5.04579350841747
Encrypted:	false
SSDEEP:	384:uzdOQdOHdOqdO+0dOydORjbTESWgdO556dOPqdOzV:btkbcjJHE35tzJ
MD5:	481C6AF3978CC6F1227FE7FDB0C8DEDF
SHA1:	8E2B5046FFA3678F0AF50AC6B3AE047E8B467DDF
SHA-256:	33B2DEA80338CE61882037B3F7497312DE895A01953121C90F9FEBEC88A77B19
SHA-512:	3F6C5CBC7E50A4108DBD3115174D7F100A04FDC664945ABB8BC944D4F57FDE5E43FCAD9035C1849FA0694A5A8914539CDD5C25F9EF06B772164B14CE2E3B1851
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="NewLabel" GUID="{EBB4FCFB-1FC9-4E13-8DAD-199D58059BD3}">.. <Properties>.. <Property Class="Type" GUID="{9463FFA6-9A81-476E-A0F5-76FEB6C1E07C}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{0361C350-A6CD-4ED6-8829-22C85D2FE846}" Name="Name" inheritaction="Ignore" calculatebefore="0

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Forms\NewRadioButton\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1322), with CRLF line terminators
Category:	dropped
Size (bytes):	38782
Entropy (8bit):	5.053136154179905
Encrypted:	false
SSDEEP:	384:rdOMdO8dOuNdOXdOBdOUqGE9W8dO553dO77dOww:Axhu20SqEM5W0Z
MD5:	954C3A0BABE1989A5DFC0A84ECB6E78D
SHA1:	A09A24BCCBDCA25E16145674DDDB964B203FE1B0
SHA-256:	1F5CC7DAAB3960B671C4106B33151E2EDC130BDB4E5E9CF05D0F27DBFA0FB1BB
SHA-512:	21A5853652D7FC7753DA318AAE3BB0A4179A55989EB8476A701EB7E919AAC5C68858E3A7F706D17735B94BD8E86FE86728BFEE20E022F065B4B3C01091FA9708
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="NewRadioButton" GUID="{CB4C7A77-93C2-4E46-BB9B-046435F5C001}">.. <Properties>.. <Property Class="Type" GUID="{C4689797-1C1A-4D96-95C0-F6C885D40833}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{3316A87A-C62F-4590-918F-600AB80621A4}" Name="Name" inheritaction="Ig

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Forms\NewRadioButton\is-HBS44.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1322), with CRLF line terminators
Category:	dropped
Size (bytes):	38782
Entropy (8bit):	5.053136154179905
Encrypted:	false
SSDEEP:	384:rdOMdO8dOuNdOXdOBdOUqGE9W8dO553dO77dOww:Axhu20SqEM5W0Z
MD5:	954C3A0BABE1989A5DFC0A84ECB6E78D
SHA1:	A09A24BCCBDCA25E16145674DDDB964B203FE1B0
SHA-256:	1F5CC7DAAB3960B671C4106B33151E2EDC130BDB4E5E9CF05D0F27DBFA0FB1BB
SHA-512:	21A5853652D7FC7753DA318AAE3BB0A4179A55989EB8476A701EB7E919AAC5C68858E3A7F706D17735B94BD8E86FE86728BFEE20E022F065B4B3C01091FA9708
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="NewRadioButton" GUID="{CB4C7A77-93C2-4E46-BB9B-046435F5C001}">.. <Properties>.. <Property Class="Type" GUID="{C4689797-1C1A-4D96-95C0-F6C885D40833}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Function</Property>.. <Property Class="Text" GUID="{3316A87A-C62F-4590-918F-600AB80621A4}" Name="Name" inheritaction="Ig

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Forms\is-189OB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (963), with CRLF line terminators
Category:	dropped
Size (bytes):	7401
Entropy (8bit):	5.139670586625744
Encrypted:	false
SSDEEP:	192:DldOgdOtdOodOWdOAdOhaWgdOhdOU8dO6:xdOgdOtdOodOWdOAdOkWgdOhdOJdO6
MD5:	0381E5AEECAE815FA98FE8BBC476D9B0
SHA1:	DF466A4D07B295C8B6CC7803938C894328A81F2D
SHA-256:	FA4D596F89D870BF3C4F292274F91FD2CA1AFAC9E332A1CEDC7D4593B55541E9
SHA-512:	6B2C4CDD4C242D786BD7383EA6B7F8B38C13CD6DBF1474128FE16AA28CE5490B41BEC45726DE5BACC9B819C61976B1CBD225B8C293632D31671B38BA038F00D1
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Forms" GUID="{7BA46A77-CE77-43A2-AD6D-C5CD5F3CBF2A}">.. <Properties>.. <Property Class="Type" GUID="{5025CD7C-9703-46F2-93DA-528786C10AFD}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Object</Property>.. <Property Class="Text" GUID="{4A94A15B-952E-4A19-99B8-0AAF66DA6B0C}" Name="Name" inheritaction="Ignore" calculatebefore="0" inh

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Global Variables and\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (598), with CRLF line terminators
Category:	dropped
Size (bytes):	18529
Entropy (8bit):	4.986918344998798
Encrypted:	false
SSDEEP:	192:NB2cp41eSeg/weeSev1nnAmGAmjwm1Jm9ymagm3TqmM1mRpme8mbXmHCmqOmhimM:NB2c6qL/FpRU2
MD5:	938E4B37CEEA87CEB03C5F9B5799D1C0
SHA1:	344275C7C2F0CA11553CE471EFAC782ADEA71DD7
SHA-256:	2DAAB92A3B650F2E42ACA8BF522C9CF059BD818C5325A391243750C22AAC1521
SHA-512:	5241C468FEF9F43FC5B62411859AA5AAC368AFBCD3E680BD4AA944303C3E0E96395583B256117FE47ED8059AB081A7A6060DF7B828E5E0E9F462FC04DFB0C615
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Global Variables and Constants" GUID="{FB3A7F97-0E44-4526-AF46-FAF27ADD7100}">.. <Properties>.. <Property Class="Text" GUID="{844A7093-5555-46EA-8757-62D95998554B}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Global Variables and Constants</Property>.. <Property Class="Type" GUID="{F823536A-7D72-4858-9CBB-81D5594C751A}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Object</Property>.. <Property Class="Number" GUID="{20B7337C-9FD9-46CF-B287-F16B57AE92E0}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">10</Property>.. <Property Class="Memo" GUID="{172F36A9-8DED-463F-B63C-15154552254D}" Name="Form Layout" systemhidden="True" OrderIndex="4" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="D

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Global Variables and\is-8188C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (598), with CRLF line terminators
Category:	dropped
Size (bytes):	18529
Entropy (8bit):	4.986918344998798
Encrypted:	false
SSDEEP:	192:NB2cp41eSeg/weeSev1nnAmGAmjwm1Jm9ymagm3TqmM1mRpme8mbXmHCmqOmhimM:NB2c6qL/FpRU2
MD5:	938E4B37CEEA87CEB03C5F9B5799D1C0
SHA1:	344275C7C2F0CA11553CE471EFAC782ADEA71DD7
SHA-256:	2DAAB92A3B650F2E42ACA8BF522C9CF059BD818C5325A391243750C22AAC1521
SHA-512:	5241C468FEF9F43FC5B62411859AA5AAC368AFBCD3E680BD4AA944303C3E0E96395583B256117FE47ED8059AB081A7A6060DF7B828E5E0E9F462FC04DFB0C615
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Global Variables and Constants" GUID="{FB3A7F97-0E44-4526-AF46-FAF27ADD7100}">.. <Properties>.. <Property Class="Text" GUID="{844A7093-5555-46EA-8757-62D95998554B}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Global Variables and Constants</Property>.. <Property Class="Type" GUID="{F823536A-7D72-4858-9CBB-81D5594C751A}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Object</Property>.. <Property Class="Number" GUID="{20B7337C-9FD9-46CF-B287-F16B57AE92E0}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">10</Property>.. <Property Class="Memo" GUID="{172F36A9-8DED-463F-B63C-15154552254D}" Name="Form Layout" systemhidden="True" OrderIndex="4" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?><Items><Item Name="Name" Order="0"/><Item Name="D

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Items\BringToFront\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (549), with CRLF line terminators
Category:	dropped
Size (bytes):	3121
Entropy (8bit):	5.550294218377425
Encrypted:	false
SSDEEP:	48:cx7edA8N0ND5anK87ClJgL3QLcpKIvtVvaxVtQKnicc:Y7kA8OXk35KSHaxVyKnG
MD5:	F0934D822C49EB44EC6DD13DF30189A2
SHA1:	41986C16FE7CCDD52A733B605BC3824ED1F693C3
SHA-256:	AA0A14A86B09CD2FA4ED0216161B7ECC3AA35F87D48ADC84C5CBDBE900AF1DA6
SHA-512:	9EBC486BC1994E6AEB7CC5594CB7639BC6361FE449A4EB9A295A3ECEFE8ADFC737205706BDA9C9692CB069F5606E68A000F90B0F66BFF04F467D788B656392E5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="BringToFront" GUID="{D5303BE1-A0CE-45D5-A299-EB739FA8A2DB}">.. <Properties>.. <Property Class="Text" GUID="{5F5A5083-F90F-4A53-A012-9FF73D0FE2BE}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">BringToFront</Property>.. <Property Class="Type" GUID="{D764EFE8-C54B-46B0-9847-EBCA4D3C0595}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Procedure</Property>.. <Property Class="Number" GUID="{281E873F-D84C-41D5-97CA-F2935DF14D1F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">-3</Property>.. <Property Class="Memo" GUID="{06381DF0-64F5-4608-9DC1-DA5296BE2520}" Name="Form Layout" systemhidden="True" OrderIndex="4" DecimalPlaces="2"><?xml version="1.0" encoding="iso-8859-1"?>..<Items>.. <Item Name="Name" Order="0"/>.. <Item Name="Declaration" Order

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Items\BringToFront\is-26I74.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (549), with CRLF line terminators
Category:	dropped
Size (bytes):	3121
Entropy (8bit):	5.550294218377425
Encrypted:	false
SSDEEP:	48:cx7edA8N0ND5anK87ClJgL3QLcpKIvtVvaxVtQKnicc:Y7kA8OXk35KSHaxVyKnG
MD5:	F0934D822C49EB44EC6DD13DF30189A2
SHA1:	41986C16FE7CCDD52A733B605BC3824ED1F693C3
SHA-256:	AA0A14A86B09CD2FA4ED0216161B7ECC3AA35F87D48ADC84C5CBDBE900AF1DA6
SHA-512:	9EBC486BC1994E6AEB7CC5594CB7639BC6361FE449A4EB9A295A3ECEFE8ADFC737205706BDA9C9692CB069F5606E68A000F90B0F66BFF04F467D788B656392E5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="BringToFront" GUID="{D5303BE1-A0CE-45D5-A299-EB739FA8A2DB}">.. <Properties>.. <Property Class="Text" GUID="{5F5A5083-F90F-4A53-A012-9FF73D0FE2BE}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">BringToFront</Property>.. <Property Class="Type" GUID="{D764EFE8-C54B-46B0-9847-EBCA4D3C0595}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Procedure</Property>.. <Property Class="Number" GUID="{281E873F-D84C-41D5-97CA-F2935DF14D1F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">-3</Property>.. <Property Class="Memo" GUID="{06381DF0-64F5-4608-9DC1-DA5296BE2520}" Name="Form Layout" systemhidden="True" OrderIndex="4" DecimalPlaces="2"><?xml version="1.0" encoding="iso-8859-1"?>..<Items>.. <Item Name="Name" Order="0"/>.. <Item Name="Declaration" Order

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Items\ChildCount\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (536), with CRLF line terminators
Category:	dropped
Size (bytes):	2757
Entropy (8bit):	5.576338568330614
Encrypted:	false
SSDEEP:	24:2dFDaT/X2gMsS/CApW9vWUgAW1T/1Oc+iPUhf2WAdOcGYSObtRCGds4474ZDqiQz:cG/rMT7nE1SSmnKvtkvtVvSVS+d
MD5:	2D51E16A29BC905BB0F90C346C2295E8
SHA1:	F8FCA53E1CBFA10E7FD4885A76EC1C3B1743C081
SHA-256:	1B2C65B078083D31DC78FD20B771087D7E44D229DE127D6F22445CC6A616468D
SHA-512:	962C926EE6968BBE6082F1BDDE5E2FA336834A74EF1DDDEE1EE84FDEBD0F62400BE9F7ED0936BAAB584F12BC57825B4BA98A6CA569822BF1DDCDBF3C2EC88076
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ChildCount" GUID="{28961ACA-0356-4A04-B1AE-BAFEFCC06AED}">.. <Properties>.. <Property Class="Text" GUID="{AC6080E3-7EFA-4DBC-834C-C4E4083B7FA3}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">ChildCount</Property>.. <Property Class="Type" GUID="{7A4D1159-15D0-410C-95C7-FF38848D88D4}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{CBBAA7ED-F68F-4701-83C4-CFEB1700DF4C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">-2</Property>.. <Property Class="Text" GUID="{C76A6343-6EFF-4970-BBB6-F40A16AAEE64}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="5" DecimalPlaces="2">{28961ACA-0356-4A04-B1AE-BAFEFCC06AED}</Property>.. <Property Class="Memo" GUID="{FEC1D5D6-F9FA-4E95-80D5-0ECBCB4470BF}" Name="HTMLSource" OrderIndex="6" De

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Items\ChildCount\is-85R83.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (536), with CRLF line terminators
Category:	dropped
Size (bytes):	2757
Entropy (8bit):	5.576338568330614
Encrypted:	false
SSDEEP:	24:2dFDaT/X2gMsS/CApW9vWUgAW1T/1Oc+iPUhf2WAdOcGYSObtRCGds4474ZDqiQz:cG/rMT7nE1SSmnKvtkvtVvSVS+d
MD5:	2D51E16A29BC905BB0F90C346C2295E8
SHA1:	F8FCA53E1CBFA10E7FD4885A76EC1C3B1743C081
SHA-256:	1B2C65B078083D31DC78FD20B771087D7E44D229DE127D6F22445CC6A616468D
SHA-512:	962C926EE6968BBE6082F1BDDE5E2FA336834A74EF1DDDEE1EE84FDEBD0F62400BE9F7ED0936BAAB584F12BC57825B4BA98A6CA569822BF1DDCDBF3C2EC88076
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ChildCount" GUID="{28961ACA-0356-4A04-B1AE-BAFEFCC06AED}">.. <Properties>.. <Property Class="Text" GUID="{AC6080E3-7EFA-4DBC-834C-C4E4083B7FA3}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">ChildCount</Property>.. <Property Class="Type" GUID="{7A4D1159-15D0-410C-95C7-FF38848D88D4}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{CBBAA7ED-F68F-4701-83C4-CFEB1700DF4C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">-2</Property>.. <Property Class="Text" GUID="{C76A6343-6EFF-4970-BBB6-F40A16AAEE64}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="5" DecimalPlaces="2">{28961ACA-0356-4A04-B1AE-BAFEFCC06AED}</Property>.. <Property Class="Memo" GUID="{FEC1D5D6-F9FA-4E95-80D5-0ECBCB4470BF}" Name="HTMLSource" OrderIndex="6" De

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Items\ChildItem\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (700), with CRLF line terminators
Category:	dropped
Size (bytes):	3195
Entropy (8bit):	5.5328166902153635
Encrypted:	false
SSDEEP:	48:ceEZCTaVLMud93nz9veubvvtrIvtVvRvi+vRq1VSaDeubwkJ/:0smVLRBveur0HNjRq1VTDeuD/
MD5:	6689399624B5917886A245C431F1131E
SHA1:	8C335B587E3FC53B263173C716E3C9C515E98B67
SHA-256:	C0FBDBDFD5939EED3E8158B229EF72CFC8BB3F97913CAA70BB390AF2CAB4528A
SHA-512:	6F4299650CFBF05F7FBA9B94FDAA058B2B2D138FB695F6901F7A1C057939F652C04D30C06F4D388AD68B43C73E36537217EFFB62F9C5B9178941E120F1E82BAC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ChildItem" GUID="{1EF77B02-D568-43DF-8455-2E197DD15E01}">.. <Properties>.. <Property Class="Text" GUID="{4655E95A-B19E-49A8-BC9F-F8B0F6E5DE83}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">ChildItem</Property>.. <Property Class="Type" GUID="{9722E0F5-3AF2-478F-B2E0-966EDD0215A6}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{EC592FED-F9D5-4C2F-A093-D466B775098B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">-1.5</Property>.. <Property Class="Text" GUID="{D0397AFF-5E77-4456-ACAB-ECCF30BB001C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="5" DecimalPlaces="2">{1EF77B02-D568-43DF-8455-2E197DD15E01}</Property>.. <Property Class="Memo" GUID="{C2767A92-7300-4F35-9C26-EB017A32CA0B}" Name="HTMLSource" OrderIndex="6" De

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Items\ChildItem\is-8AT74.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (700), with CRLF line terminators
Category:	dropped
Size (bytes):	3195
Entropy (8bit):	5.5328166902153635
Encrypted:	false
SSDEEP:	48:ceEZCTaVLMud93nz9veubvvtrIvtVvRvi+vRq1VSaDeubwkJ/:0smVLRBveur0HNjRq1VTDeuD/
MD5:	6689399624B5917886A245C431F1131E
SHA1:	8C335B587E3FC53B263173C716E3C9C515E98B67
SHA-256:	C0FBDBDFD5939EED3E8158B229EF72CFC8BB3F97913CAA70BB390AF2CAB4528A
SHA-512:	6F4299650CFBF05F7FBA9B94FDAA058B2B2D138FB695F6901F7A1C057939F652C04D30C06F4D388AD68B43C73E36537217EFFB62F9C5B9178941E120F1E82BAC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ChildItem" GUID="{1EF77B02-D568-43DF-8455-2E197DD15E01}">.. <Properties>.. <Property Class="Text" GUID="{4655E95A-B19E-49A8-BC9F-F8B0F6E5DE83}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">ChildItem</Property>.. <Property Class="Type" GUID="{9722E0F5-3AF2-478F-B2E0-966EDD0215A6}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Function</Property>.. <Property Class="Number" GUID="{EC592FED-F9D5-4C2F-A093-D466B775098B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">-1.5</Property>.. <Property Class="Text" GUID="{D0397AFF-5E77-4456-ACAB-ECCF30BB001C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="5" DecimalPlaces="2">{1EF77B02-D568-43DF-8455-2E197DD15E01}</Property>.. <Property Class="Memo" GUID="{C2767A92-7300-4F35-9C26-EB017A32CA0B}" Name="HTMLSource" OrderIndex="6" De

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Items\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (361), with CRLF line terminators
Category:	dropped
Size (bytes):	1888
Entropy (8bit):	5.572703962967854
Encrypted:	false
SSDEEP:	24:2dFDPnX2L6p/CApWUCVoBgAWIh1Ocozpkf2WAdOcGssdWvd9bt5GBwZDqi41YCaE:c1nGusaasadzohVZTP8do
MD5:	159692A43E3761F7EE126FEC5F914D45
SHA1:	8262CA9B3D4438EC54BCC3EC766BD3A9BE694445
SHA-256:	F6AC9C6CD01C17D405E0035A71533BEB421292A3C0C04A8F80A9562B6E143C67
SHA-512:	F32CDE151EA63723DEDDA5A5D067ABD1C45B678B47FB66FC392F8531CF219CFE95E8BA7E9F3249886A08E37894D4EA118D888E01D4A428B11C78A57B47AF0A1D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Items" GUID="{20A298F5-77E8-40BE-8172-6C935BE5FD97}">.. <Properties>.. <Property Class="Text" GUID="{28B32347-B1E3-4382-B0DD-D4D942D3ED4C}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Items</Property>.. <Property Class="Type" GUID="{6A341BD2-0DEF-4D86-9A58-8D14913AEAD7}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Object</Property>.. <Property Class="Number" GUID="{A31C789D-E581-4D9F-995B-88F7412FB0AB}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">5</Property>.. <Property Class="Text" GUID="{F6B0B3FE-4CC5-495D-95F9-8BECE21142BF}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="5" DecimalPlaces="2">{20A298F5-77E8-40BE-8172-6C935BE5FD97}</Property>.. <Property Class="Memo" GUID="{13F7AF40-5A88-4A08-8B6D-9EE5A3DE8590}" Name="HTMLSource" OrderIndex="6" DecimalPlaces="

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\Items\is-AFFKP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (361), with CRLF line terminators
Category:	dropped
Size (bytes):	1888
Entropy (8bit):	5.572703962967854
Encrypted:	false
SSDEEP:	24:2dFDPnX2L6p/CApWUCVoBgAWIh1Ocozpkf2WAdOcGssdWvd9bt5GBwZDqi41YCaE:c1nGusaasadzohVZTP8do
MD5:	159692A43E3761F7EE126FEC5F914D45
SHA1:	8262CA9B3D4438EC54BCC3EC766BD3A9BE694445
SHA-256:	F6AC9C6CD01C17D405E0035A71533BEB421292A3C0C04A8F80A9562B6E143C67
SHA-512:	F32CDE151EA63723DEDDA5A5D067ABD1C45B678B47FB66FC392F8531CF219CFE95E8BA7E9F3249886A08E37894D4EA118D888E01D4A428B11C78A57B47AF0A1D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Items" GUID="{20A298F5-77E8-40BE-8172-6C935BE5FD97}">.. <Properties>.. <Property Class="Text" GUID="{28B32347-B1E3-4382-B0DD-D4D942D3ED4C}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Items</Property>.. <Property Class="Type" GUID="{6A341BD2-0DEF-4D86-9A58-8D14913AEAD7}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Object</Property>.. <Property Class="Number" GUID="{A31C789D-E581-4D9F-995B-88F7412FB0AB}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">5</Property>.. <Property Class="Text" GUID="{F6B0B3FE-4CC5-495D-95F9-8BECE21142BF}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="5" DecimalPlaces="2">{20A298F5-77E8-40BE-8172-6C935BE5FD97}</Property>.. <Property Class="Memo" GUID="{13F7AF40-5A88-4A08-8B6D-9EE5A3DE8590}" Name="HTMLSource" OrderIndex="6" DecimalPlaces="

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\Scripting\is-NVVQJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (974), with CRLF line terminators
Category:	dropped
Size (bytes):	7275
Entropy (8bit):	5.125883511661624
Encrypted:	false
SSDEEP:	192:ddO0dOCFSdOCAdOddOIdO4gdOsdOMhwodOB:ddO0dOCAdOjdOddOIdO4gdOsdOMhwodg
MD5:	D02527EDAA39DCF91B10F6B66D2458DE
SHA1:	69C43A88DD0133B698D879295194435C985C065A
SHA-256:	DE25A5BC7175D86808E9A6660CB355F3E14AE759C014F99C42814EB0340806D8
SHA-512:	7B3FF115D81FDC8D78733AFD7E65B35652CCC3E6DD142D2F0BC52C7080A041F8654361EFF793208A572948E4ED4F123388642312BD37DF6E1B683419984F8A76
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Scripting" GUID="{53DF5316-8F88-441C-AF57-F8A1A6662ED1}">.. <Properties>.. <Property Class="Text" GUID="{BCD2129E-C502-4B90-B0CF-8EA57DE4A479}" Name="Name" inheritaction="" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Scripting</Property>.. <Property Class="Type" GUID="{BE039451-4DE5-4B14-B67D-42E3977C8646}" Name="Type" inheritaction="" calculatebefore="0" inhe

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\is-94PED.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (958), with CRLF line terminators
Category:	dropped
Size (bytes):	7262
Entropy (8bit):	5.136702060712245
Encrypted:	false
SSDEEP:	192:kaddOZkdOsdORdOXdOvdOEWgdOmdORdOpiY:/dOudOsdORdOXdOvdOEWgdOmdORdOH
MD5:	98F456764752C2DDE915483F5899607E
SHA1:	CFF088AF08C25A05AC864B00378F2A382FAD7632
SHA-256:	86ABA14FA38538FF669067CF7D51D433B82B7293CE3B7D783E1BB4537EBC61FD
SHA-512:	51819AD586DF7037CADA90B8EB4D50C3FFBE5BA3F48DA8E9BDDB65ACBCA3680D051266419A5CA45F53BE2017E3DD85F43A999821164FDF387ED845EACB358ADB
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="_PlanSwift Help" GUID="{BFB127A6-DAD6-47BD-92EC-80226C317034}">.. <Properties>.. <Property Class="Text" GUID="{0D5A97E5-7232-4EFD-9A5F-FEFE3B2FE0FB}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_PlanSwift Help</Property>.. <Property Class="Type" GUID="{634AE062-8E6E-4568-9657-C6B835CA30B5}" Name="Type" inheritaction="" calc

C:\Program Files (x86)\PlanSwift11\Data\Reports\Legacy Reports1\Detail Reports\Detailed Subcontracts\Subcontract Costing\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (9291), with CRLF line terminators
Category:	dropped
Size (bytes):	19489
Entropy (8bit):	5.780130346714698
Encrypted:	false
SSDEEP:	384:DeZVSZgzTpANusl6QuHTUXkssJiGImB6Lw5D3B3zi1D7UL:DytBoXMnEw5D3B3CgL
MD5:	55AAE48B3BB3A985A5E21A4C789AF30C
SHA1:	081D295A4E22A3B483FADD188B409871A3C4C3F8
SHA-256:	4B8BAACBBEECCFD6F4B265758D1D84EABE75391D59858A891FA78ABD6EA59986
SHA-512:	A882C583D66780421E2B0796A9C5B4F536C7D089BFAF0459572D6E2320047016AFDDC2F6B57C7F57D0657902EC52046E68C1B5E211E8A759D61040E0CF6BE8EB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Subcontract Costing by Folder" GUID="{800BFDAD-782A-465E-AA06-B6F19B2FE68B}">.. <Properties>.. <Property Class="Text" GUID="{E2B94DD9-1974-4E31-A5C1-E309AE0BC3FB}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Subcontract Costing by Folder</Property>.. <Property Class="Type" GUID="{76980014-BFF1-455E-ABFE-2F52AD628C14}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Report</Property>.. <Property Class="Number" GUID="{9D59C263-D893-4694-8CE1-B0B0567B9264}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Text" GUID="{75820AAC-B595-40AB-A7ED-77D59B5D1AF7}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{800BFDAD-782A-465E-AA06-B6F19B2FE68B}</Property>.. <Property Class="Memo" GUID="{CA441B52-A669-4180-813E-7F5597F7E1C1}"

C:\Program Files (x86)\PlanSwift11\Data\Reports\Legacy Reports1\Detail Reports\Detailed Subcontracts\Subcontract Costing\is-IUE0L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (9291), with CRLF line terminators
Category:	dropped
Size (bytes):	19489
Entropy (8bit):	5.780130346714698
Encrypted:	false
SSDEEP:	384:DeZVSZgzTpANusl6QuHTUXkssJiGImB6Lw5D3B3zi1D7UL:DytBoXMnEw5D3B3CgL
MD5:	55AAE48B3BB3A985A5E21A4C789AF30C
SHA1:	081D295A4E22A3B483FADD188B409871A3C4C3F8
SHA-256:	4B8BAACBBEECCFD6F4B265758D1D84EABE75391D59858A891FA78ABD6EA59986
SHA-512:	A882C583D66780421E2B0796A9C5B4F536C7D089BFAF0459572D6E2320047016AFDDC2F6B57C7F57D0657902EC52046E68C1B5E211E8A759D61040E0CF6BE8EB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Subcontract Costing by Folder" GUID="{800BFDAD-782A-465E-AA06-B6F19B2FE68B}">.. <Properties>.. <Property Class="Text" GUID="{E2B94DD9-1974-4E31-A5C1-E309AE0BC3FB}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Subcontract Costing by Folder</Property>.. <Property Class="Type" GUID="{76980014-BFF1-455E-ABFE-2F52AD628C14}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Report</Property>.. <Property Class="Number" GUID="{9D59C263-D893-4694-8CE1-B0B0567B9264}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Text" GUID="{75820AAC-B595-40AB-A7ED-77D59B5D1AF7}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{800BFDAD-782A-465E-AA06-B6F19B2FE68B}</Property>.. <Property Class="Memo" GUID="{CA441B52-A669-4180-813E-7F5597F7E1C1}"

C:\Program Files (x86)\PlanSwift11\Data\Reports\Legacy Reports1\Detail Reports\Detailed Subcontracts\Subcontract Summary1\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (8103), with CRLF line terminators
Category:	dropped
Size (bytes):	18313
Entropy (8bit):	5.78939627933254
Encrypted:	false
SSDEEP:	384:poCSZgzOBmANJsx7ibup9v0+iGLt0dlw5D3B3zW1Damw:WSCbw5D3B3eaj
MD5:	BF34A9851D21304DC2AA4B48B50CACBC
SHA1:	F89D387BBF6508E9968EE1C83F499891F1BC6A00
SHA-256:	A15F650F1D5D70781DB66DD7AA303A5B299807EC6EF557557F6A97DDBCDEB8BC
SHA-512:	9593E327EA1FD629B2929DBF24C9271280888779942A5D9533CDCFD6CFE24E39DA8573287E9A9F2601A3AD873154272336F61A96C29980681A2EB16830AEA48D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Subcontract Summary by Folder" GUID="{2CD457BC-FCBA-4802-926F-1DDA7003C121}">.. <Properties>.. <Property Class="Text" GUID="{96CCFF4B-1301-4C68-B43F-C8690DFB15A6}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Subcontract Summary by Folder</Property>.. <Property Class="Type" GUID="{773FD88E-36B0-49F3-A304-6AA69FCB8825}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Report</Property>.. <Property Class="Number" GUID="{428A4D47-356E-48A3-811D-427E508DA66C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Text" GUID="{8F84E0C3-18BA-47BC-8DC9-3FCE0A893E7F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{2CD457BC-FCBA-4802-926F-1DDA7003C121}</Property>.. <Property Class="Memo" GUID="{D4FF6AE5-7ABE-4D43-A1B3-870F58FDCB58}"

C:\Program Files (x86)\PlanSwift11\Data\Reports\Legacy Reports1\Detail Reports\Detailed Subcontracts\Subcontract Summary1\is-2U2AP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (8103), with CRLF line terminators
Category:	dropped
Size (bytes):	18313
Entropy (8bit):	5.78939627933254
Encrypted:	false
SSDEEP:	384:poCSZgzOBmANJsx7ibup9v0+iGLt0dlw5D3B3zW1Damw:WSCbw5D3B3eaj
MD5:	BF34A9851D21304DC2AA4B48B50CACBC
SHA1:	F89D387BBF6508E9968EE1C83F499891F1BC6A00
SHA-256:	A15F650F1D5D70781DB66DD7AA303A5B299807EC6EF557557F6A97DDBCDEB8BC
SHA-512:	9593E327EA1FD629B2929DBF24C9271280888779942A5D9533CDCFD6CFE24E39DA8573287E9A9F2601A3AD873154272336F61A96C29980681A2EB16830AEA48D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Subcontract Summary by Folder" GUID="{2CD457BC-FCBA-4802-926F-1DDA7003C121}">.. <Properties>.. <Property Class="Text" GUID="{96CCFF4B-1301-4C68-B43F-C8690DFB15A6}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Subcontract Summary by Folder</Property>.. <Property Class="Type" GUID="{773FD88E-36B0-49F3-A304-6AA69FCB8825}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Report</Property>.. <Property Class="Number" GUID="{428A4D47-356E-48A3-811D-427E508DA66C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Text" GUID="{8F84E0C3-18BA-47BC-8DC9-3FCE0A893E7F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{2CD457BC-FCBA-4802-926F-1DDA7003C121}</Property>.. <Property Class="Memo" GUID="{D4FF6AE5-7ABE-4D43-A1B3-870F58FDCB58}"

C:\Program Files (x86)\PlanSwift11\Data\Reports\Legacy Reports1\Detail Reports\Detailed Subcontracts\Subcontract Summary\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (7731), with CRLF line terminators
Category:	dropped
Size (bytes):	17875
Entropy (8bit):	5.79352091022556
Encrypted:	false
SSDEEP:	384:8oCSZgzOBPENJsx7ibuppvfIGLt0d0w5D3B3zCo1D7UL:9SCZw5D3B3ngL
MD5:	18410577526917ECAD7606B4177B173C
SHA1:	35C448AA1EDC466AA9B0D76DED1283B8AE491DEE
SHA-256:	2FCBA2657DCEAD0A4D01E49BCF988BD8E8FD003BC290D7C22B985F067361FD1D
SHA-512:	ABA71A6AF9FBB947AE179028B17587C689F2CEBE5435395894F7092B2A1F7B7902A2430E59EB9C1D82B2113EF3ABB4F77F5A295170673C2D4570B62225A56FF5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Subcontract Summary List" GUID="{1F64AB92-3447-40CD-8FA5-F028C9A44880}">.. <Properties>.. <Property Class="Text" GUID="{90D00905-A29A-4621-A54C-A745BFDBA322}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Subcontract Summary List</Property>.. <Property Class="Type" GUID="{5856603F-E915-4BF2-A5CF-CADF07AD2A33}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Report</Property>.. <Property Class="Number" GUID="{51FD476F-E7E9-4688-8E87-F24B3AA8ABC3}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Text" GUID="{DEF4EA78-8D10-474B-A961-87C466F57707}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{1F64AB92-3447-40CD-8FA5-F028C9A44880}</Property>.. <Property Class="Memo" GUID="{C10A8783-0313-45E9-B74B-B74F26874093}" Name="Form

C:\Program Files (x86)\PlanSwift11\Data\Reports\Legacy Reports1\Detail Reports\Detailed Subcontracts\Subcontract Summary\is-OLERF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (7731), with CRLF line terminators
Category:	dropped
Size (bytes):	17875
Entropy (8bit):	5.79352091022556
Encrypted:	false
SSDEEP:	384:8oCSZgzOBPENJsx7ibuppvfIGLt0d0w5D3B3zCo1D7UL:9SCZw5D3B3ngL
MD5:	18410577526917ECAD7606B4177B173C
SHA1:	35C448AA1EDC466AA9B0D76DED1283B8AE491DEE
SHA-256:	2FCBA2657DCEAD0A4D01E49BCF988BD8E8FD003BC290D7C22B985F067361FD1D
SHA-512:	ABA71A6AF9FBB947AE179028B17587C689F2CEBE5435395894F7092B2A1F7B7902A2430E59EB9C1D82B2113EF3ABB4F77F5A295170673C2D4570B62225A56FF5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Subcontract Summary List" GUID="{1F64AB92-3447-40CD-8FA5-F028C9A44880}">.. <Properties>.. <Property Class="Text" GUID="{90D00905-A29A-4621-A54C-A745BFDBA322}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Subcontract Summary List</Property>.. <Property Class="Type" GUID="{5856603F-E915-4BF2-A5CF-CADF07AD2A33}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Report</Property>.. <Property Class="Number" GUID="{51FD476F-E7E9-4688-8E87-F24B3AA8ABC3}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Text" GUID="{DEF4EA78-8D10-474B-A961-87C466F57707}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{1F64AB92-3447-40CD-8FA5-F028C9A44880}</Property>.. <Property Class="Memo" GUID="{C10A8783-0313-45E9-B74B-B74F26874093}" Name="Form

C:\Program Files (x86)\PlanSwift11\Data\Reports\Legacy Reports1\Reports Showing All\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1327
Entropy (8bit):	5.516234686033227
Encrypted:	false
SSDEEP:	24:2d2HgX2C4e/CApW7s6ZhBgAWDBPI/f1OcI4XjJf2WAdOcbH7h7fqcGQD5anK3jOv:cN1dF6ZhYI8Ne+BiuD5anK3jA
MD5:	C7F72363FD512668261D3827851A5213
SHA1:	D19BF745FF0F006074D7A219A6764150401F7BC3
SHA-256:	B1822A5157E06473B441E31CEA2458C8A53F279218F2C1F51C8425C2FD2DC44E
SHA-512:	7C156DF64E74EC1E1A0B23281398BFAA4878E5668E931850A588EC88F18230B4025D0B75E9C4219666457BC070E709A313AB624FAF766D89422E00B2D5339E89
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Reports Showing All Items" GUID="{32390FB5-0174-457E-A5E9-991EC3B61D0A}">.. <Properties>.. <Property Class="Text" GUID="{1440E23B-E21D-418D-B5DA-1935F1D202E9}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Reports Showing All Items</Property>.. <Property Class="Type" GUID="{A375C672-9B38-489D-9C8A-18C5E26FE13F}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Number" GUID="{8235102B-5E0E-43CA-BDD3-B13017852A6B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Text" GUID="{36E98D38-212B-471E-905B-68793D5963CC}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{32390FB5-0174-457E-A5E9-991EC3B61D0A}</Property>.. <Property Class="Memo" GUID="{C7E3CB32-F28B-4512-A314-F454F22FBC26}" Name="

C:\Program Files (x86)\PlanSwift11\Data\Reports\Legacy Reports1\Reports Showing All\Detailed Estimate -\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (7299), with CRLF line terminators
Category:	dropped
Size (bytes):	17044
Entropy (8bit):	5.761200029890835
Encrypted:	false
SSDEEP:	384:WOiI5pIR2v++Xv7MiUF7RssR6x3RtcO3Vyi:WbIzI2dTf
MD5:	05E335B3FF860CC72843386FD88677E0
SHA1:	0EE9CAB4CD3FF2A5E57FC945E537276D62355243
SHA-256:	F307B8451F797DDFE9B2CE2008A9C9D006E6ABEBC884FFE09A500D04FAC4341F
SHA-512:	1AD1D7FFE77957C50868C676C9B18584601C8E5C105D010FB36702D74B3749DDD56862E44195536F316C0EE36D8A9595B2448B5EC5DAFC4F5B58EAEA8B90924E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Detailed Estimate - Customer Copy" GUID="{8CC64331-59C8-4E16-891D-573A55D0F90E}">.. <Properties>.. <Property Class="Text" GUID="{B2D8738B-07BF-423E-BE25-83155583089B}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Detailed Estimate - Customer Copy</Property>.. <Property Class="Type" GUID="{3A0AA801-FE70-459F-A811-C32BD0DF79EA}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Report</Property>.. <Property Class="Number" GUID="{04C5424A-9517-4B58-B684-0D8DB13D2EBB}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Text" GUID="{32753F36-3A24-4BAB-9C46-71345B377030}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{8CC64331-59C8-4E16-891D-573A55D0F90E}</Property>.. <Property Class="Stream" GUID="{27AAA4C4-7477-4164-A458-6F7BF

C:\Program Files (x86)\PlanSwift11\Data\Reports\Legacy Reports1\Reports Showing All\Detailed Estimate -\is-NHJJ3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (7299), with CRLF line terminators
Category:	dropped
Size (bytes):	17044
Entropy (8bit):	5.761200029890835
Encrypted:	false
SSDEEP:	384:WOiI5pIR2v++Xv7MiUF7RssR6x3RtcO3Vyi:WbIzI2dTf
MD5:	05E335B3FF860CC72843386FD88677E0
SHA1:	0EE9CAB4CD3FF2A5E57FC945E537276D62355243
SHA-256:	F307B8451F797DDFE9B2CE2008A9C9D006E6ABEBC884FFE09A500D04FAC4341F
SHA-512:	1AD1D7FFE77957C50868C676C9B18584601C8E5C105D010FB36702D74B3749DDD56862E44195536F316C0EE36D8A9595B2448B5EC5DAFC4F5B58EAEA8B90924E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Detailed Estimate - Customer Copy" GUID="{8CC64331-59C8-4E16-891D-573A55D0F90E}">.. <Properties>.. <Property Class="Text" GUID="{B2D8738B-07BF-423E-BE25-83155583089B}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Detailed Estimate - Customer Copy</Property>.. <Property Class="Type" GUID="{3A0AA801-FE70-459F-A811-C32BD0DF79EA}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Report</Property>.. <Property Class="Number" GUID="{04C5424A-9517-4B58-B684-0D8DB13D2EBB}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Text" GUID="{32753F36-3A24-4BAB-9C46-71345B377030}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{8CC64331-59C8-4E16-891D-573A55D0F90E}</Property>.. <Property Class="Stream" GUID="{27AAA4C4-7477-4164-A458-6F7BF

C:\Program Files (x86)\PlanSwift11\Data\Reports\Legacy Reports1\Reports Showing All\Detailed Estimate wi\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (10943), with CRLF line terminators
Category:	dropped
Size (bytes):	20611
Entropy (8bit):	5.735495173758482
Encrypted:	false
SSDEEP:	384:ATi9WlVFXZVn2aOQyiY5j/lOzNssfMtcO3h3q/8L:o2WLJXilTh3dL
MD5:	6212D7A86B68DCCA3B397F20F23C9EF6
SHA1:	1DCEE20952C3B76F78590E8F3C9D99A34D9F7D69
SHA-256:	ED21DAC1755A648FFF7487750A6F5EA9C5EB777326AFCC99CCCA2682A327BBA3
SHA-512:	9DC795BB0FB265AA3CEA50EA803090785B61A33C9C8E685B03C42C919AD6B769B9E39F58D70D9B7CAF1FE66A8C5574A44DF17DC46488AC043023F41A0B37ECEE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Detailed Estimate with Markup" GUID="{FC81F5CB-0B0E-4C88-9540-80F32B3F0344}">.. <Properties>.. <Property Class="Text" GUID="{1A721677-FD4D-44CB-A718-BEF54B3E626B}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Detailed Estimate with Markup</Property>.. <Property Class="Type" GUID="{33B6CB92-C4A1-4CFE-AD7E-1A0F213BEDE1}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="2">Report</Property>.. <Property Class="Number" GUID="{77884A15-0CC2-4CC2-9904-A244AC47AE4A}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">1</Property>.. <Property Class="Text" GUID="{BDD91FE9-A69E-4BEF-9566-9C5483C84FA6}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{FC81F5CB-0B0E-4C88-9540-80F32B3F0344}</Property>.. <Property Class="Stream" GUID="{5B83C348-CFA7-4DAC-A52F-4B8264E8FE59}" Name="ViewD

C:\Program Files (x86)\PlanSwift11\Data\Reports\Legacy Reports1\Reports Showing All\Detailed Estimate wi\is-QNBQM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (10943), with CRLF line terminators
Category:	dropped
Size (bytes):	20611
Entropy (8bit):	5.735495173758482
Encrypted:	false
SSDEEP:	384:ATi9WlVFXZVn2aOQyiY5j/lOzNssfMtcO3h3q/8L:o2WLJXilTh3dL
MD5:	6212D7A86B68DCCA3B397F20F23C9EF6
SHA1:	1DCEE20952C3B76F78590E8F3C9D99A34D9F7D69
SHA-256:	ED21DAC1755A648FFF7487750A6F5EA9C5EB777326AFCC99CCCA2682A327BBA3
SHA-512:	9DC795BB0FB265AA3CEA50EA803090785B61A33C9C8E685B03C42C919AD6B769B9E39F58D70D9B7CAF1FE66A8C5574A44DF17DC46488AC043023F41A0B37ECEE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Detailed Estimate with Markup" GUID="{FC81F5CB-0B0E-4C88-9540-80F32B3F0344}">.. <Properties>.. <Property Class="Text" GUID="{1A721677-FD4D-44CB-A718-BEF54B3E626B}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Detailed Estimate with Markup</Property>.. <Property Class="Type" GUID="{33B6CB92-C4A1-4CFE-AD7E-1A0F213BEDE1}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="2">Report</Property>.. <Property Class="Number" GUID="{77884A15-0CC2-4CC2-9904-A244AC47AE4A}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">1</Property>.. <Property Class="Text" GUID="{BDD91FE9-A69E-4BEF-9566-9C5483C84FA6}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{FC81F5CB-0B0E-4C88-9540-80F32B3F0344}</Property>.. <Property Class="Stream" GUID="{5B83C348-CFA7-4DAC-A52F-4B8264E8FE59}" Name="ViewD

C:\Program Files (x86)\PlanSwift11\Data\Reports\Legacy Reports1\Reports Showing All\Project Cost vs Sell\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (10279), with CRLF line terminators
Category:	dropped
Size (bytes):	20535
Entropy (8bit):	5.7685998856658705
Encrypted:	false
SSDEEP:	384:y6FAlVFPZVEt9pdb75gtWFqGfsH0eWWFJcO3o3qfJv:feLVXX3To3M9
MD5:	6FB865804A4EE4607F7F30AE94736BBF
SHA1:	C373DC8CA267386D63AD920272F39D90D66CB064
SHA-256:	92E44D9D3FEDDDCCB6FDA62D29C9187C60E2C578C5BA8795BD510BD51E0ED285
SHA-512:	BFA08A5D76460A8250868762464317416FF89DAAA65277634C0C3B92EC5D2BD247F23F9CA769C6DE55201CA28B19D9E5B17421AFCB8E617571A89C70847B1071
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Project Cost vs Sell" GUID="{6874E3D1-1957-40DA-AD2A-A038D491641C}">.. <Properties>.. <Property Class="Text" GUID="{0356E957-C61F-4095-A584-047539E56B3B}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Project Cost vs Sell</Property>.. <Property Class="Type" GUID="{1C229CA7-C8B9-4101-80F9-D3010EF7733C}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Report</Property>.. <Property Class="Number" GUID="{A5E139F2-9177-4D93-AF8C-51AB68DBEFB8}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Text" GUID="{C4E7B5AA-B49A-49C6-8409-2171688630CD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{6874E3D1-1957-40DA-AD2A-A038D491641C}</Property>.. <Property Class="Memo" GUID="{3C5C7340-B6E6-4876-BC9E-4CBD4427083F}" Name="Form Layout"

C:\Program Files (x86)\PlanSwift11\Data\Reports\Legacy Reports1\Reports Showing All\Project Cost vs Sell\is-OKOLQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (10279), with CRLF line terminators
Category:	dropped
Size (bytes):	20535
Entropy (8bit):	5.7685998856658705
Encrypted:	false
SSDEEP:	384:y6FAlVFPZVEt9pdb75gtWFqGfsH0eWWFJcO3o3qfJv:feLVXX3To3M9
MD5:	6FB865804A4EE4607F7F30AE94736BBF
SHA1:	C373DC8CA267386D63AD920272F39D90D66CB064
SHA-256:	92E44D9D3FEDDDCCB6FDA62D29C9187C60E2C578C5BA8795BD510BD51E0ED285
SHA-512:	BFA08A5D76460A8250868762464317416FF89DAAA65277634C0C3B92EC5D2BD247F23F9CA769C6DE55201CA28B19D9E5B17421AFCB8E617571A89C70847B1071
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Project Cost vs Sell" GUID="{6874E3D1-1957-40DA-AD2A-A038D491641C}">.. <Properties>.. <Property Class="Text" GUID="{0356E957-C61F-4095-A584-047539E56B3B}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Project Cost vs Sell</Property>.. <Property Class="Type" GUID="{1C229CA7-C8B9-4101-80F9-D3010EF7733C}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Report</Property>.. <Property Class="Number" GUID="{A5E139F2-9177-4D93-AF8C-51AB68DBEFB8}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Text" GUID="{C4E7B5AA-B49A-49C6-8409-2171688630CD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{6874E3D1-1957-40DA-AD2A-A038D491641C}</Property>.. <Property Class="Memo" GUID="{3C5C7340-B6E6-4876-BC9E-4CBD4427083F}" Name="Form Layout"

C:\Program Files (x86)\PlanSwift11\Data\Reports\Legacy Reports1\Reports Showing All\Project Costs\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (9011), with CRLF line terminators
Category:	dropped
Size (bytes):	19061
Entropy (8bit):	5.78034286906666
Encrypted:	false
SSDEEP:	384:U6aAlVFPZV/+A0jtA/dPKII8sAlWWi2cO3x3qs8L:p1LVXpfTx3uL
MD5:	9965E869C35F221B9AC125D32AD17610
SHA1:	D753CE35BC6237D1EE4D5B3C994BA6B8DA52B778
SHA-256:	602A4B358D15804CD33FBE69100838F79354B2D443EDBDD596088388D126A56A
SHA-512:	C407CC1E296EAC2028DE79800A80FB815EFDBA98C891AC73F5D45907064D699771F215639AED52188931DEE5322F8D7D07E0DC2B262551AF3DE1ECD33A3293E1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Project Costs" GUID="{F7CD3B5E-68C0-44DC-90EC-C07F47E2CA63}">.. <Properties>.. <Property Class="Text" GUID="{E09D1AAD-B78A-430C-B120-1A4A45F4C9E3}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Project Costs</Property>.. <Property Class="Type" GUID="{DA446290-48B5-4A07-AC04-190FEDB49684}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Report</Property>.. <Property Class="Number" GUID="{324E0BAA-B52B-430D-ABC6-3909DA742B86}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Text" GUID="{E3366324-6D92-4631-B5E4-72C96E908E91}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{F7CD3B5E-68C0-44DC-90EC-C07F47E2CA63}</Property>.. <Property Class="Memo" GUID="{073E35D3-CD10-45C7-9677-8B20E768BE34}" Name="Form Layout" systemhidden=

C:\Program Files (x86)\PlanSwift11\Data\Reports\Legacy Reports1\Reports Showing All\Project Costs\is-H837M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (9011), with CRLF line terminators
Category:	dropped
Size (bytes):	19061
Entropy (8bit):	5.78034286906666
Encrypted:	false
SSDEEP:	384:U6aAlVFPZV/+A0jtA/dPKII8sAlWWi2cO3x3qs8L:p1LVXpfTx3uL
MD5:	9965E869C35F221B9AC125D32AD17610
SHA1:	D753CE35BC6237D1EE4D5B3C994BA6B8DA52B778
SHA-256:	602A4B358D15804CD33FBE69100838F79354B2D443EDBDD596088388D126A56A
SHA-512:	C407CC1E296EAC2028DE79800A80FB815EFDBA98C891AC73F5D45907064D699771F215639AED52188931DEE5322F8D7D07E0DC2B262551AF3DE1ECD33A3293E1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Project Costs" GUID="{F7CD3B5E-68C0-44DC-90EC-C07F47E2CA63}">.. <Properties>.. <Property Class="Text" GUID="{E09D1AAD-B78A-430C-B120-1A4A45F4C9E3}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Project Costs</Property>.. <Property Class="Type" GUID="{DA446290-48B5-4A07-AC04-190FEDB49684}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Report</Property>.. <Property Class="Number" GUID="{324E0BAA-B52B-430D-ABC6-3909DA742B86}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Text" GUID="{E3366324-6D92-4631-B5E4-72C96E908E91}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{F7CD3B5E-68C0-44DC-90EC-C07F47E2CA63}</Property>.. <Property Class="Memo" GUID="{073E35D3-CD10-45C7-9677-8B20E768BE34}" Name="Form Layout" systemhidden=

C:\Program Files (x86)\PlanSwift11\Data\Reports\Legacy Reports1\Reports Showing All\is-75O5K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1327
Entropy (8bit):	5.516234686033227
Encrypted:	false
SSDEEP:	24:2d2HgX2C4e/CApW7s6ZhBgAWDBPI/f1OcI4XjJf2WAdOcbH7h7fqcGQD5anK3jOv:cN1dF6ZhYI8Ne+BiuD5anK3jA
MD5:	C7F72363FD512668261D3827851A5213
SHA1:	D19BF745FF0F006074D7A219A6764150401F7BC3
SHA-256:	B1822A5157E06473B441E31CEA2458C8A53F279218F2C1F51C8425C2FD2DC44E
SHA-512:	7C156DF64E74EC1E1A0B23281398BFAA4878E5668E931850A588EC88F18230B4025D0B75E9C4219666457BC070E709A313AB624FAF766D89422E00B2D5339E89
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Reports Showing All Items" GUID="{32390FB5-0174-457E-A5E9-991EC3B61D0A}">.. <Properties>.. <Property Class="Text" GUID="{1440E23B-E21D-418D-B5DA-1935F1D202E9}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Reports Showing All Items</Property>.. <Property Class="Type" GUID="{A375C672-9B38-489D-9C8A-18C5E26FE13F}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Number" GUID="{8235102B-5E0E-43CA-BDD3-B13017852A6B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Text" GUID="{36E98D38-212B-471E-905B-68793D5963CC}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{32390FB5-0174-457E-A5E9-991EC3B61D0A}</Property>.. <Property Class="Memo" GUID="{C7E3CB32-F28B-4512-A314-F454F22FBC26}" Name="

C:\Program Files (x86)\PlanSwift11\Data\Reports\Legacy Reports1\Vendor Requests\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1307
Entropy (8bit):	5.5071328668805215
Encrypted:	false
SSDEEP:	24:2d2unX2y0o/CApW0V4gAWomIk1OcC2h/ff2WAdOc/+hfqcGQD5anK3jOv:cHn5uWo+hiuD5anK3jA
MD5:	8F2766775CA002504775240B5426C61C
SHA1:	346895DC7B3814EBBC5A628BD018BAD3873B97D9
SHA-256:	F64A77AE0DA05CF1BC865D5CABF7D80DBC2490292C1296113F5069255D57B556
SHA-512:	401B076BDE937E4194B51EC108F8226E6875354FA86217379B4B99AF82CB16A58BE1E4CF0E9356C31348CDF4662FB9079850011111FB71953E7B75C693251603
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Vendor Requests" GUID="{1D16F667-9A22-4AF4-B118-9F068A0FBE50}">.. <Properties>.. <Property Class="Text" GUID="{8600998D-BF3B-4FCC-863C-A7F7CBAA5F67}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Vendor Requests</Property>.. <Property Class="Type" GUID="{4ECA2F17-F709-407F-8366-94E4EC8F1CDE}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Number" GUID="{AA9B694B-C12B-47B8-9341-117E52AAA9EC}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Text" GUID="{26656137-99B2-4748-B6FF-E592A6705129}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{1D16F667-9A22-4AF4-B118-9F068A0FBE50}</Property>.. <Property Class="Memo" GUID="{BFF54925-A478-4DB4-941E-C64627882F8A}" Name="Form Layout" systemh

C:\Program Files (x86)\PlanSwift11\Data\Reports\Legacy Reports1\Vendor Requests\Request for Quote\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (53856), with CRLF line terminators
Category:	dropped
Size (bytes):	90172
Entropy (8bit):	4.546909625095701
Encrypted:	false
SSDEEP:	1536:FDLXhWDLoGVL3atuoSbzPs762GHWHhFR6r7n5tQDh3:FDLRWDLoGVLvoS+5U6hD6rTP4B
MD5:	90F8CF7C73EB6AC402318BA3928C3DE8
SHA1:	BDCEF679B8075423F4F19B60CE4CBB052D345B0B
SHA-256:	14C51CCA2CCF997CF1CEC0F223925BB71EC6FDF31E39478419CE6EECAF183A1E
SHA-512:	E7D86B3A9C86FF89055FB23F156B417A57776D09FA8671119AD0A69B7CF78ACA74BFBC9AA70085F15A09E8166958D1DE50D1A47F0D3BB59F7F8EE81DECF4C7A5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Request for Quote" GUID="{605D2E71-BA38-47C3-878A-A996F3BE2482}">.. <Properties>.. <Property Class="Text" GUID="{CF1A8798-5C93-4AA6-8C5B-AA63249B39B2}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Request for Quote</Property>.. <Property Class="Type" GUID="{10FBDB8F-6E8F-4295-A617-115005773391}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Report</Property>.. <Property Class="Number" GUID="{ECA3EBC2-AF92-4DAF-87FF-7F3C4CB1DDC2}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Text" GUID="{9B0673B4-9426-498D-873D-32E665288C9C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{605D2E71-BA38-47C3-878A-A996F3BE2482}</Property>.. <Property Class="Stream" GUID="{1666112E-8AF4-4D23-91E8-DC5C4C994421}" Name="ViewData" system

C:\Program Files (x86)\PlanSwift11\Data\Reports\Legacy Reports1\Vendor Requests\Request for Quote\is-A1NK0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (53856), with CRLF line terminators
Category:	dropped
Size (bytes):	90172
Entropy (8bit):	4.546909625095701
Encrypted:	false
SSDEEP:	1536:FDLXhWDLoGVL3atuoSbzPs762GHWHhFR6r7n5tQDh3:FDLRWDLoGVLvoS+5U6hD6rTP4B
MD5:	90F8CF7C73EB6AC402318BA3928C3DE8
SHA1:	BDCEF679B8075423F4F19B60CE4CBB052D345B0B
SHA-256:	14C51CCA2CCF997CF1CEC0F223925BB71EC6FDF31E39478419CE6EECAF183A1E
SHA-512:	E7D86B3A9C86FF89055FB23F156B417A57776D09FA8671119AD0A69B7CF78ACA74BFBC9AA70085F15A09E8166958D1DE50D1A47F0D3BB59F7F8EE81DECF4C7A5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Request for Quote" GUID="{605D2E71-BA38-47C3-878A-A996F3BE2482}">.. <Properties>.. <Property Class="Text" GUID="{CF1A8798-5C93-4AA6-8C5B-AA63249B39B2}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Request for Quote</Property>.. <Property Class="Type" GUID="{10FBDB8F-6E8F-4295-A617-115005773391}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Report</Property>.. <Property Class="Number" GUID="{ECA3EBC2-AF92-4DAF-87FF-7F3C4CB1DDC2}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Text" GUID="{9B0673B4-9426-498D-873D-32E665288C9C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{605D2E71-BA38-47C3-878A-A996F3BE2482}</Property>.. <Property Class="Stream" GUID="{1666112E-8AF4-4D23-91E8-DC5C4C994421}" Name="ViewData" system

C:\Program Files (x86)\PlanSwift11\Data\Reports\Legacy Reports1\Vendor Requests\is-JSJKC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1307
Entropy (8bit):	5.5071328668805215
Encrypted:	false
SSDEEP:	24:2d2unX2y0o/CApW0V4gAWomIk1OcC2h/ff2WAdOc/+hfqcGQD5anK3jOv:cHn5uWo+hiuD5anK3jA
MD5:	8F2766775CA002504775240B5426C61C
SHA1:	346895DC7B3814EBBC5A628BD018BAD3873B97D9
SHA-256:	F64A77AE0DA05CF1BC865D5CABF7D80DBC2490292C1296113F5069255D57B556
SHA-512:	401B076BDE937E4194B51EC108F8226E6875354FA86217379B4B99AF82CB16A58BE1E4CF0E9356C31348CDF4662FB9079850011111FB71953E7B75C693251603
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Vendor Requests" GUID="{1D16F667-9A22-4AF4-B118-9F068A0FBE50}">.. <Properties>.. <Property Class="Text" GUID="{8600998D-BF3B-4FCC-863C-A7F7CBAA5F67}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Vendor Requests</Property>.. <Property Class="Type" GUID="{4ECA2F17-F709-407F-8366-94E4EC8F1CDE}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Number" GUID="{AA9B694B-C12B-47B8-9341-117E52AAA9EC}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Text" GUID="{26656137-99B2-4748-B6FF-E592A6705129}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{1D16F667-9A22-4AF4-B118-9F068A0FBE50}</Property>.. <Property Class="Memo" GUID="{BFF54925-A478-4DB4-941E-C64627882F8A}" Name="Form Layout" systemh

C:\Program Files (x86)\PlanSwift11\Data\Reports\Quote (by Division)\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (24640), with CRLF line terminators
Category:	dropped
Size (bytes):	41451
Entropy (8bit):	6.016960732749093
Encrypted:	false
SSDEEP:	768:1Uw5D1D8a7Zx3V28nogMCfBfYgtJuddCybUWPhfr3udt:1B5D1gawTglZfYgtICybzun
MD5:	A93E92E6CA1C572DE07E7545F461E692
SHA1:	7D72310D7978419F64C8C70F56B238D9209DA396
SHA-256:	6C197FA03FEEBBFBD6B313886DD156FFB393EF835B3F6A67789F9F077AD404A6
SHA-512:	02897CC53664D10C4812B7CF6BB46034800097E0D0A464AC6A78F3FE263C898DB3FE43203833B1EA2F33864415507EE3425B31E32513AA44950C8D7AE0494320
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Quote (by Division)" GUID="{41305B40-2402-4DC0-A93F-F2FD67B967FA}">.. <Properties>.. <Property Class="Text" GUID="{1C8DDA1A-4087-4273-B790-0A8C824A4457}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{41305B40-2402-4DC0-A93F-F2FD67B967FA}</Property>.. <Property Class="Number" GUID="{13210FC1-37E5-41E5-B888-A330101A0548}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">10.5</Property>.. <Property Class="Stream" GUID="{0AA7E5ED-8DB2-439A-965D-024C2B7B95E1}" Name="ViewData" systemlocked="True" systemhidden="True" OrderIndex="7" DecimalPlaces="2" StreamData="Bh1SZXBvcnRzRm9ybS5jeEdyaWQxVGFibGVWaWV3MQYQVGN4R3JpZFRhYmxlVmlldwIMBgZGb290ZXICCAYEVHJ1ZQYKR3JvdXBCeUJveAIIBgRUcnVlBgxHcm91cEZvb3RlcnMCAgYBAAYKTmV3SXRlbVJvdwIIBgVGYWxzZQYMRmlsdGVyQWN0aXZlAggGBFRydWUGBkZpbHRlcgIIDD4CAABIZXg6RkVGRkZGRkYwMTA2MDAwMDAwMDA0NDU4NDE0NjRENTQwNjA0MDAwMDA

C:\Program Files (x86)\PlanSwift11\Data\Reports\Quote (by Division)\is-RGDN8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (24640), with CRLF line terminators
Category:	dropped
Size (bytes):	41451
Entropy (8bit):	6.016960732749093
Encrypted:	false
SSDEEP:	768:1Uw5D1D8a7Zx3V28nogMCfBfYgtJuddCybUWPhfr3udt:1B5D1gawTglZfYgtICybzun
MD5:	A93E92E6CA1C572DE07E7545F461E692
SHA1:	7D72310D7978419F64C8C70F56B238D9209DA396
SHA-256:	6C197FA03FEEBBFBD6B313886DD156FFB393EF835B3F6A67789F9F077AD404A6
SHA-512:	02897CC53664D10C4812B7CF6BB46034800097E0D0A464AC6A78F3FE263C898DB3FE43203833B1EA2F33864415507EE3425B31E32513AA44950C8D7AE0494320
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Quote (by Division)" GUID="{41305B40-2402-4DC0-A93F-F2FD67B967FA}">.. <Properties>.. <Property Class="Text" GUID="{1C8DDA1A-4087-4273-B790-0A8C824A4457}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{41305B40-2402-4DC0-A93F-F2FD67B967FA}</Property>.. <Property Class="Number" GUID="{13210FC1-37E5-41E5-B888-A330101A0548}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">10.5</Property>.. <Property Class="Stream" GUID="{0AA7E5ED-8DB2-439A-965D-024C2B7B95E1}" Name="ViewData" systemlocked="True" systemhidden="True" OrderIndex="7" DecimalPlaces="2" StreamData="Bh1SZXBvcnRzRm9ybS5jeEdyaWQxVGFibGVWaWV3MQYQVGN4R3JpZFRhYmxlVmlldwIMBgZGb290ZXICCAYEVHJ1ZQYKR3JvdXBCeUJveAIIBgRUcnVlBgxHcm91cEZvb3RlcnMCAgYBAAYKTmV3SXRlbVJvdwIIBgVGYWxzZQYMRmlsdGVyQWN0aXZlAggGBFRydWUGBkZpbHRlcgIIDD4CAABIZXg6RkVGRkZGRkYwMTA2MDAwMDAwMDA0NDU4NDE0NjRENTQwNjA0MDAwMDA

C:\Program Files (x86)\PlanSwift11\Data\Reports\Quote Summary\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (22333), with CRLF line terminators
Category:	dropped
Size (bytes):	40071
Entropy (8bit):	6.0013412594690845
Encrypted:	false
SSDEEP:	384:0bRDo0SIZiXqWFiwJUf54Neew5D1C/+AJOht5ZqfUkH7e8EjPhj6Y7qS3fM5OTCn:w2w5D1E+WQ2EsY7q1OTyORM40
MD5:	4BDCD02485479277AE11B06329E85264
SHA1:	82F4862B011E50D64D908CA7F259067812C0BBD3
SHA-256:	F164802E014BAB9911B68B2D05D7A233E04F57DF0F7838916F6AAB2FD78E60C7
SHA-512:	C4329467405C18A818FABC47A4A1B7DA0BB83DA709A8F22FC8C1EC27914458D448BF14164A69FD78337F3D3A0B2C219C56E41C1CA159541F6570DE732FFBB8D3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Quote Summary" GUID="{00B00C9A-F100-469E-B7B3-91CFDCCC0E48}">.. <Properties>.. <Property Class="Text" GUID="{4360C757-84D6-4B48-9E1A-84C01FB106F1}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Quote Summary</Property>.. <Property Class="Type" GUID="{765BA9A4-6167-4E6D-BBD8-292577884B22}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Report</Property>.. <Property Class="Number" GUID="{48AF6E48-DB94-40FD-98A1-6FC369B7A0CA}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">10</Property>.. <Property Class="Text" GUID="{4DF9066E-F3C4-47EF-BEB9-E3C4E2CD5EC1}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{00B00C9A-F100-469E-B7B3-91CFDCCC0E48}</Property>.. <Property Class="Stream" GUID="{BBB56402-7EC0-432E-9DE6-7804E255EC3A}" Name="ViewData" systemlocked=

C:\Program Files (x86)\PlanSwift11\Data\Reports\Quote Summary\is-MBH97.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (22333), with CRLF line terminators
Category:	dropped
Size (bytes):	40071
Entropy (8bit):	6.0013412594690845
Encrypted:	false
SSDEEP:	384:0bRDo0SIZiXqWFiwJUf54Neew5D1C/+AJOht5ZqfUkH7e8EjPhj6Y7qS3fM5OTCn:w2w5D1E+WQ2EsY7q1OTyORM40
MD5:	4BDCD02485479277AE11B06329E85264
SHA1:	82F4862B011E50D64D908CA7F259067812C0BBD3
SHA-256:	F164802E014BAB9911B68B2D05D7A233E04F57DF0F7838916F6AAB2FD78E60C7
SHA-512:	C4329467405C18A818FABC47A4A1B7DA0BB83DA709A8F22FC8C1EC27914458D448BF14164A69FD78337F3D3A0B2C219C56E41C1CA159541F6570DE732FFBB8D3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Quote Summary" GUID="{00B00C9A-F100-469E-B7B3-91CFDCCC0E48}">.. <Properties>.. <Property Class="Text" GUID="{4360C757-84D6-4B48-9E1A-84C01FB106F1}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Quote Summary</Property>.. <Property Class="Type" GUID="{765BA9A4-6167-4E6D-BBD8-292577884B22}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Report</Property>.. <Property Class="Number" GUID="{48AF6E48-DB94-40FD-98A1-6FC369B7A0CA}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">10</Property>.. <Property Class="Text" GUID="{4DF9066E-F3C4-47EF-BEB9-E3C4E2CD5EC1}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{00B00C9A-F100-469E-B7B3-91CFDCCC0E48}</Property>.. <Property Class="Stream" GUID="{BBB56402-7EC0-432E-9DE6-7804E255EC3A}" Name="ViewData" systemlocked=

C:\Program Files (x86)\PlanSwift11\Data\Reports\Quote\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (21578), with CRLF line terminators
Category:	dropped
Size (bytes):	38695
Entropy (8bit):	6.009247278161525
Encrypted:	false
SSDEEP:	768:uk/rLU2w5D1Km9dNDthiJSy+dQp5ik5Ggsxx:uk/rq5D1KmFphep7n5GTx
MD5:	302FAD6BEB883508D04EF534B17AFB56
SHA1:	1ADAF9BF0368D94311F0CFE7107E56501EFBAB01
SHA-256:	59BBC2B86767240DB5A7D9F39118F6028FB0FA3817C292781C2866458ADA4B69
SHA-512:	A0FF8B7369D8BC055ACB5A8C3B2CCF7A93B3C2C16A9FF529BA6FDB68E3148188569297294646BB930CE79BD99C9085F8E6CBCA17BDBDCF9CDEC7753295EC58A2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Quote" GUID="{A66BED05-0CF1-48EA-AEDA-5B1F0B38E757}">.. <Properties>.. <Property Class="Text" GUID="{D9AFF96C-787C-4E34-934C-B35E8F918DA1}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Quote</Property>.. <Property Class="Type" GUID="{0464D1DE-5EF0-4811-8860-BDF32521360A}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Report</Property>.. <Property Class="CheckBox" GUID="{BFC8D694-FF40-468E-8C7C-43EC68EBA3E6}" Name="ColumnEdit" group="Item" OrderIndex="5.5" DecimalPlaces="2">False</Property>.. <Property Class="CheckBox" GUID="{9E544D5F-45F7-4BA7-AF5B-75151291415B}" Name="ColumnGrouping" group="Item" OrderIndex="6" DecimalPlaces="2">False</Property>.. <Property Class="Text" GUID="{FCA5F3B5-FCA2-4EA6-AFD3-89F5C1936364}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{A66BED0

C:\Program Files (x86)\PlanSwift11\Data\Reports\Quote\is-RSDJG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (21578), with CRLF line terminators
Category:	dropped
Size (bytes):	38695
Entropy (8bit):	6.009247278161525
Encrypted:	false
SSDEEP:	768:uk/rLU2w5D1Km9dNDthiJSy+dQp5ik5Ggsxx:uk/rq5D1KmFphep7n5GTx
MD5:	302FAD6BEB883508D04EF534B17AFB56
SHA1:	1ADAF9BF0368D94311F0CFE7107E56501EFBAB01
SHA-256:	59BBC2B86767240DB5A7D9F39118F6028FB0FA3817C292781C2866458ADA4B69
SHA-512:	A0FF8B7369D8BC055ACB5A8C3B2CCF7A93B3C2C16A9FF529BA6FDB68E3148188569297294646BB930CE79BD99C9085F8E6CBCA17BDBDCF9CDEC7753295EC58A2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Quote" GUID="{A66BED05-0CF1-48EA-AEDA-5B1F0B38E757}">.. <Properties>.. <Property Class="Text" GUID="{D9AFF96C-787C-4E34-934C-B35E8F918DA1}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Quote</Property>.. <Property Class="Type" GUID="{0464D1DE-5EF0-4811-8860-BDF32521360A}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Report</Property>.. <Property Class="CheckBox" GUID="{BFC8D694-FF40-468E-8C7C-43EC68EBA3E6}" Name="ColumnEdit" group="Item" OrderIndex="5.5" DecimalPlaces="2">False</Property>.. <Property Class="CheckBox" GUID="{9E544D5F-45F7-4BA7-AF5B-75151291415B}" Name="ColumnGrouping" group="Item" OrderIndex="6" DecimalPlaces="2">False</Property>.. <Property Class="Text" GUID="{FCA5F3B5-FCA2-4EA6-AFD3-89F5C1936364}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{A66BED0

C:\Program Files (x86)\PlanSwift11\Data\Settings\Data.xml

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (1336), with CRLF line terminators
Category:	dropped
Size (bytes):	17556
Entropy (8bit):	5.696128453610658
Encrypted:	false
SSDEEP:	192:26g2VPzXUc0W+NF8dvmp1+547hoodC50yaXwhJ17rPUW7MzJXOFF8IMaBR5sV:2eLXthmYMtOrPyzJOX6V
MD5:	A7FC1046CA40B0B214C4BD03D013F70F
SHA1:	4BCF2A09637C82743E228B7A057FCFB95BD9EA70
SHA-256:	4BBFC9B7B949F24B9D1628EA4E901A82620EA1539DA589826470E2FBCC12CB87
SHA-512:	D04CCF8FEA5B720F4C435C04C0A23AA6E630121DC1720B9334F734E7216C79702CAF31F2A1FEB7537852577C93D93D581D6324D2AED04522D06F35CD69B78AA4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Settings" Name="Settings" GUID="{A4856C53-A1F1-4E3A-88E0-D49EDFC4D231}">.. <Properties>.. <Property Class="Text" GUID="{8F9BB0CD-8826-493D-AFF9-B394C9537968}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">Settings</Property>.. <Property Class="Image" GUID="{604AE5E6-6631-4B26-B826-172EB09FE220}" Name="Icon" group="Item" OrderIndex="1" DecimalPlaces="" List="cmbList" Transparent="False" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAACXBIWXMAAAsBAAALAQE2cE9bAAACxklEQVQ4T22Sa0zSURjG/7np6lNrWlZzuFUWoNZybtk018KZlU2cJLRMVFAhG4hCwyJMSJO8LktRiBTF2WVLydoyJ2CmIiKSl1pTFK/N9UE/ZTfe/tBASc7228553vd53p2dgwCAR8JPxew+eSaOceL0WZKnuhOPoh1xeXU4i1fwg8MXTDg1/6Cj3pt77GxsEMSLlJL+LJ6YpA7G45JSU6l91vkF0Gh7v4eEhJRFR0czKVSaJZZ46YjHgGwWJ11UWg5pGXTA43GQy8lDZYDxiUkgEGIgMjIKikruA/emc

C:\Program Files (x86)\PlanSwift11\Data\Settings\Docking\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3118
Entropy (8bit):	5.0956205102284935
Encrypted:	false
SSDEEP:	96:kfyqd2uI0MdOMObd/u20MdOMEbdwz0MdOM+bcwk0MdOMB:zdO3dOUdOQdOs
MD5:	C8D6A3E71736B235403F682961C58614
SHA1:	63B2F7FC8AB9046211FBC74107F1648CFA644140
SHA-256:	5C289D83F2C9467E373B27D99C3AD6146313C8E802376B0ECBB69FFB7B911798
SHA-512:	A1307EE8EA1C9399900A11AF1E4649F6E99D45B631CD118BE2866B74717A1771F3A1483DEFA0AD1CCC89F767646160C764F6A08FB5525E724FBD35A215CC91A1
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Docking" GUID="{AD3F5195-6136-4B2E-9599-53CAB56C2D93}">.. <Properties>.. <Property Class="Text" GUID="{7401F866-3A42-4A2E-929C-58493CA5B6AE}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Docking</Property>.. <Property Class="Type" GUID="{51719617-E894-484F-AB9B-3D7FA8F723EB}" Name="Type" inheritaction="" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\Settings\Docking\_Default\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8766
Entropy (8bit):	5.464144846433822
Encrypted:	false
SSDEEP:	96:cwUKtzitME+LubmySD/+xt9tYc3/GbveACOUNW3+iHQlLffzQQOhVhsmE9Oi3:RUKnErb1STODYc+bv1cIXwZzXOTGNh
MD5:	363EF74CFD4617054986A9C803EF3AFD
SHA1:	45BFA61F7DB849AAAAD7F905D45EDE9A6B0006FF
SHA-256:	150E3C4933AAA4AFEE5896656FD8E4558460E1008DF4AC90B3A126CF73606C25
SHA-512:	8CCD8E13E2D32D2482568D095A5DB67C0B767B11B74B155CD41D9B579E5F1382035911A7AE7D207C37D24F64BFD859A334ABC4138C76B52A565EEDD25D2E2DD8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Current" GUID="{D6C03DE7-5948-4910-B19C-1151BC8166D8}">.. <Properties>.. <Property Class="Type" GUID="{CA02BA24-9ED2-4F46-8443-A0C55D36E5DB}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="2">Folder</Property>.. <Property Class="Number" GUID="{B6D8CA96-38BE-4013-90D6-2CEEFED0A105}" Name="PagesSidebarForm DockedHeight" OrderIndex="56" DecimalPlaces="2">512</Property>.. <Property Class="Number" GUID="{2153ECC0-08F0-46D8-8987-E1A89B4E41ED}" Name="BookmarksSidebarForm DockedHeight" OrderIndex="57" DecimalPlaces="2">217</Property>.. <Property Class="Text" GUID="{8D7D66FB-79CB-49EE-9C71-75D8A2D5DA67}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="-99999" DecimalPlaces="2">Current</Property>.. <Property Class="Text" GUID="{B13157A2-417B-4A02-8597-4ADBD42C7B26}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="1" DecimalPlaces="2">{D6C03

C:\Program Files (x86)\PlanSwift11\Data\Settings\Docking\_Default\Data_old.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13447
Entropy (8bit):	5.4467618388083885
Encrypted:	false
SSDEEP:	384:fgHqRJJYdv0vHm28bujSzqGV/QDxn66T0+ME:fgKRJJYdv0vHqbujZGV/QB
MD5:	BDF1CF269BD496A4EAB40069277BDC6E
SHA1:	35C4BADCE7DA8EF4A9AD78BC7F766EECA6E9F52A
SHA-256:	F515C6F7B729B9683B1B4E970A05F93D1832377D861BEC7A5F0594D329E26FCA
SHA-512:	35A4A5120ACC2F101C2168DA6A856A84CE476C87603A6F8219B8F6B3017FBD343F23BB244CFB707CDDFD13B7010BD71069312065874B94E68306BD628DE9424F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Default" GUID="{C334B10B-5639-48B3-91DD-03F1A2D5592C}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_Default</Property>.. <Property Class="Type" GUID="{98F461E7-CEA8-417D-8093-050117F0FCEA}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces=""/>.. <Property Class="Number" GUID="{6F9F9A3E-94DE-460F-BACC-CF4CAAC0CE5E}" Name="OrderIndex" systemhidden="True" OrderIndex="2" DecimalPlaces="2">1</Property>.. <Property Class="Text" GUID="{9B72A084-1B0F-4014-8BB9-54859999193C}" Name="TemplatesSidebarForm DockWith" group="Item" OrderIndex="3" DecimalPlaces="">TemplatesSidebarForm</Property>.. <Property Class="Text" GUID="{64A5E887-19EB-4CDC-A6E2-056106B85E98}" Name="TemplatesSidebarFormDockSide" group="Item" OrderIndex="4" DecimalPlaces="">Right</Property>.. <Property Class="Text" GUID="{30B9621B-F40F-4A68-AFF

C:\Program Files (x86)\PlanSwift11\Data\Settings\Docking\_Default\is-6ESAC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13447
Entropy (8bit):	5.4467618388083885
Encrypted:	false
SSDEEP:	384:fgHqRJJYdv0vHm28bujSzqGV/QDxn66T0+ME:fgKRJJYdv0vHqbujZGV/QB
MD5:	BDF1CF269BD496A4EAB40069277BDC6E
SHA1:	35C4BADCE7DA8EF4A9AD78BC7F766EECA6E9F52A
SHA-256:	F515C6F7B729B9683B1B4E970A05F93D1832377D861BEC7A5F0594D329E26FCA
SHA-512:	35A4A5120ACC2F101C2168DA6A856A84CE476C87603A6F8219B8F6B3017FBD343F23BB244CFB707CDDFD13B7010BD71069312065874B94E68306BD628DE9424F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Default" GUID="{C334B10B-5639-48B3-91DD-03F1A2D5592C}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_Default</Property>.. <Property Class="Type" GUID="{98F461E7-CEA8-417D-8093-050117F0FCEA}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces=""/>.. <Property Class="Number" GUID="{6F9F9A3E-94DE-460F-BACC-CF4CAAC0CE5E}" Name="OrderIndex" systemhidden="True" OrderIndex="2" DecimalPlaces="2">1</Property>.. <Property Class="Text" GUID="{9B72A084-1B0F-4014-8BB9-54859999193C}" Name="TemplatesSidebarForm DockWith" group="Item" OrderIndex="3" DecimalPlaces="">TemplatesSidebarForm</Property>.. <Property Class="Text" GUID="{64A5E887-19EB-4CDC-A6E2-056106B85E98}" Name="TemplatesSidebarFormDockSide" group="Item" OrderIndex="4" DecimalPlaces="">Right</Property>.. <Property Class="Text" GUID="{30B9621B-F40F-4A68-AFF

C:\Program Files (x86)\PlanSwift11\Data\Settings\Docking\_Default\is-7J963.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8766
Entropy (8bit):	5.464144846433822
Encrypted:	false
SSDEEP:	96:cwUKtzitME+LubmySD/+xt9tYc3/GbveACOUNW3+iHQlLffzQQOhVhsmE9Oi3:RUKnErb1STODYc+bv1cIXwZzXOTGNh
MD5:	363EF74CFD4617054986A9C803EF3AFD
SHA1:	45BFA61F7DB849AAAAD7F905D45EDE9A6B0006FF
SHA-256:	150E3C4933AAA4AFEE5896656FD8E4558460E1008DF4AC90B3A126CF73606C25
SHA-512:	8CCD8E13E2D32D2482568D095A5DB67C0B767B11B74B155CD41D9B579E5F1382035911A7AE7D207C37D24F64BFD859A334ABC4138C76B52A565EEDD25D2E2DD8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Current" GUID="{D6C03DE7-5948-4910-B19C-1151BC8166D8}">.. <Properties>.. <Property Class="Type" GUID="{CA02BA24-9ED2-4F46-8443-A0C55D36E5DB}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="2">Folder</Property>.. <Property Class="Number" GUID="{B6D8CA96-38BE-4013-90D6-2CEEFED0A105}" Name="PagesSidebarForm DockedHeight" OrderIndex="56" DecimalPlaces="2">512</Property>.. <Property Class="Number" GUID="{2153ECC0-08F0-46D8-8987-E1A89B4E41ED}" Name="BookmarksSidebarForm DockedHeight" OrderIndex="57" DecimalPlaces="2">217</Property>.. <Property Class="Text" GUID="{8D7D66FB-79CB-49EE-9C71-75D8A2D5DA67}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="-99999" DecimalPlaces="2">Current</Property>.. <Property Class="Text" GUID="{B13157A2-417B-4A02-8597-4ADBD42C7B26}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="1" DecimalPlaces="2">{D6C03

C:\Program Files (x86)\PlanSwift11\Data\Settings\Docking\is-J2VQM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3118
Entropy (8bit):	5.0956205102284935
Encrypted:	false
SSDEEP:	96:kfyqd2uI0MdOMObd/u20MdOMEbdwz0MdOM+bcwk0MdOMB:zdO3dOUdOQdOs
MD5:	C8D6A3E71736B235403F682961C58614
SHA1:	63B2F7FC8AB9046211FBC74107F1648CFA644140
SHA-256:	5C289D83F2C9467E373B27D99C3AD6146313C8E802376B0ECBB69FFB7B911798
SHA-512:	A1307EE8EA1C9399900A11AF1E4649F6E99D45B631CD118BE2866B74717A1771F3A1483DEFA0AD1CCC89F767646160C764F6A08FB5525E724FBD35A215CC91A1
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Docking" GUID="{AD3F5195-6136-4B2E-9599-53CAB56C2D93}">.. <Properties>.. <Property Class="Text" GUID="{7401F866-3A42-4A2E-929C-58493CA5B6AE}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Docking</Property>.. <Property Class="Type" GUID="{51719617-E894-484F-AB9B-3D7FA8F723EB}" Name="Type" inheritaction="" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\Settings\Notes\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1515), with CRLF line terminators
Category:	dropped
Size (bytes):	5613
Entropy (8bit):	5.481319702331771
Encrypted:	false
SSDEEP:	96:kMJqd2uI0MdOzbd/u20MdOBubdwz0MdOAbcwk0MdOYbddh0MdOOG2tdbddy0MdOP:rdO1dOBRdOFdOOdOocdOIhcD
MD5:	E9DD5E9D7A46DBDF9334748FFFFF384B
SHA1:	901BF6AF164899BCF692BDBC739A4ECF352D9CBE
SHA-256:	83FD9D58DECC86F4F28B4F0D6CE1D1B089E3577103B751472BF87D03E517DF26
SHA-512:	624BFB9CE41C1C1DA4AA6F8DF2195FC216C5BB1AAB663C5470ACB3660282D87B9CD106AD6539BFFC3FAEBA0C2AD01F3986C27120EE345E6DE42E10B143DC82F8
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Notes" GUID="{18CB5B24-6393-436D-8F2C-581C8D84ACFA}">.. <Properties>.. <Property Class="Text" GUID="{5E5EA5D9-CE2B-4E1B-A9A4-76FC1CD31727}" Name="Name" inheritaction="" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0">Notes</Property>.. <Property Class="Type" GUID="{4B831548-7044-4ED5-85A1-0D6F4A41912A}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcon

C:\Program Files (x86)\PlanSwift11\Data\Settings\Notes\is-TUPO4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1515), with CRLF line terminators
Category:	dropped
Size (bytes):	5613
Entropy (8bit):	5.481319702331771
Encrypted:	false
SSDEEP:	96:kMJqd2uI0MdOzbd/u20MdOBubdwz0MdOAbcwk0MdOYbddh0MdOOG2tdbddy0MdOP:rdO1dOBRdOFdOOdOocdOIhcD
MD5:	E9DD5E9D7A46DBDF9334748FFFFF384B
SHA1:	901BF6AF164899BCF692BDBC739A4ECF352D9CBE
SHA-256:	83FD9D58DECC86F4F28B4F0D6CE1D1B089E3577103B751472BF87D03E517DF26
SHA-512:	624BFB9CE41C1C1DA4AA6F8DF2195FC216C5BB1AAB663C5470ACB3660282D87B9CD106AD6539BFFC3FAEBA0C2AD01F3986C27120EE345E6DE42E10B143DC82F8
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Notes" GUID="{18CB5B24-6393-436D-8F2C-581C8D84ACFA}">.. <Properties>.. <Property Class="Text" GUID="{5E5EA5D9-CE2B-4E1B-A9A4-76FC1CD31727}" Name="Name" inheritaction="" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0">Notes</Property>.. <Property Class="Type" GUID="{4B831548-7044-4ED5-85A1-0D6F4A41912A}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcon

C:\Program Files (x86)\PlanSwift11\Data\Settings\Open Job Dialog\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1845), with CRLF line terminators
Category:	dropped
Size (bytes):	9957
Entropy (8bit):	5.397432388958011
Encrypted:	false
SSDEEP:	192:/sdOWcdOPdOnwQdOvdOQ+wgdO0kdOydO9dOeCYdOD+zl+6dOs:UdOtdOPdOwQdOvdOogdOndOydO9dOeC4
MD5:	A5A8633094D53D69F2BD56F78D2B99C2
SHA1:	03918D96CB0BE21ED53DE558F394BFDAA5CC0154
SHA-256:	8215B26BF59DA99EEB9890E8CDBF3495F7B3816799DC1905712D6E9819B6F858
SHA-512:	48A199158EC65EBFD25477A61D045A9FDEE5A866993494AC58212639995D7C1B06421678C8DA5530FB73CB37AD5DAFE959DF7D2C66F37B2CFFC077B4488D96AA
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Open Job Dialog" GUID="{7575064A-990F-4D97-BB55-28B421B085BB}">.. <Properties>.. <Property Class="Type" GUID="{DFB86F9F-0C76-460D-A60A-647B598B0C00}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Folder</Property>.. <Property Class="Text" GUID="{A5372344-5B29-4E07-97DB-8DEB1B5DFEC9}" Name="GUID" inheritaction="Ignore" calculatebefore

C:\Program Files (x86)\PlanSwift11\Data\Settings\Open Job Dialog\is-VC9M2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1845), with CRLF line terminators
Category:	dropped
Size (bytes):	9957
Entropy (8bit):	5.397432388958011
Encrypted:	false
SSDEEP:	192:/sdOWcdOPdOnwQdOvdOQ+wgdO0kdOydO9dOeCYdOD+zl+6dOs:UdOtdOPdOwQdOvdOogdOndOydO9dOeC4
MD5:	A5A8633094D53D69F2BD56F78D2B99C2
SHA1:	03918D96CB0BE21ED53DE558F394BFDAA5CC0154
SHA-256:	8215B26BF59DA99EEB9890E8CDBF3495F7B3816799DC1905712D6E9819B6F858
SHA-512:	48A199158EC65EBFD25477A61D045A9FDEE5A866993494AC58212639995D7C1B06421678C8DA5530FB73CB37AD5DAFE959DF7D2C66F37B2CFFC077B4488D96AA
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Open Job Dialog" GUID="{7575064A-990F-4D97-BB55-28B421B085BB}">.. <Properties>.. <Property Class="Type" GUID="{DFB86F9F-0C76-460D-A60A-647B598B0C00}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Folder</Property>.. <Property Class="Text" GUID="{A5372344-5B29-4E07-97DB-8DEB1B5DFEC9}" Name="GUID" inheritaction="Ignore" calculatebefore

C:\Program Files (x86)\PlanSwift11\Data\Settings\Recent Jobs\1004\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (677), with CRLF line terminators
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	4.9567083692616665
Encrypted:	false
SSDEEP:	96:kVuddf0MdOPBd2uu0MdOzdwR0MdOLcww0MdOSndd70MdOkddK0MdOP:7dOmdO8dOadOUdONdOP
MD5:	4837D79412CF6F60C91232A09E9A7C69
SHA1:	6BB01668A992D5F7692B5595511FC64FA1396679
SHA-256:	62A19256DDFEEA2223C9B2B2060C61E728BDD9D60E8981B9E168FD258ABF0CA3
SHA-512:	DC3C449D951264284BD3648E3AD58BBE7D5F0EB06082ABA391E2B648C1F9A75F35D4B25F887F2016D4633EBA8416BD44FEECA31AD6F0A82676E2671D6FC53417
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="1004">.. <Properties>.. <Property Class="Type" GUID="{1380523B-33BA-4D3E-BF90-ABE83AE77953}" Name="Type" inheritaction="" inherited="False" input="False" inputorder="0" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="" PullFrom="" OrderIndex="0" InputFormSameLine="0" Adjust="" InputFormTab="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" Expression="0"/>.. <Property Class="Text" GUID="{C2250F8D-849B-4670-8931-F242FE4E6124}" Name="Name" inheritaction="" inherited="False" input="True" inputorder="0" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units=""

C:\Program Files (x86)\PlanSwift11\Data\Settings\Recent Jobs\1004\is-31N4K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (677), with CRLF line terminators
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	4.9567083692616665
Encrypted:	false
SSDEEP:	96:kVuddf0MdOPBd2uu0MdOzdwR0MdOLcww0MdOSndd70MdOkddK0MdOP:7dOmdO8dOadOUdONdOP
MD5:	4837D79412CF6F60C91232A09E9A7C69
SHA1:	6BB01668A992D5F7692B5595511FC64FA1396679
SHA-256:	62A19256DDFEEA2223C9B2B2060C61E728BDD9D60E8981B9E168FD258ABF0CA3
SHA-512:	DC3C449D951264284BD3648E3AD58BBE7D5F0EB06082ABA391E2B648C1F9A75F35D4B25F887F2016D4633EBA8416BD44FEECA31AD6F0A82676E2671D6FC53417
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="1004">.. <Properties>.. <Property Class="Type" GUID="{1380523B-33BA-4D3E-BF90-ABE83AE77953}" Name="Type" inheritaction="" inherited="False" input="False" inputorder="0" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="" PullFrom="" OrderIndex="0" InputFormSameLine="0" Adjust="" InputFormTab="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" Expression="0"/>.. <Property Class="Text" GUID="{C2250F8D-849B-4670-8931-F242FE4E6124}" Name="Name" inheritaction="" inherited="False" input="True" inputorder="0" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units=""

C:\Program Files (x86)\PlanSwift11\Data\Settings\Recent Jobs\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (760), with CRLF line terminators
Category:	dropped
Size (bytes):	3142
Entropy (8bit):	5.086691745634882
Encrypted:	false
SSDEEP:	96:k42ddf0MdOBncwR0MdOFdww0MdOfKd2u70MdOT:WdOBbdOPdOfqdOT
MD5:	292270EAE625E457F71E76DA2D960AC6
SHA1:	3802CEA9AD60F382593C025742AC5196BD2EB59E
SHA-256:	F478599558DFAD33B5F264EA4E4109F25280056CC5524F4FA143562536282280
SHA-512:	AB8A96C77D8E564F0F36902649BB8480585825C647E3178C64F2577E1AE03D6149C86E26D0CDF0BE50EDF2D12E25C2FD5AB59CC93B966AC2B5BA56568BDB9952
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Recent Jobs" GUID="{5EF9B617-905F-469E-90BF-430B875CD1DA}">.. <Properties>.. <Property Class="Type" GUID="{F2274A81-F02E-4E7B-82D7-B298785C9C03}" Name="Type" inheritaction="" calculateaftercopy="0" inherited="False" input="False" inputorder="0" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="" PullFrom="" OrderIndex="0" InputFormSameLine="0" Adjust="" InputFormTab="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0">Folder</Property>.. <Property Class="Text" GUID="{CF594609-94F0-4D84-A53F-B2EC4D1F04A2}" Name="GUID" inheritaction="" calculateaftercop

C:\Program Files (x86)\PlanSwift11\Data\Settings\Recent Jobs\is-C6H9U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (760), with CRLF line terminators
Category:	dropped
Size (bytes):	3142
Entropy (8bit):	5.086691745634882
Encrypted:	false
SSDEEP:	96:k42ddf0MdOBncwR0MdOFdww0MdOfKd2u70MdOT:WdOBbdOPdOfqdOT
MD5:	292270EAE625E457F71E76DA2D960AC6
SHA1:	3802CEA9AD60F382593C025742AC5196BD2EB59E
SHA-256:	F478599558DFAD33B5F264EA4E4109F25280056CC5524F4FA143562536282280
SHA-512:	AB8A96C77D8E564F0F36902649BB8480585825C647E3178C64F2577E1AE03D6149C86E26D0CDF0BE50EDF2D12E25C2FD5AB59CC93B966AC2B5BA56568BDB9952
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Recent Jobs" GUID="{5EF9B617-905F-469E-90BF-430B875CD1DA}">.. <Properties>.. <Property Class="Type" GUID="{F2274A81-F02E-4E7B-82D7-B298785C9C03}" Name="Type" inheritaction="" calculateaftercopy="0" inherited="False" input="False" inputorder="0" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="" PullFrom="" OrderIndex="0" InputFormSameLine="0" Adjust="" InputFormTab="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0">Folder</Property>.. <Property Class="Text" GUID="{CF594609-94F0-4D84-A53F-B2EC4D1F04A2}" Name="GUID" inheritaction="" calculateaftercop

C:\Program Files (x86)\PlanSwift11\Data\Settings\Show Me How\Add Pages\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (824), with CRLF line terminators
Category:	dropped
Size (bytes):	5801
Entropy (8bit):	5.032428986101893
Encrypted:	false
SSDEEP:	96:kzGnbd2uUDMdOkQSbdwlDMdOkQ9O6bd/u7DMdOkQP4bcw4DMdOkQylbd55hMdOqL:QydO2dOPrdOcdOo+dOIdO+vdOk
MD5:	E4621F04146C534EA84CEC8DF8A7C861
SHA1:	06590A0948F9091F8E5D45F604CE5B57F2BAA990
SHA-256:	A8384F14038963BBEAAF13FF7CF7872C7AB8E2733AA9612FE75079461E0862D8
SHA-512:	8F169581777AC0F7AE6511E207F605CFEDD8A0B736EAB0CD66EF4B0B1E5C5C1B285199FF00D1E27CD7DCA3246BDDA18F20F9A624BC5F2FE9EE53B911ABFB50D2
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Add Pages" GUID="{B1F7F08A-6F71-4076-83AC-8FCD0644C4E5}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ToolHint="">Add Pages</Property>.. <Property Class="Number" GUID="{10A90AAC-2D2A-48B2-897D-CB3963D530D3}" Name="OrderIndex" in

C:\Program Files (x86)\PlanSwift11\Data\Settings\Show Me How\Add Pages\is-BCN4C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (824), with CRLF line terminators
Category:	dropped
Size (bytes):	5801
Entropy (8bit):	5.032428986101893
Encrypted:	false
SSDEEP:	96:kzGnbd2uUDMdOkQSbdwlDMdOkQ9O6bd/u7DMdOkQP4bcw4DMdOkQylbd55hMdOqL:QydO2dOPrdOcdOo+dOIdO+vdOk
MD5:	E4621F04146C534EA84CEC8DF8A7C861
SHA1:	06590A0948F9091F8E5D45F604CE5B57F2BAA990
SHA-256:	A8384F14038963BBEAAF13FF7CF7872C7AB8E2733AA9612FE75079461E0862D8
SHA-512:	8F169581777AC0F7AE6511E207F605CFEDD8A0B736EAB0CD66EF4B0B1E5C5C1B285199FF00D1E27CD7DCA3246BDDA18F20F9A624BC5F2FE9EE53B911ABFB50D2
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Add Pages" GUID="{B1F7F08A-6F71-4076-83AC-8FCD0644C4E5}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ToolHint="">Add Pages</Property>.. <Property Class="Number" GUID="{10A90AAC-2D2A-48B2-897D-CB3963D530D3}" Name="OrderIndex" in

C:\Program Files (x86)\PlanSwift11\Data\Settings\Show Me How\Batch Rename\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (820), with CRLF line terminators
Category:	dropped
Size (bytes):	4159
Entropy (8bit):	5.049581248323337
Encrypted:	false
SSDEEP:	96:kLnbd2uUDMdOkQLbdwlDMdOkQaibd/u7DMdOkQKbcw4DMdOkQabd55hMdOqQH:mdO1dOIOdOidONdO7
MD5:	E6F02C3CC4CE765BA0442500A4E7A309
SHA1:	1222F2463E7D768131816886E6EC9E7C22D5CFF5
SHA-256:	A3B998A84AEE4182ACC2042ED6393164A8A79FC0BBD184DFD0F16B658E2043CC
SHA-512:	A8074115D80A0983CC358CFEFF8CEF689E53A439E6095E22F84D3FA7977CE1C0F76DC6F1BBC07F338BA4E1ED0BAC058464AF2158AF1F3DBCE6E6D83250F5DE3E
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Batch Rename" GUID="{CD48143C-A770-4F7F-9D27-8E5DE8E36E83}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ToolHint="">Batch Rename</Property>.. <Property Class="Number" GUID="{E8C236A5-4CAC-43CB-A075-621F999086CB}" Name="OrderInd

C:\Program Files (x86)\PlanSwift11\Data\Settings\Show Me How\Batch Rename\is-L6PSI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (820), with CRLF line terminators
Category:	dropped
Size (bytes):	4159
Entropy (8bit):	5.049581248323337
Encrypted:	false
SSDEEP:	96:kLnbd2uUDMdOkQLbdwlDMdOkQaibd/u7DMdOkQKbcw4DMdOkQabd55hMdOqQH:mdO1dOIOdOidONdO7
MD5:	E6F02C3CC4CE765BA0442500A4E7A309
SHA1:	1222F2463E7D768131816886E6EC9E7C22D5CFF5
SHA-256:	A3B998A84AEE4182ACC2042ED6393164A8A79FC0BBD184DFD0F16B658E2043CC
SHA-512:	A8074115D80A0983CC358CFEFF8CEF689E53A439E6095E22F84D3FA7977CE1C0F76DC6F1BBC07F338BA4E1ED0BAC058464AF2158AF1F3DBCE6E6D83250F5DE3E
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Batch Rename" GUID="{CD48143C-A770-4F7F-9D27-8E5DE8E36E83}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ToolHint="">Batch Rename</Property>.. <Property Class="Number" GUID="{E8C236A5-4CAC-43CB-A075-621F999086CB}" Name="OrderInd

C:\Program Files (x86)\PlanSwift11\Data\Settings\Show Me How\ConfirmDim\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (820), with CRLF line terminators
Category:	dropped
Size (bytes):	4155
Entropy (8bit):	5.041148065401607
Encrypted:	false
SSDEEP:	96:kDnbd2uUDMdOkQfQ+bdwlDMdOkQ9bd/u7DMdOkQHbcw4DMdOkQIbd55hMdOqQi:SdOvdODdObdOXdOG
MD5:	254B8D67C66CEFDA51CBAEDA9BF4C27A
SHA1:	F825CD39813AFA1AB7B4CB16F88C9D19E33F7706
SHA-256:	15E952975CE89BF3101596D81DEC90669DD87B93EC8462712B2175E60358F219
SHA-512:	3BD6EEDF99597D2A00C83060E397FFADF87BB33096988B97D4546AF9FB82C151B45E3427C97275FF0252B5925FBFB5396A0070963C110A0779F07A7DBA1A6569
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="ConfirmDim" GUID="{44F67F64-FABA-4EE9-B282-D3CCEED85F21}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ToolHint="">ConfirmDim</Property>.. <Property Class="Number" GUID="{D797302A-B9DF-496B-88BA-D6A60E903A9F}" Name="OrderIndex"

C:\Program Files (x86)\PlanSwift11\Data\Settings\Show Me How\ConfirmDim\is-H4SON.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (820), with CRLF line terminators
Category:	dropped
Size (bytes):	4155
Entropy (8bit):	5.041148065401607
Encrypted:	false
SSDEEP:	96:kDnbd2uUDMdOkQfQ+bdwlDMdOkQ9bd/u7DMdOkQHbcw4DMdOkQIbd55hMdOqQi:SdOvdODdObdOXdOG
MD5:	254B8D67C66CEFDA51CBAEDA9BF4C27A
SHA1:	F825CD39813AFA1AB7B4CB16F88C9D19E33F7706
SHA-256:	15E952975CE89BF3101596D81DEC90669DD87B93EC8462712B2175E60358F219
SHA-512:	3BD6EEDF99597D2A00C83060E397FFADF87BB33096988B97D4546AF9FB82C151B45E3427C97275FF0252B5925FBFB5396A0070963C110A0779F07A7DBA1A6569
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="ConfirmDim" GUID="{44F67F64-FABA-4EE9-B282-D3CCEED85F21}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ToolHint="">ConfirmDim</Property>.. <Property Class="Number" GUID="{D797302A-B9DF-496B-88BA-D6A60E903A9F}" Name="OrderIndex"

C:\Program Files (x86)\PlanSwift11\Data\Settings\Show Me How\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (859), with CRLF line terminators
Category:	dropped
Size (bytes):	4381
Entropy (8bit):	5.0603478516278795
Encrypted:	false
SSDEEP:	96:kFAzqd2uUDMdOkQWSxbd/uCDMdOkQWnbdw7DMdOkQWdQbcw4DMdOkQW+xwFbdc5x:2VdOE7dOEZdOE8dOE+xwhdOCc
MD5:	B954A8D00061A7D517ABD8EB68E24C23
SHA1:	E49D784BBD1EC8E3BAED10576BE01E11B500CF1E
SHA-256:	15D5C1366ED91A778790804B772D6A5F5AADBDAE7F442DF685D9501F47D47F39
SHA-512:	2F6C84F5F394456C423F90BA5C57233C55DC800536B27F49192F8A93EC5587D7B4C43244060E2650CD6C4031D685A71DF8E16C0067125A036917E4EC34637149
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Show Me How" GUID="{4E5BC595-D6BE-4A16-8703-459583C3CA8C}">.. <Properties>.. <Property Class="Text" GUID="{6B7AC351-B643-42E2-B625-ABD367986E04}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ParseFormula="-1" ListParseFormula="0" ToolHint="">Show Me How</Property>.. <Property

C:\Program Files (x86)\PlanSwift11\Data\Settings\Show Me How\Email Job\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (823), with CRLF line terminators
Category:	dropped
Size (bytes):	5834
Entropy (8bit):	5.048855190851236
Encrypted:	false
SSDEEP:	96:kTK4gbd2uUDMdOkQ7bd/ulDMdOkQsbdw7DMdOkQDbcw4DMdOkQqKCgbd55hMdOqJ:YSdOTdO6dO3dOctdO5Pn1dOEvdO1
MD5:	D6F11ACF64A2F035F4CC24D3A0460C33
SHA1:	74288C653656B236027CE3DDAF9D31F27FCD1EE5
SHA-256:	43FA661714E7E68F75496E047BCE6897D97A66CB41B87324768A39E62CB92DEA
SHA-512:	02C163C84F27385D2F196AD2894F86496A384961D148BD9F510365E9D6E56C25561DD11C2D8156C06AF1834A86AA121562CE698CDFD0B10867A8446315612608
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Email Job" GUID="{8F4C3738-D4DB-4389-BC7F-34316A4ADC3E}">.. <Properties>.. <Property Class="Text" GUID="{6AFF55F0-684E-4554-B8E2-8084AEA70545}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ToolHint="">Email Job</Property>.. <Property Class="Type" GUID="{CEC74911-EEB6-402D-B1F9

C:\Program Files (x86)\PlanSwift11\Data\Settings\Show Me How\Email Job\is-VGSLP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (823), with CRLF line terminators
Category:	dropped
Size (bytes):	5834
Entropy (8bit):	5.048855190851236
Encrypted:	false
SSDEEP:	96:kTK4gbd2uUDMdOkQ7bd/ulDMdOkQsbdw7DMdOkQDbcw4DMdOkQqKCgbd55hMdOqJ:YSdOTdO6dO3dOctdO5Pn1dOEvdO1
MD5:	D6F11ACF64A2F035F4CC24D3A0460C33
SHA1:	74288C653656B236027CE3DDAF9D31F27FCD1EE5
SHA-256:	43FA661714E7E68F75496E047BCE6897D97A66CB41B87324768A39E62CB92DEA
SHA-512:	02C163C84F27385D2F196AD2894F86496A384961D148BD9F510365E9D6E56C25561DD11C2D8156C06AF1834A86AA121562CE698CDFD0B10867A8446315612608
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Email Job" GUID="{8F4C3738-D4DB-4389-BC7F-34316A4ADC3E}">.. <Properties>.. <Property Class="Text" GUID="{6AFF55F0-684E-4554-B8E2-8084AEA70545}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ToolHint="">Email Job</Property>.. <Property Class="Type" GUID="{CEC74911-EEB6-402D-B1F9

C:\Program Files (x86)\PlanSwift11\Data\Settings\Show Me How\New Job\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (820), with CRLF line terminators
Category:	dropped
Size (bytes):	4153
Entropy (8bit):	5.04813211410308
Encrypted:	false
SSDEEP:	96:kKnbd2uUDMdOkQpgbdwlDMdOkQFbd/u7DMdOkQVbcw4DMdOkQByrbd55hMdOqQ3:7dOidOzdONdODdOD
MD5:	7C533A57DE01A9054B963DC5DCED720A
SHA1:	9CEFA24A6F7864370D90560044246B82BBF87AE7
SHA-256:	09D4A9CE617914A32CD6310CE1B958621878A3D9E332D490BDEFF9B5DA445144
SHA-512:	38C941248E349E31E30D9DF3A24A439F30BCE1D6DF0CCD85A36578324A7D47F6791C59C963D0FFED12CE6E2F8760EB43A499850394B788A953E1CEACD6989313
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="New Job" GUID="{51F8841C-76D4-4314-99CD-91AE41CE6C14}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ToolHint="">New Job</Property>.. <Property Class="Number" GUID="{43FDC2B2-9929-4E1C-AB9D-F2B2E1D3F0D1}" Name="OrderIndex" inheri

C:\Program Files (x86)\PlanSwift11\Data\Settings\Show Me How\New Job\is-QGROD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (820), with CRLF line terminators
Category:	dropped
Size (bytes):	4153
Entropy (8bit):	5.04813211410308
Encrypted:	false
SSDEEP:	96:kKnbd2uUDMdOkQpgbdwlDMdOkQFbd/u7DMdOkQVbcw4DMdOkQByrbd55hMdOqQ3:7dOidOzdONdODdOD
MD5:	7C533A57DE01A9054B963DC5DCED720A
SHA1:	9CEFA24A6F7864370D90560044246B82BBF87AE7
SHA-256:	09D4A9CE617914A32CD6310CE1B958621878A3D9E332D490BDEFF9B5DA445144
SHA-512:	38C941248E349E31E30D9DF3A24A439F30BCE1D6DF0CCD85A36578324A7D47F6791C59C963D0FFED12CE6E2F8760EB43A499850394B788A953E1CEACD6989313
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="New Job" GUID="{51F8841C-76D4-4314-99CD-91AE41CE6C14}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ToolHint="">New Job</Property>.. <Property Class="Number" GUID="{43FDC2B2-9929-4E1C-AB9D-F2B2E1D3F0D1}" Name="OrderIndex" inheri

C:\Program Files (x86)\PlanSwift11\Data\Settings\Show Me How\Open Job\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (820), with CRLF line terminators
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	5.039779646973725
Encrypted:	false
SSDEEP:	96:kp8nbd2uUDMdOkQfNbdwlDMdOkQ06bd/u7DMdOkQIcbcw4DMdOkQOStjbd55hMdp:tdOTdOHdOiudOhtIdOI
MD5:	BBC3EB1784BCDFCD985BF7C0AF92D73C
SHA1:	833E79705AC894F8ACF05663C76631D3198FC796
SHA-256:	00EB966F63512AC1E460C0CD465954A791F4758D75CDF254671EC5B0FBEE1632
SHA-512:	60D919B20E5CC4C3FFF816660FDC2CDFE4683592F17723611C7A3B1962006BD2F32C4AAB0E76C66C493026E1A8A0C1818F2BBEDF2BCA53D1017215F02C19CC95
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Open Job" GUID="{8C11B57F-0D01-4E5C-9CB0-FE0669C4EEF9}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ToolHint="">Open Job</Property>.. <Property Class="Number" GUID="{B97BE4D7-0475-4B44-958C-D663BCAEB69A}" Name="OrderIndex" inhe

C:\Program Files (x86)\PlanSwift11\Data\Settings\Show Me How\Open Job\is-5TSRM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (820), with CRLF line terminators
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	5.039779646973725
Encrypted:	false
SSDEEP:	96:kp8nbd2uUDMdOkQfNbdwlDMdOkQ06bd/u7DMdOkQIcbcw4DMdOkQOStjbd55hMdp:tdOTdOHdOiudOhtIdOI
MD5:	BBC3EB1784BCDFCD985BF7C0AF92D73C
SHA1:	833E79705AC894F8ACF05663C76631D3198FC796
SHA-256:	00EB966F63512AC1E460C0CD465954A791F4758D75CDF254671EC5B0FBEE1632
SHA-512:	60D919B20E5CC4C3FFF816660FDC2CDFE4683592F17723611C7A3B1962006BD2F32C4AAB0E76C66C493026E1A8A0C1818F2BBEDF2BCA53D1017215F02C19CC95
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Open Job" GUID="{8C11B57F-0D01-4E5C-9CB0-FE0669C4EEF9}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ToolHint="">Open Job</Property>.. <Property Class="Number" GUID="{B97BE4D7-0475-4B44-958C-D663BCAEB69A}" Name="OrderIndex" inhe

C:\Program Files (x86)\PlanSwift11\Data\Settings\Show Me How\Overlay\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (827), with CRLF line terminators
Category:	dropped
Size (bytes):	5024
Entropy (8bit):	5.06518074999018
Encrypted:	false
SSDEEP:	96:kIEfQbd2uUDMdOkQ/bd/ulDMdOkQ1BQbdw7DMdOkQrbcw4DMdOkQbsfwbd55hMdv:LEYdOzdOFMdOzdOpsfddOcdOk
MD5:	2B340BD53829B9710EF7D7FE26E2B310
SHA1:	589BD1C824EDFD5585EB0547377FB7073264FD82
SHA-256:	2B7696C7C3AF218F774C3EDC140170F2AA4BFBEC1420B22A6A8F3FCD4F854E47
SHA-512:	3ED178BFA8A316EF307DE6FD9DDA741A72F0710068CAA7F30A74889114A46339D0ABE2B0BDCD1ED2FD3CE02D68C3E17B974EA0BCAA3CC15DB1869985EF26EB33
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Overlay" GUID="{0892A807-3446-405E-9526-5FEF1FC786C1}">.. <Properties>.. <Property Class="Text" GUID="{A0C3A08D-2480-4E30-B4F3-285B828B85D0}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ToolHint="">Overlay</Property>.. <Property Class="Type" GUID="{1EF8A8D1-E718-4368-BD82-209

C:\Program Files (x86)\PlanSwift11\Data\Settings\Show Me How\Overlay\is-KV6RC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (827), with CRLF line terminators
Category:	dropped
Size (bytes):	5024
Entropy (8bit):	5.06518074999018
Encrypted:	false
SSDEEP:	96:kIEfQbd2uUDMdOkQ/bd/ulDMdOkQ1BQbdw7DMdOkQrbcw4DMdOkQbsfwbd55hMdv:LEYdOzdOFMdOzdOpsfddOcdOk
MD5:	2B340BD53829B9710EF7D7FE26E2B310
SHA1:	589BD1C824EDFD5585EB0547377FB7073264FD82
SHA-256:	2B7696C7C3AF218F774C3EDC140170F2AA4BFBEC1420B22A6A8F3FCD4F854E47
SHA-512:	3ED178BFA8A316EF307DE6FD9DDA741A72F0710068CAA7F30A74889114A46339D0ABE2B0BDCD1ED2FD3CE02D68C3E17B974EA0BCAA3CC15DB1869985EF26EB33
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Overlay" GUID="{0892A807-3446-405E-9526-5FEF1FC786C1}">.. <Properties>.. <Property Class="Text" GUID="{A0C3A08D-2480-4E30-B4F3-285B828B85D0}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ToolHint="">Overlay</Property>.. <Property Class="Type" GUID="{1EF8A8D1-E718-4368-BD82-209

C:\Program Files (x86)\PlanSwift11\Data\Settings\Show Me How\Print\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (820), with CRLF line terminators
Category:	dropped
Size (bytes):	4147
Entropy (8bit):	5.045020389975965
Encrypted:	false
SSDEEP:	96:khnbd2uUDMdOkQ/bdwlDMdOkQ0a3bd/u7DMdOkQyDbcw4DMdOkQdbd55hMdOqQR:adOhdOndO4xdOgdOF
MD5:	1CF55ED0FA44C5E595E87E3EC68ACBB3
SHA1:	6A778772D651C0A1EEED56436C8AC39EEE7EFAD5
SHA-256:	614B771FB841932A44AD4FE4F6735C3220941D6259CDF029997316A5E2238FF0
SHA-512:	9B4E6FAD8B298879369CFC4B8100355DFE6DF62A3B036DA2AFA937B3A162BCFF0A465F51FB58A0B5AC4141BD71963BFF8B929B39D854995C65CDCAA7477A7B4C
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Print" GUID="{A693B773-46D9-4BE3-A778-CFC9999F9A17}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ToolHint="">Print</Property>.. <Property Class="Number" GUID="{A9DF55CC-CC4B-40DF-BA29-0CF45D63029C}" Name="OrderIndex" inheritact

C:\Program Files (x86)\PlanSwift11\Data\Settings\Show Me How\Print\is-LTN63.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (820), with CRLF line terminators
Category:	dropped
Size (bytes):	4147
Entropy (8bit):	5.045020389975965
Encrypted:	false
SSDEEP:	96:khnbd2uUDMdOkQ/bdwlDMdOkQ0a3bd/u7DMdOkQyDbcw4DMdOkQdbd55hMdOqQR:adOhdOndO4xdOgdOF
MD5:	1CF55ED0FA44C5E595E87E3EC68ACBB3
SHA1:	6A778772D651C0A1EEED56436C8AC39EEE7EFAD5
SHA-256:	614B771FB841932A44AD4FE4F6735C3220941D6259CDF029997316A5E2238FF0
SHA-512:	9B4E6FAD8B298879369CFC4B8100355DFE6DF62A3B036DA2AFA937B3A162BCFF0A465F51FB58A0B5AC4141BD71963BFF8B929B39D854995C65CDCAA7477A7B4C
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Print" GUID="{A693B773-46D9-4BE3-A778-CFC9999F9A17}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ToolHint="">Print</Property>.. <Property Class="Number" GUID="{A9DF55CC-CC4B-40DF-BA29-0CF45D63029C}" Name="OrderIndex" inheritact

C:\Program Files (x86)\PlanSwift11\Data\Settings\Show Me How\Properties\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (820), with CRLF line terminators
Category:	dropped
Size (bytes):	3337
Entropy (8bit):	5.051330684270692
Encrypted:	false
SSDEEP:	96:k4nbd2uUDMdOkQlbdwlDMdOkQ/bd/u7DMdOkQQbcw4DMdOkQn:3dOvdOtdOYdO5
MD5:	298D070C315796D092FD498118C96933
SHA1:	A26C2895CD306CB222B7398E760416606081AD74
SHA-256:	B42242F9CE64B43BB7B4049C5C8CB5F7B49006D653C26FDCF2B4069D27332E1A
SHA-512:	3227D7B64A819F260D944A6FF0F0600D254DD798CD46BAA78D4F9A9BBF1A2852D4936140FECF38522644905210D9786AEF9955DA8D93C273C9F379DCAC303BAF
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Properties" GUID="{399F7E6E-FAAC-4CF9-8643-17742731D4F9}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ToolHint="">Properties</Property>.. <Property Class="Number" GUID="{954F2AAF-AA52-435C-9A42-99747D949366}" Name="OrderIndex"

C:\Program Files (x86)\PlanSwift11\Data\Settings\Show Me How\Properties\is-M28OS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (820), with CRLF line terminators
Category:	dropped
Size (bytes):	3337
Entropy (8bit):	5.051330684270692
Encrypted:	false
SSDEEP:	96:k4nbd2uUDMdOkQlbdwlDMdOkQ/bd/u7DMdOkQQbcw4DMdOkQn:3dOvdOtdOYdO5
MD5:	298D070C315796D092FD498118C96933
SHA1:	A26C2895CD306CB222B7398E760416606081AD74
SHA-256:	B42242F9CE64B43BB7B4049C5C8CB5F7B49006D653C26FDCF2B4069D27332E1A
SHA-512:	3227D7B64A819F260D944A6FF0F0600D254DD798CD46BAA78D4F9A9BBF1A2852D4936140FECF38522644905210D9786AEF9955DA8D93C273C9F379DCAC303BAF
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Properties" GUID="{399F7E6E-FAAC-4CF9-8643-17742731D4F9}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ToolHint="">Properties</Property>.. <Property Class="Number" GUID="{954F2AAF-AA52-435C-9A42-99747D949366}" Name="OrderIndex"

C:\Program Files (x86)\PlanSwift11\Data\Settings\Show Me How\Scale\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (820), with CRLF line terminators
Category:	dropped
Size (bytes):	4145
Entropy (8bit):	5.04207975824448
Encrypted:	false
SSDEEP:	96:kAinbd2uUDMdOkQ6bdwlDMdOkQdbd/u7DMdOkQzbcw4DMdOkQY9bd55hMdOqQT:sdOCdOfdOzdOhdOn
MD5:	0C805EFCCB5C394C914DD0B0DB2A806E
SHA1:	BCA0CC2757996EFC8E6C601408CE34C8C2484174
SHA-256:	1DB1F518641E0AE72AF59C39F62BD3CFD725316702058F6B29AC0A54B7B75710
SHA-512:	49E8249E9FC281F24A124B58D2E4722167FF3662AC51DB23597E1F0AF3AD642437242BD49264FEBE19E2B88EB26F732789686856C275C99F07303AA0189FDBA1
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Scale" GUID="{6C3C3955-9A4C-49B0-822F-23D398BEC2C4}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ToolHint="">Scale</Property>.. <Property Class="Number" GUID="{58173A9A-857A-47E4-BF08-1847DA3DBAB0}" Name="OrderIndex" inheritact

C:\Program Files (x86)\PlanSwift11\Data\Settings\Show Me How\Scale\is-GQ893.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (820), with CRLF line terminators
Category:	dropped
Size (bytes):	4145
Entropy (8bit):	5.04207975824448
Encrypted:	false
SSDEEP:	96:kAinbd2uUDMdOkQ6bdwlDMdOkQdbd/u7DMdOkQzbcw4DMdOkQY9bd55hMdOqQT:sdOCdOfdOzdOhdOn
MD5:	0C805EFCCB5C394C914DD0B0DB2A806E
SHA1:	BCA0CC2757996EFC8E6C601408CE34C8C2484174
SHA-256:	1DB1F518641E0AE72AF59C39F62BD3CFD725316702058F6B29AC0A54B7B75710
SHA-512:	49E8249E9FC281F24A124B58D2E4722167FF3662AC51DB23597E1F0AF3AD642437242BD49264FEBE19E2B88EB26F732789686856C275C99F07303AA0189FDBA1
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Scale" GUID="{6C3C3955-9A4C-49B0-822F-23D398BEC2C4}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ToolHint="">Scale</Property>.. <Property Class="Number" GUID="{58173A9A-857A-47E4-BF08-1847DA3DBAB0}" Name="OrderIndex" inheritact

C:\Program Files (x86)\PlanSwift11\Data\Settings\Show Me How\is-I0QUC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (859), with CRLF line terminators
Category:	dropped
Size (bytes):	4381
Entropy (8bit):	5.0603478516278795
Encrypted:	false
SSDEEP:	96:kFAzqd2uUDMdOkQWSxbd/uCDMdOkQWnbdw7DMdOkQWdQbcw4DMdOkQW+xwFbdc5x:2VdOE7dOEZdOE8dOE+xwhdOCc
MD5:	B954A8D00061A7D517ABD8EB68E24C23
SHA1:	E49D784BBD1EC8E3BAED10576BE01E11B500CF1E
SHA-256:	15D5C1366ED91A778790804B772D6A5F5AADBDAE7F442DF685D9501F47D47F39
SHA-512:	2F6C84F5F394456C423F90BA5C57233C55DC800536B27F49192F8A93EC5587D7B4C43244060E2650CD6C4031D685A71DF8E16C0067125A036917E4EC34637149
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Show Me How" GUID="{4E5BC595-D6BE-4A16-8703-459583C3CA8C}">.. <Properties>.. <Property Class="Text" GUID="{6B7AC351-B643-42E2-B625-ABD367986E04}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ParseFormula="-1" ListParseFormula="0" ToolHint="">Show Me How</Property>.. <Property

C:\Program Files (x86)\PlanSwift11\Data\Settings\is-2DPV8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1927), with CRLF line terminators
Category:	dropped
Size (bytes):	59183
Entropy (8bit):	5.147412407356318
Encrypted:	false
SSDEEP:	1536:EsfZLAwZSiFmSTM3XAlOjreTbpfrsYwKK8YpzPRbVtg98o4jvh3TDzmOuHmw6wvi:7gYK
MD5:	503E9C8359757B8E377748C145CAC941
SHA1:	AE8D6DFB04560BE464AA640058ACA4826308DD7E
SHA-256:	BDF2E49E4D92065E762A32BB568AA5F4A79D9CF3DBCC38928F6E34A1F4BAFD5C
SHA-512:	797B70B9E30A64A6D7CA5DF4FE8CD491E085B9FCD66F243BAA7B9F00677B9D3EA1D3CBE000BE8AA58B3223A018859AD28CA270813ED230BD893001517196616A
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Settings" Name="Settings" GUID="{A4856C53-A1F1-4E3A-88E0-D49EDFC4D231}">.. <Properties>.. <Property Class="Text" GUID="{8F9BB0CD-8826-493D-AFF9-B394C9537968}" Name="Name" inheritaction="" calculateaftercopy="0" inherited="False" input="True" inputorder="0" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" InputFormSameLine="0" Adjust="" InputFormTab="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0">Settings</Property>.. <Property Class="Image" GUID="{604AE5E6-6631-4B26-B826-172EB09FE220}" Name="Icon" inheritaction="" calculateafte

C:\Program Files (x86)\PlanSwift11\Data\Storages\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	897
Entropy (8bit):	5.414171058388281
Encrypted:	false
SSDEEP:	24:2d2T9jsXWPsIgtr1Ociqf2WAdOcF9jzwL0/CApW/v:c8smNCOEog
MD5:	91C839E37FBA7DE7D0972BB1278CF80B
SHA1:	9C6A64813D3D6F47087F8A4B4B4B8F7D3833A068
SHA-256:	AA834631CF8D703FD4AE4B5D12A638E67CEA227A22F70137FE6478B808F72EF1
SHA-512:	BDB82A2D22284700333EBF801149D8B098BA2553B5242A2233A16B9BE083427A4CA50B6533D904507C1FF3072328CBE64607848365B6E71B50E10DB11E3DC17B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Storages" GUID="{9BA7F720-F353-4B99-A561-4ABD81C0DA1A}">.. <Properties>.. <Property Class="Type" GUID="{80053946-1A01-47F4-B5E2-FE3F81B62BCC}" Name="Type" OrderIndex="0" DecimalPlaces="">Folder</Property>.. <Property Class="Number" GUID="{F17E65C7-742C-4C29-8F0F-21376BC325BC}" Name="OrderIndex" systemhidden="True" OrderIndex="2" DecimalPlaces="">2</Property>.. <Property Class="Text" GUID="{9C2DE04E-9C1F-44E5-9B00-C55B8FAB43C1}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{9BA7F720-F353-4B99-A561-4ABD81C0DA1A}</Property>.. <Property Class="Text" GUID="{4BBCE1A5-70AD-483E-B42E-D6537E1A5D9B}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="4" DecimalPlaces="">Storages</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (4639), with CRLF line terminators
Category:	dropped
Size (bytes):	7771
Entropy (8bit):	6.092611430532759
Encrypted:	false
SSDEEP:	192:7sOC9pjcaOvQiD3D748zQZjxuPXU8jYYFu6WVJlX:71uRcxvQibn7QNKXJMYF/WV3X
MD5:	3BD820177C3DD7BCC4E033679B87675A
SHA1:	3FBF80725BBD0B4D71E0A723DCD02D92BD34D6CF
SHA-256:	EC923FC29E4FDCC023CDD68DECEEFC6B0BEC4A1E16717448E972F003BB8C7213
SHA-512:	FBA8D03583DB8E8B822EA58B802E4963C9C263231F66389CCA46741049D98F161A8D1D033AA616954746FE3082E66D8181565C314221014296DD82548FE3E357
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Local" GUID="{BE391900-7103-4C73-B646-785AECA47C01}">.. <Properties>.. <Property Class="Text" GUID="{E735FFCF-65CB-4F58-B9C7-80C80FB46A41}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">Local</Property>.. <Property Class="Type" GUID="{8E2148FE-80FF-4D67-84E7-425515B33EC1}" Name="Type" OrderIndex="1" DecimalPlaces="">Storage</Property>.. <Property Class="Image" GUID="{4440A7B2-C94E-42CE-A140-8C5D41A4A8A9}" Name="Icon" OrderIndex="2" DecimalPlaces="" Transparent="True" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAALGOfPtRkwAAACBjSFJNAACHDwAAjA8AAP1SAACBQAAAfXkAAOmLAAA85QAAGcxzPIV3AAAKOWlDQ1BQaG90b3Nob3AgSUNDIHByb2ZpbGUAAEjHnZZ3VFTXFofPvXd6oc0wAlKG3rvAANJ7k15FYZgZYCgDDjM0sSGiAhFFRJoiSFDEgNFQJFZEsRAUVLAHJAgoMRhFVCxvRtaLrqy89/Ly++Osb+2z97n77L3PWhcAkqcvl5cGSwGQyhPwgzyc6RGRUXTsAIABHmCAKQBMVka6X7B7CBDJy82FniFyA

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (677), with CRLF line terminators
Category:	dropped
Size (bytes):	2155
Entropy (8bit):	5.022551951332305
Encrypted:	false
SSDEEP:	48:cVBJr2MZMd2uf0MdOSaNHmZddu0MdOSaNnZdwR0MdOSaNg:k/r2UMd2uf0MdOUZddu0MdOZZdwR0Mdj
MD5:	E7FF22121ACEE08E1EF49185D8020748
SHA1:	6271CC964AACD54107026CBB32230B17E06ACBF7
SHA-256:	FD5919F702895EFA309E8FE18517E6850F52465FD5C72878D08FB0DEA3DEABEA
SHA-512:	1D48C0F4232904D841F2D0669C16ED988101ACEC522213515B8A6E94EA68E42EA938125827E7326CE8244B7C690F6DE275F7A0EA65C6E71B0F406E76D6F780B2
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Jobs">.. <Properties>.. <Property Class="Text" GUID="{78775AD0-0E62-4C37-996B-91C89AD7BCFC}" Name="Name" inheritaction="" inherited="False" input="True" inputorder="0" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" InputFormSameLine="0" Adjust="" InputFormTab="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" Expression="0">Jobs</Property>.. <Property Class="Type" GUID="{7F719128-CE88-46C6-B74E-4AFB691ADE1E}" Name="Type" inheritaction="" inherited="False" input="False" inputorder="0" locked="False" hidden="False" systemlocked="False" systemhidden="False" requir

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\AutoLists\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	884
Entropy (8bit):	5.4134680796074734
Encrypted:	false
SSDEEP:	24:2dFDO5hX2VifvApWk/gAWuH11OckOd07f2WAdOcg53v:cUNUKg0xh
MD5:	8C4D89E5FCB9FFCD6A926F3129BC0B49
SHA1:	254367E5DE4D9E49704CBF53CBC2B74E07E4F780
SHA-256:	4F3FCCBDC9C24535003BD7917325D259E8C159430565CE9C929B8DE27D7A5C58
SHA-512:	D418E778A2C6FE368280FE250F433AAB190DC143F801E5F5D8F3375740277911C7855E3359EFCFF7C7845BADEAAAFC8DC9A2B31FF864506950D060BFF2AEB0F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="AutoLists" GUID="{3365692F-9877-43ED-9AD8-26F857BCA005}">.. <Properties>.. <Property Class="Text" GUID="{663839F6-5C10-4356-8AD9-F01A99395E21}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">AutoLists</Property>.. <Property Class="Type" GUID="{ED4BEFE8-3ADE-4F83-A56D-2CD9D00156D8}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2"/>.. <Property Class="Number" GUID="{01276546-5E9A-411A-8B45-7878A8E8A818}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">4</Property>.. <Property Class="Text" GUID="{D0B9D989-D5DF-4051-AE2F-A65D1C39A736}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{3365692F-9877-43ED-9AD8-26F857BCA005}</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\AutoLists\is-JV3RL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	884
Entropy (8bit):	5.4134680796074734
Encrypted:	false
SSDEEP:	24:2dFDO5hX2VifvApWk/gAWuH11OckOd07f2WAdOcg53v:cUNUKg0xh
MD5:	8C4D89E5FCB9FFCD6A926F3129BC0B49
SHA1:	254367E5DE4D9E49704CBF53CBC2B74E07E4F780
SHA-256:	4F3FCCBDC9C24535003BD7917325D259E8C159430565CE9C929B8DE27D7A5C58
SHA-512:	D418E778A2C6FE368280FE250F433AAB190DC143F801E5F5D8F3375740277911C7855E3359EFCFF7C7845BADEAAAFC8DC9A2B31FF864506950D060BFF2AEB0F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="AutoLists" GUID="{3365692F-9877-43ED-9AD8-26F857BCA005}">.. <Properties>.. <Property Class="Text" GUID="{663839F6-5C10-4356-8AD9-F01A99395E21}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">AutoLists</Property>.. <Property Class="Type" GUID="{ED4BEFE8-3ADE-4F83-A56D-2CD9D00156D8}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2"/>.. <Property Class="Number" GUID="{01276546-5E9A-411A-8B45-7878A8E8A818}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">4</Property>.. <Property Class="Text" GUID="{D0B9D989-D5DF-4051-AE2F-A65D1C39A736}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{3365692F-9877-43ED-9AD8-26F857BCA005}</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Bookmarks\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1521
Entropy (8bit):	5.435240144955024
Encrypted:	false
SSDEEP:	24:2d2qnso/X/To1OcVjf2WAdOc0F6Txa/CApWirnogAWinamkWR9RxRfYVMOGijOii:cpsELLiTgOF0amnRpTh
MD5:	6E01F3A7A4B4198A339F525B229816C1
SHA1:	D424652F394DD3CC9B25A44E67DEB96B3A37DB40
SHA-256:	DDFD441C587BD257F6F5A4CAE86C9B8A93A3CFEB8230AB57C5CD324C66405387
SHA-512:	C0D6E4DF8E871006E22CD763C06F2EFD2B6EB7B4CE1A48F697E1C1148255224B692BF5EA667CEE9C63B85D72EA3C92B54641E214173F4719E85956B431BB0E04
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Bookmarks" GUID="{06CCCAF5-F7D3-485F-82FE-637EFB5AE5ED}">.. <Properties>.. <Property Class="Number" GUID="{888A87BD-7532-48F7-BB79-ED1A9660D0C9}" Name="OrderIndex" systemhidden="True" OrderIndex="2" DecimalPlaces="2">5</Property>.. <Property Class="Text" GUID="{FC126A64-2C5F-4326-B257-F02EFA9646C8}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="11" DecimalPlaces="2">{06CCCAF5-F7D3-485F-82FE-637EFB5AE5ED}</Property>.. <Property Class="Text" GUID="{2F0F18D3-13DE-4A0E-9903-39596318CE18}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Bookmarks</Property>.. <Property Class="Type" GUID="{74F36AFD-DAB8-4717-8609-47CA9F99ABB3}" Name="Type" group="Item" OrderIndex="4" DecimalPlaces="2">Folder</Property>.. <Property Class="Color" GUID="{94F0B9C5-0710-48A0-B1E7-1A9A1E30D052}" Name="Color" group="Item" OrderIndex

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Bookmarks\Floor Plan - A1.2\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2176
Entropy (8bit):	5.467108505747543
Encrypted:	false
SSDEEP:	24:2dfG5Y4Xw1Oc3RqUcf2WAdOcPfyGnB8txY5CzL0cYqigoUfo3DvihTcrV7RU/CAz:ccDPt8eYv7g8zvr2omntTh
MD5:	99E3338100EC905001D403D17E68EB45
SHA1:	868116FDC586AF6ED0AC591E8A419D0E06E4E046
SHA-256:	30124AF1A18F594FF3E523D9048F2429F15BFF113840AF09568BE4DEE2E6DADD
SHA-512:	DE525E96760813A77BCA8AE20C4803C8140368D481A54260472457A80516F85BE3EAF707F8D5A1ABB12E02A193B24D976A69BDE69A23831D6F2666BE6BE31B0E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Bookmark" Name="Floor Plan - A1.2" GUID="{3BB9FC73-EA32-454D-BAF5-CF445D91AEEE}">.. <Properties>.. <Property Class="Number" GUID="{E113E1A7-62BE-41B9-AAC2-A9DB96A8AAAA}" Name="OrderIndex" systemhidden="True" OrderIndex="2" DecimalPlaces="2">1</Property>.. <Property Class="Text" GUID="{5EED215E-C893-43C3-9121-63B07D9F48AF}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="8" DecimalPlaces="2">{3BB9FC73-EA32-454D-BAF5-CF445D91AEEE}</Property>.. <Property Class="Text" GUID="{818920CE-1BCC-442E-B660-431111931BC7}" Name="Page" OrderIndex="9" DecimalPlaces="2">{C0725BAA-50A4-43AB-B1EB-A9E7101BB396}</Property>.. <Property Class="Number" GUID="{9915CDE4-22AF-477C-8898-314D80452767}" Name="LocationLeft" OrderIndex="10" DecimalPlaces="2">-288</Property>.. <Property Class="Number" GUID="{68ACEF5D-0C56-4F16-9AE0-62964CE9242B}" Name="LocationTop" OrderIndex="11" DecimalPlaces="2">-163.20001220

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Bookmarks\Floor Plan - A1.2\is-4CAN1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2176
Entropy (8bit):	5.467108505747543
Encrypted:	false
SSDEEP:	24:2dfG5Y4Xw1Oc3RqUcf2WAdOcPfyGnB8txY5CzL0cYqigoUfo3DvihTcrV7RU/CAz:ccDPt8eYv7g8zvr2omntTh
MD5:	99E3338100EC905001D403D17E68EB45
SHA1:	868116FDC586AF6ED0AC591E8A419D0E06E4E046
SHA-256:	30124AF1A18F594FF3E523D9048F2429F15BFF113840AF09568BE4DEE2E6DADD
SHA-512:	DE525E96760813A77BCA8AE20C4803C8140368D481A54260472457A80516F85BE3EAF707F8D5A1ABB12E02A193B24D976A69BDE69A23831D6F2666BE6BE31B0E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Bookmark" Name="Floor Plan - A1.2" GUID="{3BB9FC73-EA32-454D-BAF5-CF445D91AEEE}">.. <Properties>.. <Property Class="Number" GUID="{E113E1A7-62BE-41B9-AAC2-A9DB96A8AAAA}" Name="OrderIndex" systemhidden="True" OrderIndex="2" DecimalPlaces="2">1</Property>.. <Property Class="Text" GUID="{5EED215E-C893-43C3-9121-63B07D9F48AF}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="8" DecimalPlaces="2">{3BB9FC73-EA32-454D-BAF5-CF445D91AEEE}</Property>.. <Property Class="Text" GUID="{818920CE-1BCC-442E-B660-431111931BC7}" Name="Page" OrderIndex="9" DecimalPlaces="2">{C0725BAA-50A4-43AB-B1EB-A9E7101BB396}</Property>.. <Property Class="Number" GUID="{9915CDE4-22AF-477C-8898-314D80452767}" Name="LocationLeft" OrderIndex="10" DecimalPlaces="2">-288</Property>.. <Property Class="Number" GUID="{68ACEF5D-0C56-4F16-9AE0-62964CE9242B}" Name="LocationTop" OrderIndex="11" DecimalPlaces="2">-163.20001220

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Bookmarks\Introduction Page\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2189
Entropy (8bit):	5.466916961586919
Encrypted:	false
SSDEEP:	24:2dfGpAXqoE61Ocv4vCJ9f2WAdOcRHlR8t3l5MEW1HnTzL0neo3LOvaTv+2/CApWS:cP6ZV+t/KhHwdISgjZMI2Rh
MD5:	02CF079FA3DC2709D950F71B0FD00A6B
SHA1:	348E60AA893EAC82F47B1FF265A6972178BBDBD9
SHA-256:	2A4EF54B8C0499FF0637E641FB1C8292A89AF787438C704BC96C15A920EC3817
SHA-512:	564A1F78340E01AEB99D7869D600F75008D8F0B2E0C535AAA07246D3B890108F7EB98AFED2963CB1C24567AF8674BF107ED90282646B55EFBB070120BE868471
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Bookmark" Name="Introduction Page" GUID="{E38579A5-FA0C-49A2-92F9-0CB57335337A}">.. <Properties>.. <Property Class="Number" GUID="{A1A2BC71-C355-41A2-A92B-74B144DAB202}" Name="OrderIndex" systemhidden="True" OrderIndex="2" DecimalPlaces="2">2</Property>.. <Property Class="Text" GUID="{580B393D-68BE-4344-8569-0EA1DDCBC460}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="8" DecimalPlaces="2">{E38579A5-FA0C-49A2-92F9-0CB57335337A}</Property>.. <Property Class="Text" GUID="{C7DCCDCD-7A30-4638-A8A5-DE30BD8964CD}" Name="Page" OrderIndex="9" DecimalPlaces="2">{62989AF0-36A2-481F-BBE0-473278D6DF0A}</Property>.. <Property Class="Number" GUID="{FA163E9D-1EA9-4ABF-B5B8-82FC74010858}" Name="LocationLeft" OrderIndex="10" DecimalPlaces="2">-123.903999328613</Property>.. <Property Class="Number" GUID="{D2F1B339-CCD1-4087-B366-80B39AA9573C}" Name="LocationTop" OrderIndex="11" DecimalPlaces="2">

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Bookmarks\Introduction Page\is-615QK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2189
Entropy (8bit):	5.466916961586919
Encrypted:	false
SSDEEP:	24:2dfGpAXqoE61Ocv4vCJ9f2WAdOcRHlR8t3l5MEW1HnTzL0neo3LOvaTv+2/CApWS:cP6ZV+t/KhHwdISgjZMI2Rh
MD5:	02CF079FA3DC2709D950F71B0FD00A6B
SHA1:	348E60AA893EAC82F47B1FF265A6972178BBDBD9
SHA-256:	2A4EF54B8C0499FF0637E641FB1C8292A89AF787438C704BC96C15A920EC3817
SHA-512:	564A1F78340E01AEB99D7869D600F75008D8F0B2E0C535AAA07246D3B890108F7EB98AFED2963CB1C24567AF8674BF107ED90282646B55EFBB070120BE868471
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Bookmark" Name="Introduction Page" GUID="{E38579A5-FA0C-49A2-92F9-0CB57335337A}">.. <Properties>.. <Property Class="Number" GUID="{A1A2BC71-C355-41A2-A92B-74B144DAB202}" Name="OrderIndex" systemhidden="True" OrderIndex="2" DecimalPlaces="2">2</Property>.. <Property Class="Text" GUID="{580B393D-68BE-4344-8569-0EA1DDCBC460}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="8" DecimalPlaces="2">{E38579A5-FA0C-49A2-92F9-0CB57335337A}</Property>.. <Property Class="Text" GUID="{C7DCCDCD-7A30-4638-A8A5-DE30BD8964CD}" Name="Page" OrderIndex="9" DecimalPlaces="2">{62989AF0-36A2-481F-BBE0-473278D6DF0A}</Property>.. <Property Class="Number" GUID="{FA163E9D-1EA9-4ABF-B5B8-82FC74010858}" Name="LocationLeft" OrderIndex="10" DecimalPlaces="2">-123.903999328613</Property>.. <Property Class="Number" GUID="{D2F1B339-CCD1-4087-B366-80B39AA9573C}" Name="LocationTop" OrderIndex="11" DecimalPlaces="2">

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Bookmarks\Level 01 Floor Plan\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2157
Entropy (8bit):	5.446706184499945
Encrypted:	false
SSDEEP:	24:2dfGOcWgXVw1Oc2wf2WAdOcOWnSh9h8tTg5FBOKzL0svPs5rio3CT4x6I/CApWSm:c0fNGjb9HcXsvPCEg8WYFLh
MD5:	B8195E7217F92EFF37C1881FCCFAC773
SHA1:	25829DCFE477E9107A50F71655E8650B00A943A2
SHA-256:	BB04EEE59794A9D964A6F416EEC0CA3C0CB78B6DEB751C21DD92057C78365370
SHA-512:	91995F40A9B0FEA75A8634DB6F830C1833095067C4B69E6F57FEB806C3238C2F8D7F079186C60DE3422BB00DA5918D3986DB774F8859124E58227DBC680F0403
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Bookmark" Name="Level 01 Floor Plan - A101" GUID="{642FD1EC-EE7A-413B-931B-E66518E14307}">.. <Properties>.. <Property Class="Number" GUID="{303952B2-2864-4EFB-82FF-E2A37F5040A9}" Name="OrderIndex" systemhidden="True" OrderIndex="2" DecimalPlaces="2">0</Property>.. <Property Class="Text" GUID="{A2078AE0-FA9C-488B-986B-182455798783}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="8" DecimalPlaces="2">{642FD1EC-EE7A-413B-931B-E66518E14307}</Property>.. <Property Class="Text" GUID="{7739279D-C09D-4432-8189-59867D0B0755}" Name="Page" OrderIndex="9" DecimalPlaces="2">{D89AEBD4-1D4B-445F-8C82-F096D084A245}</Property>.. <Property Class="Number" GUID="{141494E6-AD6C-460C-9A5F-A2CD3D235EB6}" Name="LocationLeft" OrderIndex="10" DecimalPlaces="2">-588</Property>.. <Property Class="Number" GUID="{96739DAC-0845-4398-B4BA-B41CDDFCC158}" Name="LocationTop" OrderIndex="11" DecimalPlaces="2">-210

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Bookmarks\Level 01 Floor Plan\is-VF2IR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2157
Entropy (8bit):	5.446706184499945
Encrypted:	false
SSDEEP:	24:2dfGOcWgXVw1Oc2wf2WAdOcOWnSh9h8tTg5FBOKzL0svPs5rio3CT4x6I/CApWSm:c0fNGjb9HcXsvPCEg8WYFLh
MD5:	B8195E7217F92EFF37C1881FCCFAC773
SHA1:	25829DCFE477E9107A50F71655E8650B00A943A2
SHA-256:	BB04EEE59794A9D964A6F416EEC0CA3C0CB78B6DEB751C21DD92057C78365370
SHA-512:	91995F40A9B0FEA75A8634DB6F830C1833095067C4B69E6F57FEB806C3238C2F8D7F079186C60DE3422BB00DA5918D3986DB774F8859124E58227DBC680F0403
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Bookmark" Name="Level 01 Floor Plan - A101" GUID="{642FD1EC-EE7A-413B-931B-E66518E14307}">.. <Properties>.. <Property Class="Number" GUID="{303952B2-2864-4EFB-82FF-E2A37F5040A9}" Name="OrderIndex" systemhidden="True" OrderIndex="2" DecimalPlaces="2">0</Property>.. <Property Class="Text" GUID="{A2078AE0-FA9C-488B-986B-182455798783}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="8" DecimalPlaces="2">{642FD1EC-EE7A-413B-931B-E66518E14307}</Property>.. <Property Class="Text" GUID="{7739279D-C09D-4432-8189-59867D0B0755}" Name="Page" OrderIndex="9" DecimalPlaces="2">{D89AEBD4-1D4B-445F-8C82-F096D084A245}</Property>.. <Property Class="Number" GUID="{141494E6-AD6C-460C-9A5F-A2CD3D235EB6}" Name="LocationLeft" OrderIndex="10" DecimalPlaces="2">-588</Property>.. <Property Class="Number" GUID="{96739DAC-0845-4398-B4BA-B41CDDFCC158}" Name="LocationTop" OrderIndex="11" DecimalPlaces="2">-210

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Bookmarks\is-LEDG5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1521
Entropy (8bit):	5.435240144955024
Encrypted:	false
SSDEEP:	24:2d2qnso/X/To1OcVjf2WAdOc0F6Txa/CApWirnogAWinamkWR9RxRfYVMOGijOii:cpsELLiTgOF0amnRpTh
MD5:	6E01F3A7A4B4198A339F525B229816C1
SHA1:	D424652F394DD3CC9B25A44E67DEB96B3A37DB40
SHA-256:	DDFD441C587BD257F6F5A4CAE86C9B8A93A3CFEB8230AB57C5CD324C66405387
SHA-512:	C0D6E4DF8E871006E22CD763C06F2EFD2B6EB7B4CE1A48F697E1C1148255224B692BF5EA667CEE9C63B85D72EA3C92B54641E214173F4719E85956B431BB0E04
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Bookmarks" GUID="{06CCCAF5-F7D3-485F-82FE-637EFB5AE5ED}">.. <Properties>.. <Property Class="Number" GUID="{888A87BD-7532-48F7-BB79-ED1A9660D0C9}" Name="OrderIndex" systemhidden="True" OrderIndex="2" DecimalPlaces="2">5</Property>.. <Property Class="Text" GUID="{FC126A64-2C5F-4326-B257-F02EFA9646C8}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="11" DecimalPlaces="2">{06CCCAF5-F7D3-485F-82FE-637EFB5AE5ED}</Property>.. <Property Class="Text" GUID="{2F0F18D3-13DE-4A0E-9903-39596318CE18}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Bookmarks</Property>.. <Property Class="Type" GUID="{74F36AFD-DAB8-4717-8609-47CA9F99ABB3}" Name="Type" group="Item" OrderIndex="4" DecimalPlaces="2">Folder</Property>.. <Property Class="Color" GUID="{94F0B9C5-0710-48A0-B1E7-1A9A1E30D052}" Name="Color" group="Item" OrderIndex

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1988
Entropy (8bit):	5.442751870561866
Encrypted:	false
SSDEEP:	24:2dFD3BNyw3JX2AIP/CApW/H/gAWmxn3GkVMOGijo7YxfnO881KOF1OcGcfY4f2Wv:ctBNygJKsL9k1haHwtaW3QSM8T71
MD5:	CA6A51417031FA51EF411E24B7D7558C
SHA1:	84E255B6D39059AA79F01B10F00DDB3AEBC285BF
SHA-256:	C5D92C10AF3B12BCD200E1A43AA6AEAAC3578E29D45BC2EB1129DE67ED7C69E7
SHA-512:	39E751D3E5D313C5A6D288014BB95EC61206D7BDD54CB1F1548CC838AD29E42A142615BD6813EFD49F92790A5D39A62C9798F55D5B3D408FC58B589FE70B2780
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Sample Project" GUID="{48E760CD-DBAC-48CE-8711-C00AF5BA0383}">.. <Properties>.. <Property Class="Text" GUID="{771047B9-BC70-4621-9884-BEEB26193064}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Sample Project</Property>.. <Property Class="Type" GUID="{55AF6F30-2132-4DB6-88FF-8678223F3172}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Job</Property>.. <Property Class="Text" GUID="{4702899B-CB83-4763-8125-5BBA6A589224}" Name="Created By" inheritaction="Flatten" group="Audit Trail" OrderIndex="5" DecimalPlaces="" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{C59ABAA5-F9E7-4984-A391-1FE0DA16ACF1}" Name="Time Stamp" inheritaction="Flatten" group="Audit Trail" OrderIndex="6" DecimalPlaces="" List="cmbList" PluginToExecute="cmbList">4/5/21 10:57:47 PM</Property>.. <Property Class="Number" GUID="{EF6E2728-606

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Links\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1019
Entropy (8bit):	5.4222337622739865
Encrypted:	false
SSDEEP:	24:2dFD7X2zlJvApW70Irx6gAWkky1OciRwDhf2WAdOcbpGPuzv:cx8AI9kAszSpGi
MD5:	E5707E630440CBE3C716EC1158C87F40
SHA1:	E999AB55D7816F8F6E17789D66C16A776DA26EB8
SHA-256:	FF89C099F933750855BFF650DC430751E5D3E36EB09818B09066F5A1A12A057A
SHA-512:	09E7EC89397A27AFA65B83ABB0887F117A3AEA752993CE9919C6B535E87545E0279D1D41F96121DD9FC61AE2A2E07866C8C3EFEB71C0FC45F3422C6A5A0B1104
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Links" GUID="{9F2E9BDD-48B2-4B16-BA47-8DC32EEF0585}">.. <Properties>.. <Property Class="Text" GUID="{F094C0AD-B7CC-4ADE-83E6-054EB1B44A99}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Links</Property>.. <Property Class="Type" GUID="{40494A42-F27F-48AD-968E-3C5DE602D912}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2"/>.. <Property Class="Number" GUID="{68161248-1987-41CB-B48E-7F4A59CB068D}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">1</Property>.. <Property Class="Text" GUID="{7C9851FB-3C38-4EAB-964B-E91FF1A159D4}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{9F2E9BDD-48B2-4B16-BA47-8DC32EEF0585}</Property>.. <Property Class="Number" GUID="{66A55872-F9B0-4BCB-AB74-3F744728255B}" Name="TabOrderIndex" OrderIndex="4" DecimalPlaces="2">8</Property>.. </Pro

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Links\is-JV4B5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1019
Entropy (8bit):	5.4222337622739865
Encrypted:	false
SSDEEP:	24:2dFD7X2zlJvApW70Irx6gAWkky1OciRwDhf2WAdOcbpGPuzv:cx8AI9kAszSpGi
MD5:	E5707E630440CBE3C716EC1158C87F40
SHA1:	E999AB55D7816F8F6E17789D66C16A776DA26EB8
SHA-256:	FF89C099F933750855BFF650DC430751E5D3E36EB09818B09066F5A1A12A057A
SHA-512:	09E7EC89397A27AFA65B83ABB0887F117A3AEA752993CE9919C6B535E87545E0279D1D41F96121DD9FC61AE2A2E07866C8C3EFEB71C0FC45F3422C6A5A0B1104
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Links" GUID="{9F2E9BDD-48B2-4B16-BA47-8DC32EEF0585}">.. <Properties>.. <Property Class="Text" GUID="{F094C0AD-B7CC-4ADE-83E6-054EB1B44A99}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Links</Property>.. <Property Class="Type" GUID="{40494A42-F27F-48AD-968E-3C5DE602D912}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2"/>.. <Property Class="Number" GUID="{68161248-1987-41CB-B48E-7F4A59CB068D}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">1</Property>.. <Property Class="Text" GUID="{7C9851FB-3C38-4EAB-964B-E91FF1A159D4}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{9F2E9BDD-48B2-4B16-BA47-8DC32EEF0585}</Property>.. <Property Class="Number" GUID="{66A55872-F9B0-4BCB-AB74-3F744728255B}" Name="TabOrderIndex" OrderIndex="4" DecimalPlaces="2">8</Property>.. </Pro

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Architectural Detail1\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2733
Entropy (8bit):	5.466862248785371
Encrypted:	false
SSDEEP:	24:2dRbTl5X2/Md/CApWpG/32/BgAWa1Oc4+J+f2WAdOcU8db1Ar4ILqyAyWAr0QaRx:cz5P+gGiP2Spt4QmPakQ7YuztGftpT
MD5:	D044525F1B72B7C8B087A758BD29EF11
SHA1:	AD1AD5773A3463000BFB7BCCB5DB323FEF35EE52
SHA-256:	92BB871E86694189A3C36CEE68A7A3A6FE6A0B538CBF5F2C1D766AB9CB08D1F0
SHA-512:	D3565B89EEC10300CE5A984AE82A3C890E45246387E7E09B51D03D0518249D5BA6FD0CCCF4A56861E31EA8C3FB8329CF3E8BD77A84FE6A3F9C80EBA8C8A3D87B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Page" Name="Architectural Details - A502" GUID="{1769B27A-8149-4371-AB7A-16A4E0969F0A}">.. <Properties>.. <Property Class="Text" GUID="{C173C05A-E613-4DD6-B760-65E7B6DF3374}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Architectural Details - A502</Property>.. <Property Class="Type" GUID="{7ECCAD9C-979C-46D8-AF49-E9B2C4A94FD8}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">.TIFF Page</Property>.. <Property Class="Number" GUID="{FEBB781F-97B0-43BE-8F29-2E5A69DE265C}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">16</Property>.. <Property Class="Text" GUID="{CEF7329A-A77D-4247-81CF-C593D4A45A66}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="9" DecimalPlaces="2">{1769B27A-8149-4371-AB7A-16A4E0969F0A}</Property>.. <Property Class="Large Image" GUID="{DCFAC06D-3F9B-41C6-B74D-6648C

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Architectural Detail1\is-3C7DD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2733
Entropy (8bit):	5.466862248785371
Encrypted:	false
SSDEEP:	24:2dRbTl5X2/Md/CApWpG/32/BgAWa1Oc4+J+f2WAdOcU8db1Ar4ILqyAyWAr0QaRx:cz5P+gGiP2Spt4QmPakQ7YuztGftpT
MD5:	D044525F1B72B7C8B087A758BD29EF11
SHA1:	AD1AD5773A3463000BFB7BCCB5DB323FEF35EE52
SHA-256:	92BB871E86694189A3C36CEE68A7A3A6FE6A0B538CBF5F2C1D766AB9CB08D1F0
SHA-512:	D3565B89EEC10300CE5A984AE82A3C890E45246387E7E09B51D03D0518249D5BA6FD0CCCF4A56861E31EA8C3FB8329CF3E8BD77A84FE6A3F9C80EBA8C8A3D87B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Page" Name="Architectural Details - A502" GUID="{1769B27A-8149-4371-AB7A-16A4E0969F0A}">.. <Properties>.. <Property Class="Text" GUID="{C173C05A-E613-4DD6-B760-65E7B6DF3374}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Architectural Details - A502</Property>.. <Property Class="Type" GUID="{7ECCAD9C-979C-46D8-AF49-E9B2C4A94FD8}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">.TIFF Page</Property>.. <Property Class="Number" GUID="{FEBB781F-97B0-43BE-8F29-2E5A69DE265C}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">16</Property>.. <Property Class="Text" GUID="{CEF7329A-A77D-4247-81CF-C593D4A45A66}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="9" DecimalPlaces="2">{1769B27A-8149-4371-AB7A-16A4E0969F0A}</Property>.. <Property Class="Large Image" GUID="{DCFAC06D-3F9B-41C6-B74D-6648C

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Architectural Detail1\is-B59MP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	TIFF image data, little-endian, direntries=20, height=4500, bps=8, compression=PackBits (Macintosh RLE), PhotometricIntepretation=RGB Palette, orientation=upper-left, width=6300
Category:	dropped
Size (bytes):	775112
Entropy (8bit):	3.660316164363229
Encrypted:	false
SSDEEP:	6144:lcj2HhbWIxypDIvH7kokPOgjBSPI3HumX3UBFHu:s2Hha8ypDIvHQokPOgjBSPI3HP3yF
MD5:	6EC972B22760CFCA9687288AB78A372F
SHA1:	90CC3D5FDAFD9F5DF37F850C34AAFE7876093711
SHA-256:	CED1EBF7A9F54E7500D12DB14AEDFAFB192FD61F784AC064BC429E3514F0D6F2
SHA-512:	B48621E610DC04E6477334AA6780B8A053834FFDA61FC1B4EA4EE826BF6954CB0921D2DDA63C971CB326487B9B4A2B5041C93061C5A532A3640646A5BCC798C2
Malicious:	false
Preview:	II*.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Architectural Detail1\{DCFAC06D-3F9B-41C6-B74D-6648C26F24B3}.tiff (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	TIFF image data, little-endian, direntries=20, height=4500, bps=8, compression=PackBits (Macintosh RLE), PhotometricIntepretation=RGB Palette, orientation=upper-left, width=6300
Category:	dropped
Size (bytes):	775112
Entropy (8bit):	3.660316164363229
Encrypted:	false
SSDEEP:	6144:lcj2HhbWIxypDIvH7kokPOgjBSPI3HumX3UBFHu:s2Hha8ypDIvHQokPOgjBSPI3HP3yF
MD5:	6EC972B22760CFCA9687288AB78A372F
SHA1:	90CC3D5FDAFD9F5DF37F850C34AAFE7876093711
SHA-256:	CED1EBF7A9F54E7500D12DB14AEDFAFB192FD61F784AC064BC429E3514F0D6F2
SHA-512:	B48621E610DC04E6477334AA6780B8A053834FFDA61FC1B4EA4EE826BF6954CB0921D2DDA63C971CB326487B9B4A2B5041C93061C5A532A3640646A5BCC798C2
Malicious:	false
Preview:	II*.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Architectural Detail\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2733
Entropy (8bit):	5.463385424772535
Encrypted:	false
SSDEEP:	48:czUZ9+gDtnRUVAxDumQ/de3aauQgPIwURT:JZxn2wDumGauQgPxg
MD5:	77C158C878869DC8DBC50981C55E3788
SHA1:	70D2E6F4A93F6EC8120228468C1AAE61B8F3D3EB
SHA-256:	A093702A17E6D88C4CE61C2DF1D8203FB520C9D9C31C31AD475718A6569D8731
SHA-512:	114F1062A1026ADC9C3E38876D2B8FA71EFE9E19B3884D5DBED6B48E647977E2D7D6EA5C62A7A6589A6EA4732B994837B5F1D5F61AABD206A342759E1B49E76A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Page" Name="Architectural Details - A501" GUID="{24597337-41AE-43EA-8A15-1B86887EFA3A}">.. <Properties>.. <Property Class="Text" GUID="{FD097897-02E7-44BE-9B82-8DFD7003C7AD}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Architectural Details - A501</Property>.. <Property Class="Type" GUID="{1220048C-9895-49FC-ACE5-36B035308D8B}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">.TIFF Page</Property>.. <Property Class="Number" GUID="{1348DBE2-CF91-4632-BD63-8A83015E778A}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">15</Property>.. <Property Class="Text" GUID="{20F16CBD-D4C2-4BB4-97CB-8A21276CDAC5}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="9" DecimalPlaces="2">{24597337-41AE-43EA-8A15-1B86887EFA3A}</Property>.. <Property Class="Large Image" GUID="{D0B09C3C-BFFC-46BC-8F02-99A66

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Architectural Detail\is-D600E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2733
Entropy (8bit):	5.463385424772535
Encrypted:	false
SSDEEP:	48:czUZ9+gDtnRUVAxDumQ/de3aauQgPIwURT:JZxn2wDumGauQgPxg
MD5:	77C158C878869DC8DBC50981C55E3788
SHA1:	70D2E6F4A93F6EC8120228468C1AAE61B8F3D3EB
SHA-256:	A093702A17E6D88C4CE61C2DF1D8203FB520C9D9C31C31AD475718A6569D8731
SHA-512:	114F1062A1026ADC9C3E38876D2B8FA71EFE9E19B3884D5DBED6B48E647977E2D7D6EA5C62A7A6589A6EA4732B994837B5F1D5F61AABD206A342759E1B49E76A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Page" Name="Architectural Details - A501" GUID="{24597337-41AE-43EA-8A15-1B86887EFA3A}">.. <Properties>.. <Property Class="Text" GUID="{FD097897-02E7-44BE-9B82-8DFD7003C7AD}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Architectural Details - A501</Property>.. <Property Class="Type" GUID="{1220048C-9895-49FC-ACE5-36B035308D8B}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">.TIFF Page</Property>.. <Property Class="Number" GUID="{1348DBE2-CF91-4632-BD63-8A83015E778A}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">15</Property>.. <Property Class="Text" GUID="{20F16CBD-D4C2-4BB4-97CB-8A21276CDAC5}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="9" DecimalPlaces="2">{24597337-41AE-43EA-8A15-1B86887EFA3A}</Property>.. <Property Class="Large Image" GUID="{D0B09C3C-BFFC-46BC-8F02-99A66

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Architectural Detail\is-Q65UD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	TIFF image data, little-endian
Category:	dropped
Size (bytes):	2257768
Entropy (8bit):	4.817100037043351
Encrypted:	false
SSDEEP:	49152:S+kF7BpjOY8RCpzgHGHpN7u7597BDwhbTqxYBvJGFZj/6iZb+VJ3eBr/Hwv9fSy2:S+kFFpjOY8RCpzgHGHpN7u7597BDwhbe
MD5:	C8A873600DCC4367DEC3B80539ABBFCC
SHA1:	AF20374567192F2D06FABE924FD2B00159F2EE11
SHA-256:	F5CEB8AD344150C4A7623BC94FAFE26F50F92BE1D0565FEB2A33658F903C3639
SHA-512:	16568EFF6790BF7B6DAA039A438C15D70F04EAD13FCA07A2E89F07BA148B63E90B5F7BDB8C82443D8CD1986A359C42E0177F9E3593BA8DDB483CE19FEB2B7F31
Malicious:	false
Preview:	II*.6l".................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Architectural Detail\{D0B09C3C-BFFC-46BC-8F02-99A66B46F04B}.tiff (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	TIFF image data, little-endian
Category:	dropped
Size (bytes):	2257768
Entropy (8bit):	4.817100037043351
Encrypted:	false
SSDEEP:	49152:S+kF7BpjOY8RCpzgHGHpN7u7597BDwhbTqxYBvJGFZj/6iZb+VJ3eBr/Hwv9fSy2:S+kFFpjOY8RCpzgHGHpN7u7597BDwhbe
MD5:	C8A873600DCC4367DEC3B80539ABBFCC
SHA1:	AF20374567192F2D06FABE924FD2B00159F2EE11
SHA-256:	F5CEB8AD344150C4A7623BC94FAFE26F50F92BE1D0565FEB2A33658F903C3639
SHA-512:	16568EFF6790BF7B6DAA039A438C15D70F04EAD13FCA07A2E89F07BA148B63E90B5F7BDB8C82443D8CD1986A359C42E0177F9E3593BA8DDB483CE19FEB2B7F31
Malicious:	false
Preview:	II*.6l".................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Architectural Site P\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2745
Entropy (8bit):	5.479633462419534
Encrypted:	false
SSDEEP:	48:czB4T1Q7+gBuihueQZbYuWIT0HRMligMT:tT1PihuexuPT0HRMlig0
MD5:	3065190E03DC23D96071A7F5455717C6
SHA1:	690BDC5BDA44CF740FC1BCB8E541EFF55183AB92
SHA-256:	AFD66A95D427F5776F2792C34D934FDFE11AD339A169943C07991D490760BC25
SHA-512:	6725BBB1FE7C6D525E71869ECEE0B1AA3E63AA380CC7EA13548A4A9931B6F7A8935F2B9B31D2C4F415EB52D356BFA2A52E94BABB01A8C97ABEE354BFD92AAC5F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Page" Name="Architectural Site Plan - AS101" GUID="{83CAE4F6-044D-46CE-AA09-F05549307712}">.. <Properties>.. <Property Class="Text" GUID="{0F0C4865-C27A-4C28-8FB9-5428F809F3DF}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Architectural Site Plan - AS101</Property>.. <Property Class="Type" GUID="{F70DEDCE-CB73-4D35-A843-BB9B9A36D977}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">.TIFF Page</Property>.. <Property Class="Number" GUID="{01EB232B-5EEE-45B5-8CCD-2A8BED49F582}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">3</Property>.. <Property Class="Text" GUID="{C802FF30-A118-4D7B-8A8E-64B61902D6BC}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="9" DecimalPlaces="2">{83CAE4F6-044D-46CE-AA09-F05549307712}</Property>.. <Property Class="Large Image" GUID="{EEAC763A-CD96-44EC-9D87-

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Architectural Site P\is-GF3SQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2745
Entropy (8bit):	5.479633462419534
Encrypted:	false
SSDEEP:	48:czB4T1Q7+gBuihueQZbYuWIT0HRMligMT:tT1PihuexuPT0HRMlig0
MD5:	3065190E03DC23D96071A7F5455717C6
SHA1:	690BDC5BDA44CF740FC1BCB8E541EFF55183AB92
SHA-256:	AFD66A95D427F5776F2792C34D934FDFE11AD339A169943C07991D490760BC25
SHA-512:	6725BBB1FE7C6D525E71869ECEE0B1AA3E63AA380CC7EA13548A4A9931B6F7A8935F2B9B31D2C4F415EB52D356BFA2A52E94BABB01A8C97ABEE354BFD92AAC5F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Page" Name="Architectural Site Plan - AS101" GUID="{83CAE4F6-044D-46CE-AA09-F05549307712}">.. <Properties>.. <Property Class="Text" GUID="{0F0C4865-C27A-4C28-8FB9-5428F809F3DF}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Architectural Site Plan - AS101</Property>.. <Property Class="Type" GUID="{F70DEDCE-CB73-4D35-A843-BB9B9A36D977}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">.TIFF Page</Property>.. <Property Class="Number" GUID="{01EB232B-5EEE-45B5-8CCD-2A8BED49F582}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">3</Property>.. <Property Class="Text" GUID="{C802FF30-A118-4D7B-8A8E-64B61902D6BC}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="9" DecimalPlaces="2">{83CAE4F6-044D-46CE-AA09-F05549307712}</Property>.. <Property Class="Large Image" GUID="{EEAC763A-CD96-44EC-9D87-

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Architectural Site P\is-STOF9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	TIFF image data, little-endian
Category:	dropped
Size (bytes):	1365574
Entropy (8bit):	4.526513319251275
Encrypted:	false
SSDEEP:	12288:tJ4O7VaI3qq9fzb3adBcdLpDBmE+GvABwz9v51pYF:tyOL3qq5SaLpDBmnI3q
MD5:	7F2C20AAC838236E030863160ADA56D9
SHA1:	65D16C46170AFDC940FE288A688021C0B9D90276
SHA-256:	AA8F58FDB56B87C8A807D00A21E61C39FA0BBAF30DD83D64559615946C06575A
SHA-512:	FE8D3444D5DA699A7FE0C3B92809A9E9BD98778C8E2A995EBB2B789E603694B77FF182586EC3592A081655238D455F12E3E1180CCAAA318EADEC310734C2BEDA
Malicious:	false
Preview:	II*.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Architectural Site P\{EEAC763A-CD96-44EC-9D87-B7E2BDBACCAA}.tiff (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	TIFF image data, little-endian
Category:	dropped
Size (bytes):	1365574
Entropy (8bit):	4.526513319251275
Encrypted:	false
SSDEEP:	12288:tJ4O7VaI3qq9fzb3adBcdLpDBmE+GvABwz9v51pYF:tyOL3qq5SaLpDBmnI3q
MD5:	7F2C20AAC838236E030863160ADA56D9
SHA1:	65D16C46170AFDC940FE288A688021C0B9D90276
SHA-256:	AA8F58FDB56B87C8A807D00A21E61C39FA0BBAF30DD83D64559615946C06575A
SHA-512:	FE8D3444D5DA699A7FE0C3B92809A9E9BD98778C8E2A995EBB2B789E603694B77FF182586EC3592A081655238D455F12E3E1180CCAAA318EADEC310734C2BEDA
Malicious:	false
Preview:	II*.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Assembly Types - G50\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2716
Entropy (8bit):	5.470225053120608
Encrypted:	false
SSDEEP:	48:c9xuAd8E1gFeC/nBNQkPbN14uBiq2LYb9T:+xuS10BnBN/GuBinLYbN
MD5:	F4C8423CCDCB8BE68DC1957EDEE90C6E
SHA1:	B1A7AC3813593C91E0081DF59EA5BF1FD9BE1FBE
SHA-256:	32F719046C0EB25BD1866A6FE5E7D3E41B094124CD44DC574DFAAE9DFCFE0169
SHA-512:	9843BE1BE8FA5312F09E9A606ECED10E6BABE470ADC5AAB6DDF593B5C61AAC5E7A1B34992A0E134F5B2E02DF8A22CD501F0EC0CA00E2F0BFA54F4D7E31AFF78B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Page" Name="Assembly Types - G501" GUID="{0104ADE6-5B8E-4D1B-A605-EA4A2E045C25}">.. <Properties>.. <Property Class="Text" GUID="{40A89A68-02C0-4B37-9C25-5C834B65ED17}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Assembly Types - G501</Property>.. <Property Class="Type" GUID="{1891C864-DCAF-42A7-A9D1-F65D1DB5661C}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">.TIFF Page</Property>.. <Property Class="Number" GUID="{3D5730D1-C5BC-4168-A9B5-245E07E1088C}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">2</Property>.. <Property Class="Text" GUID="{32F003AD-DBB8-46BE-957A-2186D79AB9B0}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="9" DecimalPlaces="2">{0104ADE6-5B8E-4D1B-A605-EA4A2E045C25}</Property>.. <Property Class="Large Image" GUID="{79D3454A-156C-4829-9D83-9718B477ABFB}" Name=

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Assembly Types - G50\is-IIBJ1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	TIFF image data, little-endian
Category:	dropped
Size (bytes):	2049890
Entropy (8bit):	4.69371834970636
Encrypted:	false
SSDEEP:	49152:lRbW/8HTmmkGS4dKyENX/My05M7ZARHxo9+0:llS8ymkGS4dLOprd
MD5:	CE32AF17A70150D7B4A550DF76F712CA
SHA1:	C290BB521C3F604B7059600FCD6F065DA304A7C1
SHA-256:	F175F7E3899CA5C199247601683FA82A65021A02F598C298A46EBD7F360CDA91
SHA-512:	84F4F0B2C849E494571E2FA75274E108693D0609E34808DD3AE28D92312920AB4EE8B2A17A07EFC7F273405B57F7E3BA5BB3437C8010A2FED6D20CB013E1FBEA
Malicious:	false
Preview:	II*.0@..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Assembly Types - G50\is-UMVGS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2716
Entropy (8bit):	5.470225053120608
Encrypted:	false
SSDEEP:	48:c9xuAd8E1gFeC/nBNQkPbN14uBiq2LYb9T:+xuS10BnBN/GuBinLYbN
MD5:	F4C8423CCDCB8BE68DC1957EDEE90C6E
SHA1:	B1A7AC3813593C91E0081DF59EA5BF1FD9BE1FBE
SHA-256:	32F719046C0EB25BD1866A6FE5E7D3E41B094124CD44DC574DFAAE9DFCFE0169
SHA-512:	9843BE1BE8FA5312F09E9A606ECED10E6BABE470ADC5AAB6DDF593B5C61AAC5E7A1B34992A0E134F5B2E02DF8A22CD501F0EC0CA00E2F0BFA54F4D7E31AFF78B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Page" Name="Assembly Types - G501" GUID="{0104ADE6-5B8E-4D1B-A605-EA4A2E045C25}">.. <Properties>.. <Property Class="Text" GUID="{40A89A68-02C0-4B37-9C25-5C834B65ED17}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Assembly Types - G501</Property>.. <Property Class="Type" GUID="{1891C864-DCAF-42A7-A9D1-F65D1DB5661C}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">.TIFF Page</Property>.. <Property Class="Number" GUID="{3D5730D1-C5BC-4168-A9B5-245E07E1088C}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">2</Property>.. <Property Class="Text" GUID="{32F003AD-DBB8-46BE-957A-2186D79AB9B0}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="9" DecimalPlaces="2">{0104ADE6-5B8E-4D1B-A605-EA4A2E045C25}</Property>.. <Property Class="Large Image" GUID="{79D3454A-156C-4829-9D83-9718B477ABFB}" Name=

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Assembly Types - G50\{79D3454A-156C-4829-9D83-9718B477ABFB}.tiff (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	TIFF image data, little-endian
Category:	dropped
Size (bytes):	2049890
Entropy (8bit):	4.69371834970636
Encrypted:	false
SSDEEP:	49152:lRbW/8HTmmkGS4dKyENX/My05M7ZARHxo9+0:llS8ymkGS4dLOprd
MD5:	CE32AF17A70150D7B4A550DF76F712CA
SHA1:	C290BB521C3F604B7059600FCD6F065DA304A7C1
SHA-256:	F175F7E3899CA5C199247601683FA82A65021A02F598C298A46EBD7F360CDA91
SHA-512:	84F4F0B2C849E494571E2FA75274E108693D0609E34808DD3AE28D92312920AB4EE8B2A17A07EFC7F273405B57F7E3BA5BB3437C8010A2FED6D20CB013E1FBEA
Malicious:	false
Preview:	II*.0@..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Building Elevations1\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2735
Entropy (8bit):	5.483561286962985
Encrypted:	false
SSDEEP:	48:chWsN64tQjUMWHa6uQuhHuxai3Ihi5aYT:WxNUjUMkZuLuEiYoYQ
MD5:	1868BFD6DCA92030807C6E17B2E8F511
SHA1:	C0DAA391F3A2F42C1FC93D363DDFA92683B842D6
SHA-256:	6B871F2BFF413BBAF9FDA2C3BEF94DE12D7AB1CE6BE5B5176CD3F8647AA0A361
SHA-512:	484D2478EC48DF5CD4364EC452F9C91C48CBFA9C3E4F35EB0ACE2FDACCB1A275DF65345F885C37E33CA87E6DC3DAB10837BA346BECCD996CC33DC37A15B06AB1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Page" Name="Building Elevations - A202" GUID="{8F833CB0-A862-4B0A-9BE9-C34E032840EB}">.. <Properties>.. <Property Class="Text" GUID="{31D4D50C-6937-4151-AB7A-B7932EA31678}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Building Elevations - A202</Property>.. <Property Class="Type" GUID="{9E5E3738-EDDA-443A-AC22-40FF5B07B2AD}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">.TIFF Page</Property>.. <Property Class="Number" GUID="{88AA35A7-756B-417E-86D9-E1B32739AB7D}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">10</Property>.. <Property Class="Text" GUID="{1BB5531C-5B50-4D64-9BF0-57D53FF9263E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="9" DecimalPlaces="2">{8F833CB0-A862-4B0A-9BE9-C34E032840EB}</Property>.. <Property Class="Large Image" GUID="{D4F0A1D2-8BD6-4E2D-9086-487690C50

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Building Elevations1\is-B7QO1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2735
Entropy (8bit):	5.483561286962985
Encrypted:	false
SSDEEP:	48:chWsN64tQjUMWHa6uQuhHuxai3Ihi5aYT:WxNUjUMkZuLuEiYoYQ
MD5:	1868BFD6DCA92030807C6E17B2E8F511
SHA1:	C0DAA391F3A2F42C1FC93D363DDFA92683B842D6
SHA-256:	6B871F2BFF413BBAF9FDA2C3BEF94DE12D7AB1CE6BE5B5176CD3F8647AA0A361
SHA-512:	484D2478EC48DF5CD4364EC452F9C91C48CBFA9C3E4F35EB0ACE2FDACCB1A275DF65345F885C37E33CA87E6DC3DAB10837BA346BECCD996CC33DC37A15B06AB1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Page" Name="Building Elevations - A202" GUID="{8F833CB0-A862-4B0A-9BE9-C34E032840EB}">.. <Properties>.. <Property Class="Text" GUID="{31D4D50C-6937-4151-AB7A-B7932EA31678}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Building Elevations - A202</Property>.. <Property Class="Type" GUID="{9E5E3738-EDDA-443A-AC22-40FF5B07B2AD}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">.TIFF Page</Property>.. <Property Class="Number" GUID="{88AA35A7-756B-417E-86D9-E1B32739AB7D}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">10</Property>.. <Property Class="Text" GUID="{1BB5531C-5B50-4D64-9BF0-57D53FF9263E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="9" DecimalPlaces="2">{8F833CB0-A862-4B0A-9BE9-C34E032840EB}</Property>.. <Property Class="Large Image" GUID="{D4F0A1D2-8BD6-4E2D-9086-487690C50

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Building Elevations1\is-I03HP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	TIFF image data, little-endian
Category:	dropped
Size (bytes):	1618072
Entropy (8bit):	4.600225172927296
Encrypted:	false
SSDEEP:	12288:N0/sY61qS1AvVGBlW/DrfJ7oL4rDKzmbQzHmbfkpCHwgTssAu1SlmmFYaHgz1OV2:hq2cJrDKznmbfLdT47Y8Uusjf
MD5:	7E0AF25A4BFD608BE29161D7113C9EF8
SHA1:	1CC6CC9B10827C6D36648F1EB911E2D70C577DAD
SHA-256:	22CAA48F6D22750DB790E2FB794F467D0E489324CDBEFF2E92B12017B9822D5A
SHA-512:	EE4DA5F024D7665595EB78A6C79D4D2D63B2725A4F1474D036B85EBCD2C54491B63E817B22A47AFA7593CDB18B9E1F796E52604EFE7772D9B011DEEF9013B095
Malicious:	false
Preview:	II*.f...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Building Elevations1\{D4F0A1D2-8BD6-4E2D-9086-487690C507E3}.tiff (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	TIFF image data, little-endian
Category:	dropped
Size (bytes):	1618072
Entropy (8bit):	4.600225172927296
Encrypted:	false
SSDEEP:	12288:N0/sY61qS1AvVGBlW/DrfJ7oL4rDKzmbQzHmbfkpCHwgTssAu1SlmmFYaHgz1OV2:hq2cJrDKznmbfLdT47Y8Uusjf
MD5:	7E0AF25A4BFD608BE29161D7113C9EF8
SHA1:	1CC6CC9B10827C6D36648F1EB911E2D70C577DAD
SHA-256:	22CAA48F6D22750DB790E2FB794F467D0E489324CDBEFF2E92B12017B9822D5A
SHA-512:	EE4DA5F024D7665595EB78A6C79D4D2D63B2725A4F1474D036B85EBCD2C54491B63E817B22A47AFA7593CDB18B9E1F796E52604EFE7772D9B011DEEF9013B095
Malicious:	false
Preview:	II*.f...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Building Elevations\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2734
Entropy (8bit):	5.478720658529502
Encrypted:	false
SSDEEP:	24:2dRbKdkX2cAg8/CApWLZOys6cW6gAWxo1OcbPRUkbf2WAdOcj/8J1Ar4ILkh7yW5:cL/Pcfys6RpWRmEDQ+ihdZNuCwQ8FYMT
MD5:	DA3C6701026FC11EC7B4E6F1D642B62D
SHA1:	64FECFC9C7C7292533A919DD5EE29E177DD4D0A7
SHA-256:	ADF021DD87F92B71BA121464E35A70AEDB19C67C1B23D2FF619F5061A4F1EDC2
SHA-512:	FB4DAEFFF3023C4EDB8E79D6DB04D0BACCB851A5BC558402CA2D3CA7DE56F0ACC717FED95D3D8EBE8F079DD168419B3E84FA9B19DDFFF58C49ADF671DA2418CA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Page" Name="Building Elevations - A201" GUID="{DEDF3797-54C5-41EB-A8E5-CD7DA09923F1}">.. <Properties>.. <Property Class="Text" GUID="{A78A09F7-CDB4-4904-9CC3-DCC763EE1594}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Building Elevations - A201</Property>.. <Property Class="Type" GUID="{25EF72B3-BF3C-4F31-8F81-5FD40FE3CC8B}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">.TIFF Page</Property>.. <Property Class="Number" GUID="{CB79E92C-5ED9-4841-9CDC-875C7F2C1972}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">9</Property>.. <Property Class="Text" GUID="{BDFFA2BB-DFF3-49A7-B7F6-D3E787743419}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="9" DecimalPlaces="2">{DEDF3797-54C5-41EB-A8E5-CD7DA09923F1}</Property>.. <Property Class="Large Image" GUID="{6F0CC2AE-93BC-4D0B-A1D5-E3B16FAB70

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Building Elevations\is-JFS11.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2734
Entropy (8bit):	5.478720658529502
Encrypted:	false
SSDEEP:	24:2dRbKdkX2cAg8/CApWLZOys6cW6gAWxo1OcbPRUkbf2WAdOcj/8J1Ar4ILkh7yW5:cL/Pcfys6RpWRmEDQ+ihdZNuCwQ8FYMT
MD5:	DA3C6701026FC11EC7B4E6F1D642B62D
SHA1:	64FECFC9C7C7292533A919DD5EE29E177DD4D0A7
SHA-256:	ADF021DD87F92B71BA121464E35A70AEDB19C67C1B23D2FF619F5061A4F1EDC2
SHA-512:	FB4DAEFFF3023C4EDB8E79D6DB04D0BACCB851A5BC558402CA2D3CA7DE56F0ACC717FED95D3D8EBE8F079DD168419B3E84FA9B19DDFFF58C49ADF671DA2418CA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Page" Name="Building Elevations - A201" GUID="{DEDF3797-54C5-41EB-A8E5-CD7DA09923F1}">.. <Properties>.. <Property Class="Text" GUID="{A78A09F7-CDB4-4904-9CC3-DCC763EE1594}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Building Elevations - A201</Property>.. <Property Class="Type" GUID="{25EF72B3-BF3C-4F31-8F81-5FD40FE3CC8B}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">.TIFF Page</Property>.. <Property Class="Number" GUID="{CB79E92C-5ED9-4841-9CDC-875C7F2C1972}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">9</Property>.. <Property Class="Text" GUID="{BDFFA2BB-DFF3-49A7-B7F6-D3E787743419}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="9" DecimalPlaces="2">{DEDF3797-54C5-41EB-A8E5-CD7DA09923F1}</Property>.. <Property Class="Large Image" GUID="{6F0CC2AE-93BC-4D0B-A1D5-E3B16FAB70

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Building Elevations\is-NLQNA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	TIFF image data, little-endian
Category:	dropped
Size (bytes):	1326558
Entropy (8bit):	4.569831103609393
Encrypted:	false
SSDEEP:	12288:b32ez9q57XFIAzJdMES8daQC4/ezK4zXPkwB0kqGhONsia30KKlR:834ESMaQ8+kojKKlR
MD5:	30E58C10D20C0B08482411ED2B249DA9
SHA1:	556A1966E40713A0ACF1BCD34548249B4879FF81
SHA-256:	8A3333CAF7AA12E68A65C529899C767807AF71EA3E8346127973A552A2C2DBE9
SHA-512:	6F3996AA057B32D259B13013212565ABC55FAC264ED6E02D398D26DCDAFF38C6DC1D6F3701B5451A014FBA4173412DC015BD5889924375A1796D9E104D033763
Malicious:	false
Preview:	II*..6..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Building Elevations\{6F0CC2AE-93BC-4D0B-A1D5-E3B16FAB705B}.tiff (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	TIFF image data, little-endian
Category:	dropped
Size (bytes):	1326558
Entropy (8bit):	4.569831103609393
Encrypted:	false
SSDEEP:	12288:b32ez9q57XFIAzJdMES8daQC4/ezK4zXPkwB0kqGhONsia30KKlR:834ESMaQ8+kojKKlR
MD5:	30E58C10D20C0B08482411ED2B249DA9
SHA1:	556A1966E40713A0ACF1BCD34548249B4879FF81
SHA-256:	8A3333CAF7AA12E68A65C529899C767807AF71EA3E8346127973A552A2C2DBE9
SHA-512:	6F3996AA057B32D259B13013212565ABC55FAC264ED6E02D398D26DCDAFF38C6DC1D6F3701B5451A014FBA4173412DC015BD5889924375A1796D9E104D033763
Malicious:	false
Preview:	II*..6..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1686
Entropy (8bit):	5.435652570966361
Encrypted:	false
SSDEEP:	24:2d2TlS7DX22xcxf2WAdOcmtzHFG1Oc0uojolV0EK4Zlh/CApWqG/LMkgAWiei+bC:cimDDcjLDxjXEhl9dgNV3mnV5sP
MD5:	D9E881803A0AAF2D727AAB4321C23ADD
SHA1:	9D6D597CC7904624E280FD6682E3335D1DE80E47
SHA-256:	177682DB8A42A71CFBEF128EBD9D6BAFFD534C2CECEA5DCC3C23191B8C5E6863
SHA-512:	F3E429BA8C164FCA8D1521E5EE72CCCC565644B2B51CA27A2BF79426AE5A888E248853790D15E24DC23349A2A1037771FD13649F67C4552591ECDA2A3B3DE493
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Architectural" GUID="{DE75D439-19ED-4656-A8CA-D38D40364630}">.. <Properties>.. <Property Class="Text" GUID="{1F88213B-9B0A-4B73-9B10-94E2BBAA082A}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{DE75D439-19ED-4656-A8CA-D38D40364630}</Property>.. <Property Class="Number" GUID="{FABF1FA5-7E0D-4562-A1C4-30514529994A}" Name="OrderIndex" systemhidden="True" OrderIndex="2" DecimalPlaces="2">-1</Property>.. <Property Class="CheckBox" GUID="{3077E7AB-EF8C-45AB-8DD3-830CD9568C45}" Name="PagesWindow_Expanded" OrderIndex="11" DecimalPlaces="2">False</Property>.. <Property Class="Text" GUID="{BE5257DA-9215-4B0C-934C-A3BE2723517F}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Architectural</Property>.. <Property Class="Type" GUID="{E60A9259-40DC-497C-95E3-E494B67DF226}" Name="Type" group="Ite

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Door and Finish Sche\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2763
Entropy (8bit):	5.469014299175936
Encrypted:	false
SSDEEP:	48:cdos0WJ50sKo9kB8TQCGF8HeuTmhC3z2mE7T:Ts0+CsKAkB8THWRuTGC3ymEH
MD5:	C7E6F46E94A424389424D3EFB7F9C3DF
SHA1:	928A2774662EE59ECEAAD7539ECFD9E1A0AA9872
SHA-256:	C69DD2072876FADE4CB04D4E544F1CA580E480FB8189A47994061EE5CE230699
SHA-512:	64353F47B4D881D3B5F4F1F06B9584E2A1FF284EBDF5DDBBA6E764B376E572D8C318F9848E1A5338881E9B8C07DA90650E97DAA3FDF843B1BE343AE258B3544E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Page" Name="Door and Finish Schedule and Details - A601" GUID="{1EE1387A-EDB6-4B3B-AC5C-BABFC933BB33}">.. <Properties>.. <Property Class="Text" GUID="{291EDD2D-786C-44A6-9513-C19BAC255219}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Door and Finish Schedule and Details - A601</Property>.. <Property Class="Type" GUID="{EE189571-414E-4CA2-BD00-DFE3A5331912}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">.TIFF Page</Property>.. <Property Class="Number" GUID="{F2466D70-6A25-4A61-AFC0-32231C1E1DA6}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">17</Property>.. <Property Class="Text" GUID="{867A8824-A2FC-4DDB-90EF-9B0F8117358E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="9" DecimalPlaces="2">{1EE1387A-EDB6-4B3B-AC5C-BABFC933BB33}</Property>.. <Property Class="Large Image" GUID="

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Door and Finish Sche\is-3T9U8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	TIFF image data, little-endian
Category:	dropped
Size (bytes):	2573124
Entropy (8bit):	4.844817656537171
Encrypted:	false
SSDEEP:	49152:Qnc2SgNwid3XNLHCBCyLeHXC0nbJGoAh7l3T5Zr:QcwNwi9NLHCBCyiyRo0l3
MD5:	82125B866C9D603AD07BC616BAA5E837
SHA1:	2AB799690418999A6A449297FAED8B7A51076037
SHA-256:	5C77619413FD998BC49649966F963A8AF3F4171064B3BF427D29AE37711EDB55
SHA-512:	A480C467ED78D0C887DC36688794441A7AE61DDA64A477C056DA2B19218A40FCABF9A32FDD89885DD879C1B15E14A6B1013E4B16EED01A697D036A35FD20864E
Malicious:	false
Preview:	II*..<'.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Door and Finish Sche\is-FF31Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2763
Entropy (8bit):	5.469014299175936
Encrypted:	false
SSDEEP:	48:cdos0WJ50sKo9kB8TQCGF8HeuTmhC3z2mE7T:Ts0+CsKAkB8THWRuTGC3ymEH
MD5:	C7E6F46E94A424389424D3EFB7F9C3DF
SHA1:	928A2774662EE59ECEAAD7539ECFD9E1A0AA9872
SHA-256:	C69DD2072876FADE4CB04D4E544F1CA580E480FB8189A47994061EE5CE230699
SHA-512:	64353F47B4D881D3B5F4F1F06B9584E2A1FF284EBDF5DDBBA6E764B376E572D8C318F9848E1A5338881E9B8C07DA90650E97DAA3FDF843B1BE343AE258B3544E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Page" Name="Door and Finish Schedule and Details - A601" GUID="{1EE1387A-EDB6-4B3B-AC5C-BABFC933BB33}">.. <Properties>.. <Property Class="Text" GUID="{291EDD2D-786C-44A6-9513-C19BAC255219}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Door and Finish Schedule and Details - A601</Property>.. <Property Class="Type" GUID="{EE189571-414E-4CA2-BD00-DFE3A5331912}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">.TIFF Page</Property>.. <Property Class="Number" GUID="{F2466D70-6A25-4A61-AFC0-32231C1E1DA6}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">17</Property>.. <Property Class="Text" GUID="{867A8824-A2FC-4DDB-90EF-9B0F8117358E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="9" DecimalPlaces="2">{1EE1387A-EDB6-4B3B-AC5C-BABFC933BB33}</Property>.. <Property Class="Large Image" GUID="

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Door and Finish Sche\{7AC4454B-7A06-4E04-8D7C-DB33AF70CA5C}.tiff (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	TIFF image data, little-endian
Category:	dropped
Size (bytes):	2573124
Entropy (8bit):	4.844817656537171
Encrypted:	false
SSDEEP:	49152:Qnc2SgNwid3XNLHCBCyLeHXC0nbJGoAh7l3T5Zr:QcwNwi9NLHCBCyiyRo0l3
MD5:	82125B866C9D603AD07BC616BAA5E837
SHA1:	2AB799690418999A6A449297FAED8B7A51076037
SHA-256:	5C77619413FD998BC49649966F963A8AF3F4171064B3BF427D29AE37711EDB55
SHA-512:	A480C467ED78D0C887DC36688794441A7AE61DDA64A477C056DA2B19218A40FCABF9A32FDD89885DD879C1B15E14A6B1013E4B16EED01A697D036A35FD20864E
Malicious:	false
Preview:	II*..<'.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Enlarged Floor Plans\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2735
Entropy (8bit):	5.470977041195665
Encrypted:	false
SSDEEP:	24:2dRbtYHEX2rXJ/CApWJq+ZZRgAWhDyY1Oco4y+zf2WAdOcHf82yh1Ar4ILYyWArX:c/sbybK552VyfQHnUs0uPTVOMIz/ggwT
MD5:	1011D5E0FFEFEC2198256809E21992A4
SHA1:	AEB992A31E954519AB9056DED70869793D32EB5B
SHA-256:	0DB624F82E7A989BEBD6A600E45844DC3277C8ECB6F592F9C26ED88754707908
SHA-512:	23C29E5B3AA2358F034DF479A01FCE8A6C504235AE1007A28CE39823DC9B62486336A815628393B6D9F613288498D7BDA19A493FB76A2674234A7A66D3350389
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Page" Name="Enlarged Floor Plans - A401" GUID="{775E191E-B137-42FA-A277-ED9AFCA1445F}">.. <Properties>.. <Property Class="Text" GUID="{2C31B3D5-B86D-41FC-8140-84E565995594}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Enlarged Floor Plans - A401</Property>.. <Property Class="Type" GUID="{A96C2D9F-FAB8-4D71-B1E7-260020425DC5}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">.TIFF Page</Property>.. <Property Class="Number" GUID="{F13A3227-464D-4DBB-BF5D-5C9219360A89}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">13</Property>.. <Property Class="Text" GUID="{F2FB4D25-6893-4771-B7DD-4E2609804CBE}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="9" DecimalPlaces="2">{775E191E-B137-42FA-A277-ED9AFCA1445F}</Property>.. <Property Class="Large Image" GUID="{03108E87-EDA8-4995-8A85-7FD0B06

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Enlarged Floor Plans\is-80SKQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	TIFF image data, little-endian
Category:	dropped
Size (bytes):	1355696
Entropy (8bit):	4.4655790125636186
Encrypted:	false
SSDEEP:	12288:Am6qfglmrvLZ3OLQEO8G+mB7J4xVvxTJtR3623ZdmGw1N8vSe+exfVacgLIJqfXf:7vLM8axTJ731ww
MD5:	61C4BEEE6D69BE019BC94ABF0D6BD870
SHA1:	7CCDAE2AF8958154D7B25CFD301B58D31E9ACF9B
SHA-256:	FC78EA32F4DFD96B7E5DCBA74946EF80BA9C33B17AAD04CD102D4F94C47CE986
SHA-512:	7BFB98B5EAFB21F4864E50C505FCC314CD8450725FA1FF89FAD6FD0511EE4A5D20578A10D26BEA2F4DB4357E74A09158BB9C8C7BF99173012088879EEEB81EAB
Malicious:	false
Preview:	II*.~...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Enlarged Floor Plans\is-9939K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2735
Entropy (8bit):	5.470977041195665
Encrypted:	false
SSDEEP:	24:2dRbtYHEX2rXJ/CApWJq+ZZRgAWhDyY1Oco4y+zf2WAdOcHf82yh1Ar4ILYyWArX:c/sbybK552VyfQHnUs0uPTVOMIz/ggwT
MD5:	1011D5E0FFEFEC2198256809E21992A4
SHA1:	AEB992A31E954519AB9056DED70869793D32EB5B
SHA-256:	0DB624F82E7A989BEBD6A600E45844DC3277C8ECB6F592F9C26ED88754707908
SHA-512:	23C29E5B3AA2358F034DF479A01FCE8A6C504235AE1007A28CE39823DC9B62486336A815628393B6D9F613288498D7BDA19A493FB76A2674234A7A66D3350389
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Page" Name="Enlarged Floor Plans - A401" GUID="{775E191E-B137-42FA-A277-ED9AFCA1445F}">.. <Properties>.. <Property Class="Text" GUID="{2C31B3D5-B86D-41FC-8140-84E565995594}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Enlarged Floor Plans - A401</Property>.. <Property Class="Type" GUID="{A96C2D9F-FAB8-4D71-B1E7-260020425DC5}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">.TIFF Page</Property>.. <Property Class="Number" GUID="{F13A3227-464D-4DBB-BF5D-5C9219360A89}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">13</Property>.. <Property Class="Text" GUID="{F2FB4D25-6893-4771-B7DD-4E2609804CBE}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="9" DecimalPlaces="2">{775E191E-B137-42FA-A277-ED9AFCA1445F}</Property>.. <Property Class="Large Image" GUID="{03108E87-EDA8-4995-8A85-7FD0B06

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Enlarged Floor Plans\{03108E87-EDA8-4995-8A85-7FD0B0606FBD}.tiff (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	TIFF image data, little-endian
Category:	dropped
Size (bytes):	1355696
Entropy (8bit):	4.4655790125636186
Encrypted:	false
SSDEEP:	12288:Am6qfglmrvLZ3OLQEO8G+mB7J4xVvxTJtR3623ZdmGw1N8vSe+exfVacgLIJqfXf:7vLM8axTJ731ww
MD5:	61C4BEEE6D69BE019BC94ABF0D6BD870
SHA1:	7CCDAE2AF8958154D7B25CFD301B58D31E9ACF9B
SHA-256:	FC78EA32F4DFD96B7E5DCBA74946EF80BA9C33B17AAD04CD102D4F94C47CE986
SHA-512:	7BFB98B5EAFB21F4864E50C505FCC314CD8450725FA1FF89FAD6FD0511EE4A5D20578A10D26BEA2F4DB4357E74A09158BB9C8C7BF99173012088879EEEB81EAB
Malicious:	false
Preview:	II*.~...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Enlarged Reflected C\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2760
Entropy (8bit):	5.471055503772762
Encrypted:	false
SSDEEP:	48:ciPVoFtOMxlkoEhIQ3V5z26uxkrTwKjQUT:HoFsYlrPaS6uqr0KX
MD5:	D4FAED25100B1F3DC0AA78D13EFB849C
SHA1:	791B530979F81AEAB2112B2197576240C2B7CB0B
SHA-256:	F6B673D7E39C533E0CD880B159CDFADC41C1B59981F7C22620EB9D0346FA03F8
SHA-512:	2EF87E193AECB9A31C8F393C311A094456741D171452981D395774AE45E61572450ADB9FFFE00D1CCD176C7FA2E6B1F2627E0429523A84642DD036679EB7CD08
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Page" Name="Enlarged Reflected Ceiling Plans - A152" GUID="{4E6ADF37-D653-4D1F-85C4-8EF9F409E86D}">.. <Properties>.. <Property Class="Text" GUID="{A9A1F328-7243-4A9E-BA8D-F52CD75854C9}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Enlarged Reflected Ceiling Plans - A152</Property>.. <Property Class="Type" GUID="{AE049E76-35CB-4F4B-B378-D7610A1812B8}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">.TIFF Page</Property>.. <Property Class="Number" GUID="{2696BF90-DB5C-46F1-B1DD-EC8A8F2C167D}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">8</Property>.. <Property Class="Text" GUID="{8404C901-663F-4587-8479-C674CF29DEFB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="9" DecimalPlaces="2">{4E6ADF37-D653-4D1F-85C4-8EF9F409E86D}</Property>.. <Property Class="Large Image" GUID="{BEFB62FF

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Enlarged Reflected C\is-6287U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2760
Entropy (8bit):	5.471055503772762
Encrypted:	false
SSDEEP:	48:ciPVoFtOMxlkoEhIQ3V5z26uxkrTwKjQUT:HoFsYlrPaS6uqr0KX
MD5:	D4FAED25100B1F3DC0AA78D13EFB849C
SHA1:	791B530979F81AEAB2112B2197576240C2B7CB0B
SHA-256:	F6B673D7E39C533E0CD880B159CDFADC41C1B59981F7C22620EB9D0346FA03F8
SHA-512:	2EF87E193AECB9A31C8F393C311A094456741D171452981D395774AE45E61572450ADB9FFFE00D1CCD176C7FA2E6B1F2627E0429523A84642DD036679EB7CD08
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Page" Name="Enlarged Reflected Ceiling Plans - A152" GUID="{4E6ADF37-D653-4D1F-85C4-8EF9F409E86D}">.. <Properties>.. <Property Class="Text" GUID="{A9A1F328-7243-4A9E-BA8D-F52CD75854C9}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Enlarged Reflected Ceiling Plans - A152</Property>.. <Property Class="Type" GUID="{AE049E76-35CB-4F4B-B378-D7610A1812B8}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">.TIFF Page</Property>.. <Property Class="Number" GUID="{2696BF90-DB5C-46F1-B1DD-EC8A8F2C167D}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">8</Property>.. <Property Class="Text" GUID="{8404C901-663F-4587-8479-C674CF29DEFB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="9" DecimalPlaces="2">{4E6ADF37-D653-4D1F-85C4-8EF9F409E86D}</Property>.. <Property Class="Large Image" GUID="{BEFB62FF

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Enlarged Reflected C\is-E0AFQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	TIFF image data, little-endian
Category:	dropped
Size (bytes):	1552268
Entropy (8bit):	4.6753537000468866
Encrypted:	false
SSDEEP:	12288:VZuu9BynuBucvnsOq6rq4fqc6vysgwDyuZKegmp9kKxhQWotAErGqBW3g/lNHmEd:zuurysEyoyuZtiA8uUVgZwnX
MD5:	391541522D1F63B570DE7CD45D75507B
SHA1:	99071DF0A4D8B26F2B3D63C29EBAF4F47A433801
SHA-256:	F4334F1476C3E8D1C0660D5BDB3E8B0D1441766DD4E06461D86063FEB916FD3D
SHA-512:	0453BACB176C67F919A6D8CAC687ABE996B46252E98C2E87F7C5B2A5EF04D55FF60D0363AB4476B875E596EBCE52047330CCBF63503D8BFF6A4A677DADFB1435
Malicious:	false
Preview:	II*.Z...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Enlarged Reflected C\{BEFB62FF-C7C8-41B5-8106-7AB301B964D0}.tiff (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	TIFF image data, little-endian
Category:	dropped
Size (bytes):	1552268
Entropy (8bit):	4.6753537000468866
Encrypted:	false
SSDEEP:	12288:VZuu9BynuBucvnsOq6rq4fqc6vysgwDyuZKegmp9kKxhQWotAErGqBW3g/lNHmEd:zuurysEyoyuZtiA8uUVgZwnX
MD5:	391541522D1F63B570DE7CD45D75507B
SHA1:	99071DF0A4D8B26F2B3D63C29EBAF4F47A433801
SHA-256:	F4334F1476C3E8D1C0660D5BDB3E8B0D1441766DD4E06461D86063FEB916FD3D
SHA-512:	0453BACB176C67F919A6D8CAC687ABE996B46252E98C2E87F7C5B2A5EF04D55FF60D0363AB4476B875E596EBCE52047330CCBF63503D8BFF6A4A677DADFB1435
Malicious:	false
Preview:	II*.Z...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Exiting and Occupanc\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2751
Entropy (8bit):	5.478085279289196
Encrypted:	false
SSDEEP:	48:cbl+TBjJYq1xC9FoQ58HTpu3b8XqychUjT:5h6qbsFo1lu3b6Vf
MD5:	13CEB10A2A64AC6CBADD9A4A63007559
SHA1:	A6C17FB30A073CC27CF801A114D5BE857C467794
SHA-256:	3F683E27530917B64CA580507B1B06DAC0B3605B492B982DCE5963BC6277C177
SHA-512:	55566CA9A85EE0BDAF17A64F0CD39D7EAD91C0C5CA4CDD183D960DE21E1598C7B3DA41730DF49341430255D1C2C8EE6B53AF66680E4F54E6636915C68B450A71
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Page" Name="Exiting and Occupancy Plans - G101" GUID="{342ECA22-FC48-40B5-B98F-EA932D4D035C}">.. <Properties>.. <Property Class="Text" GUID="{1F1A938C-4574-47D2-8D6B-15BE833C0532}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Exiting and Occupancy Plans - G101</Property>.. <Property Class="Type" GUID="{8037AEFE-8D73-41F0-BF10-374C7AAD2553}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">.TIFF Page</Property>.. <Property Class="Number" GUID="{55B77F4F-949E-4F8E-BD02-97379C2E3403}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">1</Property>.. <Property Class="Text" GUID="{34F4E25B-20E9-4271-A59F-EF463365BD58}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="9" DecimalPlaces="2">{342ECA22-FC48-40B5-B98F-EA932D4D035C}</Property>.. <Property Class="Large Image" GUID="{7F570134-8A1A-4D49

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Exiting and Occupanc\is-2R70E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2751
Entropy (8bit):	5.478085279289196
Encrypted:	false
SSDEEP:	48:cbl+TBjJYq1xC9FoQ58HTpu3b8XqychUjT:5h6qbsFo1lu3b6Vf
MD5:	13CEB10A2A64AC6CBADD9A4A63007559
SHA1:	A6C17FB30A073CC27CF801A114D5BE857C467794
SHA-256:	3F683E27530917B64CA580507B1B06DAC0B3605B492B982DCE5963BC6277C177
SHA-512:	55566CA9A85EE0BDAF17A64F0CD39D7EAD91C0C5CA4CDD183D960DE21E1598C7B3DA41730DF49341430255D1C2C8EE6B53AF66680E4F54E6636915C68B450A71
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Page" Name="Exiting and Occupancy Plans - G101" GUID="{342ECA22-FC48-40B5-B98F-EA932D4D035C}">.. <Properties>.. <Property Class="Text" GUID="{1F1A938C-4574-47D2-8D6B-15BE833C0532}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Exiting and Occupancy Plans - G101</Property>.. <Property Class="Type" GUID="{8037AEFE-8D73-41F0-BF10-374C7AAD2553}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">.TIFF Page</Property>.. <Property Class="Number" GUID="{55B77F4F-949E-4F8E-BD02-97379C2E3403}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">1</Property>.. <Property Class="Text" GUID="{34F4E25B-20E9-4271-A59F-EF463365BD58}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="9" DecimalPlaces="2">{342ECA22-FC48-40B5-B98F-EA932D4D035C}</Property>.. <Property Class="Large Image" GUID="{7F570134-8A1A-4D49

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Exiting and Occupanc\is-R9K1R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	TIFF image data, little-endian
Category:	dropped
Size (bytes):	1577966
Entropy (8bit):	4.619052900886977
Encrypted:	false
SSDEEP:	12288:PkA3FAHMRsHijSiN/PbEfEkkbyAls6NgfgKK6eZWwUYNYa4L0/ASeyNwxOgWL9U8:WQ/2xtmxU2YpyNwxdtwFTb
MD5:	E73B118B4A7CFA5E1EDE170D019E5D8A
SHA1:	9320BC9DAFC44A15CB1B7DAB760588BBFEAD0D1B
SHA-256:	EFA70CBA986058E7E9BF87FD18BE6406A125D7C0887A68275FF24451069611F0
SHA-512:	EAA6E704002A07EF43976AE4F92AD8122BF3A3E94CEB26FCE5F44C55B335DA92E01D892FD3B72883C69E12C2D5321752426755FA8BD5EB35ED08FFA0EDD4A617
Malicious:	false
Preview:	II*.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Exiting and Occupanc\{7F570134-8A1A-4D49-AD6E-18B699BC3A89}.tiff (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	TIFF image data, little-endian
Category:	dropped
Size (bytes):	1577966
Entropy (8bit):	4.619052900886977
Encrypted:	false
SSDEEP:	12288:PkA3FAHMRsHijSiN/PbEfEkkbyAls6NgfgKK6eZWwUYNYa4L0/ASeyNwxOgWL9U8:WQ/2xtmxU2YpyNwxdtwFTb
MD5:	E73B118B4A7CFA5E1EDE170D019E5D8A
SHA1:	9320BC9DAFC44A15CB1B7DAB760588BBFEAD0D1B
SHA-256:	EFA70CBA986058E7E9BF87FD18BE6406A125D7C0887A68275FF24451069611F0
SHA-512:	EAA6E704002A07EF43976AE4F92AD8122BF3A3E94CEB26FCE5F44C55B335DA92E01D892FD3B72883C69E12C2D5321752426755FA8BD5EB35ED08FFA0EDD4A617
Malicious:	false
Preview:	II*.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\General Information\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2726
Entropy (8bit):	5.467304033524247
Encrypted:	false
SSDEEP:	48:cWrI22Sj7IsvTQ8ZE3HlL0u0PPiywZxIT:FrI27IsvTnu36uQPv4xA
MD5:	B0DF1B3D7B8E5882F9EAB08FA8D62E3D
SHA1:	85B5CA2789959E285F8E1C4EC338109975DCFF06
SHA-256:	EB8AEBADB2A88073D2D9A33CD4F4348FFBDA23D23C54BC4E1389CA723E70B5EF
SHA-512:	D2DF92A04F982B0E09791B9576DB0623F747980DA5DD682CD2A753265CB1D1D7D4B556923D20E9570512C38BD1D3E9B4405E8CDA4071FCB9102816FA42085ED7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Page" Name="General Information - G002" GUID="{41A6980E-8A1D-4E19-BBDC-9B41E1670D18}">.. <Properties>.. <Property Class="Text" GUID="{737E47DA-F5A9-407D-95A6-5959DF9D1927}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">General Information - G002</Property>.. <Property Class="Type" GUID="{69F86F14-5CB0-49E5-B13D-F46A5D05F507}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">.TIFF Page</Property>.. <Property Class="Number" GUID="{41134118-44EC-41C7-A03A-034B925778C8}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">0</Property>.. <Property Class="Text" GUID="{8F5B1AB8-99D9-4AC6-984B-656C028E88BA}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="9" DecimalPlaces="2">{41A6980E-8A1D-4E19-BBDC-9B41E1670D18}</Property>.. <Property Class="Large Image" GUID="{87D0A7C4-ECA3-4F66-A16F-DBD5ED1C47

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\General Information\is-9J5RO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	TIFF image data, little-endian
Category:	dropped
Size (bytes):	1544218
Entropy (8bit):	4.447621786949413
Encrypted:	false
SSDEEP:	24576:FFE3oFQwMiAghedUCQ1S13qLY2Wy6AemGw+YGmiboyrn2D/cPe4:M3oFQwMiUCS13qLY2Wy6FmGw+YGmiboi
MD5:	76BE5F0A8C5D59E2E73191AD3352C128
SHA1:	C58BA0EA774F205E1B1642107BE987324C004411
SHA-256:	5D84AC0E74CE615EEC9770736E678BB5AA17EDED0EA12236828CA0C7DD473F29
SHA-512:	7B3494D87BBDC51ABA045DCEBE6492DB9C194BE0C66A38C3AC14B0AFD2B4204FC047A68B9DDE066706E4C847863FFD8C8EE14DADF67BBAD70FDE74FF69451571
Malicious:	false
Preview:	II*....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\General Information\is-NFLG4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2726
Entropy (8bit):	5.467304033524247
Encrypted:	false
SSDEEP:	48:cWrI22Sj7IsvTQ8ZE3HlL0u0PPiywZxIT:FrI27IsvTnu36uQPv4xA
MD5:	B0DF1B3D7B8E5882F9EAB08FA8D62E3D
SHA1:	85B5CA2789959E285F8E1C4EC338109975DCFF06
SHA-256:	EB8AEBADB2A88073D2D9A33CD4F4348FFBDA23D23C54BC4E1389CA723E70B5EF
SHA-512:	D2DF92A04F982B0E09791B9576DB0623F747980DA5DD682CD2A753265CB1D1D7D4B556923D20E9570512C38BD1D3E9B4405E8CDA4071FCB9102816FA42085ED7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Page" Name="General Information - G002" GUID="{41A6980E-8A1D-4E19-BBDC-9B41E1670D18}">.. <Properties>.. <Property Class="Text" GUID="{737E47DA-F5A9-407D-95A6-5959DF9D1927}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">General Information - G002</Property>.. <Property Class="Type" GUID="{69F86F14-5CB0-49E5-B13D-F46A5D05F507}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">.TIFF Page</Property>.. <Property Class="Number" GUID="{41134118-44EC-41C7-A03A-034B925778C8}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">0</Property>.. <Property Class="Text" GUID="{8F5B1AB8-99D9-4AC6-984B-656C028E88BA}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="9" DecimalPlaces="2">{41A6980E-8A1D-4E19-BBDC-9B41E1670D18}</Property>.. <Property Class="Large Image" GUID="{87D0A7C4-ECA3-4F66-A16F-DBD5ED1C47

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\General Information\{87D0A7C4-ECA3-4F66-A16F-DBD5ED1C4795}.tiff (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	TIFF image data, little-endian
Category:	dropped
Size (bytes):	1544218
Entropy (8bit):	4.447621786949413
Encrypted:	false
SSDEEP:	24576:FFE3oFQwMiAghedUCQ1S13qLY2Wy6AemGw+YGmiboyrn2D/cPe4:M3oFQwMiUCS13qLY2Wy6FmGw+YGmiboi
MD5:	76BE5F0A8C5D59E2E73191AD3352C128
SHA1:	C58BA0EA774F205E1B1642107BE987324C004411
SHA-256:	5D84AC0E74CE615EEC9770736E678BB5AA17EDED0EA12236828CA0C7DD473F29
SHA-512:	7B3494D87BBDC51ABA045DCEBE6492DB9C194BE0C66A38C3AC14B0AFD2B4204FC047A68B9DDE066706E4C847863FFD8C8EE14DADF67BBAD70FDE74FF69451571
Malicious:	false
Preview:	II*....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Interior Elevations\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2733
Entropy (8bit):	5.4715701973959385
Encrypted:	false
SSDEEP:	48:c4fBMcIhWxliN41Q1Y6UzKtuWK2YsJR3T:FfucIoliy1+q0uWbYsJ1
MD5:	B8F8A7042A34D31C3B706D68ADA94E91
SHA1:	12B24F0FDAFCFEA7EF212EC4DAF586CAB939DEDA
SHA-256:	641E9B3F67834C67424EAC57239AA600337F61E68411316A0195352414E57B0E
SHA-512:	E6DD21F8ABF420282F3BB300E16EA12E6D22F4695EAF3E6DA656E556A98EAF9570B681934A91F3F5991096BDC1492107CF458B5505EBE2FDEC0A62E4AC474AA0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Page" Name="Interior Elevations - A251" GUID="{1485354B-D567-46DB-8FAC-0621FC77A4ED}">.. <Properties>.. <Property Class="Text" GUID="{55486762-397B-4667-91E2-52A6C810C4EA}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Interior Elevations - A251</Property>.. <Property Class="Type" GUID="{A527AEFC-D2E8-48AF-ADE0-D28FDE5C5419}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">.TIFF Page</Property>.. <Property Class="Number" GUID="{08D01EC4-E675-4B92-BFEE-8E0B07946931}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">11</Property>.. <Property Class="Text" GUID="{2709FADF-0043-4C92-A34C-DD4507FD3CFC}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="9" DecimalPlaces="2">{1485354B-D567-46DB-8FAC-0621FC77A4ED}</Property>.. <Property Class="Large Image" GUID="{21517F1F-1D4C-4322-BA42-25E96FA50

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Interior Elevations\is-3372K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	TIFF image data, little-endian
Category:	dropped
Size (bytes):	1871858
Entropy (8bit):	4.699561075923134
Encrypted:	false
SSDEEP:	49152:oZ3kGl2h7C/q1+QdJ9wNjcKMFmxCI4mw7:o9k+M7C/q1+Qr9wNjcKMFmxCIy
MD5:	AC48F284D218C50A4B24192EB4EF6392
SHA1:	946214265E698C4AA76947326456E14020832C9E
SHA-256:	153F71B952A3911124429E2C524E2A889CBF83DDE7ECE8C04685906C0EF3ED7C
SHA-512:	53695D175A61381DDB67ADD25A85C9F54BF8FEC9B36495E3290C6E77E88738FE94911F036C46E24DA9FA28DF474D9CBA71D772F2FC628F78B78763E559A6D70E
Malicious:	false
Preview:	II*.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Interior Elevations\is-FBDB6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2733
Entropy (8bit):	5.4715701973959385
Encrypted:	false
SSDEEP:	48:c4fBMcIhWxliN41Q1Y6UzKtuWK2YsJR3T:FfucIoliy1+q0uWbYsJ1
MD5:	B8F8A7042A34D31C3B706D68ADA94E91
SHA1:	12B24F0FDAFCFEA7EF212EC4DAF586CAB939DEDA
SHA-256:	641E9B3F67834C67424EAC57239AA600337F61E68411316A0195352414E57B0E
SHA-512:	E6DD21F8ABF420282F3BB300E16EA12E6D22F4695EAF3E6DA656E556A98EAF9570B681934A91F3F5991096BDC1492107CF458B5505EBE2FDEC0A62E4AC474AA0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Page" Name="Interior Elevations - A251" GUID="{1485354B-D567-46DB-8FAC-0621FC77A4ED}">.. <Properties>.. <Property Class="Text" GUID="{55486762-397B-4667-91E2-52A6C810C4EA}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Interior Elevations - A251</Property>.. <Property Class="Type" GUID="{A527AEFC-D2E8-48AF-ADE0-D28FDE5C5419}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">.TIFF Page</Property>.. <Property Class="Number" GUID="{08D01EC4-E675-4B92-BFEE-8E0B07946931}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">11</Property>.. <Property Class="Text" GUID="{2709FADF-0043-4C92-A34C-DD4507FD3CFC}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="9" DecimalPlaces="2">{1485354B-D567-46DB-8FAC-0621FC77A4ED}</Property>.. <Property Class="Large Image" GUID="{21517F1F-1D4C-4322-BA42-25E96FA50

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\Interior Elevations\{21517F1F-1D4C-4322-BA42-25E96FA509EA}.tiff (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	TIFF image data, little-endian
Category:	dropped
Size (bytes):	1871858
Entropy (8bit):	4.699561075923134
Encrypted:	false
SSDEEP:	49152:oZ3kGl2h7C/q1+QdJ9wNjcKMFmxCI4mw7:o9k+M7C/q1+Qr9wNjcKMFmxCIy
MD5:	AC48F284D218C50A4B24192EB4EF6392
SHA1:	946214265E698C4AA76947326456E14020832C9E
SHA-256:	153F71B952A3911124429E2C524E2A889CBF83DDE7ECE8C04685906C0EF3ED7C
SHA-512:	53695D175A61381DDB67ADD25A85C9F54BF8FEC9B36495E3290C6E77E88738FE94911F036C46E24DA9FA28DF474D9CBA71D772F2FC628F78B78763E559A6D70E
Malicious:	false
Preview:	II*.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Architectural\is-T8MVA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1686
Entropy (8bit):	5.435652570966361
Encrypted:	false
SSDEEP:	24:2d2TlS7DX22xcxf2WAdOcmtzHFG1Oc0uojolV0EK4Zlh/CApWqG/LMkgAWiei+bC:cimDDcjLDxjXEhl9dgNV3mnV5sP
MD5:	D9E881803A0AAF2D727AAB4321C23ADD
SHA1:	9D6D597CC7904624E280FD6682E3335D1DE80E47
SHA-256:	177682DB8A42A71CFBEF128EBD9D6BAFFD534C2CECEA5DCC3C23191B8C5E6863
SHA-512:	F3E429BA8C164FCA8D1521E5EE72CCCC565644B2B51CA27A2BF79426AE5A888E248853790D15E24DC23349A2A1037771FD13649F67C4552591ECDA2A3B3DE493
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Architectural" GUID="{DE75D439-19ED-4656-A8CA-D38D40364630}">.. <Properties>.. <Property Class="Text" GUID="{1F88213B-9B0A-4B73-9B10-94E2BBAA082A}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{DE75D439-19ED-4656-A8CA-D38D40364630}</Property>.. <Property Class="Number" GUID="{FABF1FA5-7E0D-4562-A1C4-30514529994A}" Name="OrderIndex" systemhidden="True" OrderIndex="2" DecimalPlaces="2">-1</Property>.. <Property Class="CheckBox" GUID="{3077E7AB-EF8C-45AB-8DD3-830CD9568C45}" Name="PagesWindow_Expanded" OrderIndex="11" DecimalPlaces="2">False</Property>.. <Property Class="Text" GUID="{BE5257DA-9215-4B0C-934C-A3BE2723517F}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Architectural</Property>.. <Property Class="Type" GUID="{E60A9259-40DC-497C-95E3-E494B67DF226}" Name="Type" group="Ite

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	5.434812544463953
Encrypted:	false
SSDEEP:	24:2d2IFTEXj41Oc3Rgxf2WAdOc01gV9lV7ybnBAh/CApWCFjagAWiNamkWR9RcVMOo:cufdjTqInaicmn0g
MD5:	091644837041FFCEA16AA28600129AEF
SHA1:	3DF1C9FA3E49E47369F3718243BDEA729F0C539F
SHA-256:	CC408AC087E2C76B7898B4DEF5AE535876331C3ED12B0255CF859AF6BED20B48
SHA-512:	D88F2EBD753D08E99838349D48EA3805A04970D9B64C40AEA70F3D2FAB5F9B525F2968B7B92F19327B9A300FB5C70A027C4433E8F01649DB4EB42402F20E428C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Commerical Plan Set" GUID="{16E693E1-4019-497D-88FB-D7C3AEB300A9}">.. <Properties>.. <Property Class="Number" GUID="{1A3EBD95-6C49-4500-A9BA-45D862ED09AB}" Name="OrderIndex" systemhidden="True" OrderIndex="2" DecimalPlaces="2">1</Property>.. <Property Class="Text" GUID="{D7C84D45-FA67-447A-B343-8F7678425225}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="11" DecimalPlaces="2">{16E693E1-4019-497D-88FB-D7C3AEB300A9}</Property>.. <Property Class="CheckBox" GUID="{22103F47-2DB3-4F99-AE35-CA9A9D002EE0}" Name="PagesWindow_Expanded" OrderIndex="12" DecimalPlaces="2">True</Property>.. <Property Class="Text" GUID="{812BCB15-2401-40E4-9569-7CCB82C4A9D1}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Commerical Plan Set</Property>.. <Property Class="Type" GUID="{13BFFE76-F83B-48F9-B71C-914C8A2A76AB}" Name="Type"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Commerical Plan Set\is-BPLQU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	5.434812544463953
Encrypted:	false
SSDEEP:	24:2d2IFTEXj41Oc3Rgxf2WAdOc01gV9lV7ybnBAh/CApWCFjagAWiNamkWR9RcVMOo:cufdjTqInaicmn0g
MD5:	091644837041FFCEA16AA28600129AEF
SHA1:	3DF1C9FA3E49E47369F3718243BDEA729F0C539F
SHA-256:	CC408AC087E2C76B7898B4DEF5AE535876331C3ED12B0255CF859AF6BED20B48
SHA-512:	D88F2EBD753D08E99838349D48EA3805A04970D9B64C40AEA70F3D2FAB5F9B525F2968B7B92F19327B9A300FB5C70A027C4433E8F01649DB4EB42402F20E428C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Commerical Plan Set" GUID="{16E693E1-4019-497D-88FB-D7C3AEB300A9}">.. <Properties>.. <Property Class="Number" GUID="{1A3EBD95-6C49-4500-A9BA-45D862ED09AB}" Name="OrderIndex" systemhidden="True" OrderIndex="2" DecimalPlaces="2">1</Property>.. <Property Class="Text" GUID="{D7C84D45-FA67-447A-B343-8F7678425225}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="11" DecimalPlaces="2">{16E693E1-4019-497D-88FB-D7C3AEB300A9}</Property>.. <Property Class="CheckBox" GUID="{22103F47-2DB3-4F99-AE35-CA9A9D002EE0}" Name="PagesWindow_Expanded" OrderIndex="12" DecimalPlaces="2">True</Property>.. <Property Class="Text" GUID="{812BCB15-2401-40E4-9569-7CCB82C4A9D1}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Commerical Plan Set</Property>.. <Property Class="Type" GUID="{13BFFE76-F83B-48F9-B71C-914C8A2A76AB}" Name="Type"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1514
Entropy (8bit):	5.411919049005502
Encrypted:	false
SSDEEP:	24:2d2TXbdSd1Oc2yf2WAdOc0w/V4/CApWrmgAWiyamkWR9Re6qfVMOGijdjnO8813v:cerN8TxPBmnFqJ01f
MD5:	E90ABB410011E875D0129B576A05E639
SHA1:	6B337A20B171DFF7F9B9CB3394FD714AACDE5047
SHA-256:	E5D0342E1C1DEBA6E4F68FFCA924F3E507B124121326C2B86063BD038E11FA9B
SHA-512:	83425843CCBB9875B34907A746142C21AE258CD589A8E7A7F99644AB1CE376705A2D5B8DCB5044D69F91D397578AC416DE7466FDFA3089085BD5111AB5554CEF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Pages" GUID="{2673994E-D11A-4198-A4AD-95C5B8A58610}">.. <Properties>.. <Property Class="Number" GUID="{513F94B6-E130-49ED-9A81-000455B8E52D}" Name="OrderIndex" systemhidden="True" OrderIndex="2" DecimalPlaces="2">0</Property>.. <Property Class="Text" GUID="{D1829A8E-158A-483A-BAB5-F24650042E13}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="11" DecimalPlaces="2">{2673994E-D11A-4198-A4AD-95C5B8A58610}</Property>.. <Property Class="Text" GUID="{3D4C300A-3DBB-4331-956C-D920F1F8A2FE}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Pages</Property>.. <Property Class="Type" GUID="{1A6F3702-1185-485D-8DFD-A231A105306C}" Name="Type" group="Item" OrderIndex="4" DecimalPlaces="2">Folder</Property>.. <Property Class="Color" GUID="{F8121726-52DC-48DD-A50B-2E6F188C2B16}" Name="Color" group="Item" OrderIndex="10" De

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Pages\is-ABF0T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1514
Entropy (8bit):	5.411919049005502
Encrypted:	false
SSDEEP:	24:2d2TXbdSd1Oc2yf2WAdOc0w/V4/CApWrmgAWiyamkWR9Re6qfVMOGijdjnO8813v:cerN8TxPBmnFqJ01f
MD5:	E90ABB410011E875D0129B576A05E639
SHA1:	6B337A20B171DFF7F9B9CB3394FD714AACDE5047
SHA-256:	E5D0342E1C1DEBA6E4F68FFCA924F3E507B124121326C2B86063BD038E11FA9B
SHA-512:	83425843CCBB9875B34907A746142C21AE258CD589A8E7A7F99644AB1CE376705A2D5B8DCB5044D69F91D397578AC416DE7466FDFA3089085BD5111AB5554CEF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Pages" GUID="{2673994E-D11A-4198-A4AD-95C5B8A58610}">.. <Properties>.. <Property Class="Number" GUID="{513F94B6-E130-49ED-9A81-000455B8E52D}" Name="OrderIndex" systemhidden="True" OrderIndex="2" DecimalPlaces="2">0</Property>.. <Property Class="Text" GUID="{D1829A8E-158A-483A-BAB5-F24650042E13}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="11" DecimalPlaces="2">{2673994E-D11A-4198-A4AD-95C5B8A58610}</Property>.. <Property Class="Text" GUID="{3D4C300A-3DBB-4331-956C-D920F1F8A2FE}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Pages</Property>.. <Property Class="Type" GUID="{1A6F3702-1185-485D-8DFD-A231A105306C}" Name="Type" group="Item" OrderIndex="4" DecimalPlaces="2">Folder</Property>.. <Property Class="Color" GUID="{F8121726-52DC-48DD-A50B-2E6F188C2B16}" Name="Color" group="Item" OrderIndex="10" De

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Men's Restroom - 107\Hanging Labor (Price\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (378), with CRLF line terminators
Category:	dropped
Size (bytes):	9240
Entropy (8bit):	5.607005343763194
Encrypted:	false
SSDEEP:	96:GbmQurj03SD1Iz9OfQ0tdtL9GDEtlonXOD08J2IDtMSgnc1PBSECnj:KYj0yIz96b99GDEDA+D52CtMrcBjCj
MD5:	3EBC5E6E39F3D675E614D4A110074F95
SHA1:	90CC65D2FEA7D3C90A058BF4885490AF65B2666D
SHA-256:	ECA34C6D387593762C3548B1EE0AD2744EC22900230C9212D673C8EF9352511A
SHA-512:	A9A28D97D1624B018EAD6649CF78F34851EE9880AC2D2C0DD38CB0A00183DA126F37935E6A6F620236E8CE643BBDF4BA61B2998356DFB6834E2C5AF3055F303A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Hanging Labor (Priced per SQ FT)" GUID="{F80F9F57-4671-40E3-AF23-2A2B0D66031F}">.. <Properties>.. <Property Class="Type" GUID="{97A76A99-5738-45E7-A9FD-783A70CEF944}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="2">Labor</Property>.. <Property Class="Text" GUID="{2AE74583-E4D1-47BD-B0E0-0BF0EBFC7127}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="56" DecimalPlaces="2">Hanging Labor (Priced per SQ FT)</Property>.. <Property Class="Text" GUID="{DF7D9C86-9655-4370-8F53-86133125C021}" Name="Description" input="True" group="Item" OrderIndex="57" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList" ToolHint="Type in a Description of this item"/>.. <Property Class="Text" GUID="{73E7746D-4D1A-4EF5-816F-E74E3E154533}" Name="Item #" group="Item" OrderIndex="58" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{5870FE12-ACE8-4BD4

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Men's Restroom - 107\Hanging Labor (Price\is-7SLAT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (378), with CRLF line terminators
Category:	dropped
Size (bytes):	9240
Entropy (8bit):	5.607005343763194
Encrypted:	false
SSDEEP:	96:GbmQurj03SD1Iz9OfQ0tdtL9GDEtlonXOD08J2IDtMSgnc1PBSECnj:KYj0yIz96b99GDEDA+D52CtMrcBjCj
MD5:	3EBC5E6E39F3D675E614D4A110074F95
SHA1:	90CC65D2FEA7D3C90A058BF4885490AF65B2666D
SHA-256:	ECA34C6D387593762C3548B1EE0AD2744EC22900230C9212D673C8EF9352511A
SHA-512:	A9A28D97D1624B018EAD6649CF78F34851EE9880AC2D2C0DD38CB0A00183DA126F37935E6A6F620236E8CE643BBDF4BA61B2998356DFB6834E2C5AF3055F303A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Hanging Labor (Priced per SQ FT)" GUID="{F80F9F57-4671-40E3-AF23-2A2B0D66031F}">.. <Properties>.. <Property Class="Type" GUID="{97A76A99-5738-45E7-A9FD-783A70CEF944}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="2">Labor</Property>.. <Property Class="Text" GUID="{2AE74583-E4D1-47BD-B0E0-0BF0EBFC7127}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="56" DecimalPlaces="2">Hanging Labor (Priced per SQ FT)</Property>.. <Property Class="Text" GUID="{DF7D9C86-9655-4370-8F53-86133125C021}" Name="Description" input="True" group="Item" OrderIndex="57" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList" ToolHint="Type in a Description of this item"/>.. <Property Class="Text" GUID="{73E7746D-4D1A-4EF5-816F-E74E3E154533}" Name="Item #" group="Item" OrderIndex="58" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{5870FE12-ACE8-4BD4

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Men's Restroom - 107\Joint Compound (Pric\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	9650
Entropy (8bit):	5.603674124622616
Encrypted:	false
SSDEEP:	192:B5xjv5HpvD8sWaGpb/cOXFTTDWsiMHA+D72eOAAzaj:fxBp78sWanOXF/m+n2JAAGj
MD5:	80C81DA0BF5C7170F9483CC951CA47C3
SHA1:	67FA6E01E5306419CBF1716DC2914CB4353620C4
SHA-256:	6ACB157548F8AE3E4EC06189648500A60480A18D166A2F51C986047FC4F25D23
SHA-512:	0087031D45830F183CEE320010D855EDEA2076E342B768482C198739884A51E949F4F5A9844DA37B8B69AEB873B9470C5AC7D2EB5BDDF5935D226ABC012EF46C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Joint Compound (Priced per EA)" GUID="{04F4A2DC-F662-4B1F-A3A4-2ACB0DF4A515}">.. <Properties>.. <Property Class="Type" GUID="{1D8A456C-B996-42F4-AFB3-5AAD6763EA23}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Material</Property>.. <Property Class="Text" GUID="{BE1F4F80-77C8-4915-89A5-96FC38BC4B7D}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="56" DecimalPlaces="2">Joint Compound (Priced per EA)</Property>.. <Property Class="Text" GUID="{ED6B360B-A59B-4066-B76E-7EF428922E6B}" Name="Description" input="True" group="Item" OrderIndex="57" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList" ToolHint="Type in a Description of this item"/>.. <Property Class="Text" GUID="{4C73C9A7-DB6E-48D8-AE7D-EA540FE5186A}" Name="Item #" group="Item" OrderIndex="58" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{5EE4230D-CE5A-4496-

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Men's Restroom - 107\Joint Compound (Pric\is-757QP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	9650
Entropy (8bit):	5.603674124622616
Encrypted:	false
SSDEEP:	192:B5xjv5HpvD8sWaGpb/cOXFTTDWsiMHA+D72eOAAzaj:fxBp78sWanOXF/m+n2JAAGj
MD5:	80C81DA0BF5C7170F9483CC951CA47C3
SHA1:	67FA6E01E5306419CBF1716DC2914CB4353620C4
SHA-256:	6ACB157548F8AE3E4EC06189648500A60480A18D166A2F51C986047FC4F25D23
SHA-512:	0087031D45830F183CEE320010D855EDEA2076E342B768482C198739884A51E949F4F5A9844DA37B8B69AEB873B9470C5AC7D2EB5BDDF5935D226ABC012EF46C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Joint Compound (Priced per EA)" GUID="{04F4A2DC-F662-4B1F-A3A4-2ACB0DF4A515}">.. <Properties>.. <Property Class="Type" GUID="{1D8A456C-B996-42F4-AFB3-5AAD6763EA23}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Material</Property>.. <Property Class="Text" GUID="{BE1F4F80-77C8-4915-89A5-96FC38BC4B7D}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="56" DecimalPlaces="2">Joint Compound (Priced per EA)</Property>.. <Property Class="Text" GUID="{ED6B360B-A59B-4066-B76E-7EF428922E6B}" Name="Description" input="True" group="Item" OrderIndex="57" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList" ToolHint="Type in a Description of this item"/>.. <Property Class="Text" GUID="{4C73C9A7-DB6E-48D8-AE7D-EA540FE5186A}" Name="Item #" group="Item" OrderIndex="58" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{5EE4230D-CE5A-4496-

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Men's Restroom - 107\Joint Tape (Priced p\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	9517
Entropy (8bit):	5.6050700811344
Encrypted:	false
SSDEEP:	192:Hyp0jvhq7lxqYbucfzxDUBMsA+DYXz2CHj:a0ghxqQfzx0to2CHj
MD5:	526339D0E53212F5DCC712099CFEB1BB
SHA1:	C174DCF71810882C3C14686D3F5DBE4706890271
SHA-256:	AA74C92C3F962C99A2FAE71716FDCEE1B7BF1C1898B6279979A2FCD1F49AFF8C
SHA-512:	7116F8881ABDC66814B2AC54365DA9F58EB356B9F28F382E1F8DDF471EB801148C0BBFA53963F08C639EB7709B76249C8B6F8BF146840DD4FD8AAF13126F9D84
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Joint Tape (Priced per EA)" GUID="{16DBBA8B-6142-4AB4-94B3-FEC4C3DD6F7E}">.. <Properties>.. <Property Class="Type" GUID="{EEABA5E8-0DDF-42F2-88D6-14EC795FE336}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Material</Property>.. <Property Class="Text" GUID="{FDA2555E-74DC-4394-9377-EF89AAD854AE}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="56" DecimalPlaces="2">Joint Tape (Priced per EA)</Property>.. <Property Class="Text" GUID="{24679D3A-2D74-4EDF-9D6B-45327802423D}" Name="Description" input="True" group="Item" OrderIndex="57" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList" ToolHint="Type in a Description of this item"/>.. <Property Class="Text" GUID="{E8BD83B2-188E-458D-8D9B-D33B09B80D77}" Name="Item #" group="Item" OrderIndex="58" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{69624F39-5F22-4785-87E9-90B

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Men's Restroom - 107\Joint Tape (Priced p\is-8K53B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	9517
Entropy (8bit):	5.6050700811344
Encrypted:	false
SSDEEP:	192:Hyp0jvhq7lxqYbucfzxDUBMsA+DYXz2CHj:a0ghxqQfzx0to2CHj
MD5:	526339D0E53212F5DCC712099CFEB1BB
SHA1:	C174DCF71810882C3C14686D3F5DBE4706890271
SHA-256:	AA74C92C3F962C99A2FAE71716FDCEE1B7BF1C1898B6279979A2FCD1F49AFF8C
SHA-512:	7116F8881ABDC66814B2AC54365DA9F58EB356B9F28F382E1F8DDF471EB801148C0BBFA53963F08C639EB7709B76249C8B6F8BF146840DD4FD8AAF13126F9D84
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Joint Tape (Priced per EA)" GUID="{16DBBA8B-6142-4AB4-94B3-FEC4C3DD6F7E}">.. <Properties>.. <Property Class="Type" GUID="{EEABA5E8-0DDF-42F2-88D6-14EC795FE336}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Material</Property>.. <Property Class="Text" GUID="{FDA2555E-74DC-4394-9377-EF89AAD854AE}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="56" DecimalPlaces="2">Joint Tape (Priced per EA)</Property>.. <Property Class="Text" GUID="{24679D3A-2D74-4EDF-9D6B-45327802423D}" Name="Description" input="True" group="Item" OrderIndex="57" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList" ToolHint="Type in a Description of this item"/>.. <Property Class="Text" GUID="{E8BD83B2-188E-458D-8D9B-D33B09B80D77}" Name="Item #" group="Item" OrderIndex="58" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{69624F39-5F22-4785-87E9-90B

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Men's Restroom - 107\Section\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (972), with CRLF line terminators
Category:	dropped
Size (bytes):	5569
Entropy (8bit):	5.583321763698217
Encrypted:	false
SSDEEP:	96:8XGIZSyT44WkgwbJ5sdAMMK2bbLUc4RZKFgT9gbXMws2eO:0GIXredAMMK2bbcKFVA25
MD5:	F321F173359E83F1020136A0F9616CE8
SHA1:	C3D59895FE6591399246C50E1C206C1BDA86AC96
SHA-256:	83146321EABD87CF0C6B54BA9127ED0284C1CD75B6445CFD513A4BE221467531
SHA-512:	5BE318D03F68D70FA2C776DFBE249CB4C46807D718C1DA0E4A7F6578FB0D4BC5B78A3A41C1459A01D449799B3FF7ED5D2DCBD74D8BD0D8954643087E900F095D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Area Section" Name="Section" GUID="{7A1B7A02-9741-48F6-A65D-7ACC8D455EC5}">.. <Properties>.. <Property Class="Text" GUID="{89FC1F5E-FE8A-4F38-ABA3-E2DAC8FAC7B1}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Section</Property>.. <Property Class="Text" GUID="{7D435D73-F129-442C-8DC5-36109231C806}" Name="Fill Type" input="True" group="Item" OrderIndex="1" DecimalPlaces="2" SimpleList="Solid..Hatch Pattern..Texture" List="cmbList" PluginToExecute="cmbList">[..]</Property>.. <Property Class="Type" GUID="{4834AC7F-99D5-4DCC-A07F-6025C8F7E44B}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Area Section</Property>.. <Property Class="Text" GUID="{106CE0E8-AB54-4C87-A521-3A556C501B93}" Name="Page" group="Item" OrderIndex="3" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[[PageGUID]\Name]</Property>.. <Property Class="Text" GUID="{C6D14254-

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Men's Restroom - 107\Section\Label\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (869), with CRLF line terminators
Category:	dropped
Size (bytes):	8422
Entropy (8bit):	5.5428364953972356
Encrypted:	false
SSDEEP:	96:wU/vSkqju24Kip5ZoVIpII3Ap8xAgHWgip4h5uevU5G7GDGD/HCRC9fQf:w6SMcii9CrBh7cgCKD/HCRC9fI
MD5:	E539D0C505E1F599FC20F0517B0325A3
SHA1:	98AA4AE7D775A998D2DDFEC2DA5FB3BCEEFE25C1
SHA-256:	4CF004AE85D2D74EED742D09E4E5AA3B6C2E374DAFE2AECB53C8AE727942E547
SHA-512:	BA83A358158C7FFB73DCABDF09BB473724AF3426607E2E3E8B3118D59D39352A749F46675D9F0308894778677459EE5768B23B757071727402B9E31FDC81CD7D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Note" Name="Label" GUID="{079D7752-68FB-43F2-B373-5EDEB695FC7C}">.. <Properties>.. <Property Class="Text" GUID="{ECFF06EB-0D2D-429F-84FE-397C347DB2B5}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Label</Property>.. <Property Class="Type" GUID="{1DF0C89D-0DE6-497C-8EEB-B95366661E0C}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Area Label</Property>.. <Property Class="Memo" GUID="{6B6A41D6-E652-432D-8B72-C21218CAF588}" Name="Text" input="True" group="Item" OrderIndex="2" DecimalPlaces="" List="cmbList">[..\..\Name]..[..\Takeoff] [..\..\!Units('Takeoff')]</Property>.. <Property Class="Text" GUID="{93A62056-A4B6-450C-A570-988B255ACAC0}" Name="Page" group="Item" OrderIndex="3" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[[PageGUID]\Name]</Property>.. <Property Class="CheckBox" GUID="{9ED02712-DD8E-4CC9-8D0D-28B12ED3B84C}" Name="Auto

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Men's Restroom - 107\Section\Label\is-N4UGL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (869), with CRLF line terminators
Category:	dropped
Size (bytes):	8422
Entropy (8bit):	5.5428364953972356
Encrypted:	false
SSDEEP:	96:wU/vSkqju24Kip5ZoVIpII3Ap8xAgHWgip4h5uevU5G7GDGD/HCRC9fQf:w6SMcii9CrBh7cgCKD/HCRC9fI
MD5:	E539D0C505E1F599FC20F0517B0325A3
SHA1:	98AA4AE7D775A998D2DDFEC2DA5FB3BCEEFE25C1
SHA-256:	4CF004AE85D2D74EED742D09E4E5AA3B6C2E374DAFE2AECB53C8AE727942E547
SHA-512:	BA83A358158C7FFB73DCABDF09BB473724AF3426607E2E3E8B3118D59D39352A749F46675D9F0308894778677459EE5768B23B757071727402B9E31FDC81CD7D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Note" Name="Label" GUID="{079D7752-68FB-43F2-B373-5EDEB695FC7C}">.. <Properties>.. <Property Class="Text" GUID="{ECFF06EB-0D2D-429F-84FE-397C347DB2B5}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Label</Property>.. <Property Class="Type" GUID="{1DF0C89D-0DE6-497C-8EEB-B95366661E0C}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Area Label</Property>.. <Property Class="Memo" GUID="{6B6A41D6-E652-432D-8B72-C21218CAF588}" Name="Text" input="True" group="Item" OrderIndex="2" DecimalPlaces="" List="cmbList">[..\..\Name]..[..\Takeoff] [..\..\!Units('Takeoff')]</Property>.. <Property Class="Text" GUID="{93A62056-A4B6-450C-A570-988B255ACAC0}" Name="Page" group="Item" OrderIndex="3" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[[PageGUID]\Name]</Property>.. <Property Class="CheckBox" GUID="{9ED02712-DD8E-4CC9-8D0D-28B12ED3B84C}" Name="Auto

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Men's Restroom - 107\Section\is-NK3CB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (972), with CRLF line terminators
Category:	dropped
Size (bytes):	5569
Entropy (8bit):	5.583321763698217
Encrypted:	false
SSDEEP:	96:8XGIZSyT44WkgwbJ5sdAMMK2bbLUc4RZKFgT9gbXMws2eO:0GIXredAMMK2bbcKFVA25
MD5:	F321F173359E83F1020136A0F9616CE8
SHA1:	C3D59895FE6591399246C50E1C206C1BDA86AC96
SHA-256:	83146321EABD87CF0C6B54BA9127ED0284C1CD75B6445CFD513A4BE221467531
SHA-512:	5BE318D03F68D70FA2C776DFBE249CB4C46807D718C1DA0E4A7F6578FB0D4BC5B78A3A41C1459A01D449799B3FF7ED5D2DCBD74D8BD0D8954643087E900F095D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Area Section" Name="Section" GUID="{7A1B7A02-9741-48F6-A65D-7ACC8D455EC5}">.. <Properties>.. <Property Class="Text" GUID="{89FC1F5E-FE8A-4F38-ABA3-E2DAC8FAC7B1}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Section</Property>.. <Property Class="Text" GUID="{7D435D73-F129-442C-8DC5-36109231C806}" Name="Fill Type" input="True" group="Item" OrderIndex="1" DecimalPlaces="2" SimpleList="Solid..Hatch Pattern..Texture" List="cmbList" PluginToExecute="cmbList">[..]</Property>.. <Property Class="Type" GUID="{4834AC7F-99D5-4DCC-A07F-6025C8F7E44B}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Area Section</Property>.. <Property Class="Text" GUID="{106CE0E8-AB54-4C87-A521-3A556C501B93}" Name="Page" group="Item" OrderIndex="3" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[[PageGUID]\Name]</Property>.. <Property Class="Text" GUID="{C6D14254-

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Right Hand Doors\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (435), with CRLF line terminators
Category:	dropped
Size (bytes):	47745
Entropy (8bit):	5.289358644843829
Encrypted:	false
SSDEEP:	384:sjWlF9k0P2Je8OWZq6DJL5OmvyF/CLekhUr/bQ:1F932JefCLekh+c
MD5:	24DED5E59D9E9A934ED53ACFE921C094
SHA1:	2642A19E5D27E1A6F635B681C7F9EEEFBA8A5054
SHA-256:	819286B11DF7D2385C76BAD1A7E933BA2C0C5C93B9859E0B31E09AD4D8B135A0
SHA-512:	65069ECBFF9471ADCCAFB04BA05F4F7A34390A3C90AA64CD606C18D2952D8650F6264F0F156C861C6ADA0A333D0C13511AD3EEED8790363B2A9D16EA2DDD967F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Count" Name="Right Hand Doors" GUID="{8657383A-31E5-4AD7-8E89-6EF4F559DE67}">.. <Properties>.. <Property Class="Number" GUID="{7E3AE0A9-A3EC-4C2E-99E6-E716F9A02B19}" Name="Qty" inputunits="EA" group="Estimating" OrderIndex="0" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Takeoff]</Property>.. <Property Class="Number" GUID="{CC95B191-594B-4C79-954F-77AB87A7C259}" Name="Cost Each" units="[!CU]" group="Estimating" OrderIndex="23" DecimalPlaces="2" List="cmbList"/>.. <Property Class="Number" GUID="{C67B7A90-8016-4FD5-93EB-28A7D53A1E8E}" Name="Markup %" units="%" group="Estimating" OrderIndex="24" DecimalPlaces="2" List="cmbList"/>.. <Property Class="Text" GUID="{D116EE79-5F1A-4FC5-9F03-8B9EF4CFF1C1}" Name="Cost Type" group="Estimating" OrderIndex="25" DecimalPlaces="2" SimpleList="Material..Labor..Equipment..Subcontract..Other" List="cmbList"/>.. <Property Class="Text" GUID="{C9B509C3-6220-4609-84AB-41B6E4A

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Right Hand Doors\Section\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (655), with CRLF line terminators
Category:	dropped
Size (bytes):	5255
Entropy (8bit):	5.576190905632348
Encrypted:	false
SSDEEP:	96:sykQSvVvw0OgkfONDaPFKBKqKNKia9DgM8gbXHyO:syCPePFydiXaJdbd
MD5:	8C345F4F2BF2457B43973D6019608491
SHA1:	986326D607804F38E60EF0075B8A0CE2F309A627
SHA-256:	A42F0A4CADB7EC29DB23630E2B5622E0D84B2608AFCF195928464D1935F8859B
SHA-512:	003CB0A41AEE5371E1734D0EB1D5CD89205839E27183D8644B4DF5767F563E21BEEADDE1003B7BFBAB1273C2433EAEDBEDF2A6B98E317CE3CE84C2F2C56B3E62
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Count Section" Name="Section" GUID="{F74E5C83-C6C8-4249-ADC1-FB447F1E1828}">.. <Properties>.. <Property Class="Text" GUID="{1ADCD057-504E-4F0A-8B80-CF93AF08F42C}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Section</Property>.. <Property Class="Text" GUID="{94133B5D-49D6-4D1B-A7D1-D3568B5CDDAA}" Name="Fill Type" input="True" group="Item" OrderIndex="1" DecimalPlaces="2" SimpleList="Solid..Hatch Pattern..Texture" List="cmbList" PluginToExecute="cmbList">[..]</Property>.. <Property Class="Type" GUID="{2EDC1D9E-169F-4AD3-80A6-1E9BA4536B9D}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Count Section</Property>.. <Property Class="Text" GUID="{27D067DC-7F93-4FE0-A2E5-99FCC774D0C0}" Name="Page" group="Item" OrderIndex="3" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[[PageGUID]\Name]</Property>.. <Property Class="Text" GUID="{CD43338

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Right Hand Doors\Section\is-9VPH5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (655), with CRLF line terminators
Category:	dropped
Size (bytes):	5255
Entropy (8bit):	5.576190905632348
Encrypted:	false
SSDEEP:	96:sykQSvVvw0OgkfONDaPFKBKqKNKia9DgM8gbXHyO:syCPePFydiXaJdbd
MD5:	8C345F4F2BF2457B43973D6019608491
SHA1:	986326D607804F38E60EF0075B8A0CE2F309A627
SHA-256:	A42F0A4CADB7EC29DB23630E2B5622E0D84B2608AFCF195928464D1935F8859B
SHA-512:	003CB0A41AEE5371E1734D0EB1D5CD89205839E27183D8644B4DF5767F563E21BEEADDE1003B7BFBAB1273C2433EAEDBEDF2A6B98E317CE3CE84C2F2C56B3E62
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Count Section" Name="Section" GUID="{F74E5C83-C6C8-4249-ADC1-FB447F1E1828}">.. <Properties>.. <Property Class="Text" GUID="{1ADCD057-504E-4F0A-8B80-CF93AF08F42C}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Section</Property>.. <Property Class="Text" GUID="{94133B5D-49D6-4D1B-A7D1-D3568B5CDDAA}" Name="Fill Type" input="True" group="Item" OrderIndex="1" DecimalPlaces="2" SimpleList="Solid..Hatch Pattern..Texture" List="cmbList" PluginToExecute="cmbList">[..]</Property>.. <Property Class="Type" GUID="{2EDC1D9E-169F-4AD3-80A6-1E9BA4536B9D}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Count Section</Property>.. <Property Class="Text" GUID="{27D067DC-7F93-4FE0-A2E5-99FCC774D0C0}" Name="Page" group="Item" OrderIndex="3" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[[PageGUID]\Name]</Property>.. <Property Class="Text" GUID="{CD43338

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Right Hand Doors\is-AE0QH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (435), with CRLF line terminators
Category:	dropped
Size (bytes):	47745
Entropy (8bit):	5.289358644843829
Encrypted:	false
SSDEEP:	384:sjWlF9k0P2Je8OWZq6DJL5OmvyF/CLekhUr/bQ:1F932JefCLekh+c
MD5:	24DED5E59D9E9A934ED53ACFE921C094
SHA1:	2642A19E5D27E1A6F635B681C7F9EEEFBA8A5054
SHA-256:	819286B11DF7D2385C76BAD1A7E933BA2C0C5C93B9859E0B31E09AD4D8B135A0
SHA-512:	65069ECBFF9471ADCCAFB04BA05F4F7A34390A3C90AA64CD606C18D2952D8650F6264F0F156C861C6ADA0A333D0C13511AD3EEED8790363B2A9D16EA2DDD967F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Count" Name="Right Hand Doors" GUID="{8657383A-31E5-4AD7-8E89-6EF4F559DE67}">.. <Properties>.. <Property Class="Number" GUID="{7E3AE0A9-A3EC-4C2E-99E6-E716F9A02B19}" Name="Qty" inputunits="EA" group="Estimating" OrderIndex="0" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Takeoff]</Property>.. <Property Class="Number" GUID="{CC95B191-594B-4C79-954F-77AB87A7C259}" Name="Cost Each" units="[!CU]" group="Estimating" OrderIndex="23" DecimalPlaces="2" List="cmbList"/>.. <Property Class="Number" GUID="{C67B7A90-8016-4FD5-93EB-28A7D53A1E8E}" Name="Markup %" units="%" group="Estimating" OrderIndex="24" DecimalPlaces="2" List="cmbList"/>.. <Property Class="Text" GUID="{D116EE79-5F1A-4FC5-9F03-8B9EF4CFF1C1}" Name="Cost Type" group="Estimating" OrderIndex="25" DecimalPlaces="2" SimpleList="Material..Labor..Equipment..Subcontract..Other" List="cmbList"/>.. <Property Class="Text" GUID="{C9B509C3-6220-4609-84AB-41B6E4A

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Shipping Area - 110\1%22 Gravel (Priced pe\is-RRIO8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (377), with CRLF line terminators
Category:	dropped
Size (bytes):	13555
Entropy (8bit):	5.597092697355922
Encrypted:	false
SSDEEP:	384:L5IKPoaSmdkdb4dMHNd+ccSFk3lDRW2Nyj:LmKVSmdkdb4dMHNsPSG3lDRxNyj
MD5:	9F015FBC745DD89BFEB6109034C49922
SHA1:	ABEC31CFB14C66D05DB4CD54A1D9753158B2FBD3
SHA-256:	6199B3F1D1F7E175566A021A9662A2D16EF6C832EE7018EAD94B91DD736AA431
SHA-512:	28D25F86544A2788589A5D00AEA024494983A5835FE5BDEB7FE5F38CE88CDFC27FF57FADD231EBBC91851163A25E0D25B22B92625DDC2F296E3FE5D61EB85423
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="1" Gravel (Priced per TON)" GUID="{DB3BD92F-5CE8-48B8-8DF1-947412AC49B4}">.. <Properties>.. <Property Class="Type" GUID="{CBEFA70C-701F-49F7-AE8E-79C3DF8B8F00}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Material</Property>.. <Property Class="Text" GUID="{62F8C651-9613-41CA-A1F6-14F0A9D8077B}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="56" DecimalPlaces="2">1" Gravel (Priced per TON)</Property>.. <Property Class="Text" GUID="{2253C18A-CD9E-4AB1-AD42-98745026A164}" Name="Description" input="True" group="Item" OrderIndex="57" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList" ToolHint="Type in a Description of this item"/>.. <Property Class="Text" GUID="{DD9EE54B-779D-4C97-988C-1AFE2C9C0180}" Name="Item #" group="Item" OrderIndex="58" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{C31DFD55-D72C-48C

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Shipping Area - 110\15 mil Vapor Barrier\is-32RJE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (380), with CRLF line terminators
Category:	dropped
Size (bytes):	8755
Entropy (8bit):	5.596484646786474
Encrypted:	false
SSDEEP:	192:ytS6jWqdzcjZn6vWke7bglfL3s1er0+DkSqb0j:yA6jNOZnSXfN8cp7qb0j
MD5:	106668755DAED25AE145F25C66F431C3
SHA1:	E79C20C88C293CFB52447A0FAB46BF23D9392971
SHA-256:	158AA7310A2B8C634A9A0D0822FADF55A7A8CE74C82633819E686136AC6DECF8
SHA-512:	4D715AE42D43AFBCEB76FA576F353D865EEB10A8272BC2612F075D0023CA0853EA1CD16182A1F1ED02F5CD18EE217BCC7701D14F5FE20E99A6A362EC119DBF5F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="15 mil Vapor Barrier (Priced per ROLL)" GUID="{B3E43E37-EFDD-49CD-B35A-29C42FDDA589}">.. <Properties>.. <Property Class="Type" GUID="{92F0B579-5190-4530-9416-DDA397811A9B}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Material</Property>.. <Property Class="Text" GUID="{A11AE68B-F790-4864-AAA1-204DF4DC334C}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="60" DecimalPlaces="2">15 mil Vapor Barrier (Priced per ROLL)</Property>.. <Property Class="Text" GUID="{9C6A558B-7BAF-48F6-9A1A-7E995AAEDC49}" Name="Description" input="True" group="Item" OrderIndex="61" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList" ToolHint="Type in a Description of this item"/>.. <Property Class="Text" GUID="{AE56AB91-3957-421D-BA76-12F16D04A218}" Name="Item #" group="Item" OrderIndex="62" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{13C

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Shipping Area - 110\Concrete Labor (Pric\is-3DBCM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (343), with CRLF line terminators
Category:	dropped
Size (bytes):	7966
Entropy (8bit):	5.594747760462853
Encrypted:	false
SSDEEP:	96:iPin/zkFl1DPvojNyzZjHsBLJliEKlOkqiyoQ0tdlLLGXnXOD08+YIimjpc:dLOYjNy9mDifqWblnGX+DOYBm6
MD5:	961F655652738F12432F99DAE6D50887
SHA1:	6D286E5977FE625D706963C26CDFB12EA2BABC20
SHA-256:	1DFC42B8CF5C635295F84D7F5643D7BB3D1B7B989EA9BB6031BB91426E58FC09
SHA-512:	6D067014FA17F1203A627A2A165A90C3725F71AC771DF841FC534F9DEFEE661A7F4DFF61B12CC3CAF32C55EEDE0E9AA190824A2DABF02F1AC64C018F6036D3D7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Concrete Labor (Priced per SQ FT)" GUID="{C5639F28-4CF2-4795-B382-4D79409A8D33}">.. <Properties>.. <Property Class="Text" GUID="{E4CC86A4-5948-4F93-B620-1ED116A6DA67}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Concrete Labor (Priced per SQ FT)</Property>.. <Property Class="Text" GUID="{D80A7215-C6DB-4302-A6CD-996B5AEFE6A9}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Type" GUID="{AEC62787-E9DF-479B-9251-9641B4358952}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="2">Labor</Property>.. <Property Class="Text" GUID="{4A77A419-770D-489A-9523-0DAEAC1AEFD0}" Name="Item #" group="Item" OrderIndex="3" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{2FCEA541-71DE-4003-BF04-BE5DEE41F8EA}" Name="Created By" inheritaction="Flatte

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Shipping Area - 110\Concrete Slab (Price\is-QPK13.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (378), with CRLF line terminators
Category:	dropped
Size (bytes):	8617
Entropy (8bit):	5.597782946276181
Encrypted:	false
SSDEEP:	192:g9Gdje/mY4dT9btoyD3wx0Jf3+DQ22MrOVj:HdAmY4djoyjyCm022MqVj
MD5:	599E88C812172DD7FE097C4F84778ACA
SHA1:	BF04E9B82E16F2B2A41F625A0708CCB41FA9460B
SHA-256:	3866C6CBE53B79B6E490F1EA60CDC0BF08668A0822A18E3DD8A392903E95CE50
SHA-512:	F42EC2B5DCF65727179EF62144BAAB365D251CF194E41B16F1BA21BEE154208E909D134B2029F4E3242003D2FF0F128825DB159120C8B1270C4FEBC4A9207BBB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Concrete Slab (Priced per CU YD)" GUID="{48EA27E9-66A1-4B5D-8FF8-6DB16D14DFE0}">.. <Properties>.. <Property Class="Type" GUID="{96717E59-6BD8-476D-82B2-AA1035B17204}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Material</Property>.. <Property Class="Text" GUID="{B0EE48E9-2A3E-4AC2-A0D8-06774D595593}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="56" DecimalPlaces="2">Concrete Slab (Priced per CU YD)</Property>.. <Property Class="Text" GUID="{03ABBD18-3FF9-4A4F-9312-3790A3312B70}" Name="Description" input="True" group="Item" OrderIndex="57" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList" ToolHint="Type in a Description of this item"/>.. <Property Class="Text" GUID="{F4D58B04-2FFA-42FB-89EB-480ED02C8C04}" Name="Item #" group="Item" OrderIndex="58" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{DFB0833B-50EB-4

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Shipping Area - 110\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (32644), with CRLF line terminators
Category:	dropped
Size (bytes):	50121
Entropy (8bit):	6.110971105349142
Encrypted:	false
SSDEEP:	1536:mHy+7JuSfoXj2VapPJP420+reyjetKvP08TvEzx5l/D/zc10bY8:jljetc6xr/bQ1EY8
MD5:	BF6D42B468DF8A52718640F07F61B69C
SHA1:	562BD2A1EE963C3BFF22420BA7A33598CCA0799F
SHA-256:	6ACC78CC67660C85023A39DF44BF865A2FF7488F3C9A8C2AA421FCCB61D6D54C
SHA-512:	AFF74CDC5E287149446B84C5CBA0E8941563BCCBC6B1B6A040E579B0E1B178F29441CA4267408D5911477A3D6E7F4EF56F991817A4304E55583245B3A36C4A01
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Area" Name="Shipping Area - 110" GUID="{AA8F15DA-468C-409C-970A-057410E35127}">.. <Properties>.. <Property Class="Type" GUID="{8D203684-B6C9-4327-8970-B37D97EAC43A}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="2">Area</Property>.. <Property Class="Text" GUID="{F1641A98-5AAC-4424-8B0B-627115C513B9}" Name="Description" input="True" group="Item" OrderIndex="9.5" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList" ToolHint="Type in a Description of this item"/>.. <Property Class="Text" GUID="{5FBD9354-FE6B-4B0C-A1BF-19FA791821B7}" Name="Item #" group="Item" OrderIndex="37" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{B7BE05E6-2F04-4D7F-B598-DA77512C88F0}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="95" DecimalPlaces="2">Shipping Area - 110</Property>.. <Property Class="Text" GUID="{09A33851-C7D4-4E5E-B1F0-D3603E8

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Shipping Area - 110\Rebar (Priced per LB\is-GC7MD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	13573
Entropy (8bit):	5.612795596979229
Encrypted:	false
SSDEEP:	384:jmW9DZpN34on4kOHl6c5K82Oa5gQhZT1nWrMiCV0KjPj:xZpN34on4kOHwIK82Oa5gQZTJWjQDj
MD5:	25DF007D88C2B74DD964570B0F754B9C
SHA1:	DECCD0F202550280983EFD2B9EE818C3A8A02F9E
SHA-256:	EB9A2FC0237740FECE20B8A5ADC45BF08329AEC7E9326E86CDF0029A20E8485F
SHA-512:	ED9E36AB65E3BDD94F25D1EC2F6AF7485A4A7B5047B1BC493D39D3B0C4A45A68B9A0FBD17B0663E2B71DBFB1668222425A6298CB0F7C6952A25E3A06E3F71D69
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Rebar (Priced per LBS)" GUID="{A99708EA-7F68-4393-85AC-836EA93287F3}">.. <Properties>.. <Property Class="Type" GUID="{707E5767-4445-467A-A8EA-51BCEB8C187F}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Material</Property>.. <Property Class="Text" GUID="{3E5ECF94-F736-4EF0-8615-CC051065E92C}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="73" DecimalPlaces="2">Rebar (Priced per LBS)</Property>.. <Property Class="Text" GUID="{50528F94-FBB4-49F1-BAC7-B3E837D3400B}" Name="Description" group="Item" OrderIndex="74" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList" ToolHint="Type in a Description of this item"/>.. <Property Class="Text" GUID="{4F0AEE55-5087-4DFF-956F-F6DC0DCD9B39}" Name="Item #" group="Item" OrderIndex="75" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{D000D616-8469-4D0F-A3A2-BAB265D27A0E}" Name="Cre

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Shipping Area - 110\Section\Label\is-007SL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (869), with CRLF line terminators
Category:	dropped
Size (bytes):	8423
Entropy (8bit):	5.541956037886806
Encrypted:	false
SSDEEP:	96:L1QqXVDJ24+p5Z6Ik6IG3KQp7RAEoxL/Q4hPbuQkr50iEx/xQx+VO:NJ0wjUchPi50igp0+8
MD5:	A1BDC6FA651BC9B6577CE4308F18991D
SHA1:	4C4862A92E74AF784C2899092429F71A53E1C09D
SHA-256:	93E74F111F19B48C1379623D94296786979BAE7AE8DF92BB2E6055BE9ABED743
SHA-512:	C340CA1D5208CF342F60211F26A35529227ECC6EA80ED759D1B7802D01F1960CAD9D2034EA94B0CE549F0BF49E974DDD611A6B586831A915C122D99365C26515
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Note" Name="Label" GUID="{79AEEB22-5D35-4524-9B05-F89D0EF186EB}">.. <Properties>.. <Property Class="Text" GUID="{95896728-E684-48AB-AC89-F89B4341A838}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Label</Property>.. <Property Class="Type" GUID="{DA4FEB1D-2B33-4B11-A0D0-3BEFADCF4059}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Area Label</Property>.. <Property Class="Memo" GUID="{ECCAB7E7-B404-410B-9873-22D834A79D4C}" Name="Text" input="True" group="Item" OrderIndex="2" DecimalPlaces="" List="cmbList">[..\..\Name]..[..\Takeoff] [..\..\!Units('Takeoff')]</Property>.. <Property Class="Text" GUID="{E02EA46D-933D-4166-A6FD-8C9F65C8ACEB}" Name="Page" group="Item" OrderIndex="3" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[[PageGUID]\Name]</Property>.. <Property Class="CheckBox" GUID="{C057FF9F-B4AB-49A1-9FA9-4ACC7BEAB05A}" Name="Auto

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Shipping Area - 110\Section\is-BASD8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (659), with CRLF line terminators
Category:	dropped
Size (bytes):	5256
Entropy (8bit):	5.576878693802293
Encrypted:	false
SSDEEP:	96:FkbiXSpjRJ34vkaagi58GQGbVVqPDrgTEgSXnOgO:Pw8y581iVgPnN+7
MD5:	90565793B5D6F2F7FB6D6FF7611C432B
SHA1:	BEFE530F3641B8303395169F428F29976A423265
SHA-256:	3B58C4706B680A26BEFE6D04A9751BDECE8C831DE6687ACD02EECB631EA12869
SHA-512:	24505AE391F88C4FE00FD811A7FE28730B8726691D134967050E32DD5A524D58206311A36D3AF9A4ECF4D25F53583DA51A121F6FF6D7FBE7DE8E1D8AE4379F82
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Area Section" Name="Section" GUID="{5516E2AA-EB17-44CF-8191-CBB0F1742C19}">.. <Properties>.. <Property Class="Text" GUID="{E2ECA0D1-3CA5-405C-A907-F76131136CFC}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Section</Property>.. <Property Class="Text" GUID="{850638BD-AAD2-4E0B-A3DD-3DC2A0EBFE65}" Name="Fill Type" input="True" group="Item" OrderIndex="1" DecimalPlaces="2" SimpleList="Solid..Hatch Pattern..Texture" List="cmbList" PluginToExecute="cmbList">[..]</Property>.. <Property Class="Type" GUID="{08E2AB6F-15A3-440B-9C75-379DEBCE445A}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Area Section</Property>.. <Property Class="Text" GUID="{F7159C86-27DA-4EA7-B577-F36A5C06D683}" Name="Page" group="Item" OrderIndex="3" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[[PageGUID]\Name]</Property>.. <Property Class="Text" GUID="{987A0B35-

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Shipping Area - 110\is-9RUSF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (32644), with CRLF line terminators
Category:	dropped
Size (bytes):	50121
Entropy (8bit):	6.110971105349142
Encrypted:	false
SSDEEP:	1536:mHy+7JuSfoXj2VapPJP420+reyjetKvP08TvEzx5l/D/zc10bY8:jljetc6xr/bQ1EY8
MD5:	BF6D42B468DF8A52718640F07F61B69C
SHA1:	562BD2A1EE963C3BFF22420BA7A33598CCA0799F
SHA-256:	6ACC78CC67660C85023A39DF44BF865A2FF7488F3C9A8C2AA421FCCB61D6D54C
SHA-512:	AFF74CDC5E287149446B84C5CBA0E8941563BCCBC6B1B6A040E579B0E1B178F29441CA4267408D5911477A3D6E7F4EF56F991817A4304E55583245B3A36C4A01
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Area" Name="Shipping Area - 110" GUID="{AA8F15DA-468C-409C-970A-057410E35127}">.. <Properties>.. <Property Class="Type" GUID="{8D203684-B6C9-4327-8970-B37D97EAC43A}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="2">Area</Property>.. <Property Class="Text" GUID="{F1641A98-5AAC-4424-8B0B-627115C513B9}" Name="Description" input="True" group="Item" OrderIndex="9.5" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList" ToolHint="Type in a Description of this item"/>.. <Property Class="Text" GUID="{5FBD9354-FE6B-4B0C-A1BF-19FA791821B7}" Name="Item #" group="Item" OrderIndex="37" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{B7BE05E6-2F04-4D7F-B598-DA77512C88F0}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="95" DecimalPlaces="2">Shipping Area - 110</Property>.. <Property Class="Text" GUID="{09A33851-C7D4-4E5E-B1F0-D3603E8

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Sinks\Section\is-1VNJT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (379), with CRLF line terminators
Category:	dropped
Size (bytes):	4856
Entropy (8bit):	5.555012271735924
Encrypted:	false
SSDEEP:	96:siFrGSOrd77GqdAkFz+YgKHnn0vgMgodXnbO:sipi/xKYgEchdi
MD5:	745FFEFF203D4342A6A44549989A0B6C
SHA1:	1D06E9DDE4614E532E47B3F49A44CC95570AB77C
SHA-256:	E7E95BD029C68DD5381FC564D8B18999DB19BE09B2AE084E4F90118C10AFF024
SHA-512:	DD257FF738D0C8A16BC975D9AC1F884A34AA14D3A3C8E21473D1CB0CB2580ABCB3A142697A4E659C99502C185D20340FF45E17BA2E62474FAE230A80C65AF2E4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Count Section" Name="Section" GUID="{082DF447-F4A6-4F7A-B8C2-4CCAE71A784E}">.. <Properties>.. <Property Class="Text" GUID="{13BDFCBB-D78B-42F9-8673-60C165143647}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Section</Property>.. <Property Class="Text" GUID="{A4086910-41B8-4A36-A18B-16F4EF4FC795}" Name="Fill Type" input="True" group="Item" OrderIndex="1" DecimalPlaces="2" SimpleList="Solid..Hatch Pattern..Texture" List="cmbList" PluginToExecute="cmbList">[..]</Property>.. <Property Class="Type" GUID="{73598507-6889-4F97-B7AD-D5CE21354F02}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Count Section</Property>.. <Property Class="Text" GUID="{A6E184C7-E7B1-4F9E-A944-A18DFBE6CCF9}" Name="Page" group="Item" OrderIndex="3" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[[PageGUID]\Name]</Property>.. <Property Class="Text" GUID="{99A179D

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Sinks\is-1SSS0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (435), with CRLF line terminators
Category:	dropped
Size (bytes):	47719
Entropy (8bit):	5.289056873550359
Encrypted:	false
SSDEEP:	384:snpYF9a7vkJe8OlNMrJJQe4mIVqeyevRcrWP:qpYF9hJe7keyevRV
MD5:	9C05168558C5B1798162BA65491C8472
SHA1:	C81D87FB2BEE4AD8C2F51343FF72888615B049C1
SHA-256:	86EDD8EBB1C0864E17819391090233425AADD3B24E221A5C9713AE837D5257C3
SHA-512:	10077447A9A1A067EF73CFF695669CA36EB9A083693B9854D2C6E3E30E0AD6023722DDB43F51B7D34CB9AB4907A941A35E3DE2704F14D0BFAC2FEE8C36C7B641
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Count" Name="Sinks" GUID="{09858CF6-EF6B-4609-8DF4-955F143A763F}">.. <Properties>.. <Property Class="Number" GUID="{83E4639F-BA9C-4503-A39C-74DE521E5F7B}" Name="Qty" inputunits="EA" group="Estimating" OrderIndex="0" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Takeoff]</Property>.. <Property Class="Number" GUID="{5D95C78E-8CEB-4B23-9FCA-3D78A04C2375}" Name="Cost Each" units="[!CU]" group="Estimating" OrderIndex="23" DecimalPlaces="2" List="cmbList"/>.. <Property Class="Number" GUID="{5C6E6518-C4E9-415B-BB48-52F57122837F}" Name="Markup %" units="%" group="Estimating" OrderIndex="24" DecimalPlaces="2" List="cmbList"/>.. <Property Class="Text" GUID="{0008D356-9F20-4BC2-9FFE-97F69D5D990B}" Name="Cost Type" group="Estimating" OrderIndex="25" DecimalPlaces="2" SimpleList="Material..Labor..Equipment..Subcontract..Other" List="cmbList"/>.. <Property Class="Text" GUID="{BC12E8C5-9549-4848-8BA1-B902D30BFB3D}" Nam

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Toilets\Section\is-PSFRR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (379), with CRLF line terminators
Category:	dropped
Size (bytes):	4973
Entropy (8bit):	5.564932618826757
Encrypted:	false
SSDEEP:	96:sSMvSI7FFnkv7QgisiGK0eltgBgOMXhUO:sCVbqYMJ
MD5:	6CE59C26C608FAD8C452447C65E73186
SHA1:	9A71C49221F3A08CFCF6AD2DFD62E911AB9EB64A
SHA-256:	37DAE4350C5E4A486642FCE2C6EA87F26D192F057CA2F3DE5B35C2C81E92B76E
SHA-512:	4499F60F21A87B3ECD7DB9868FE1291C17B10DB202E2ADB1B939830663F9306870491D6DE8E4C27DF5F4851934DD523894CF3341FF74B80F6C3C56F8524AEE25
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Count Section" Name="Section" GUID="{D75AEBA3-A91E-4330-80D0-1006E10BFA66}">.. <Properties>.. <Property Class="Text" GUID="{7D53D0D4-BA3A-407A-A145-3B65855E8D80}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Section</Property>.. <Property Class="Text" GUID="{918A44B7-FF18-4F12-80C9-A97AA3A95130}" Name="Fill Type" input="True" group="Item" OrderIndex="1" DecimalPlaces="2" SimpleList="Solid..Hatch Pattern..Texture" List="cmbList" PluginToExecute="cmbList">[..]</Property>.. <Property Class="Type" GUID="{5A80F420-A0C1-4DE8-BD5A-E2F4602E1B5A}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Count Section</Property>.. <Property Class="Text" GUID="{5CE68BA3-D6B0-4B53-AED2-B5ACE844902F}" Name="Page" group="Item" OrderIndex="3" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[[PageGUID]\Name]</Property>.. <Property Class="Text" GUID="{9520367

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Toilets\is-KIUJM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (435), with CRLF line terminators
Category:	dropped
Size (bytes):	47716
Entropy (8bit):	5.287999523162487
Encrypted:	false
SSDEEP:	384:sCF9kL/Je8OHFpAGJnGEmhye+CdJroQLresPIrrP:pF90JexSNFvroQ/esP4
MD5:	3C06B6A91450FB10886FDC2B9105A6F6
SHA1:	9CEB9394DBF38B0C6DE1BBCC291984C7D61660DC
SHA-256:	1BF8F2BB6A3FCB01B22999C650130CDD815D272FA3C99B4E8B4E7679A903F41D
SHA-512:	419B5F2F33769DD0F49E379DA452D80C32B43DE99AAFD2DE01B5E294E53BE6F4CBD2A56C93E1ED4C8EBE7251182F0B479923322A56CA462A01ED54D5BDD8B85C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Count" Name="Toilets" GUID="{CCD40D61-8ED3-490D-954C-94284802AA07}">.. <Properties>.. <Property Class="Number" GUID="{1886C0F0-4A6F-4410-BE6E-ABF49688CDB1}" Name="Qty" inputunits="EA" group="Estimating" OrderIndex="0" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Takeoff]</Property>.. <Property Class="Number" GUID="{AF385FED-ED32-4471-B8CA-E4616CDA7AE8}" Name="Cost Each" units="[!CU]" group="Estimating" OrderIndex="23" DecimalPlaces="2" List="cmbList"/>.. <Property Class="Number" GUID="{89BE5BF0-81D7-4D45-AEE7-A663EB1204EE}" Name="Markup %" units="%" group="Estimating" OrderIndex="24" DecimalPlaces="2" List="cmbList"/>.. <Property Class="Text" GUID="{DE883BA7-60F1-467F-9D58-2658A298AB9A}" Name="Cost Type" group="Estimating" OrderIndex="25" DecimalPlaces="2" SimpleList="Material..Labor..Equipment..Subcontract..Other" List="cmbList"/>.. <Property Class="Text" GUID="{36DEA986-2CC4-4DEC-B9A8-BD1EA0EEE34D}" N

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Wall Mounted Urinal\Section\is-1M7DF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (379), with CRLF line terminators
Category:	dropped
Size (bytes):	4734
Entropy (8bit):	5.542353085605339
Encrypted:	false
SSDEEP:	96:sYAipSIuh3okjARSGZ2gq5Igmg1XKgAwYO:sxnh3gq+4BPT
MD5:	868EDA8AB780792C1BE27A0CEAF0FC97
SHA1:	14348A9DE89DEB443C9F028CCF66C1153D1293F7
SHA-256:	3BD66269E8D3271B08A5CFB4049DD10FE37EABAAB05FEC8840C3CD4FB4A3D72D
SHA-512:	E2A3AFF33C2EB6731B5073CAE39F06B4A8052FE8C3511266F4697DC49310A43EC019B36EEF46C74CFEB0796A90B046B4636852631462C3BBA5A2FC8676B3855B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Count Section" Name="Section" GUID="{BA052E71-A83B-4735-BD55-D47C6690558C}">.. <Properties>.. <Property Class="Text" GUID="{1E30657C-C707-45DB-82DD-C3E67D28F405}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Section</Property>.. <Property Class="Text" GUID="{2989B911-416A-4F42-A29C-4393C54B163F}" Name="Fill Type" input="True" group="Item" OrderIndex="1" DecimalPlaces="2" SimpleList="Solid..Hatch Pattern..Texture" List="cmbList" PluginToExecute="cmbList">[..]</Property>.. <Property Class="Type" GUID="{C435FEB9-8ECD-4BAE-A06C-629B489CEC6B}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Count Section</Property>.. <Property Class="Text" GUID="{1F290735-DCE9-4F30-AE7E-4D1B66DA3946}" Name="Page" group="Item" OrderIndex="3" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[[PageGUID]\Name]</Property>.. <Property Class="Text" GUID="{34A7C5D

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Wall Mounted Urinal\is-9CLIT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (435), with CRLF line terminators
Category:	dropped
Size (bytes):	47216
Entropy (8bit):	5.2806167308518175
Encrypted:	false
SSDEEP:	384:sdLnF94HmdOcIWs/eJ4S1mv8BCGei/rFruiU:QF9VIqBCGei/rK
MD5:	BFA3AA764E2D2D7119DBE000C75AC674
SHA1:	CE11DBE16E6BAB535FDB4A0FFA8CC9029F4630E6
SHA-256:	25C1BDCD937C2AA8C404526B83C15B04C4037531CC9FDD5719F1124EAF8F2BDA
SHA-512:	D6771C9969F89E64D2B69D5E6A1C55DAABBC6F36D047AF278986D8F28EBA8A3826167CE701C2A4F998A0648CEAE0FF544F09DD41033ACFA8395799D761493FF5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Count" Name="Wall Mounted Urinal" GUID="{F9C24DF1-2030-41B9-B2D3-654FDCF2C797}">.. <Properties>.. <Property Class="Number" GUID="{084A38A1-CBEA-4965-BE5B-BE9B4D1989BC}" Name="Qty" inputunits="EA" group="Estimating" OrderIndex="0" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Takeoff]</Property>.. <Property Class="Number" GUID="{2FBF8A8E-5CA9-47A8-94B4-D53D77E40C07}" Name="Cost Each" units="[!CU]" group="Estimating" OrderIndex="23" DecimalPlaces="2" List="cmbList"/>.. <Property Class="Number" GUID="{15EE443D-FC62-45E6-A7E9-F9630B268FD9}" Name="Markup %" units="%" group="Estimating" OrderIndex="24" DecimalPlaces="2" List="cmbList"/>.. <Property Class="Text" GUID="{7979409D-8238-41EF-8DA8-ED7C775E1B7E}" Name="Cost Type" group="Estimating" OrderIndex="25" DecimalPlaces="2" SimpleList="Material..Labor..Equipment..Subcontract..Other" List="cmbList"/>.. <Property Class="Text" GUID="{90AC8290-E25B-4F26-BEEF-57B0

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Windows\Section\is-QLDOV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (657), with CRLF line terminators
Category:	dropped
Size (bytes):	5257
Entropy (8bit):	5.580467445388952
Encrypted:	false
SSDEEP:	96:smK7SgUpX8Ok6w5gdpIRIVK6IvIm6L8Ogg7gWBX2MCO:spwpIRIVK6IvImEngcb
MD5:	F1C05FDF864458E748BCCD370C15C31C
SHA1:	25D51B26FE227229E84E54A88CDEF5DB61F19D0D
SHA-256:	017395A30F566941BA999F2F90B49DF6A9C21EAD497D155BE5C3BE34F2D7F559
SHA-512:	A56F0C788849E664CA844BDDA308AA8F681ABA14FEAD488BCDF596CA507F019753203BF45DB59DF262A80053EE5041ED21B0BC7E077A76E00AA259F58E15FC31
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Count Section" Name="Section" GUID="{D0B2B448-5FCA-465F-8BEA-7592D44146D8}">.. <Properties>.. <Property Class="Text" GUID="{A5820E6A-ECF6-486D-94B6-1046D797CE74}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Section</Property>.. <Property Class="Text" GUID="{517AE7E0-20F7-4BF2-A3CC-FE4CE308D82C}" Name="Fill Type" input="True" group="Item" OrderIndex="1" DecimalPlaces="2" SimpleList="Solid..Hatch Pattern..Texture" List="cmbList" PluginToExecute="cmbList">[..]</Property>.. <Property Class="Type" GUID="{B84B6B79-941A-4C15-A53C-35E9CDA96204}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Count Section</Property>.. <Property Class="Text" GUID="{3A31CEAA-2DC4-45A5-BD1C-C3ADB7FFFD0B}" Name="Page" group="Item" OrderIndex="3" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[[PageGUID]\Name]</Property>.. <Property Class="Text" GUID="{910FCB8

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Windows\is-1GIMG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (435), with CRLF line terminators
Category:	dropped
Size (bytes):	47729
Entropy (8bit):	5.28955779074215
Encrypted:	false
SSDEEP:	384:sj/gF9PSgtGJe8O0Wx/J/EemP6+3evItVAruvP:WIF9uJeZuev2VL
MD5:	246EC4A576045F2D729D16BBDAFFC9F1
SHA1:	BD0BF39A33298668AEBA453F64EDA0A06F45E330
SHA-256:	99D84727801B88BD1437BA4A8B8AB85B3E3FB433D1C779426A69AEC16E457D36
SHA-512:	C772A572518FA5F46D649038035175AAE5F2FB9F2F7C013F1535058C46D01B78AB3A2E557046D7DF0DF8551C71C1C4C56B6649DCD82436C1B7ED08ABB29A09DE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Count" Name="Windows" GUID="{AB705CE0-52A0-4410-ACDC-97036D9AD2B1}">.. <Properties>.. <Property Class="Number" GUID="{AA9A840C-C118-40A2-8528-F103460A9DB0}" Name="Qty" inputunits="EA" group="Estimating" OrderIndex="0" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Takeoff]</Property>.. <Property Class="Number" GUID="{BA271370-A7E8-48A2-9E94-595C658173E6}" Name="Cost Each" units="[!CU]" group="Estimating" OrderIndex="23" DecimalPlaces="2" List="cmbList"/>.. <Property Class="Number" GUID="{C44C94B7-4456-4D73-9CD4-797F0C53B5DF}" Name="Markup %" units="%" group="Estimating" OrderIndex="24" DecimalPlaces="2" List="cmbList"/>.. <Property Class="Text" GUID="{9628CDAB-990B-4A0B-A1BB-B48512DE7707}" Name="Cost Type" group="Estimating" OrderIndex="25" DecimalPlaces="2" SimpleList="Material..Labor..Equipment..Subcontract..Other" List="cmbList"/>.. <Property Class="Text" GUID="{D56DD07C-238A-458A-877D-D77D8C93611A}" N

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Women's Restroom - 1\1%2F2%22 Drywall (Priced\is-BMCJR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	5.6190645440683875
Encrypted:	false
SSDEEP:	192:MxojOLoPF73Ou2b8lHvZlfcAXbDoxLMFA+Db22T7Izj:UoCoPFLOuLPbEubcJo322T7Izj
MD5:	4E06BC9FBC129147D856F0624ECE0197
SHA1:	937D9714FA00F1E0ACA31580B476D14E8B159DEF
SHA-256:	3236B79CA47082D294F291FBF3AB1EFAD40D7AA0B2561EBE2878D6EE72039703
SHA-512:	A04A742738B136A295E407DB823A9DA18B532B52B5346EC002BE8B3FBC6115B83FFB67F98D9DFC1CCF98F7A7CE8BF9920E974CA5F7D61712B10E882A9DFCB117
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="1/2" Drywall (Priced per EA)" GUID="{9DAF3754-E6BD-47C2-9188-69B19BB8F1D1}">.. <Properties>.. <Property Class="Type" GUID="{C83FD09A-2D72-4B95-9044-FD470CFC2833}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Material</Property>.. <Property Class="Text" GUID="{A2AFB751-C6CE-41A4-A5CB-618AE6ECEB4D}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="56" DecimalPlaces="2">1/2" Drywall (Priced per EA)</Property>.. <Property Class="Text" GUID="{E900FBED-7575-473A-B3ED-382BDB00B43E}" Name="Description" group="Item" OrderIndex="57" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList" ToolHint="Type in a Description of this item"/>.. <Property Class="Text" GUID="{A97BF66F-74DF-4D10-90FC-8C4583377F64}" Name="Item #" group="Item" OrderIndex="58" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{AA44DD82-B32F-4AF7-A954-79

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Women's Restroom - 1\Drywall Fasteners (P\is-HDS9F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	9536
Entropy (8bit):	5.60524822898573
Encrypted:	false
SSDEEP:	192:3L9ywfJjv/ApmD4b+catqDZNSpMcA+D+020Jfj:38whTApmDsatqa9f2Afj
MD5:	B81EE31C06ACDE92A6433862C893CCA1
SHA1:	A40B960FA37697C173341BD4D8B39E7501022908
SHA-256:	45FA9942C9640E94EEDA4C95A6481FC7E500849C5BBACCC20CDB1BC99006108B
SHA-512:	74F54AA5DEE2B90AEBEBD1779A69C78CE54316321F117B3A8FFAB4F91F836314182DD54CAC0FC414BDB65E7AE7E8E1C11C86153F56B39D30334469CF602AD585
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Drywall Fasteners (Priced per EA)" GUID="{157A8176-92D3-4E1B-AA3D-F2869534759C}">.. <Properties>.. <Property Class="Type" GUID="{292BF6B2-5AD9-41F2-AA28-C84E04376EFD}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Material</Property>.. <Property Class="Text" GUID="{D339EFF6-42D4-463E-A8B6-D583802EB58F}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="56" DecimalPlaces="2">Drywall Fasteners (Priced per EA)</Property>.. <Property Class="Text" GUID="{D0C9AF61-CD6A-43CF-9F0B-023B9D73A2B1}" Name="Description" input="True" group="Item" OrderIndex="57" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList" ToolHint="Type in a Description of this item"/>.. <Property Class="Text" GUID="{71F5DA77-9DDE-4BCD-AF82-127FBD84E537}" Name="Item #" group="Item" OrderIndex="58" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{CF752C29-EEFC

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Women's Restroom - 1\Finish Labor (Priced\is-I9BMQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (378), with CRLF line terminators
Category:	dropped
Size (bytes):	9234
Entropy (8bit):	5.603269734673166
Encrypted:	false
SSDEEP:	192:HsKFj0+56lYe7b1cM+4ciKD5zRjA+DO82GeQj:HsID6lYei1viKhRNl2VQj
MD5:	EF712F6B70BEEDB303961BB3C6423B51
SHA1:	F771603F2C165C7A180C7E66A378B8B06F5D7546
SHA-256:	5C4AB6784C12C508D20083B5FFB5F7D319FAEE884BFD02EE0AFEBCE2AFD5B124
SHA-512:	5ECA31684B6A33F24910F060A58819ED513BA0FD1329C9A1612D110F4FAE57556216279DFF1999F57EB4F0304659AA323E020C990F8A940B26F631076D7CF4D7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Finish Labor (Priced per SQ FT)" GUID="{58DC078D-CB53-4E0F-AC57-290438E52F17}">.. <Properties>.. <Property Class="Type" GUID="{6331C018-EDC8-421E-974A-89DCABB16F71}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="2">Labor</Property>.. <Property Class="Text" GUID="{1212C037-062A-4B1C-932F-983183FEFF80}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="56" DecimalPlaces="2">Finish Labor (Priced per SQ FT)</Property>.. <Property Class="Text" GUID="{D72001F2-8B6E-4E85-B1DF-A2C7B70CB68C}" Name="Description" input="True" group="Item" OrderIndex="57" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList" ToolHint="Type in a Description of this item"/>.. <Property Class="Text" GUID="{6C576A89-43E4-4D02-94FB-6FC3802C97CD}" Name="Item #" group="Item" OrderIndex="58" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{A2A8FFEA-12C5-46A9-B

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Women's Restroom - 1\Hanging Labor (Price\is-1Q5VP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (378), with CRLF line terminators
Category:	dropped
Size (bytes):	9240
Entropy (8bit):	5.60841773867267
Encrypted:	false
SSDEEP:	96:b7Va3Ldyrj0d4tcV9GZChLZn3Q0tdoLMsDJ6m0UonXOD08Z2IWMSAncwcvtDnj:d7j0VAZChLZnZbydDJUUA+DJ2VMjcbDj
MD5:	7581D0525EEF0A69E8EC4D3A20592842
SHA1:	79DF9A044BD7B858B165C4F14B0AF68B1BAB909E
SHA-256:	99700ACB4AA8416CCF1D09168BBCC0C7ECDFC4B8EF7B68EEABC3637B4B77DE61
SHA-512:	03EBE55E8EEA858DA2DD382E95CB76F887FA4881BB8B79BB3A5A7142BE90C6F83E9C83530ACA45D2EF6A6E45C4D7718FF0342A95C386BE004C8DCC028BA562F3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Hanging Labor (Priced per SQ FT)" GUID="{DCD4EF52-E6F9-4096-BB60-F7323E055601}">.. <Properties>.. <Property Class="Type" GUID="{B3D9A9CC-6531-405E-93AB-58B5E79F934D}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="2">Labor</Property>.. <Property Class="Text" GUID="{6D91A07C-C182-4C48-891A-B5F0BFEB1DF9}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="56" DecimalPlaces="2">Hanging Labor (Priced per SQ FT)</Property>.. <Property Class="Text" GUID="{453967E5-49B5-43A2-A0B3-98DB6653211A}" Name="Description" input="True" group="Item" OrderIndex="57" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList" ToolHint="Type in a Description of this item"/>.. <Property Class="Text" GUID="{2B07BE68-2EBA-4B3E-8A3F-AF9F91F78D91}" Name="Item #" group="Item" OrderIndex="58" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{446D39D3-299D-4231

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Women's Restroom - 1\Joint Compound (Pric\is-V1JBR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	9650
Entropy (8bit):	5.606669388039679
Encrypted:	false
SSDEEP:	192:Vfijv0mufvkiaCbwzcLdCMDVLVOMeA+DN2tpij:Fi4mufvkiaWLdrhJOXZ2Xij
MD5:	3ED0BF0B543811596EE096858EB64784
SHA1:	CA7E1012FC181B23311B1427B62ECBDFA8FD0E75
SHA-256:	5DF250DE4FEAF338BBE245506EC4DDADED1348E6315B9331EACE2C88B7BC7F95
SHA-512:	D7A0730E864E66566812A414EF6465E5C66ACA6E957AFA59D32E9D2650F7962781D56FF12EBFE8D7115E061557A570CA9D0B7B38B92BFF6F1C3AB1357F6235B1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Joint Compound (Priced per EA)" GUID="{8C67051C-0B2D-4634-ABDD-3356C99097E3}">.. <Properties>.. <Property Class="Type" GUID="{C9B73BC2-7080-4481-A913-BFF509D89B1E}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Material</Property>.. <Property Class="Text" GUID="{4695C30E-440F-4D90-A4BA-2B3C6940732B}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="56" DecimalPlaces="2">Joint Compound (Priced per EA)</Property>.. <Property Class="Text" GUID="{D08E75C2-C7F6-46B8-953A-960D11FD9667}" Name="Description" input="True" group="Item" OrderIndex="57" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList" ToolHint="Type in a Description of this item"/>.. <Property Class="Text" GUID="{2810D767-6A0E-40EB-A6C4-A73CEF6F7D74}" Name="Item #" group="Item" OrderIndex="58" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{B8D4CAC0-B42E-43AB-

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Women's Restroom - 1\Joint Tape (Priced p\is-SEG4B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	9517
Entropy (8bit):	5.606929446314661
Encrypted:	false
SSDEEP:	192:K3jvxMu67EJh8bKTcU6BUaD/wsMUA+DF2phHj:K3Su6IJhEFBUaddZ2phHj
MD5:	D54505C3BDC16E1230D33FA3255FF29A
SHA1:	0798BF6DAE6456292744CDC9BF431BA282F4393E
SHA-256:	DA7A1C64B22907FDD3A6878337E994350ADD05B04C9D358EEB6F6E36136AA154
SHA-512:	CD3FCA6C59220B9FAC24BD2979066F4F63BF43CD96625285FBCD30BE1897F3805AF19B63768B311F861330301BEEAAE743B605EC689230C234DDFED2B69268BB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Joint Tape (Priced per EA)" GUID="{6314B8CB-609F-42F4-8118-8DA807FEF6F7}">.. <Properties>.. <Property Class="Type" GUID="{BFFB24E4-083B-4136-8B7F-058090073405}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Material</Property>.. <Property Class="Text" GUID="{E14008E0-146D-4D0B-8227-470A2E414918}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="56" DecimalPlaces="2">Joint Tape (Priced per EA)</Property>.. <Property Class="Text" GUID="{6AD315FF-6753-49FC-9327-04545C349F8A}" Name="Description" input="True" group="Item" OrderIndex="57" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList" ToolHint="Type in a Description of this item"/>.. <Property Class="Text" GUID="{A900AFE8-F90D-4BFF-8BCD-31B60A50DB43}" Name="Item #" group="Item" OrderIndex="58" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{9F1A0909-EB63-4D05-A1B6-F26

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Women's Restroom - 1\Section\Label\is-32UL8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (869), with CRLF line terminators
Category:	dropped
Size (bytes):	8423
Entropy (8bit):	5.5426945822690445
Encrypted:	false
SSDEEP:	96:8cK5nqVk24LUp5ZEIkJINv3bp7HAZiIQKR4hluGxWxY82DNjZn:JK5lBU2KguhwxY82DNjh
MD5:	7525FC149AD48C3E222AA94E2239A16C
SHA1:	73A2D6F9860B3BD917670437F8AAD84208B2E618
SHA-256:	3C00CA341D325CA218EB81CE3CCA481E886FE17A78300C06FD47B1AE3CB8AFB9
SHA-512:	31D902D089F6D311FC44D2AF32478B3839C56AC765473BF6516251A78B8BFF418596D26AED6F19F9EFBA2CD156AD27BDFC2DF493C0EB43E10AC57E286BEC0009
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Note" Name="Label" GUID="{C8F7B3E5-449A-4AA4-BCCD-081C394B1CCD}">.. <Properties>.. <Property Class="Text" GUID="{D1669266-94F2-4251-80E5-FE12369B447E}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Label</Property>.. <Property Class="Type" GUID="{538F7903-7ADA-45E0-93D3-F473A6AA11E9}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Area Label</Property>.. <Property Class="Memo" GUID="{337DBC23-E8D8-4A8D-A9F6-AE97479874A7}" Name="Text" input="True" group="Item" OrderIndex="2" DecimalPlaces="" List="cmbList">[..\..\Name]..[..\Takeoff] [..\..\!Units('Takeoff')]</Property>.. <Property Class="Text" GUID="{9576E17B-5B61-498A-87F4-83FE77ABDCBD}" Name="Page" group="Item" OrderIndex="3" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[[PageGUID]\Name]</Property>.. <Property Class="CheckBox" GUID="{2660EFE9-3F33-4C05-8402-800EB83AF2DE}" Name="Auto

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Women's Restroom - 1\Section\is-1Q9C4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (858), with CRLF line terminators
Category:	dropped
Size (bytes):	5455
Entropy (8bit):	5.579005550568886
Encrypted:	false
SSDEEP:	96:gASgE5Qo1s4jk8lBuS/Q/b1xmlHgMg8Xg/JO:lvm/BuUQ/bnWHbn
MD5:	C411C8270BC5C660E03DFF52435F9DD4
SHA1:	C07E5DF3D55998CD194593ADD047F4681AADD1A8
SHA-256:	4A90A4AA43D36EFE858E19FDEB207E7F048C0DBD12945B0DDC853A7025270CFA
SHA-512:	A614E400F4B0C938E1BD2962656F396BEB894ECEB96B610062E46B5275A4730D947AA8F5BCEF14664D6DF95ACA2B2CAE27CAD68C21C4DCFA0114C9AA965853FB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Area Section" Name="Section" GUID="{521BD8A4-F374-4F53-887A-99D767B808C1}">.. <Properties>.. <Property Class="Text" GUID="{AB8AD0FD-4023-4421-AEB1-4827E74A8584}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Section</Property>.. <Property Class="Text" GUID="{15097F82-2E6D-4AE2-B96F-25996ECB52BA}" Name="Fill Type" input="True" group="Item" OrderIndex="1" DecimalPlaces="2" SimpleList="Solid..Hatch Pattern..Texture" List="cmbList" PluginToExecute="cmbList">[..]</Property>.. <Property Class="Type" GUID="{7B2154DC-9196-4920-BCDD-4DD31A62B13F}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Area Section</Property>.. <Property Class="Text" GUID="{18F77377-4016-43F7-8A25-90654CA33F01}" Name="Page" group="Item" OrderIndex="3" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[[PageGUID]\Name]</Property>.. <Property Class="Text" GUID="{F16BA049-

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\Takeoff\Women's Restroom - 1\is-6GAFJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (416), with CRLF line terminators
Category:	dropped
Size (bytes):	13247
Entropy (8bit):	5.542289532301373
Encrypted:	false
SSDEEP:	192:ebvKij9PZmbF1jdk0yPGXEEG89XJb6idA+ykPl+DOlNtMt7g9:ebvZxPZmbNyPkEOABvDKlbMt89
MD5:	51638DF1410D366406F4A0E74E1818D0
SHA1:	B69E6462CEE433C58DBB5ADC81802B620FA1EA49
SHA-256:	E49C7C2733CF08658DA73917F9D8C9AB131E82740ADB89D81C36E71477E65798
SHA-512:	6B6D2E590F31228C086EBD61EECDB571232F00C512AFA210949D4C70B67B640A33B89D26DB7E8B9BAF34224E3071BCC32C31DA1F96628370926FC877435789D2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Area" Name="Women's Restroom - 106" GUID="{8A594A8F-7C94-46F0-A5EF-F59085C3ADE3}">.. <Properties>.. <Property Class="Type" GUID="{6D907C3C-3C3E-4927-AE57-23BD42155135}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="2">Area</Property>.. <Property Class="Text" GUID="{AF987A88-3F44-43E2-9454-40E9621D2B5D}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="8" DecimalPlaces="2">Women's Restroom - 106</Property>.. <Property Class="Text" GUID="{F10D958B-98F4-4293-9104-CED20E09F402}" Name="Description" input="True" group="Item" OrderIndex="11" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList" ToolHint="Type in a Description of this item"/>.. <Property Class="Text" GUID="{23C7413B-DE1E-4A71-811A-4318B298EFCE}" Name="Item #" group="Item" OrderIndex="28" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{934DCB97-D3D2-4BF

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\Sample Project\is-U4K1P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1988
Entropy (8bit):	5.442751870561866
Encrypted:	false
SSDEEP:	24:2dFD3BNyw3JX2AIP/CApW/H/gAWmxn3GkVMOGijo7YxfnO881KOF1OcGcfY4f2Wv:ctBNygJKsL9k1haHwtaW3QSM8T71
MD5:	CA6A51417031FA51EF411E24B7D7558C
SHA1:	84E255B6D39059AA79F01B10F00DDB3AEBC285BF
SHA-256:	C5D92C10AF3B12BCD200E1A43AA6AEAAC3578E29D45BC2EB1129DE67ED7C69E7
SHA-512:	39E751D3E5D313C5A6D288014BB95EC61206D7BDD54CB1F1548CC838AD29E42A142615BD6813EFD49F92790A5D39A62C9798F55D5B3D408FC58B589FE70B2780
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Sample Project" GUID="{48E760CD-DBAC-48CE-8711-C00AF5BA0383}">.. <Properties>.. <Property Class="Text" GUID="{771047B9-BC70-4621-9884-BEEB26193064}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Sample Project</Property>.. <Property Class="Type" GUID="{55AF6F30-2132-4DB6-88FF-8678223F3172}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Job</Property>.. <Property Class="Text" GUID="{4702899B-CB83-4763-8125-5BBA6A589224}" Name="Created By" inheritaction="Flatten" group="Audit Trail" OrderIndex="5" DecimalPlaces="" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{C59ABAA5-F9E7-4984-A391-1FE0DA16ACF1}" Name="Time Stamp" inheritaction="Flatten" group="Audit Trail" OrderIndex="6" DecimalPlaces="" List="cmbList" PluginToExecute="cmbList">4/5/21 10:57:47 PM</Property>.. <Property Class="Number" GUID="{EF6E2728-606

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Jobs\is-1PT52.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (677), with CRLF line terminators
Category:	dropped
Size (bytes):	2155
Entropy (8bit):	5.022551951332305
Encrypted:	false
SSDEEP:	48:cVBJr2MZMd2uf0MdOSaNHmZddu0MdOSaNnZdwR0MdOSaNg:k/r2UMd2uf0MdOUZddu0MdOZZdwR0Mdj
MD5:	E7FF22121ACEE08E1EF49185D8020748
SHA1:	6271CC964AACD54107026CBB32230B17E06ACBF7
SHA-256:	FD5919F702895EFA309E8FE18517E6850F52465FD5C72878D08FB0DEA3DEABEA
SHA-512:	1D48C0F4232904D841F2D0669C16ED988101ACEC522213515B8A6E94EA68E42EA938125827E7326CE8244B7C690F6DE275F7A0EA65C6E71B0F406E76D6F780B2
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Jobs">.. <Properties>.. <Property Class="Text" GUID="{78775AD0-0E62-4C37-996B-91C89AD7BCFC}" Name="Name" inheritaction="" inherited="False" input="True" inputorder="0" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" InputFormSameLine="0" Adjust="" InputFormTab="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" Expression="0">Jobs</Property>.. <Property Class="Type" GUID="{7F719128-CE88-46C6-B74E-4AFB691ADE1E}" Name="Type" inheritaction="" inherited="False" input="False" inputorder="0" locked="False" hidden="False" systemlocked="False" systemhidden="False" requir

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\2x2 Acoustical Ceili\2' T (Priced per EA)\is-V0B7G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (339), with CRLF line terminators
Category:	dropped
Size (bytes):	5122
Entropy (8bit):	5.585304150470877
Encrypted:	false
SSDEEP:	96:egAO7+mjC7xDpypl5nktoQ0tdKNsaLiYIiqGRW1E9/bbpDdn0:eAdjSpylkSbUswiYv0I/bbb0
MD5:	6AF3FA5658FB925DE220BE89FD5A7591
SHA1:	CD6FCDB8AAC5F119F3F8B84F34586C81F9EFAAD1
SHA-256:	C615B469677A4D34D947C04D181D23AA44CB7187244190DCC9D20BB029AA068F
SHA-512:	37C7AD5F6C639746FC96A1C4B0857395007A208513C35DC3BAB6238BE0DD42C36E2A27A9F4D2EF4DE15FF8132D9CDEE9D04C0A1D97674DE92E69A4E0565AAAAA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="2' T (Priced per EA)" GUID="{92F47896-82C5-4C49-B3CC-D01A74B7D955}">.. <Properties>.. <Property Class="Text" GUID="{2209B70C-8378-496B-A40E-DBAFA8FFCD76}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{92F47896-82C5-4C49-B3CC-D01A74B7D955}</Property>.. <Property Class="Number" GUID="{4CC06170-1399-4E9D-8C6E-3CD0B0D1E4FC}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Memo" GUID="{C79240D9-D4AF-44AF-821A-16933ACBE0C4}" Name="Form Layout" systemhidden="True" OrderIndex="8" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="OC Spacing" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False" SameLi

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\2x2 Acoustical Ceili\4' T (Priced per EA)\is-2KJ4N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (339), with CRLF line terminators
Category:	dropped
Size (bytes):	4851
Entropy (8bit):	5.592739454581486
Encrypted:	false
SSDEEP:	96:ZihnCmj1DCkuoQ0tdbYaLXUYCEqiTS1IMHHJdn0:CjhNFbUwEYhTS6MHHv0
MD5:	43B3B1FDF2E2CA9DB9E8C58A0D1D856D
SHA1:	383296FFF15472BE34CF68F9D7BE0E2321508BC6
SHA-256:	9822511A1D32FC527C4D3B3E67E497CA1C1494DBBF158BDB052808207310964F
SHA-512:	93AC686E6FC438861082A81E6BE597A0D9F9E56544F4CCA9075A8D74091EAEB7D63BE357E6765F64C3DB2DF270D45C363698EC07810BFF2CB38C793C5334ADF8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="4' T (Priced per EA)" GUID="{26268600-3AE7-4FDE-B597-AFFD22799D7B}">.. <Properties>.. <Property Class="Text" GUID="{9F18512A-B132-4689-9E16-9E3244977B6E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{26268600-3AE7-4FDE-B597-AFFD22799D7B}</Property>.. <Property Class="Number" GUID="{40B030B9-C512-4383-AE4F-AAF42629849A}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{FCC2C834-F558-4872-B7C9-8CB03293CE8E}" Name="Form Layout" systemhidden="True" OrderIndex="8" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="OC Spacing" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False" SameLi

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\2x2 Acoustical Ceili\ACT Labor (priced pe\is-2CIS2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (378), with CRLF line terminators
Category:	dropped
Size (bytes):	6831
Entropy (8bit):	5.593449586075576
Encrypted:	false
SSDEEP:	96:GlCgcrjywcbHjQ0td7ncXuFLO1aDk8B42IcXvZp4LKgobGInzDOQ+pL:jjyttb7cXuFO1aDk822lBpf1LfD+pL
MD5:	128270F4B3E2C26266BE4A25B19F86F7
SHA1:	A1BB47FE2889B3EAFBAD425310FCBD3DCF4A3C39
SHA-256:	106588EA18EE220CB3F1D7D3B6D8E3EF7F444B26B34A4F980727D32E9BCAA7F8
SHA-512:	260B369C9C737B644060E07D13DFEF74BB43BB4C63679F3A82CC46F34798967ABB5C59C86784E122D35D0A25F60784DB06927EAB0A4150CA51051B68E4C53D70
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="ACT Labor (priced per SQ FT)" GUID="{9773BC26-3661-4877-849B-F423C43B9E7B}">.. <Properties>.. <Property Class="Text" GUID="{4A35B6FE-D388-4EA3-B1DD-3540ECA8117E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{9773BC26-3661-4877-849B-F423C43B9E7B}</Property>.. <Property Class="Number" GUID="{6C3CD566-D4B6-4E60-A784-A9FF1EC09DC2}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">6</Property>.. <Property Class="Memo" GUID="{ED6BE003-5B12-4641-B921-3B0832228783}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Waste %" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False" Sam

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\2x2 Acoustical Ceili\[Length]' Mains (pri\is-MFIAV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (339), with CRLF line terminators
Category:	dropped
Size (bytes):	4861
Entropy (8bit):	5.597578048378528
Encrypted:	false
SSDEEP:	96:xvOzCmjgrrDpkwJoQ0tdtaLv1Ytq01DtPOdn0:q1jImwGbtwtYFttP60
MD5:	33400978EFDF5C4D68D8DC7007CD8D58
SHA1:	3E20CB9C2BE0E17FE5DBF231FC76EF85F266E2DA
SHA-256:	AAB6B83F61D7F20A4964057137EC7F50D15919ED6778C0FE708C399DFBC5B30A
SHA-512:	A0FEC2B8773417E6B3685C6702D8DC0C1EF74D321CB62D16DFEF29BDCDF6076C6A785120D3F4BE642C6900C5CFBEFAC036B3DDFCE2C967A543BCEAABB83F0CC6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="[Length]' Mains (priced EA)" GUID="{9BC30A72-CB13-4A65-926A-D713D67267C8}">.. <Properties>.. <Property Class="Text" GUID="{E0B5483A-A44D-46C9-B76C-43715A553B19}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{9BC30A72-CB13-4A65-926A-D713D67267C8}</Property>.. <Property Class="Number" GUID="{F95F9632-15A2-4F2B-BE45-F330421F6A2A}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{FD7455F5-B763-4922-A5A3-0761D897852D}" Name="Form Layout" systemhidden="True" OrderIndex="8" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="OC Spacing" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\2x2 Acoustical Ceili\[Length]' Wall Angle\is-4NRON.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (339), with CRLF line terminators
Category:	dropped
Size (bytes):	4310
Entropy (8bit):	5.599827413557211
Encrypted:	false
SSDEEP:	96:L/fWtZ/ZSMOj3odnvk7oQ0tdkaLihCYE0qo1BnM:LihCjUMUbkwihCY/jM
MD5:	C7FD2C376EC4BD8E364B072890716A48
SHA1:	0C568B08BA1CF4A236CCD481B8880DD180E417AE
SHA-256:	3E946BC9E4D4432D72F414BC92152D63B0ACDB2EC3A46FBA12B02872CB5C3C00
SHA-512:	F6EEF0E40BEF8A78DA933E7C460DBF28F1FD7A6CEA65844CC9DDEA342153D4F69951CF9BF04F6F7553FBA63A292140F9D4AF999DB282E269548376B7DFDC1D19
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="[Length]' Wall Angle (priced EA)" GUID="{C49EC6A5-868B-4CF4-9FFC-50866DDC987D}">.. <Properties>.. <Property Class="Text" GUID="{F080B550-3392-473F-9095-EC4AFFE253A1}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{C49EC6A5-868B-4CF4-9FFC-50866DDC987D}</Property>.. <Property Class="Number" GUID="{9348F055-1080-4046-9E8B-8C52E0BF9CC6}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{7FED7B25-2BED-4E93-81E7-758D8C9F94DC}" Name="Form Layout" systemhidden="True" OrderIndex="8" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Length" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False&quo

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\2x2 Acoustical Ceili\[Length]' [Gauge] Ha\is-0BFDO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (339), with CRLF line terminators
Category:	dropped
Size (bytes):	5315
Entropy (8bit):	5.609598334760931
Encrypted:	false
SSDEEP:	96:VEr17wc11jTKDzdn2vkgoQ0tdEaLIzYkqY1MBNe:aZjsx2MrbEw6YWoNe
MD5:	43C7E52E13587B7C4DEA37B756D8EB61
SHA1:	7C12A3AE22C3BC7287D26B7CC2C25E4EE7D059E6
SHA-256:	2ABBEE6629F2AF7B8A7D960A6193259F4613D9377CDFDFAB5AF2927682A2C584
SHA-512:	27B1681227FBB5355EE9FDA209E65FF38FCA8AE79970C923091E7E9DB209B4FCE9F159EAFD4A2764060031E737180F9712F823263631A18A6626BB65C09F9E03
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="[Length]' [Gauge] Hanger Wire (priced EA)" GUID="{CFBE151D-65E2-48DC-A838-86999C6020CA}">.. <Properties>.. <Property Class="Text" GUID="{073DE502-36DD-41F3-B60E-2811578CB217}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{CFBE151D-65E2-48DC-A838-86999C6020CA}</Property>.. <Property Class="Number" GUID="{9F791CA5-DAF1-4822-BEF9-6C39D78C26DA}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">5</Property>.. <Property Class="Memo" GUID="{D77D0414-E4E3-4B49-A3CA-2D31D9B083C2}" Name="Form Layout" systemhidden="True" OrderIndex="8" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Gauge" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="Fa

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\2x2 Acoustical Ceili\[Width]' W x [Length\is-8OG87.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	7574
Entropy (8bit):	5.603477685875559
Encrypted:	false
SSDEEP:	96:LthmehojyCPq5PQ0tdnHVB1nckcFLckdDh8Bli2U+ppx3P3C7nvBebOL:EjJqnbnHblckcFckdDh8Hi2tpu7vwbOL
MD5:	6E9170D978C22117CF24686A360244E7
SHA1:	C0E59C6FE6AB69D97D97C230A5CC20BC4C128B4C
SHA-256:	6507434B58C48C954FBAC8E3DA1078CAAEDC573B10CA411D05E0DAA23D8CEA40
SHA-512:	5C5BBB0D5BAEDDF3775F4BA88E9003917B38EAE534BAC42E6B0CEBF398CD86951AD2C3F6155D1AA701F5E60571432FF730797F639148ED55802A9A327B9A00CA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="[Width]' W x [Length]' L x [Tile Thickness] Tiles (priced EA)" GUID="{96768E1A-3A21-4DFA-92F3-645608207FC0}">.. <Properties>.. <Property Class="Text" GUID="{7454BACB-DA76-4988-A1CB-164FCC44BCA6}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{96768E1A-3A21-4DFA-92F3-645608207FC0}</Property>.. <Property Class="Number" GUID="{28E7C662-A7F6-4391-A435-215507C64D61}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{9A1D69A7-EF20-4F8F-97F2-B5DE61698E3D}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\2x2 Acoustical Ceili\is-S655N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (28970), with CRLF line terminators
Category:	dropped
Size (bytes):	45217
Entropy (8bit):	6.118709567155341
Encrypted:	false
SSDEEP:	768:myCOCK89J/MpkrgbZfR8I7DiQf5lHjilVgBWdqwMw9t6gcqbnz5DnR:QGyI7uQxFvAQat65qbn1DnR
MD5:	8B4476FAB088EDDD4180B6C366ADDB28
SHA1:	4B3E823F5F6B8B93048A536CE62A92FA56920630
SHA-256:	1A30E8DAE7EA8DF0E8EC47E40C6382831277BBB0EF2AFBCB319A70F573270926
SHA-512:	C30D095C6843D832944EE6667FE19E815887ED3A5B29C1356D91D674032E6A5F8A3136E8DC02E31C973993F0B08E7ADD0D12B38A413C0C0551016DE8EFC5A2A4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="2x2 Acoustical Ceiling Tile" GUID="{62572B26-A87F-4C1B-859B-34A7BB178890}">.. <Properties>.. <Property Class="Text" GUID="{5AF16B96-04EA-4AED-8E6C-337EFC50BE74}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{62572B26-A87F-4C1B-859B-34A7BB178890}</Property>.. <Property Class="Number" GUID="{E05AB67E-124E-48FD-B4E7-FE6FC03FB7F2}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Image" GUID="{B2D13BB8-B67C-40BC-82B1-CB9FD3209CCA}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="5" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmg

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\CMU Block Wall\#[Rebar Size] Rebar\is-EDOMG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	12260
Entropy (8bit):	5.595695470586874
Encrypted:	false
SSDEEP:	192:85j7GL2zDbqwbpGvk2lHWWEJ7R9d/ReLL2FvnADCI5MicNn5APKnPj:85vu2zDbqKEk2lHtEZR9dwLL2FvADCIy
MD5:	C6F6029359BA93837E02F9B6C0746D2D
SHA1:	EE44FBBEE00196832FC8EE17A47E83620D50B2C0
SHA-256:	65CEF703450B5C8C7BDFC166FA0F319781BB8C5FBE6CBE4440225060891FE109
SHA-512:	9F95BF1A370CAACAA7386287418DEB3A0460EACDA8E781AF2D49C25F44CD6F98641A6DAFA70A42B36B47FC2A14AE7CBC3EAADBC9F9CC893C12A1E37874E6C9AB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="#[Rebar Size] Rebar per [Rebar OC Spacing]" OC spacing (priced per LBS)" GUID="{A12DFEAC-B0DC-4C26-9849-4D3794BD23C3}">.. <Properties>.. <Property Class="Text" GUID="{71460581-60AB-4BBA-9841-9C43680413FA}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{A12DFEAC-B0DC-4C26-9849-4D3794BD23C3}</Property>.. <Property Class="Number" GUID="{53400545-3A9F-4EA8-A911-1584091B06E1}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{FBA1C460-F625-42C8-A1D3-821E6F3B55AA}" Name="Form Layout" systemhidden="True" OrderIndex="11" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Waste %" Order="0" ShowUnits="False" SameLine="True" Tab=""/>.. <Item Name="Cost Each" Ord

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\CMU Block Wall\Block Labor (priced\is-K1C5M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (378), with CRLF line terminators
Category:	dropped
Size (bytes):	9185
Entropy (8bit):	5.600970527778806
Encrypted:	false
SSDEEP:	192:wjdHc3S6nGGb5cXMFdKgNe2R0uupd77TnNIIj:wxHc3S6nG3XMFLe2R0u2d77TnyIj
MD5:	8BC3D06152548D9F72F53054AAA8DB20
SHA1:	E3C5A48B6AE7667797E3B32CCE07E962280E0319
SHA-256:	13165C984BD6A85242A5D041379AC8E38DBA18C88DC2723FD5F098B2198BF12E
SHA-512:	08388B8188063C06B42861EF96474A6076E785F53AA4E59C280D8D0A42815BB502C77AEFE85B12E0C40DE8E29CB47ACEDE1DE79DD4C92F7E5FB938450BCD8A14
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Block Labor (priced per HR)" GUID="{6A2F0869-19FC-4DFC-97EA-70C620D7BEA0}">.. <Properties>.. <Property Class="Text" GUID="{18AE1FED-ED2F-4D93-8328-435912C910FC}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{6A2F0869-19FC-4DFC-97EA-70C620D7BEA0}</Property>.. <Property Class="Number" GUID="{CE47A4B8-D71C-4140-B073-2AA9B691F300}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Memo" GUID="{49DDD506-2760-4A4A-BF5A-EFD10AD1A559}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Waste %" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False" Same

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\CMU Block Wall\Block Mortar (priced\is-QISEQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (379), with CRLF line terminators
Category:	dropped
Size (bytes):	9740
Entropy (8bit):	5.602375642962023
Encrypted:	false
SSDEEP:	192:anqjcyxEPEWMSLR/VbZoOQFyDR9qT2QHylMgdDHM/pVkRaj:3QzMSLR/HoOQFyFI2QHylMgdDmUaj
MD5:	8CDF6B1BC41485314B1D68EBAD2DB122
SHA1:	EE6DFA965BD0C0FDA2BF11FDE5B1A80AC03B2D22
SHA-256:	9018CE3A4D2A3DAF4E0931A473E874745B6A508B384922556DB0EAC6087529AF
SHA-512:	B304E2CF788A3A6F8BE5017A3E654F278011135069293F59640698B4E4121513E834503A467383585827616111328C8FFD1BFC8C0559B10C2C2C3873984C57C8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Block Mortar (priced per Bag)" GUID="{22117C2D-44ED-4AA4-9A50-4AE5EC7E1457}">.. <Properties>.. <Property Class="Text" GUID="{7FB8F4B6-C8F6-467A-9697-C71D54231029}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{22117C2D-44ED-4AA4-9A50-4AE5EC7E1457}</Property>.. <Property Class="Number" GUID="{960A21AB-277A-4002-8559-75D4DF1F2C18}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{0747D6B7-4947-4488-87B1-B9271146A031}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False&

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\CMU Block Wall\Brick Sand (priced p\is-FT0EO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (379), with CRLF line terminators
Category:	dropped
Size (bytes):	9979
Entropy (8bit):	5.60822390230722
Encrypted:	false
SSDEEP:	192:uHjpfSNljsMWr0bsjqOcFrvvDnva2CPHcmpHhJFpTH6Aj:uHNejsNraOcFrn22CP8mpHhJnTaAj
MD5:	5662B6115803B8206F9029498C0D28C4
SHA1:	BB857D13531B8D398D88B537FBDB1322827029C2
SHA-256:	27FDB6BFFA40AF217033C994030FB1F52D485E737F55DA2CA6D84A9352821AFC
SHA-512:	715AC2C554CA85A6ACA45EA69CE8BB826B25B7E48E869CC3BFE92C2797F233E95AB5D3021A69BA3FBFD66622FA749AC576E40D7D3461575116961AF22E5AEADE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Brick Sand (priced per TON)" GUID="{6FF0A388-FE9C-4846-815F-245CBD757921}">.. <Properties>.. <Property Class="Text" GUID="{471D2237-E71C-4A9F-87E8-C0DD3BD27A03}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{6FF0A388-FE9C-4846-815F-245CBD757921}</Property>.. <Property Class="Number" GUID="{FCC5294E-CAFB-4BBA-9C78-39A13D3E5345}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{E389B7C7-FA4F-4FD7-981D-B4D095461717}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False&qu

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\CMU Block Wall\CMU Block (Priced pe\is-A6P9K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (381), with CRLF line terminators
Category:	dropped
Size (bytes):	10177
Entropy (8bit):	5.615813354878784
Encrypted:	false
SSDEEP:	192:FN4gjluqmtjQ7hnXrTT2bmlHWlhYlFrDfrbI22p+kGBj:F8qucJXHbwhYlFrjI2O+k2j
MD5:	717E6FF8D728A6E8838A8863F5F8391C
SHA1:	6BD13018F10A08B5F10FF9C7DC7BA99366723EAF
SHA-256:	B0C5ADA3352BF6E37C03C9005BFDBDD855365A9B4BBE867D7A2428D29C0F1079
SHA-512:	85565958BB129FBA6182A26AC2FB9C0414B9A5E4458AC21284D79B74DFDBD53B87C2568CAEA764763637449FF6D5BC8DEF7951C92B4CCA512327821083BEFCB3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="CMU Block (Priced per EA)" GUID="{9BACF9A2-7637-4EC5-AFF6-3F3389BEFC85}">.. <Properties>.. <Property Class="Text" GUID="{032E94F8-3999-4E4D-9D0C-CC39F1E0B86F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{9BACF9A2-7637-4EC5-AFF6-3F3389BEFC85}</Property>.. <Property Class="Number" GUID="{0B0CF868-0A70-4A4E-9D5E-88729E01725B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{F0A946D3-CC13-4089-9F85-A585D6C20ABA}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Waste %" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False" SameLi

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\CMU Block Wall\is-E9L2N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (35589), with CRLF line terminators
Category:	dropped
Size (bytes):	57521
Entropy (8bit):	6.1210578924026695
Encrypted:	false
SSDEEP:	1536:hcpYOud/+b+ybFma4Fcj8QQx5dyiiuAdyM9ROfNpiMO:rOu9+qRxO
MD5:	8C6A996518B50958161933289DE9B037
SHA1:	9FBB64BBF257DBF42294E6DA5BA7C55715AD9B87
SHA-256:	ED0C1D1AEBF1D69882913606DBBBEC8D131C0BC143A9BDBBABA3F0BD00083C9A
SHA-512:	D2AFA4FF6D2EDFC8D720460792C18812A4B60234C8E99E5BBC6641F53423D97E9AF99F52B1BD54FC58EBEBDB3FEAFC5B4C8A45C26F3290B16C2E8CA11C9BC98C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Linear" Name="CMU Block Wall" GUID="{942307B5-4F72-4361-96C2-FBE116CC5944}">.. <Properties>.. <Property Class="Text" GUID="{12C72C4D-B950-4CAE-A9BE-8BC43675E3D5}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{942307B5-4F72-4361-96C2-FBE116CC5944}</Property>.. <Property Class="Number" GUID="{6575AFFF-59D1-4C37-B945-13BC091ADF06}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">10</Property>.. <Property Class="Memo" GUID="{CF46AF3A-229C-4B0E-9911-1D1AD8389EB0}" Name="Form Layout" systemhidden="True" OrderIndex="12" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine=&quot

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Concrete Footing Ass\#4 Rebar Continuous\is-9PDAK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	12205
Entropy (8bit):	5.587171135020969
Encrypted:	false
SSDEEP:	192:HrjCOC/f4BdFXEbGKusf4XRdEqley3BanWGnGDaZi6MiBGLrZIKTPj:Hr+OC/f4BDjK1f4hdEqEyxanWGGDaZiH
MD5:	FBBEFA72E72B15D33F14AB05F401548A
SHA1:	924DEEE7B27270F6F7DA184E31D502C83AE4A97D
SHA-256:	AE12ED5E074D8245B82B7AF3A66D5D5C9CD81B172C1EFF689C389A41C38D0124
SHA-512:	6D8FBD1F5DEF5B8E800B31EEB13A9D0A73C0136E11C59C36F58AF7BCDAF2A439CCEB5ED1901726E1B3E3D8515D5BC64EA41ADF02D3D85A3448B29BAD58DE5161
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="#4 Rebar Continuous (priced per LBS)" GUID="{56E10233-E275-4B30-BD2F-B1BB657E9D23}">.. <Properties>.. <Property Class="Text" GUID="{978CA317-0BF9-42E6-8488-0D83214D5DED}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{56E10233-E275-4B30-BD2F-B1BB657E9D23}</Property>.. <Property Class="Number" GUID="{2039F0B8-4222-4FFF-A3EB-88C95FF4C4CD}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{6D059645-6F5E-4E19-865C-80E9CE706C66}" Name="Form Layout" systemhidden="True" OrderIndex="11" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Waste %" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False&

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Concrete Footing Ass\#4 Rebar Vertical (p\is-HGPKP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	12684
Entropy (8bit):	5.580138146038236
Encrypted:	false
SSDEEP:	384:jPRCr/xBTyV3vnN6cT1dTF5t+hfVDnJOMi9tEEKMPj:jyxBTyV/nIu1dTF5t+hfVJ09oKj
MD5:	D76AB35969DF223F7DB252A3532C3DE3
SHA1:	8AF317F775DAE30C2FD975431A672969491F9FB6
SHA-256:	BE118F5EDCB2BBEC5CFDB100A6166D6FDB3349708004C128A5F43495B74D4832
SHA-512:	0B9BE5F58DD1577BB98B7663AB13C2B34B93B5CC60EC247F94733C24608EE569F094CDB250B6C83E1133F8DBC7D86BACA92D4032B71C5955F3E4839C1810BED6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="#4 Rebar Vertical (priced per LBS)" GUID="{AC7977A2-A192-4F89-9B6B-91AA564EEDDF}">.. <Properties>.. <Property Class="Text" GUID="{446902DE-A53D-44EC-A902-ECDECF3A8B89}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{AC7977A2-A192-4F89-9B6B-91AA564EEDDF}</Property>.. <Property Class="Number" GUID="{AC7B8E5E-8ED0-47C4-A7D4-944B9E22871C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{22267045-8B3A-4568-84B8-E19D3CD8BFA0}" Name="Form Layout" systemhidden="True" OrderIndex="11" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Waste %" Order="0" ShowUnits="False" SameLine="True" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False&quo

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Concrete Footing Ass\Concrete (priced per\is-E4FEQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (378), with CRLF line terminators
Category:	dropped
Size (bytes):	8504
Entropy (8bit):	5.605545776812685
Encrypted:	false
SSDEEP:	96:aWnBwkGRg4rjuksyh+qgUOqGMD3Q0tdwYnlHVpondMLhO8DI4yyRYq9XCItnj:wjaqgUOqJtbnlHTAd+hhDIjyRYqEItj
MD5:	D1E0D0119ABD2D49BB746DE163FFE512
SHA1:	CE703B0AE56F7252B2536ADC3CE9A7D022E63F5B
SHA-256:	C5F00445449C9F0DD9196CE2567A0C9A9D7BD9EC601D08602D8A0F7845E5575B
SHA-512:	74681A202EA47DCD8176D0A7EA79D515AC357F7BB8AF4E73BD6CD823AB1BC754BEBC151691422CDB7D84D9F5BDADE13A5DD3A3158EF460CFB0ED57332446DD6B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Concrete (priced per CU YD)" GUID="{A08AE180-4F3A-47AF-ADD1-E5EC3380B8FC}">.. <Properties>.. <Property Class="Text" GUID="{4B24782F-9319-4196-9406-853DF4B242EF}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{A08AE180-4F3A-47AF-ADD1-E5EC3380B8FC}</Property>.. <Property Class="Number" GUID="{920B1C4B-BB86-4FA8-B8B5-04868ADA63D6}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{EC3BB0E4-CA26-4002-B1E4-F71B895BEA40}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Waste %" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False" Same

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Concrete Footing Ass\Concrete Labor (pric\is-UFTL6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	8225
Entropy (8bit):	5.599493712892183
Encrypted:	false
SSDEEP:	96:F9egNgrjnOtVuv6pfxpuYLQ0tdbCncQFL5DzudD2I3peotojnj:a/jOqv6pJIY1bbacQF5DzyD2Mp3ijj
MD5:	7442E0576B02AA39B0AF0E0F2343A5B9
SHA1:	CBEC48E8F606C77D40ACB7AEB63E0332FE042513
SHA-256:	6B8B740AE73DA077CFB0DD831086544474934B29A41AAEE38DF01855C8F6A19C
SHA-512:	700DD632A22CA2F35E6B3525D18DB7C8BF59615314438DA446F51771BF3DF346DE9C93B354812535E0728C881C675EE2993D267291779E562BDE019091C05EEA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Concrete Labor (priced per FT)" GUID="{DE5DD8A7-1472-4E93-A7F0-498C063F58B3}">.. <Properties>.. <Property Class="Text" GUID="{238BE3A7-E7C2-470B-BA87-4FA6CCA68FA5}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{DE5DD8A7-1472-4E93-A7F0-498C063F58B3}</Property>.. <Property Class="Number" GUID="{02099BC5-20CB-414C-8A44-0F4CB9C3C72E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{6BF6B14F-E120-4BEA-82A2-BEA0B50F6F3E}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Waste %" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False" S

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Concrete Footing Ass\is-GELO8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (31621), with CRLF line terminators
Category:	dropped
Size (bytes):	53184
Entropy (8bit):	6.116463655480176
Encrypted:	false
SSDEEP:	1536:92GRiLJBA87T4WRst1JucBYVzIiowWOAfQCybiDk7g4:WcBafowy2Z
MD5:	0AF0CCFFE542803D99448C9CD07240FB
SHA1:	FD4E5FC01B43821941231936CE58BBF83D4F6D2A
SHA-256:	1502911C5F96457F60E2B66D2E1CF9CDDFEA4DF82D5B2E3332522DDA0A3A62C7
SHA-512:	CBD89C1847526278BC30A53575D6849DB7F80D89DEF0ECA72651DEAF05D93DD296DEBBA50F2DCD3C65E83E94BF2F8D767E6B0C6A372D7A875B681B3DC2005AD5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Linear" Name="Concrete Footing Assembly" GUID="{57360119-574D-4DA8-B34D-A856445245AE}">.. <Properties>.. <Property Class="Text" GUID="{8621966C-B4C8-457F-8E95-B83DA1A98044}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{57360119-574D-4DA8-B34D-A856445245AE}</Property>.. <Property Class="Number" GUID="{56757242-6F93-4D18-AF08-38864BB0766A}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Memo" GUID="{2B5D394A-E01B-46C5-BB4B-226B623D90F3}" Name="Form Layout" systemhidden="True" OrderIndex="39" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" Same

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Drywall Wall Assembl\Drywall Screws (pric\is-DS5UI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	10106
Entropy (8bit):	5.607451407627909
Encrypted:	false
SSDEEP:	192:uGFIFJjWM7sEMZbeMNVe6WDs1B9QDQHfae02lzpD70f7X76L:Da3ngbUx6kMBikd02nD70Dr6L
MD5:	9510B73C04E27C48349F1B5C2B05F525
SHA1:	0BA88CF221E4B859ED205760274D6584CC4ED8BA
SHA-256:	FCE96ED3F811AD5B4EC3F4E3B9596ABCC38746F9B48761EEA560A50D91A01155
SHA-512:	D943E7E995621C83D5CCB41F12D2B1C426AACC3D03A3E5F17BC4B11D0691EF47A9139371BA6BB668B9525E5FD20140C4846EB020D0422AF8550F80312F0B78E1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Drywall Screws (priced per BOX)" GUID="{17858EE0-66E4-40CE-96A8-BD54EA24DF36}">.. <Properties>.. <Property Class="Text" GUID="{2C28A7EF-EC4D-4309-B3E8-47FA44B7A772}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{17858EE0-66E4-40CE-96A8-BD54EA24DF36}</Property>.. <Property Class="Number" GUID="{DFD5A323-A95C-41BB-BBF9-FAE1F7088F8A}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{FE22A7FD-6844-422A-BF10-36AA0BEAAB03}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Screws per SQ FT" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Screws per BOX" Order="1" ShowUnits=&quo

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Drywall Wall Assembl\Finish Labor (priced\is-ASDMQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (378), with CRLF line terminators
Category:	dropped
Size (bytes):	9253
Entropy (8bit):	5.595426127331744
Encrypted:	false
SSDEEP:	192:jaOjqrWY55kU85GbBTR9Y11DydesL2kpRGGj:2OKB55kU852kqL2sRJj
MD5:	7593DB26D0E7A937AC4B03C294D7E6F6
SHA1:	1089FDDB392E310DCD010AA3794C9E33038A6798
SHA-256:	07A513B0484C152D3A36EB0C6C52D433194C130C6D268A117A0C95B62BBF1146
SHA-512:	6E0D3C0C96718A80C8B91513548381E91D3B0C6D6B164AEEBCAF88F679E9AC0A73394D88E414DDE638B93A2817894A197EA9216B3B207971DF875FD8C57A1BDE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Finish Labor (priced per SQ FT)" GUID="{25DA62D7-D93C-439F-AF6A-2B078C019185}">.. <Properties>.. <Property Class="Text" GUID="{F68461F7-220C-4721-8EB0-F3677D3C3FFB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{25DA62D7-D93C-439F-AF6A-2B078C019185}</Property>.. <Property Class="Number" GUID="{0A968304-C841-49C6-B54C-CCBB8D71A0D6}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">5</Property>.. <Property Class="Memo" GUID="{E5D5234E-7018-4170-B980-3AC802DBA9B1}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides" Order="1" ShowUnits="Fa

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Drywall Wall Assembl\Hanging Labor (price\is-0POG9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (378), with CRLF line terminators
Category:	dropped
Size (bytes):	8680
Entropy (8bit):	5.592262404351969
Encrypted:	false
SSDEEP:	192:mj37TM3FAz1kT8SbHFBSp1rTDopTv5EDjs2dwp89j:mSFApkTdFBS3TEsDg2dA89j
MD5:	1B0E953F4A6A8E455B829D36B0F0566D
SHA1:	92157EBEE65D603F291ECB85337730E437A9B115
SHA-256:	235951272BFB0799A3AACB53C90DB84298FB42725F0DFEEC58E8BF626A7CDA20
SHA-512:	D643073C7192C0D4271ACF5B077E29FD55EC41FDBCA6F559CF7E68AAA3CAF719FED68A955213747E47BBC25E2C9FF51E918F0B3D5138F11B62674EFC6B6A33A4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Hanging Labor (priced per SQ FT)" GUID="{D48C1304-9ABE-41DD-A965-44FBAE495398}">.. <Properties>.. <Property Class="Text" GUID="{75F1D6E1-CCE7-47BB-96B2-85398BEF21BA}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{D48C1304-9ABE-41DD-A965-44FBAE495398}</Property>.. <Property Class="Number" GUID="{9EC6B4CD-FFB5-42EC-9564-AB44CFCDD55A}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Memo" GUID="{BB7D017A-F7F9-410F-9DCE-601181816328}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Waste %" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Drywall Wall Assembl\Joint Compound (pric\is-F1AGR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	9151
Entropy (8bit):	5.5947184396358605
Encrypted:	false
SSDEEP:	192:SwMwjdV7NiV49F9ZbboJFXDb2LMP2Kp59T+nj:SJw5+a9F9aJFXvP2KPWj
MD5:	5D421E99818DCE83050FFBAF10BDF43F
SHA1:	C5EE66D772B6527EE198DD4E5B1F46DCEB4150A2
SHA-256:	9BEC6FEEAC3BA45A05FCA7966B617556DFA6FE051F27E8B176B78CF8795F10A4
SHA-512:	B35747295397A40C5DDFC41E49A33D144FB8060E5091E03EA8B752A61EAE8BD8A5CED56BF84742AA69150936A3DDFC435308351AA42462ECA2BA93671A3DC808
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Joint Compound (priced EA)" GUID="{D1D1DB19-B019-457D-9667-8B957F1C4A94}">.. <Properties>.. <Property Class="Text" GUID="{01EDAE99-D1C4-45AF-8AC1-B14D12BAC733}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{D1D1DB19-B019-457D-9667-8B957F1C4A94}</Property>.. <Property Class="Number" GUID="{29600808-59F0-485F-A37B-CBF8171BC37D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{766D89B2-40AE-495A-A9AE-AAD7091FD072}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False&quo

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Drywall Wall Assembl\Joint Tape (Priced p\is-AOOPT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	9710
Entropy (8bit):	5.595940009287555
Encrypted:	false
SSDEEP:	192:jWjZEuN0dC8SqZ26baIM4WjFPDHMBbmC26pBn94j:yhN98SqZ2pD4kFPDMkC265uj
MD5:	5E95C9AEC3C27134EACC35D8EEDD8AF3
SHA1:	30B29A5B963C203624AA8602AC865612471FE452
SHA-256:	36768D11512420B379CB1BFFB51ABD697839A5926707D56DCB0DF383E42F84E4
SHA-512:	594338E0C39E93009ECEB9243D0E5A7172058C59EB2A9774A9A07D7BDD3B1AB01A21116C3A714E817A63CD55006145292D273B29A2BA72831794DFE32D602214
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Joint Tape (Priced per EA)" GUID="{C50BBAB0-1206-4FE0-B0B0-F17749D8D997}">.. <Properties>.. <Property Class="Text" GUID="{459725FB-3704-4EB9-8312-B292DF00B8B2}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{C50BBAB0-1206-4FE0-B0B0-F17749D8D997}</Property>.. <Property Class="Number" GUID="{2C3F912D-FA0F-4C51-BC42-497DE8425E75}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{CA55C49D-6090-4457-8D29-C5C7B04BF132}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides" Order="1" ShowUnits="False&q

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Drywall Wall Assembl\[Drywall Thickness]\is-QKD6D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (363), with CRLF line terminators
Category:	dropped
Size (bytes):	10352
Entropy (8bit):	5.605806711172113
Encrypted:	false
SSDEEP:	192:Kj/xMkCU6sSwGCDCZQ5RFL2bP48B7QO4GvEqqtnj:Kr6sSw7DCZQ5RFLgQO42E/tnj
MD5:	8814E525E2438223FB03BCC20741D5FF
SHA1:	63FEDAB5889018316D9D084E5BF8A8B8FD9D464E
SHA-256:	509BA352FECDEDBF485E25DBF47C10A1134228DE61684752925DE680AEC437DD
SHA-512:	3D4A39E11559098FCCBF66D15FFC061156D8833F24206AA448249143B2AFE5720FFC0AE4D70FCC93EF7C230AC0A514C4F26C2B051CDC999D511937B3CAD419F8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="[Drywall Thickness] [Drywall Type] (priced EA)" GUID="{D46365AD-2A95-4B02-A388-40259593A24A}">.. <Properties>.. <Property Class="Text" GUID="{EAADED69-E103-4E92-B8A3-7F42D47F67EE}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{D46365AD-2A95-4B02-A388-40259593A24A}</Property>.. <Property Class="Number" GUID="{6EC19939-2C86-4CAB-A5C1-99220F4B4DCA}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{E29C046B-A652-4A0C-A831-A685EF7F4FCA}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="Fa

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Drywall Wall Assembl\is-02IAC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (32212), with CRLF line terminators
Category:	dropped
Size (bytes):	57961
Entropy (8bit):	6.09896550241568
Encrypted:	false
SSDEEP:	1536:Hp+lEQDhmI+gcgHHsIQ/ofRThIna7W0xuqKFOyBM2Jiua/2UV815:o7Iay0xuqEBMUa/2U2v
MD5:	3F32C2F8F9F93A415B5E469B97429F35
SHA1:	107619202830485E7FF23C292D5394CA43C6B566
SHA-256:	5D788BCEE85E6D470D6D78838C57B1621C26956E1911519A0CE2866560A0D4D1
SHA-512:	49DEBD92B438700DF6E986000BEEA1D0DA34844999DACAF0937A6FF6997684C2B871F84BC8E632EA99C6E6F078E3D36A502AE692BE6913E5A881D93336DAA81B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Linear" Name="Drywall Wall Assembly" GUID="{AAAAA0E6-5AA7-42EF-B66E-853D3974C65C}">.. <Properties>.. <Property Class="Text" GUID="{B6EBD2CB-3E4F-4AA4-975B-FF5D9951C967}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{AAAAA0E6-5AA7-42EF-B66E-853D3974C65C}</Property>.. <Property Class="Number" GUID="{1633659D-CD2E-4C30-A597-BD63A4125BA2}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">6</Property>.. <Property Class="Memo" GUID="{D6010CDB-5D57-4ECF-AAB0-E82DCB075845}" Name="Form Layout" systemhidden="True" OrderIndex="39" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Interior Trim Assemb\Base Board Labor (pr\is-05QKO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	7825
Entropy (8bit):	5.582262649826514
Encrypted:	false
SSDEEP:	192:BjYUtSrjQf+9EYMG1ObNoFC9FDvkdt2G/p3Gmj:BjYUKUf0jMG1coF+o32qWmj
MD5:	F29537C382F676226A3E2623AF13A834
SHA1:	AD26FEE96B6F05A4A18A91253E213A5D104450A1
SHA-256:	80CA57403BFCC5CF1A524A79E097A3449A8769FE226DF23EBD9C6B281B25C736
SHA-512:	D514F5306EA7092D1AF4FEDF63625ED32E43F3E5413D37492F81C98997E8418D5FE59FE691FB5AE46077517E52CB21B78728C21DF10EC8F29881C7C3BEB99709
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Base Board Labor (priced per FT)" GUID="{8FB5E9A6-E479-483E-B0AD-56CE16C26A53}">.. <Properties>.. <Property Class="Text" GUID="{F3B5E724-0EDF-4AF2-BC0A-E49D6506DDA4}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{8FB5E9A6-E479-483E-B0AD-56CE16C26A53}</Property>.. <Property Class="Number" GUID="{6F502AD0-6D59-4226-ACCB-1FE37DB65696}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{4A9690FE-DCB9-41CA-8A44-E30139028BC5}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Waste %" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Interior Trim Assemb\Crown Molding Labor\is-V61OF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	8043
Entropy (8bit):	5.585443701978561
Encrypted:	false
SSDEEP:	192:+cmj9h17zmonQnbQFL9xDEL2lDArxGJqj:Pmxh1fmoQsFbI2GrxWqj
MD5:	88A89F2176A5021781C23020836A710B
SHA1:	E9F51ADA58F04623295B70384DB38203CB7104C8
SHA-256:	71CF1F4C7A68F477012635781391FAEC856516B20BFFF1CC063F3A3562293CE3
SHA-512:	9B4F8BBC81A7748D6B7EE0A9A4183B8538F3DE3B95F3A6F1AE4B55FF3EF502FCF36431D98C03276B67BEC625D83DF50B52DCD962AB7787345DCE6461170F0693
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Crown Molding Labor (priced per FT)" GUID="{AFBFE78D-0671-47F3-8EC8-832D3BDDF349}">.. <Properties>.. <Property Class="Text" GUID="{A6ED67AA-1C7E-4828-B9CD-69FA4A7CC4FE}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{AFBFE78D-0671-47F3-8EC8-832D3BDDF349}</Property>.. <Property Class="Number" GUID="{276CA50A-E7DC-42BD-B0B9-DA78811D3494}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{19DE661C-BB9D-41B3-990F-7D5CF898B45A}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Waste %" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False&qu

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Interior Trim Assemb\[Base Type] [Length]\is-DJJMB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	8462
Entropy (8bit):	5.598913690218346
Encrypted:	false
SSDEEP:	96:p0WfnCfjn5nlIzlI3GrKtpLM54Q0tdyFLjqD0A2in2e4upvOfvnj:wjnplfGrKbL0obyF2D52g2e4upUvj
MD5:	9E5C559171B162854560C7CA70687E8B
SHA1:	060CC5FD6D3AAFFCDF19589C38E0FDF681A33D70
SHA-256:	07A157CC77A7BA364DD249F9AAC2D18F4BAE72F0A3C6A8CF58C8A1A66E988BB4
SHA-512:	8619C9F67F772A635F7FF67F65075B7AAFF007C990C6D6DEE8754B70A4A6C9B814FAFFDCF1294D7BA1620FB2142CADF54EDDCC269D3889155C65BB73AE161A5B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="[Base Type] [Length]' Base (priced EA)" GUID="{5944A870-7DBF-4DB0-A517-E87F6F8B0A4C}">.. <Properties>.. <Property Class="Text" GUID="{18E83A82-EDAA-4DB4-9B40-A6BFDF8D8B6E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{5944A870-7DBF-4DB0-A517-E87F6F8B0A4C}</Property>.. <Property Class="Number" GUID="{C579C5D6-9807-4AB1-8627-1927C9FF48D4}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{299A573E-DBF0-4B72-87E3-ED9B4BC70472}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Length" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="Fal

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Interior Trim Assemb\[Crown Type] [Length\is-48T3S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	8632
Entropy (8bit):	5.604935299193794
Encrypted:	false
SSDEEP:	96:mKiWP1TjyjnlixKwOcJK0+tUMQ0tdJFLG8Dtuu2fpCVDhfnnj:PjyDliAwlK0+tU0bJFhDgu2fpCV1nj
MD5:	B3E94602EBBDBADC0C1ADBD2DC784775
SHA1:	E73976C561017EA34DF8E67D19D5EDBC23393F2E
SHA-256:	34907F894DA620A7835F152A79EBE0B41EFCB61B7B3DD4683D6A61116D4AB53F
SHA-512:	02B4E4F044035D7A7810067DBA97DC1E7F8ABF6865DC9CD1DEA089045AF39C4669F185628FD0D880C413D905DE895EF580BA53DBE8F869B956D0127FADDF970A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="[Crown Type] [Length]' Crown (priced EA)" GUID="{8F7369ED-0AA2-4088-92D0-5007948B9C1A}">.. <Properties>.. <Property Class="Text" GUID="{78AC8EEB-28EF-442C-839B-ADCEA5055990}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{8F7369ED-0AA2-4088-92D0-5007948B9C1A}</Property>.. <Property Class="Number" GUID="{70542AA9-CED1-40E7-82A2-8C26DB3439DA}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{3CF63627-0B8B-4A64-9693-119A103DA1B0}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Length" Order="0" ShowUnits="False" SameLine="True" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="Fa

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Interior Trim Assemb\is-45S18.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (38813), with CRLF line terminators
Category:	dropped
Size (bytes):	59799
Entropy (8bit):	6.128130949407551
Encrypted:	false
SSDEEP:	1536:6Qipd5VFZjHTPaG+Pp/g0V914GfHkOBsyXvOTdk/se7aGzY1QbeeuJR:8HfzP6xFr1XfHtjYR
MD5:	D157F04CB307E74A6367BEEBC8CE3912
SHA1:	02F540C05BD4CFCE2379BFDDE25433E1A176CCE1
SHA-256:	52D6AF51D802B35025E2248AFDC8CA768E0D29066E1A8832A754AAA0188A305C
SHA-512:	223CFE4A7DEF84C5C6B1E8737970DDD34DCE71FC2AA5D91FB09B5B67D863A6920872C2C61574E1E34D1A90A36E2E68E648ED96AF07DD70290C0A521D3A0044B3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Linear" Name="Interior Trim Assembly" GUID="{782179EA-7C17-41A2-BD06-CFE3246F83E5}">.. <Properties>.. <Property Class="Text" GUID="{2893A663-7DA0-43D3-8D1E-4FAAFAAB4C95}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{782179EA-7C17-41A2-BD06-CFE3246F83E5}</Property>.. <Property Class="Number" GUID="{16EBEF55-7077-4C22-A628-BFC79A8BFEBD}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">7</Property>.. <Property Class="Memo" GUID="{19190108-2B8F-4C28-BF07-B60765B3B345}" Name="Form Layout" systemhidden="True" OrderIndex="39" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLin

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Painted Wall\Paint (priced per GA\is-KDQG3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	10114
Entropy (8bit):	5.607010738989002
Encrypted:	false
SSDEEP:	96:j+7pVh+r9mjTc2KZ5RgT6lQ0tdx6n1OuUwL9ptG/qspT8Stnj:j8zLjT2Z5RgerbIgBq9ptG/qspjtj
MD5:	176D7BC51F1936E9AA1B33C5DEFBF838
SHA1:	5B4DEBCC34DA1DDBA7A810606611CE456383E979
SHA-256:	DE1AD7CE2E8F6EBE5EB46EC3FA959ADD28651943D7BE945D784D5ECB9FCC1A54
SHA-512:	71D1668F0EEE82D218738D29724B94674D5E20DD51EDD83C1E49F8D230ABD293D9504B5C4DC359F14F1E60413AC5A7BE376ECB29584F20F38B203CB306C0216D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Paint (priced per GAL)" GUID="{3C88CB18-319D-4A12-A702-FFE0717DF610}">.. <Properties>.. <Property Class="Text" GUID="{83AA4C98-0A1B-45F0-8880-6E0E761AC0B7}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{3C88CB18-319D-4A12-A702-FFE0717DF610}</Property>.. <Property Class="Number" GUID="{3750506D-7D8C-4D2B-98FF-546FCF11D57C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{F076C934-EC63-4870-8028-89298132BF4A}" Name="Form Layout" systemhidden="True" OrderIndex="10" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides" Order="1" ShowUnits="False&quot

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Painted Wall\Paint Labor (priced\is-TOPJB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (378), with CRLF line terminators
Category:	dropped
Size (bytes):	9738
Entropy (8bit):	5.593752359071323
Encrypted:	false
SSDEEP:	96:4D1K+dbSj6yPSufX/FpmQ0tdXQjSKuFLyTDMjbGI2IRpAsizIXInj:4B30j6yh/FpKbgmKuFyTDsSI2WpA0XIj
MD5:	A0C704205BB4F3735031F8128C39545E
SHA1:	57087E3EA310433C4B09A85651D5306A362DC47A
SHA-256:	96BFEA1B880F6415C8FF8465593C0EBBDBE63C2E81CC33D27DE24024F9F0019C
SHA-512:	B78A70C4BD4C7926017EB250D6BE336DE5904FE5D2E01FC965B9B3406F2E08EEA92EF332C3ED51BAC7A9EF2B364B0B3CB1D5CA3FB06A4EC118911328BEEDE369
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Paint Labor (priced per SQ FT)" GUID="{5F34CD0F-63E8-4608-BCD3-ECBD5E7AE301}">.. <Properties>.. <Property Class="Text" GUID="{00F86E93-A4BA-4D1E-BD18-A5F1EF84C6DC}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{5F34CD0F-63E8-4608-BCD3-ECBD5E7AE301}</Property>.. <Property Class="Number" GUID="{1D71B02E-5BBC-4FAC-86B7-B9AE65680351}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{9EA9F438-32B6-43A5-820A-E29800AA3811}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides" Order="1" ShowUnits="Fal

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Painted Wall\Prep Labor (priced p\is-K1DNT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (378), with CRLF line terminators
Category:	dropped
Size (bytes):	9749
Entropy (8bit):	5.595960148736991
Encrypted:	false
SSDEEP:	192:Pl1Fvsj6nn2FW2rx1q4ZdXfbDNHFoEDuSJT2Xpiip1j:CQiWw2UFFHFXjT2ZiA1j
MD5:	5FA5EEBA9EDA782E174A95BD9428E144
SHA1:	E512E9BDB4D615ACCB9701E706D04DC6A72E439D
SHA-256:	0A2F35BE1D7BE8F607940CDFBC4AA61511DB1C3713928AB813B5AF901671D808
SHA-512:	48BA2CBA3AFA963043EE39BAAE22DEE14FF9D35BF41D2E2CB117BE301BCA63DE0F5B507BCF736E9A5BF2E0283B4C37D9B621D302C96CDF10BF5B65841A92252C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Prep Labor (priced per SQ FT)" GUID="{067E16F6-02CF-439D-AF8C-78A797CD25C8}">.. <Properties>.. <Property Class="Text" GUID="{71A563B6-EFEF-4B55-95AD-A5DFED90C351}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{067E16F6-02CF-439D-AF8C-78A797CD25C8}</Property>.. <Property Class="Number" GUID="{05C0B3D9-47B9-4FF4-AFFD-FCFCFE67BE67}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{A820266C-4798-451E-99CB-9671AC7DDACC}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides" Order="1" ShowUnits="Fals

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Painted Wall\Primer (priced per G\is-Q1LJU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	10120
Entropy (8bit):	5.605699323862007
Encrypted:	false
SSDEEP:	192:ZjTsPsSZHLZxbw/OkBG9jkBqBzqvpqjZj:ZkXZHLZa/OkAtkcBzqhqjZj
MD5:	0AB1F422AC59795E672C946E833D74C2
SHA1:	BE51B9A925F4F3FF81AE8DB102E39F0F921856DD
SHA-256:	A8CC77E893677779FE93D81BC7E5B2A79DD62B631D1BF404764C0A86025A39D8
SHA-512:	57D7870CD30A8E2F9F9199B194EF7AFA9AC3A1E283630E3AC3D58C112D656248C8E342F36E684C4497D82EAD29C5F94F6B1920EE668535D61D31F506719779C2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Primer (priced per GAL)" GUID="{16419276-CA5D-4C1A-B88C-8AE7FBAB5BC5}">.. <Properties>.. <Property Class="Text" GUID="{8BD306C2-E854-4B58-A1C3-985FEF1F0D52}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{16419276-CA5D-4C1A-B88C-8AE7FBAB5BC5}</Property>.. <Property Class="Number" GUID="{B9565757-2E6E-406F-BA8A-D44F234264E0}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{D81E77C6-83D3-464E-ACDD-F48CDF48E160}" Name="Form Layout" systemhidden="True" OrderIndex="10" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides" Order="1" ShowUnits="False&quo

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Painted Wall\is-AB30S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (25873), with CRLF line terminators
Category:	dropped
Size (bytes):	45521
Entropy (8bit):	6.099397126657541
Encrypted:	false
SSDEEP:	768:gLSSZzGmai9AkCIvtpEqoDbPUhaJgRFoincJbBSLvyEzIy+/6gFhPTB/G9zf42zD:gBGmai9wIF+q6co2RuincRAuEzwTF1Tm
MD5:	6B3F2DA4186A9D06BFAB5B49B9683A9C
SHA1:	04E89E8C3E5CA49EFBD5CC051F2D58225CAF62B8
SHA-256:	D1D3299497853C1DC99870739197ACA6E7EB3476629F453C707D08D3D2206CCB
SHA-512:	E40273BDCE7566B0891200E7231413A2667EEDFA76716B0F4DA02130F2F843F4C73B3DC3AE4C074EBC6A39B3242372DB8259934D10D0FD0C9D519832EA99D183
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Linear" Name="Painted Wall" GUID="{1037B22C-102E-4C53-9DD8-607A49478657}">.. <Properties>.. <Property Class="Text" GUID="{D933C0EA-763F-48D1-A092-00AC371D249D}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{1037B22C-102E-4C53-9DD8-607A49478657}</Property>.. <Property Class="Number" GUID="{60601AE5-C56E-4EBA-A3BB-634B68CFB938}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">9</Property>.. <Property Class="Memo" GUID="{CE05EC27-B7B5-4251-AD9C-A34439E474A9}" Name="Form Layout" systemhidden="True" OrderIndex="39" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine="Fa

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Slab on Grade\#[Rebar Size] Rebar\is-R5FU6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	11120
Entropy (8bit):	5.600671360619124
Encrypted:	false
SSDEEP:	192:njdZLubn2fHqPpbjhPA6tPZgx6cWIuZShew5UN+Cn1DdH8HXlMi5OgEuKBP80:n/LuT2PqxVA6tR66cWIuZpw5UNN1DdH/
MD5:	940B6D6820BD6E066757E351065627B1
SHA1:	1C93D11FC5EFFEE7D4FB0C4CD750F0D6FC2F281A
SHA-256:	9D9F2461D2F7AE79AF28A42D9DBDDF054CCF0683936D99610D921039310043AA
SHA-512:	CC8373DDF8C593AE13CBC562C760344ED7D8FEB40E1A1E4B3E37651C123145961171D9B4A823112912AF4C4C2EE0B0FE7BC20A3AEFE7285B95400A865C830B76
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="#[Rebar Size] Rebar (priced per LBS)" GUID="{58960445-8F72-47AF-A5A2-046FC328CECC}">.. <Properties>.. <Property Class="Text" GUID="{DBC94454-7595-4253-B6BF-10AB9A65769D}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{58960445-8F72-47AF-A5A2-046FC328CECC}</Property>.. <Property Class="Number" GUID="{38ACB772-7D83-4C57-8470-42CF1CB2BBB4}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{D1854646-236B-4183-AE1B-D73EB4F31DFD}" Name="Form Layout" systemhidden="True" OrderIndex="11" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Waste %" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False&

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Slab on Grade\1%22 Gravel (priced by\is-1FR12.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (377), with CRLF line terminators
Category:	dropped
Size (bytes):	11194
Entropy (8bit):	5.592879243956221
Encrypted:	false
SSDEEP:	192:Zdjx0zYbklHtlv+6z/hRcKxT+Vm+cvFYD+xu8+aM9K2EpsifX4L:/azvPG6LhWKNim+cvFYlXa4K2MsifX4L
MD5:	A91EA7F0F0F3F8A7FA413738AFF08C36
SHA1:	633230B98FE113F7B92D4E02BF8AB95FE700D2AA
SHA-256:	AB4DC93127D61B9DF309E455BA5F83FFD6A10D504ACEB562829DADD835F9EA60
SHA-512:	9CC7EDDBEC6F59715D312B91CC5E955B30F2FDD85ADC84E50C268C47A17D54D9ABD45D64DEED696F3B7013CD1DF9021F411D3812E952191449BEB01B116C5EF5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="1" Gravel (priced by Tons)" GUID="{8CED447F-B155-498C-A4E7-2DBCDCE5D75D}">.. <Properties>.. <Property Class="Text" GUID="{B9E9DF1A-0CCC-4E59-9F0E-3658FAEB2A72}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{8CED447F-B155-498C-A4E7-2DBCDCE5D75D}</Property>.. <Property Class="Number" GUID="{77F6C790-7F4E-44A6-BC44-5C32DEE9D545}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{59CC8CEF-5267-41DB-9982-DE46BFA77902}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Weight" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False" Sam

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Slab on Grade\15 mil Vapor Barrier\is-27C0N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (380), with CRLF line terminators
Category:	dropped
Size (bytes):	7269
Entropy (8bit):	5.577836830686097
Encrypted:	false
SSDEEP:	96:rrwGFbjkoxLk+VQ0tda6j3co0LiR/Q8SYqIOCqODYS1WsnRionDUDZ3BAh:oWjkyk+7ba6zF2iFQ8hqCqOcHhosZ3Oh
MD5:	683512436D3286A001F322B8EE34C4DD
SHA1:	AFE4741FC64EBFB7DF24E090B86D7808623F565C
SHA-256:	13C478519DCAF43D3ED1975755BA6CFDFD3AB8ADB25ABB858A961AA94A64A509
SHA-512:	57F542A378CB956C35F0B7872BA01A7EBCF7E435CB01152E476A1004516FA2C3ABEBEB3499BD845E7A6E663F40E40F137DBF749174FC4F00B1F942C131537C3F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="15 mil Vapor Barrier (priced per Roll)" GUID="{DB840839-3C1E-4FEB-976D-F8CFBC93A113}">.. <Properties>.. <Property Class="Text" GUID="{3AB849F1-A0F6-47E8-B4A8-C71E9B4429EF}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{DB840839-3C1E-4FEB-976D-F8CFBC93A113}</Property>.. <Property Class="Number" GUID="{CBEACDC0-5D07-47FB-A4E4-414BAE94C9E3}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{4C11AD92-CEB7-4C8B-8F39-DF27DA8B849D}" Name="Form Layout" systemhidden="True" OrderIndex="10" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits=

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Slab on Grade\Concrete Labor (pric\is-A98LB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (343), with CRLF line terminators
Category:	dropped
Size (bytes):	3547
Entropy (8bit):	5.619192866583168
Encrypted:	false
SSDEEP:	96:CRu1B9vjqL3JkwFoQ0td3qm1BRdaLqYIu3:hjqKwabF1BPwqYF3
MD5:	41D591CC5A61F0DDB8B6BC010A9F71D3
SHA1:	961DE7BC31ED55CEDE7D866F23A8DD75CF5A9800
SHA-256:	333C28D1E09C37D210FDC85B0090D0EC44FBE8A150A4B2BDD6453A64BCB3AD70
SHA-512:	2A820CFFC3145E2EEF411B7B0BDC891AAC07D2CEE87E93ADDE417FEF2F863FB15126F2C0237A0C0904C356B14FBCF2C53D7F63FEF9BD591C856DDE1DE2A65BA0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Concrete Labor (priced per SQ FT)" GUID="{FD8BAA4D-B79F-4C05-A5BB-937B4D9DE345}">.. <Properties>.. <Property Class="Text" GUID="{C08BF7D3-3106-4071-8217-1C9A01C74E1F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{FD8BAA4D-B79F-4C05-A5BB-937B4D9DE345}</Property>.. <Property Class="Number" GUID="{34472495-B8D2-4DBE-BD84-BBB66BD77FC0}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Memo" GUID="{965B6ACB-5206-4EE5-87B2-7EA478B81386}" Name="Form Layout" systemhidden="True" OrderIndex="18" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Waste %" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False&quo

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Slab on Grade\Concrete Slab (price\is-AE6BJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (378), with CRLF line terminators
Category:	dropped
Size (bytes):	6700
Entropy (8bit):	5.59636632110886
Encrypted:	false
SSDEEP:	96:V3eArjLwLK37Q0tdKIAgFL9ulDG8BA2HpSpUzK4YnmeG+gFDL:BjyK3FbmgF9ulDG8i2JSpp4YdrgtL
MD5:	F260E5BD1D2A73BE771CE3B97B47789E
SHA1:	E22336E440A6E5ACAD173898D655B66B42333C99
SHA-256:	380B85A0BF051B4D4D53A90E3AF6555155D65F70C0F2601F0CF75BBAADD66474
SHA-512:	6279962EAE5444B6C900DE464346692182102BB49DD3FBD67BD20E3CEB3FDFCB1CCF1DB0841588CAE1B8DAF373F12D2D455052DB05626FEDC34AC3A7DFC924CC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Concrete Slab (priced per CU YD)" GUID="{23DAC330-52DF-490F-83A3-F4E5F61414E0}">.. <Properties>.. <Property Class="Text" GUID="{C2CFE61B-7BB5-45FF-9A1B-2A08A5B5A1EB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{23DAC330-52DF-490F-83A3-F4E5F61414E0}</Property>.. <Property Class="Number" GUID="{24D929B8-3405-4554-B52C-542E80B597EA}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{D07AC95E-C5FF-4944-B7BD-370C0370FAFB}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Waste %" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Slab on Grade\Rebar Labor (priced\is-K7B73.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (378), with CRLF line terminators
Category:	dropped
Size (bytes):	15832
Entropy (8bit):	5.593453879680302
Encrypted:	false
SSDEEP:	384:5EtNkvtkDR2k9ejQWI6FXcs4TrQEGGIFj2RNpjUADhPDjtWL:5EtNkvtkt2k9ejQWI69NeaGIFqRNCoPS
MD5:	1CAB818E4757498F134571F98CF675FC
SHA1:	88593D7F804ABDB183F6FC64D8EE563E04F60F66
SHA-256:	FEAEF375534543014C7895B08C2A9B7C515BFBECBE2431FE7ECB099F54E41BEA
SHA-512:	98E6015C9F13A2548FB96E3AAA7FF588ECB7781CD7D584D45E41529B4AA04BBA75A85A402521E14BEE0BB9083755E2EE6EC47C12935EB8C525895E00932F644D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Rebar Labor (priced per Hour)" GUID="{230B0F85-00C7-46F2-AA4E-0B4B58385A0B}">.. <Properties>.. <Property Class="Type" GUID="{9D8C4D51-FE06-4725-B0F0-502781EC3801}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Labor</Property>.. <Property Class="Text" GUID="{608574F5-BB52-4C59-9E58-FC24BA7DAED0}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="56" DecimalPlaces="2">Rebar Labor (priced per Hour)</Property>.. <Property Class="Text" GUID="{0D500A4A-8C1C-4031-9CBD-BF76C3977FDC}" Name="Description" input="True" group="Item" OrderIndex="57" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList" ToolHint="Type in a Description of this item">Tie, Bend and Set</Property>.. <Property Class="Text" GUID="{BDD91254-E91B-4EB0-9814-ED0EDFA74EFE}" Name="Item #" group="Item" OrderIndex="58" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Number" GU

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Slab on Grade\is-5PKQE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (46672), with CRLF line terminators
Category:	dropped
Size (bytes):	66927
Entropy (8bit):	6.139675743149505
Encrypted:	false
SSDEEP:	1536:Caa6oZsu7tCRYemXjA4rzdFurNvAdpy+uipP4OLGDK/7YmMOvc:RNvcy+/pVGDWvc
MD5:	75C38679C3173ECEFB55A904F7BB68EB
SHA1:	700B75CBB88E21DFAD6E66AEB2C52E5EBC9D4B56
SHA-256:	8AF376E059E478E2CD3AF11EB3E030AC7150F339C32C8AFBF6732AB23ED5491E
SHA-512:	C4D2798CCA38563FF278CF7C28442159033C2872483720C6F44E49C9FF7F19A904F78EECA97134F802A3767B6C7ED5F51EB1CFEF88F74865DF88D83F683566BB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Slab on Grade" GUID="{A7CC56D2-47B8-41F9-B7C4-175935C1DF05}">.. <Properties>.. <Property Class="Text" GUID="{60F711BD-323D-4F2E-A328-290245785B99}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{A7CC56D2-47B8-41F9-B7C4-175935C1DF05}</Property>.. <Property Class="Number" GUID="{22874AA6-D97C-4E3B-9A00-0ABFDE8F4674}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Image" GUID="{846DC75E-2F42-4047-8503-116F15A1398F}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="5" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZfmgZG

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Wood Framing Assembl\2x[Wall Width] [Stud\is-RQ22F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	11278
Entropy (8bit):	5.599324620989659
Encrypted:	false
SSDEEP:	192:dOjzB9eybkGvUEqaClWDqbuFHL4FHGDDrc27J7dj:0HDeybkGvgplWDpL4FmQ2Rdj
MD5:	4BBE56900FBC497E9244C03D2BA86B99
SHA1:	95B8A6AA649F7F4F0C435F0820AF5944D784C6F3
SHA-256:	BBC8A18C87D11FAB09D1EB67F415D68B5877F4B5788A3C2F4164899A25676CD7
SHA-512:	7A8019183403074431092B105C32E21B77B6035D7431D4976462AFD15D1C9101366E8CD2B2F1354A584F389589E1768EB316E10819D5B0698D35BDE8E4CC1DA9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="2x[Wall Width] [Stud Length]' Studs (priced EA)" GUID="{2F6603B5-B08D-45CB-99A9-C91577BF0FFF}">.. <Properties>.. <Property Class="Text" GUID="{BC49F44D-0904-4C16-9EB4-393E1AEF797A}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{2F6603B5-B08D-45CB-99A9-C91577BF0FFF}</Property>.. <Property Class="Number" GUID="{291BEBC6-FCC3-4991-B113-8BCC6BB12945}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{86E01B70-4C7F-49A2-A6DF-75B67137D3B8}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Waste %" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUni

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Wood Framing Assembl\2x[Wall Width]x[Leng1\is-E7RLP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	9674
Entropy (8bit):	5.589113822161884
Encrypted:	false
SSDEEP:	192:JfjT5d6AjWg3kKpntbJqqHAqFV/9DK5S2q4i0pHZz2+Gzhj:JfBdNWgUKpnTjAqFVVP2q4i8HZz2+Ehj
MD5:	2907B23ED6887175B8329C3E0B30FCEC
SHA1:	801E92FEE93870E501CFFF794458025D534336FE
SHA-256:	D0F22568A008305A72DDD2C861C22673408522624146521DA1CBC8E383DDFDD9
SHA-512:	BD046E97BE9787C0AA236059E225A2FF6E20D7682E6FFE17448ADDBB27C64950073C7DF5E5A9E1A2D52DF8E0C862031095071C1E608CE7125C7BB4A29699DD8B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="2x[Wall Width]x[Length]' [Bottom Plate Lumber Type] (priced EA)" GUID="{17ED2E20-6A4F-4C78-ABDE-EE79CCE6895E}">.. <Properties>.. <Property Class="Text" GUID="{CA06CFEA-E022-429F-A344-5E7F29D2C661}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{17ED2E20-6A4F-4C78-ABDE-EE79CCE6895E}</Property>.. <Property Class="Number" GUID="{B932EDB7-1CEA-4225-9F7F-12BD0A1B62F1}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{E21DE1EE-E46B-4895-9296-03D5F17DD4DD}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Length" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1&

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Wood Framing Assembl\2x[Wall Width]x[Leng\is-MVH4A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	10025
Entropy (8bit):	5.607663537486381
Encrypted:	false
SSDEEP:	192:JDj+OJ2gHxVQb68H0lF1DbQDK2Ps3mmppOYtj:JDCOggHxVX80lF1j2Ps3mmjOYtj
MD5:	B9F7DE6D550FC81AFBEAB3CF649163B8
SHA1:	EF20085963DC194FBF55D97029B3D122AA3415EF
SHA-256:	C6FF8A29DD31EDB6863F815D2A235287BFE3193DF108ACD8C6EB7D149E4689B4
SHA-512:	C4CDD5EDB6DE7EA1524901B8928BDFD6F43209D8403B59540C9773B62B94BADB5A516B39412260E26906C5C8FB673BDEB71F246B4169EABD3DEDF2C02E931D66
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="2x[Wall Width]x[Length]' [Top Plate Lumber Type] (priced EA)" GUID="{2BF83A2F-1AC1-4934-A645-D7C33DA1CE02}">.. <Properties>.. <Property Class="Text" GUID="{98B636DF-96D7-4FA9-B86F-DFF9C53607B3}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{2BF83A2F-1AC1-4934-A645-D7C33DA1CE02}</Property>.. <Property Class="Number" GUID="{B629AB16-0A57-4598-BC87-8D698F5E7355}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{79FE33A3-7D48-4948-A9D4-A66C18E11C36}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Length" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1&quo

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Wood Framing Assembl\Count Doors\is-R2KMC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	5.4003240977133204
Encrypted:	false
SSDEEP:	24:2ddfahWpX24f2WAdOcQMhWdl91OcoEB/CApWXnl8VW28WM1Ih+gAWov:cdKabqWksduNSO
MD5:	BE55CFF4C5E66C958EC914BD0440DD4E
SHA1:	389917FB5A2BE6A84E81C0BE86A28A68675F1290
SHA-256:	E77C52B9082BDCC190C6D7977DA88FBF6E4F8888AE914DC8CFEC532C15179496
SHA-512:	62245757067E122A844243DB3047036B9E7FB69401780ED32203296D2631E81CA1382CE688BE215EA60D8660AFA38BBA7D15B539CD348863EB6063B91227EC33
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Count" Name="Count Doors" GUID="{BBB19E02-A2B2-41E4-ACCF-97171EC9DBE5}">.. <Properties>.. <Property Class="Text" GUID="{787282ED-BA80-4602-B2C9-1280B352E8EB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{BBB19E02-A2B2-41E4-ACCF-97171EC9DBE5}</Property>.. <Property Class="Number" GUID="{3C327C72-C6B1-4767-8E0E-F92F4E641989}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">5</Property>.. <Property Class="Text" GUID="{CF232383-09CD-417E-A8B0-FD6450E2489F}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">Count Doors</Property>.. <Property Class="Text" GUID="{B576FC74-D00F-49C4-9341-93E9F1D191FB}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">Used only to count for Extra Studs</Property>.. <Property Class="Type" GUID=

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Wood Framing Assembl\Count Windows\is-NFF7K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1147
Entropy (8bit):	5.426360503285435
Encrypted:	false
SSDEEP:	24:2ddfRTyR/X2zGOf2WAdOctk8RvS1OcpIn9/CApWQKP6irVW28WwMgAWov:cd0R/7Cj8RvtlnRzve
MD5:	C663BCE157DC39C539CB07F22B1BCD41
SHA1:	342B80B260EF8FBBC334C9526FC34D61294073EF
SHA-256:	0712A4C140BECC52C561250A6391EB76D4A7E404B14394969F25F8BD7876BFD3
SHA-512:	78FCCB047B125C63DDA34C54E710492889983691AF8EF11533326778E8C19479448CC31CAB9F75C49D6CF164ADA2F06EEFDADA1000EF90CE565A541D221D5257
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Count" Name="Count Windows" GUID="{4AAF04F7-05E5-4DC7-94E6-FC17E31C246E}">.. <Properties>.. <Property Class="Text" GUID="{5003AB36-DC94-41CA-8DF8-C0037C770CC3}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{4AAF04F7-05E5-4DC7-94E6-FC17E31C246E}</Property>.. <Property Class="Number" GUID="{32397449-96A6-4BD2-8893-5A453F522347}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">6</Property>.. <Property Class="Text" GUID="{CB84C703-79CB-4535-936D-55B98C919CA0}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">Count Windows</Property>.. <Property Class="Text" GUID="{0D32B61C-7C5C-4938-9604-039DBD2FC8A8}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">Used only to count for Extra Studs</Property>.. <Property Class="Type" G

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Wood Framing Assembl\Framing Labor (price\is-28F54.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (380), with CRLF line terminators
Category:	dropped
Size (bytes):	8282
Entropy (8bit):	5.589341955416053
Encrypted:	false
SSDEEP:	96:GP0eluj0kC9o1M7MCDTWkhqMQ0tdMFLP2uSDQAcMTe02stpxM22qnj:8wjv1+pDTWkk0bMFuuSDQAw02stpuqj
MD5:	4613BBB129EE93F7BD2E5E4B0C90BB66
SHA1:	042FEFC8B3DF6994A0FED47CD5658FE090DE0E66
SHA-256:	B059C9C8702DCF283FEF750C1BA530AAB578D06424EC1B51169934E96A1E0AE7
SHA-512:	910164C93202AA0A0FB5306F9687EBB4C83757EBAB65758C9645F074A4F8152085FCEAD88AFF5F792628F920AC3DCAB9F0ECA6A272DCAFB31A566DA4E2B7EF49
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Framing Labor (priced per HR)" GUID="{943333C5-7647-4D31-937B-923916ADE4DF}">.. <Properties>.. <Property Class="Text" GUID="{81609626-22DA-4387-9593-5478B129C401}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{943333C5-7647-4D31-937B-923916ADE4DF}</Property>.. <Property Class="Number" GUID="{4FFF4F28-85A8-46FE-BC9F-D61C55A3CF1C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Memo" GUID="{E69AD8D8-BBE2-41EA-B678-01E40EF53100}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Production Rate" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False&qu

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Wood Framing Assembl\[Sheathing Thickness\is-UGUSS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	9863
Entropy (8bit):	5.608784249919876
Encrypted:	false
SSDEEP:	192:wbjr6Zcj/Kdud7b9lHPiF2QgD0cVIi2dislEnpNPj:wbSqj/KdudHviF2zbF2gslEpNPj
MD5:	93F363E4A9D3F2BD9CBD5C31249CF623
SHA1:	DED77E9DC6F850BCD318087F2139F80AB3D0BF39
SHA-256:	A6DF461AA4B5C9516BCF962CFA8A181BD9F7F61B72440669018721897A7A4B00
SHA-512:	D9FA4B064B53F275D83054CEA0928E035231F51E17E6C958A08CA3943A19F11D231E4838BE7861935B667082ED8341017F04EFE412EF9C7F8CF6E2ED16A673F4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="[Sheathing Thickness] [Width]'x[Length]' [Sheathing Type] (priced EA)" GUID="{2E60643E-DA7F-4619-972B-32E9110F2968}">.. <Properties>.. <Property Class="Text" GUID="{DF262D6A-AD34-444F-8A6C-ACE2C11B9A49}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{2E60643E-DA7F-4619-972B-32E9110F2968}</Property>.. <Property Class="Number" GUID="{493F319B-E53E-445C-B380-6C2AEB03CBE1}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{8F94FA72-ECDF-4D57-B5FB-6A8FE49DD0B1}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Description" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %&quot

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\Wood Framing Assembl\is-IRTDV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (25750), with CRLF line terminators
Category:	dropped
Size (bytes):	52486
Entropy (8bit):	6.062533327504386
Encrypted:	false
SSDEEP:	768:bp2l0Kxy3eHT158fUeJVk6dtUknQpGNTxA/KC7DUlq0GRGU5CPyRr:3uHT158fUqkuuGNq/KCF0GRGU5CPyRr
MD5:	2BDCC139C836BF16831495FA7EB5C4D7
SHA1:	C4B692265430A446DFA0F0742BA06CB8DC05C5F4
SHA-256:	29C5AE8804EB4B09FFF057EA09F754A20AF4A0A574025DE99EA106EA977CA15D
SHA-512:	EC0F4F3169121BDAF74318221AD44D652D331186DB66FF96AF97641A85A559A666857C19B4B5A3281FEDB9E6C42415D0C1DB785521693D0C0C4E4E87F4A8A76B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Linear" Name="Wood Framing Assembly" GUID="{C97B0E24-7FDC-4C9D-86CF-A45A6692BDCA}">.. <Properties>.. <Property Class="Text" GUID="{E009FBB4-5B61-4427-9018-4780F5473E85}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{C97B0E24-7FDC-4C9D-86CF-A45A6692BDCA}</Property>.. <Property Class="Number" GUID="{FB1F37D0-4213-4D4D-B049-800DCFD834E1}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">5</Property>.. <Property Class="Memo" GUID="{9362C7CC-7214-4C9A-AC2E-D9A23A81B6A8}" Name="Form Layout" systemhidden="True" OrderIndex="39" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\Custom Advanced Asse\is-VJI3J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	949
Entropy (8bit):	5.387627020021528
Encrypted:	false
SSDEEP:	24:2d2ciLDUo4X2p9bf2WAdOcfDUo3PBy1Oc2FIH3/CApWYIupgAWXv:c3ZU7yBNrUzu
MD5:	71B005CD4E0DD18BDE04901AC0558198
SHA1:	37A92DF8C3BCA22623F6D815AB53F16B2933B945
SHA-256:	17621863F2BDD842AA3E4EB7DBD3A2F146EFDF5E1461FC86FB5DE95CBFF5AE87
SHA-512:	DEA1701128AC6F7DF98DA62DC989AA3D133EBD491B0547D8BCC306D243A5F6DD451D7326120EBA756D2BB47666FB3B144F4EC0EE7303C170A39296E04903BC43
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Custom Advanced Assemblies" GUID="{95A1AD3B-3B4B-4C2E-B12B-39B6A1940C2C}">.. <Properties>.. <Property Class="Text" GUID="{D8BBC4CF-3A3C-49DB-9E4A-1DA1C9E636AD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{95A1AD3B-3B4B-4C2E-B12B-39B6A1940C2C}</Property>.. <Property Class="Number" GUID="{BE2BEB61-8C09-450B-89C4-4AD077E9DC1F}" Name="OrderIndex" systemhidden="True" OrderIndex="2" DecimalPlaces="2">0</Property>.. <Property Class="Text" GUID="{66AB20DB-B55D-4646-9C1E-5A780B1E58B2}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Custom Advanced Assemblies</Property>.. <Property Class="Type" GUID="{DD40282B-F1B1-4D70-A1BA-21FFD08F475F}" Name="Type" group="Item" OrderIndex="4" DecimalPlaces="2">Folder</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Assemblies\is-7TI2R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (5158), with CRLF line terminators
Category:	dropped
Size (bytes):	14836
Entropy (8bit):	5.905643546946615
Encrypted:	false
SSDEEP:	384:LuRcxvQibnBAAZ/JRPAIJc8IkDGs++Xi4iY70lpMWPXDUfAb6C6:F3Z/JRPfy8Ikas/Xi4iY700WPXDUa6t
MD5:	27513D26B21C6DE01773EFE63B6BF28A
SHA1:	A3A9820D4F647742CD247383B1A42C4DBA83E5DE
SHA-256:	32E83B8B0FD4E6DBA027E97375FC2D35378ABE0E73B77D87B352D09471501DF4
SHA-512:	6828EC489F34BB675841264FAB32EDCD3D0FCAF98B99452C6595A23493CDFE877C465AFB335431AF7A49B2310C25A76AA3846DD88B23A39826A02F5F876D7FD8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Sample Assemblies" GUID="{FE2D1B12-F546-466C-9E1C-87719E578EC5}">.. <Properties>.. <Property Class="Text" GUID="{8A162DB0-8B3F-45A4-AFD2-1D66235C8764}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Sample Assemblies</Property>.. <Property Class="Type" GUID="{92B949B5-924F-44EB-A5CD-0EEF1C4C2527}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="2">Folder</Property>.. <Property Class="Image" GUID="{C691B9D2-55F4-4F74-9CB4-6F909EF269F4}" Name="icon" group="Item" OrderIndex="4" DecimalPlaces="2" Transparent="False" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAALGOfPtRkwAAACBjSFJNAACHDwAAjA8AAP1SAACBQAAAfXkAAOmLAAA85QAAGcxzPIV3AAAKOWlDQ1BQaG90b3Nob3AgSUNDIHByb2ZpbGUAAEjHnZZ3VFTXFofPvXd6oc0wAlKG3rvAANJ7k15FYZgZYCgDDjM0sSGiAhFFRJoiSFDEgNFQJFZEsRAUVLAHJAgoMRhFVCxvRtaLrqy89/Ly++Osb+2z97n77L3PWhcAkqcvl5cGSwGQyhPwgzyc6RG

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\01.0 Gen Requiremen\Field Office\Mobile Office Rental\is-STQG3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (332), with CRLF line terminators
Category:	dropped
Size (bytes):	5708
Entropy (8bit):	5.5830810106534186
Encrypted:	false
SSDEEP:	96:LJTSkqbnMjm5E0d/koHoQ0tddLuXnXOD08uYWc1rz7:DjmK4coYbNuX+DeYlB7
MD5:	886559E03A954CF5D555FE549CB3009C
SHA1:	A7D1D1EF9B73CDA6ED20B7E62976F3775CE4E6D3
SHA-256:	B49AB76CB96C7F0156C29214438AC81CB53221C98ED01B93B2EA5DFCC8000103
SHA-512:	18D87DF48AC164791577AF0536D34699C5BA941E689B3E348BFA94EAA3EDC13A4FB4D510AF782F006D98410050F69D6AC5351BCD28C89815935E79139158719C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Mobile Office Rental (Priced per PERIOD)" GUID="{F3AD6FBB-CEE4-4975-8BA7-2666CEF92012}">.. <Properties>.. <Property Class="Text" GUID="{EA836395-6E01-4A13-9D3B-E1F738618643}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Mobile Office Rental (Priced per PERIOD)</Property>.. <Property Class="Type" GUID="{1014587E-2C61-4263-A1B8-D4404F2CF9CA}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Equipment</Property>.. <Property Class="Text" GUID="{80FC5B21-A1C2-4E7A-8C1F-3219FFE1E627}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{6FFF533F-EA85-4DFB-AB01-65EC9B4894B6}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{F3AD6FBB-CEE4-4975-8BA7-2666CEF92012}</Property>.. <Property Class="Numbe

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\01.0 Gen Requiremen\Field Office\is-1PFUP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1314), with CRLF line terminators
Category:	dropped
Size (bytes):	13983
Entropy (8bit):	5.548588248184057
Encrypted:	false
SSDEEP:	192:5TGjPmKa01vcDns4buOslwHO89S+7+DfMA9VIxuGXR61vIgRW3Sll:5SjU01v1dvGHO+1qLMA9VIxuk/gRWql
MD5:	277F9A8CF852E30C2DC2549738F78BC3
SHA1:	1D2802AF9E4D9A5005DCEEFA8F9CB6510C2097C8
SHA-256:	76D3222D5F43F1593E085B42FF048BC8A9F212D821564BBEBD84934989DEE5B4
SHA-512:	0D93FC593C0CA308574FDE0877CE517463B48E909BA04AA869F3B6CADC28D0903566E8F663C80E485E904951AB1400C1E277CD947BAA96F85BC78FECCAC5DB10
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Field Office" GUID="{F2A022F5-5CBD-4044-A5BE-E66C95B41AB2}">.. <Properties>.. <Property Class="Text" GUID="{DB2B088F-439B-45AD-A317-260443F59455}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{F2A022F5-5CBD-4044-A5BE-E66C95B41AB2}</Property>.. <Property Class="Number" GUID="{C986CE2D-69B4-4BDE-8AC8-5DE0F31C9DED}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{DDA30BCD-2EE6-4A19-B036-12A3CBA76ADA}" Name="Form Layout" systemhidden="True" OrderIndex="8" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Periods" Order="1" ShowUnits="False" SameLine="Fals

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\01.0 Gen Requiremen\Temporary Fencing\6' x 50' Chain Link\is-6DS50.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (328), with CRLF line terminators
Category:	dropped
Size (bytes):	5020
Entropy (8bit):	5.577198036705613
Encrypted:	false
SSDEEP:	96:tinwHRPMjmKcmdN2kDIoQ0td6LRvXnXOD08rEYIR21/i:4Hjm9yNBPbQRvX+D7EYdc
MD5:	B438D187ECD8814D0A09498935642557
SHA1:	81034E1DC347E86E5995B4C7562B4605E6057875
SHA-256:	587D03BC14572092CCC4A8433944F9F2F2B94D8DA4133C47E5B23643C1213639
SHA-512:	E8DA904FA57603F23BBAC89C6FE73558C67FCB71864FC9AF2D4AADE357A2AECBEAAF8A65A5320F051C9DB0987C939CE9A5469F1C17A1CF1F3CCADEC4DB02A465
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="6' x 50' Chain Link (Priced per ROLL)" GUID="{4A1CE032-A50D-4385-9F51-CBE8675B4A85}">.. <Properties>.. <Property Class="Text" GUID="{37A1B198-6D00-4AFA-9446-A44E76C2C942}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">6' x 50' Chain Link (Priced per ROLL)</Property>.. <Property Class="Type" GUID="{2E5C98FF-8A61-4BBA-A0FA-425B19E815E5}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Material</Property>.. <Property Class="Text" GUID="{D7B57C20-31D6-4D39-9971-A1DF756F1E0B}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{5C517E1A-F87E-4BA3-93F9-31A2875968DF}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{4A1CE032-A50D-4385-9F51-CBE8675B4A85}</Property>.. <Property

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\01.0 Gen Requiremen\Temporary Fencing\8' 16-Gauge Fence Po\is-58PM0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (328), with CRLF line terminators
Category:	dropped
Size (bytes):	5007
Entropy (8bit):	5.574602863852777
Encrypted:	false
SSDEEP:	96:o0jFroMjmwEkjoQ0tdGL0XnXOD08+HYsRa1Fd1:31JjmwXMbE0X+DEY7d1
MD5:	3B929DEF84505AF2863C515F5692F71D
SHA1:	9BAF3DF9D134139AA1B067F60C0288CAE24C37E4
SHA-256:	CE46ABB608A526A9AA001326BF8EE35382C9B5DB34B1A9331BE016288AFB7A07
SHA-512:	281775D800B69B04FF02DD1B5159BB1409F50AF689DDFF45EE6CCA9E784A9380EB59CAFC664E2F96FCB12B9908FAD834D5B4D2043B8D905FFF2EE14CE830B949
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="8' 16-Gauge Fence Post (Priced per EA)" GUID="{A3555C06-EADD-46DB-8BE7-22617C9C0A9A}">.. <Properties>.. <Property Class="Text" GUID="{F12CB600-1B84-4ACD-82F1-1BA661BD2A3E}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">8' 16-Gauge Fence Post (Priced per EA)</Property>.. <Property Class="Type" GUID="{A5611908-4545-4DC0-8A48-FC5E1F456A30}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Material</Property>.. <Property Class="Text" GUID="{D4B480A6-8CE3-45EA-BC18-A5CAF8F1BB75}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{DD590BC8-0F85-4FF1-95DC-032768ABBBCC}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{A3555C06-EADD-46DB-8BE7-22617C9C0A9A}</Property>.. <Property Class="

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\01.0 Gen Requiremen\Temporary Fencing\Fence Installation (\is-EQ576.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	7720
Entropy (8bit):	5.586943096445984
Encrypted:	false
SSDEEP:	96:nmtgLij2lxUaPQ0tdcncbLQD3y8BPj4onXOD08e2IiAK0HngH03oL:Ej2lOaxb0cXQD3y8iA+DO2N0HgH03oL
MD5:	B9A8D923AF024F23509DBC162C7F76BA
SHA1:	261084A651D6F8DD2B99F4999E45B039E9B96ED2
SHA-256:	9A30BCC7CA6655F6DFA707BF5AFF216C63D976E13226862D5BC994E653B88808
SHA-512:	C658013C0E3ABB8307B38CB24EB2ADD31D5F4A3C518F5DB68F6949D94F2275E2926DDDC3D8CB54E589DAF0B22EFFB8DC9F183143A9FDB71BC889D4833DD69A21
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Fence Installation (Priced per FT)" GUID="{BCE7CBB6-AD96-4A33-AEBE-7AF39F5E1360}">.. <Properties>.. <Property Class="Text" GUID="{33614F43-24E2-4C30-98AE-D7F91553932B}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{BCE7CBB6-AD96-4A33-AEBE-7AF39F5E1360}</Property>.. <Property Class="Number" GUID="{45C27D68-527B-41D3-86D1-43C9751B9CDA}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{F11905B9-1D6B-4AAE-A4E5-D4871F91B09A}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Labor Production" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="Fa

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\01.0 Gen Requiremen\Temporary Fencing\is-QB67S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	13590
Entropy (8bit):	5.6553187552834805
Encrypted:	false
SSDEEP:	192:2GjnHij8y/It5lb9qekDB8m0LV+DsRnIuYjcXZeWoZ1vc7qUL:XCYnrqekdeMIRdYjmpoZ1EOUL
MD5:	7DDC107A07800A59D8B5FB4E3DD29F89
SHA1:	4EC0FAA44117272F96D20A845F5D8AFEDEAEFD96
SHA-256:	A30103E0485790CCC2E9A7DEC81CC1D5467A4035C277A5B88C668D2455773A28
SHA-512:	EF9422481FA09FD4C08EEEF7AA7630C516391C3B84C79085EDC558287073AB04086E60925B80AB2276C218808A62C0AE4F988EFC9E539E879B98198EC9C50BE8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Temporary Fencing" GUID="{0F0684E8-6D9E-49D9-8019-D14819775B9F}">.. <Properties>.. <Property Class="Text" GUID="{7FC5F66F-DF5D-411D-9902-A8B9EDE2E86F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{0F0684E8-6D9E-49D9-8019-D14819775B9F}</Property>.. <Property Class="Number" GUID="{58F6F9F2-1AD5-4579-80C4-9B3D82D21B70}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Image" GUID="{D5BA0184-CDBD-4EC1-AA7C-B1F413895359}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="6" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADCHgAAwh4AAAAAAAAAAAAAZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\01.0 Gen Requiremen\is-QCEEI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	971
Entropy (8bit):	5.422552915744641
Encrypted:	false
SSDEEP:	24:2d26ZHhluf+I7UpX2D0FFf2WAdOckf+I7UgO91OcIMk2g+gAWa5jt/CApWOZHhLv:chhYfrUpP7frU1SNIxlhb
MD5:	F4C480D95EF61A6697913F5455F0BEEA
SHA1:	09DD76084A91B5917D0E43E2BEC7E8BCCBDEC41B
SHA-256:	969BB85C1C665B07B9D98728C09825942CB9DCC4EED1AB89D0B88B40343FBB4B
SHA-512:	71A274E5CD54F8D7955CDA01948B74D40C4936E8BB2BD7C118A0357927B577DC32451F669076C0FCBF864B0F71FE950234AE422B5CD386371C873A3C569BC200
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="01.0 Gen Requirements (Div 01.00.00)" GUID="{862CBF0D-B40D-4E3A-9358-4AA3D8EF5901}">.. <Properties>.. <Property Class="Text" GUID="{3F1EA199-17D6-4E91-9A20-EA0C6A00652B}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{862CBF0D-B40D-4E3A-9358-4AA3D8EF5901}</Property>.. <Property Class="Number" GUID="{CDE901DF-5002-40B2-93EE-D3BDC3F99250}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Type" GUID="{D36E3CF9-8FDB-4FD0-9E9A-C486ACF39E0F}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{92C25302-8269-4BFB-8F25-45FB57FD3D11}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">01.0 Gen Requirements (Div 01.00.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\02.4 Demolition (Di\Floor and Ceiling De\Demolition (Priced p\is-6BF3I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (329), with CRLF line terminators
Category:	dropped
Size (bytes):	4775
Entropy (8bit):	5.571943702019487
Encrypted:	false
SSDEEP:	96:A4DdCjqojNvkQ3oQ0td7fRxALoXnXOD08JYIMB:VD8jNMQIbbeoX+DZY7B
MD5:	59BFB2DA2DFBE97FFAA576947CAC249D
SHA1:	3DE27A023C7526E8D73B706AD48CEE666CCA8112
SHA-256:	8431E752B596E3D93E0C31BDDD94EF029A024DD43CEED093A9B4647C23B812D3
SHA-512:	8DFA59F79E62AA2B61992B3AE76E5C088B0B8C56C02695254961AE5F2333AACC5774428A7A5B83F19F11B19332B0755EE2D9EE366D3B46765CE08356C28614E3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Demolition (Priced per SQ FT)" GUID="{7F39C823-3693-42A1-B296-32F77E0E6A3D}">.. <Properties>.. <Property Class="Text" GUID="{AB66C32C-EC62-4434-A5C5-1AF37BF26C0C}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Demolition (Priced per SQ FT)</Property>.. <Property Class="Text" GUID="{13FBF973-58D0-4F0C-8A8E-86750A66D706}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Type" GUID="{A895666F-548A-4864-9260-F62CE1D65BBB}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Labor</Property>.. <Property Class="Text" GUID="{F66C862D-4169-41F8-972D-0960E3A179A8}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{7F39C823-3693-42A1-B296-32F77E0E6A3D}</Property>.. <Property Class="Number" GUID="{C6B99EDF-37E9-4B

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\02.4 Demolition (Di\Floor and Ceiling De\Material Removal (Pr\is-S04TU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (327), with CRLF line terminators
Category:	dropped
Size (bytes):	4977
Entropy (8bit):	5.579699289483179
Encrypted:	false
SSDEEP:	96:tHGI3/zMjmRknoQ0tdfLjEXnXOD08M/YIgt179Rd1:FtAjmO4bzjEX+D8/Ynf1
MD5:	8E321A3DEF644433F54B21CF721AE86B
SHA1:	B6B23F337EBCE631A09CCA6FDCDAA7C3B77C7C66
SHA-256:	D2DDFDD5B6A94714A32723FFCBD56F45DA99EAA977E5B4E2BADE78BF838F96B0
SHA-512:	40C01169CFFD0FC17A4E756E77765D80C383E9146BF2FA4199B767446E8D90947ADD301E963A5B05469D390B415868C82CF2AEA08CCB4568B5C557936E9804DF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Material Removal (Priced per TON)" GUID="{16975F29-31F1-471D-9B99-EE751017D993}">.. <Properties>.. <Property Class="Text" GUID="{103A987E-FBB6-4D2C-A68B-E7E04592BE03}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Material Removal (Priced per TON)</Property>.. <Property Class="Text" GUID="{511CA2C0-6E17-44FA-A5C3-C59A9D5F871B}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Type" GUID="{9E46C3A7-4D06-40A3-9ACA-48042FED0161}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Material</Property>.. <Property Class="Text" GUID="{7F9271EB-D2DA-48A8-9911-1A257FD3D758}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{16975F29-31F1-471D-9B99-EE751017D993}</Property>.. <Property Class="Number" GUID="{7FA7D

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\02.4 Demolition (Di\Floor and Ceiling De\is-2M0SN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	12485
Entropy (8bit):	5.619123372719408
Encrypted:	false
SSDEEP:	192:ymIij9riFEbkba8NUK+yhl+D86lOLbX7A1gg/M02:y4xriFFu2v6TlOLr7g/R2
MD5:	0C4D5151C94B671060C160911F1D063C
SHA1:	A88955ADB4474B63CC0E295798277226823E7C63
SHA-256:	251319BA9CADFE532D85F7394CCD854D358FF9FDD54BF8F2ABADDEAF190ED9B6
SHA-512:	C7D9AF5C9ECC9887AE3BC4561727B339D8081620DA4ECCDF02E0BF6198C7143477A88FB9F45F5F1076BC1AF1FEE64203C0B9DBDEFA2403D84B68870D10E3E04B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Floor and Ceiling Demolition" GUID="{2F42B5FA-A786-4E64-96E2-EE5FDCBAB965}">.. <Properties>.. <Property Class="Text" GUID="{C0AB0070-FA4B-4CC8-8B46-51287595DD90}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{2F42B5FA-A786-4E64-96E2-EE5FDCBAB965}</Property>.. <Property Class="Image" GUID="{3A2875B1-6D0F-412E-BC14-2C23FE56DF1A}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="2" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZfmgZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZfmgZGRk////////////////ZGRkZGRkZGRkZGRkZGRkZGRkZGRkZfmgZfmgZfmgZfmgZGRkZGRkZGRk///////

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\02.4 Demolition (Di\Wall Demolition\Demolition (Priced p\is-IOVBE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (329), with CRLF line terminators
Category:	dropped
Size (bytes):	4942
Entropy (8bit):	5.571492315249366
Encrypted:	false
SSDEEP:	96:8A1/vMZpmojN5kioQ0tdhKMRyLiAXnXOD08eNYI+N8:8CE9jN2Bb4MOiAX+DYYY
MD5:	558725149E6AD223E8EA419B6DD48510
SHA1:	05B7DDBE35F9240CC3DE2F2830ABC58001810BBF
SHA-256:	5BC12E227E3DDE0F1ED0914333DE9683E745B339B503781910C23B58A9B948DC
SHA-512:	B1D4C8795C6613108F4218CFD27838754AF75B76E61EDF27A4B9D19B3E363D5A84C8C84E435F3D524E717ECB0CD31B54E258AD0CE28002C05625AEF2930E22E5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Demolition (Priced per SQ FT)" GUID="{00DD0033-01C5-4F71-B4DC-B3DF53F5B155}">.. <Properties>.. <Property Class="Text" GUID="{7B5631D3-FFB1-42D4-A02E-EB3B8683D8B5}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Demolition (Priced per SQ FT)</Property>.. <Property Class="Text" GUID="{D3E1482C-705A-4FBE-93E5-02FD6D46FD6D}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Type" GUID="{7B8B29DB-6399-4C23-9A51-D39EFDFEECF8}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Labor</Property>.. <Property Class="Text" GUID="{243072CC-D7A9-47AA-8E20-E9ECDFF4C89E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{00DD0033-01C5-4F71-B4DC-B3DF53F5B155}</Property>.. <Property Class="Number" GUID="{711439DD-5791-43

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\02.4 Demolition (Di\Wall Demolition\Material Removal (Pr\is-BJLK6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (327), with CRLF line terminators
Category:	dropped
Size (bytes):	5163
Entropy (8bit):	5.585383529800357
Encrypted:	false
SSDEEP:	96:JP4Gnh8ZJn2npASzMjmEbdVkqoQ0tdJLJXnXOD08IlYI/O1mc:ZnhvmSAjmE5i5bxJX+DYlY3gc
MD5:	3F5854560BC3B88CE0489A35CD8643C0
SHA1:	A11B47842D1D0D86F09385B07BB0BD81EBD251AF
SHA-256:	663ADC524E4F2181946816B162C42560F624E737EE4F4A82A19FF2B98AEF9DE2
SHA-512:	FF86D9DD07A1558ABEFCF94EEE1C8A2B333E7A676823F83565D6E27CAC09EC51DB63C124DFB9CA31B8C25D735A825C67C132CBEA4D5FE8DC33E3251C549AF838
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Material Removal (Priced per TON)" GUID="{DEE9595D-530F-45D8-8216-D5DB1B3FF4AC}">.. <Properties>.. <Property Class="Text" GUID="{6F0181A7-F376-4DC7-A3AB-C252EE248CF3}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Material Removal (Priced per TON)</Property>.. <Property Class="Text" GUID="{9BE1A02D-128B-4DB2-A4E9-87D47A2D58B2}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Type" GUID="{E746544F-C8EC-435E-AE5D-71E190F63B47}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Material</Property>.. <Property Class="Text" GUID="{CE986C5C-8AED-4136-A9E5-E19E047B560C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{DEE9595D-530F-45D8-8216-D5DB1B3FF4AC}</Property>.. <Property Class="Number" GUID="{6B7FD

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\02.4 Demolition (Di\Wall Demolition\is-3N3R5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	15036
Entropy (8bit):	5.655628267291539
Encrypted:	false
SSDEEP:	192:l2EjD58jfdb2lHFp8wWBmSbV+D7XRlTFtHRg3WGLX7XZiKvlBW:ZnSjfm/VWBmS8/RlK3WG7DcKdBW
MD5:	1CD566AF9035AD1A316CFE203250F82B
SHA1:	F7F3286F90C7846985A54127D36C9F3B66F4A517
SHA-256:	CD4E10E2E53E4D618A4DCC9F03D743C51D30CB42788B094F70ED5DE11E82D286
SHA-512:	9EAB8C954B674BAD0EBE04D194957B0397B58C9BCAC19CE08A5881DE554454E12C1BCD54DEB9F09749D7A579EB84DB49036F471456920D98E5433EE7040806DC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Wall Demolition" GUID="{B6C31181-9789-4E5F-B6F5-639B032423E2}">.. <Properties>.. <Property Class="Text" GUID="{4EF2CFE7-1A68-47B6-B44C-C7849936F9E3}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{B6C31181-9789-4E5F-B6F5-639B032423E2}</Property>.. <Property Class="Image" GUID="{ED8D7284-729C-48F4-A186-05844FADCA2C}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="3" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADCHgAAwh4AAAAAAAAAAAAAZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HZGRkZGRkZGRkZGRkZGRkmV0HZGRk

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\02.4 Demolition (Di\is-3AUAD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	959
Entropy (8bit):	5.441923090132649
Encrypted:	false
SSDEEP:	24:2d2mX+X2FBEf2WAdOcGWs1uS1OcCSI1gAWaqW/CApWCpv:c04cbP2w3C/
MD5:	5BA98B3289837DD906C27A1D5E43BDCC
SHA1:	909AC14E7ED92D9A9285856BB607C96A3FF6FDC5
SHA-256:	D6EEDAC92C97245323146802770E01164F5F7FB69880FF1FE4C58C221E281BF4
SHA-512:	CD7C3D392A84AAC49E62C9ED425A7E0A1963DACD1FB718DC26F74F2283697E1F594CD89898BA4315B9A69C23B77C4E652A758BB70BA7EA2E35C85E4811E3C216
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="02.4 Demolition (Div 02.40.00)" GUID="{853F1903-3B73-4C8F-AA2A-CEA92573CEEA}">.. <Properties>.. <Property Class="Text" GUID="{A0507F43-35A9-4179-A19E-386406FEBABE}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{853F1903-3B73-4C8F-AA2A-CEA92573CEEA}</Property>.. <Property Class="Number" GUID="{E8E3D547-A8CD-4728-8607-6AE59A3381E1}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Type" GUID="{956C4EF6-BDA8-4611-95F8-0D4886588E9C}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{1ECC0C3A-CCBA-4E04-AFF4-9BEF687F7E01}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">02.4 Demolition (Div 02.40.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\03.0 Concrete (Div\Continuous Footing\#4 Rebar (Priced per1\is-G3R8K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	13623
Entropy (8bit):	5.594345584187336
Encrypted:	false
SSDEEP:	384:TNMCVqtgrq3k+JJRoPf6ciJqEfYH9LWsYDLuMi+ZW9KVPj:6xgm3k+/RoPi7JqEfYH9LWswLUABj
MD5:	334B91BA2717D4A29D6226065B7BC16B
SHA1:	7D7996B45D4B593716F304007B7A39C4D36AE6CA
SHA-256:	F7B73B1AA61AD76CD7BE757557AD12896B0EF2368185954E293DADDC837F4231
SHA-512:	6D5376DB1C742D9935D956C34C6025F3C5A9EF0B9F2F39B3DE5C6FD3D9247A6A0828B429391955E980AFFE1F54A01D2D8054774425B1EA658A14A3337FA166F3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="#4 Rebar (Priced per LBS)" GUID="{0EDC5E28-3C6A-4BFC-8229-39BB708D6C8A}">.. <Properties>.. <Property Class="Text" GUID="{AD34509E-21FE-485E-AA02-26600151EA00}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{0EDC5E28-3C6A-4BFC-8229-39BB708D6C8A}</Property>.. <Property Class="Number" GUID="{6EA18B19-340B-4D83-A574-C3ABCC4802BF}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{66EF22E6-38BD-40F4-92DA-88896259F85E}" Name="Form Layout" systemhidden="True" OrderIndex="11" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="OC Spacing" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False" SameL

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\03.0 Concrete (Div\Continuous Footing\#4 Rebar (Priced per\is-8Q2AU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	12594
Entropy (8bit):	5.588001841596869
Encrypted:	false
SSDEEP:	384:UGmzKxQHhfwknd1nbmJu4rAp94BYFjt/8EaMicMDKNPj:UI2hxn3bmJuaAp94BYFjtEEIQZj
MD5:	74C4ADC400E46B647EDDAC19F0F0733B
SHA1:	43A61BCF9720956CD1412D8143B662054B67CE41
SHA-256:	F9C0F8AAEA53997C37B1FEABF644AE553C03D53FF8FAD6B7746BE356EADE9731
SHA-512:	C5811CFAA71808F91314929C50A2649F3ADCB20F21D19526BF6AD248AF6A87D181651A5492E57C4869E3B796809F4D5D217EFF333C1AF422F569290B3B4CC245
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="#4 Rebar (Priced per LBS)" GUID="{E6D658A3-96BF-45FA-B80F-6D12D188379C}">.. <Properties>.. <Property Class="Text" GUID="{116D2293-C2F8-4353-8E44-2E8B536A770E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{E6D658A3-96BF-45FA-B80F-6D12D188379C}</Property>.. <Property Class="Number" GUID="{FDE29FBC-6E8A-42DD-9CA8-492362D4785E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{B863E06F-2B99-4D5B-9459-F4383BD75ACD}" Name="Form Layout" systemhidden="True" OrderIndex="11" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Rebar Size" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Runs" Order="1" ShowUnits="False" Sa

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\03.0 Concrete (Div\Continuous Footing\Concrete (Priced per\is-7CQDC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (378), with CRLF line terminators
Category:	dropped
Size (bytes):	9030
Entropy (8bit):	5.605423350841622
Encrypted:	false
SSDEEP:	192:zbj7QF/PjelCbOQlHBLPJzDKG3+Dh2WBRj:zbAtPjelLuBJz0V2WBRj
MD5:	FB3B7924DBC634C52FC7558CED16167E
SHA1:	75F54C82CB0EC9F0008E7F1CC98B117B854E366A
SHA-256:	CFF2A10D8B2AE9610841BBF22E16DAF9AFD9B27386FCE4204228AAB9B45BDEE7
SHA-512:	2A235FA3AAF324F3BE047BA858FDC6EB18F68FD8E77DB470E7879B29C06DDA939D4812673FDD2A9FD271C1BA8AC7F20D874E2E8ED7B937D02B799031003C79EC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Concrete (Priced per CU YD)" GUID="{F6318EE0-DA4A-41C1-8048-020D5626CFAC}">.. <Properties>.. <Property Class="Text" GUID="{EF10D698-C8DC-4155-895D-8B509735B81A}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{F6318EE0-DA4A-41C1-8048-020D5626CFAC}</Property>.. <Property Class="Number" GUID="{FEDBF371-8BA2-49FC-8D16-2C60549C19D8}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{5B844E8A-B2CF-4F54-8F67-E1494A5DB140}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Depth" Order="1" ShowUnits="False" SameLine=&

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\03.0 Concrete (Div\Continuous Footing\Concrete Labor (Pric\is-GAAM8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	9112
Entropy (8bit):	5.601418070221082
Encrypted:	false
SSDEEP:	192:0j2qdWiT/nmiJBDbMfcL0JDVObA+DY42dgUj:0RTfmiLnYJ4/2dgUj
MD5:	99439F39F254B5B3C2890CCC79D75664
SHA1:	E684C799E16659AE1D1E30349E5715C67B2367AF
SHA-256:	B551603F51DB050DE94AFC3B3D0B9957A33C6FEAC1C1AC79829128C807CD128A
SHA-512:	CE483AB4C3D577202BD8FB6BE5762C800A6D5474909B4363DB20D9C53E35F309C18384815536B1C714F42524791BBB66025228680613D8C3EC8598598115D042
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Concrete Labor (Priced per FT)" GUID="{74BE3261-EF3B-4383-B63B-6E0FC8B6B9A1}">.. <Properties>.. <Property Class="Text" GUID="{B3E2FFD4-A4DB-46B6-B4F5-4B553372B923}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{74BE3261-EF3B-4383-B63B-6E0FC8B6B9A1}</Property>.. <Property Class="Number" GUID="{A973986E-9D77-4A71-8490-2137CD0DB183}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{18618F13-8273-46AF-B3BD-35F48E4F51CF}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Labor Production" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False&

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\03.0 Concrete (Div\Continuous Footing\is-55DOR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (416), with CRLF line terminators
Category:	dropped
Size (bytes):	18323
Entropy (8bit):	5.563158064701477
Encrypted:	false
SSDEEP:	384:Zm/tAy0mUKI9lEQT6V42tfOvJOFqxfLGsz8AvXyV1h:Zm/tAy0mUzT6V42l6JOQxfRNW1h
MD5:	82AF6EB7E2A3F6E643CFDCDE5A33DB93
SHA1:	4027D94E722E31C2EB6108C16EA72F43A4F66603
SHA-256:	F9B1F535084BB76145B959163A2EE26E0C61D4A9D7D145F9025120A5EB527640
SHA-512:	9D473AF7ED4E3ADE8C97F654822D41382A360BC42F22015E3D94065CAE27A15F1B159FF8C217426A7348C1D3ECAD608F644F8610DBAB77DF2103F2515CD10D1A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Linear" Name="Continuous Footing" GUID="{3DDDF042-4BBE-4045-8CA3-9EC750E12AF4}">.. <Properties>.. <Property Class="Text" GUID="{06DE68E8-76D2-41CA-BF32-617EA878585E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{3DDDF042-4BBE-4045-8CA3-9EC750E12AF4}</Property>.. <Property Class="Number" GUID="{8DBB0100-BDDD-436D-B649-85AC7520982D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{3996193A-F671-4069-9FF0-0AA61A8E6C1C}" Name="Form Layout" systemhidden="True" OrderIndex="11" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Width" Order="1" ShowUnits="True" SameLine="Fal

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\03.0 Concrete (Div\Slab on Grade\1%22 Gravel (Priced pe\is-96SLL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (377), with CRLF line terminators
Category:	dropped
Size (bytes):	11952
Entropy (8bit):	5.592776303781007
Encrypted:	false
SSDEEP:	192:PjZtT5ZbDlHvlIbdprenAcgju5m+cj1DuI8HXNMEES33+Dq2SNS6QL:PP5n9idpenngju5m+cj1CIMXNd+22SNO
MD5:	7A64606D7955341283AED0BAE00FA532
SHA1:	FFAD733D73DD31754D9F7EE34F66B7C673141151
SHA-256:	BE650666276F8FEE8E4674CB157844E3296568FC776B2E26D307459C57FBD808
SHA-512:	6A4FF91660328554E9018A10993228D3A69AC63CC9E8A57A07A6898898756F345D0A79177FF11FF4DD1E4CC51661F873B7A7E2149E200C9BC025336D39BE596D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="1" Gravel (Priced per TON)" GUID="{50E79D1A-13D2-46F4-BAB1-0C6BE9B39224}">.. <Properties>.. <Property Class="Text" GUID="{93DD3F17-0DFE-4E67-B887-962A28050107}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{50E79D1A-13D2-46F4-BAB1-0C6BE9B39224}</Property>.. <Property Class="Number" GUID="{A320CD50-F5CE-41C1-BF2F-A84A2642FE09}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{53B89D50-EAE6-4B49-803D-F54974E5DC60}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Thickness" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\03.0 Concrete (Div\Slab on Grade\15 mil Vapor Barrier\is-FRLHH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (380), with CRLF line terminators
Category:	dropped
Size (bytes):	7152
Entropy (8bit):	5.589559565871771
Encrypted:	false
SSDEEP:	96:p+26E3jW2kIyVQ0tdOld4LbI3h8SmcnXOD08cqIDrKDnLpZB63h:pNjW2kIy7bOlIk3h8F0+DsqPDtZB63h
MD5:	BCB6773F7D6769538C1C4697E3FA609D
SHA1:	8F190489F078C3A618B35B7C53EBC14DE371A84B
SHA-256:	912DF0CEB7BF0DF06A6104C858875D96B9F85D5BB3055FCEEA3220AB63784FE8
SHA-512:	7EF260A92967902E55094F77BE94FA41BCCBF81AB76F610AD6A3F9B70DC6688B8D1F52FC7D0446E7E9DBE6E58941C7BCFA54E66BD200630282653C3D248898EE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="15 mil Vapor Barrier (Priced per ROLL)" GUID="{51CC35AE-B5B5-4170-BA80-30F9939291F8}">.. <Properties>.. <Property Class="Text" GUID="{8E33F89C-32CC-4C6A-AFF3-BADE118230BE}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{51CC35AE-B5B5-4170-BA80-30F9939291F8}</Property>.. <Property Class="Number" GUID="{744C9C34-5AE0-4E18-B2E7-2CEA15AB06D8}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{AA8F83F9-D28A-4A69-98CD-DEBC65603CC4}" Name="Form Layout" systemhidden="True" OrderIndex="10" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits=&q

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\03.0 Concrete (Div\Slab on Grade\Concrete Labor (Pric\is-OLMQ3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (343), with CRLF line terminators
Category:	dropped
Size (bytes):	4352
Entropy (8bit):	5.5689863502226
Encrypted:	false
SSDEEP:	96:NYu6Y3ojNACkDooQ0td9DSWLrXnXOD08TYII:BYjNYDDb9DS0rX+DjYj
MD5:	3FB016ABE54F76DE1282BCAA977CE524
SHA1:	6F2FE91A959D6FFF9AB9DF5DE29E24377F7CF71B
SHA-256:	1D9B367DAE1B19124B818D351F4148C742F215D30F4503EC657A6171A3A15A54
SHA-512:	C783F19B8D0690DCB731B33C9EAB832A9FA67976AF6A1191528001F2D213F05E1EE46BFE0C2B1295E392090009783CE2CBFEC007C175CAE04B5FC6787CCABD64
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Concrete Labor (Priced per SQ FT)" GUID="{6BC13B83-90AB-4DBD-A206-44166F566C6D}">.. <Properties>.. <Property Class="Text" GUID="{EBB8A030-156E-4235-86F6-7FBCD545BCC5}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Concrete Labor (Priced per SQ FT)</Property>.. <Property Class="Type" GUID="{BD7803C5-9483-4F68-A872-333BFFCAD99B}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Labor</Property>.. <Property Class="Text" GUID="{CB951FC0-2988-436E-9366-AD12ADB9AE74}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{6BC13B83-90AB-4DBD-A206-44166F566C6D}</Property>.. <Property Class="Number" GUID="{82791106-3FF8-4B6D-831D-DB6FE246CFD1}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Memo" GUID="{DF9C84C8-B1F9-4100-9693-610631BB1377}" Name="

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\03.0 Concrete (Div\Slab on Grade\Concrete Slab (Price\is-0NTN7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (378), with CRLF line terminators
Category:	dropped
Size (bytes):	7014
Entropy (8bit):	5.59508189524451
Encrypted:	false
SSDEEP:	96:HmPsq6jrIzvQ0td6AtjLOD08BDGU3nXOD08N2I7I4WNhvnfz0n2wqL:M2jr0RblNOD08tL3+Dd2FphvfVwqL
MD5:	C200A6AEE803862DE5FE52DF89CE3F1F
SHA1:	E479929C36E43BA9EE6E9A63B29DA2EA75994326
SHA-256:	1CCBF8B41FFB63389CE82B451A7A3ABBA0A6D18A7024ED60BF675C31BBEE95F3
SHA-512:	44AF8825544DBE1FE7F1B2A55F203A713D8DD833744ADADF42F39A05539C072E2A04A6374A133AA278BD3E158E8B9F0787D52A8FEE88FEF45E2FE1E4ECD7E7A7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Concrete Slab (Priced per CU YD)" GUID="{631B5FE2-9A7C-47B7-AD04-CC8552C130AF}">.. <Properties>.. <Property Class="Text" GUID="{F06888E6-200B-49A2-BE06-97A06602963A}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{631B5FE2-9A7C-47B7-AD04-CC8552C130AF}</Property>.. <Property Class="Number" GUID="{D601573B-B197-432E-B238-1D8F2759F504}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{A41FC968-7F89-4160-BC7D-983C90589973}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Thickness" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\03.0 Concrete (Div\Slab on Grade\Rebar (Priced per LB\is-BTB41.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	12175
Entropy (8bit):	5.6094545320389475
Encrypted:	false
SSDEEP:	192:t3fqjTdmUppjbCZ/nTHq6cse43Sme8MyOYUCnghPyW98wIj6+DtMiggSKDPdd:lq9mUTCZ/nTHq6cse43k8MyvUCg1yQdO
MD5:	7C28762CB7D3D8836EAFF8E4AF5A8AC4
SHA1:	34DF6437893BBAC6D3D09FB596C4E207D986DF95
SHA-256:	FFF6B6DB03B7BCEA19D736F5AD1323361D9EAEEE2D0FB857526233AD1EC5D31D
SHA-512:	4A7C018FC5FDE0A22B715FE3D018D756482427510A28B2E5FABA1B7F429DFC869272CA2944A28F84E8DF030D2488289AE669D7654AFA4CDF44FEB89959BDB8C6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Rebar (Priced per LBS)" GUID="{B6A50923-54D7-4A73-95F6-1C9DA508AB89}">.. <Properties>.. <Property Class="Text" GUID="{352F0220-C478-4E80-81B5-317820DD37F4}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{B6A50923-54D7-4A73-95F6-1C9DA508AB89}</Property>.. <Property Class="Number" GUID="{9B051FC5-2EDB-4B30-A5D7-5FE9D3FFA444}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{44F28717-29C8-45BF-8342-2EB0D72D15C3}" Name="Form Layout" systemhidden="True" OrderIndex="11" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Rebar Size" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="OC Spacing (X axis)" Order="1" ShowUnits="False&q

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\03.0 Concrete (Div\Slab on Grade\is-TAAOU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (32644), with CRLF line terminators
Category:	dropped
Size (bytes):	49734
Entropy (8bit):	6.115985276637798
Encrypted:	false
SSDEEP:	1536:KBzCb4coObjFzbZ+TJedeTLreyjetKvP08TvEzx5l/D/zc1yh:gjetc6xr/bQ1yh
MD5:	7FF372E23C302B4109D229430D10D86D
SHA1:	4789A2AD0DA9A9A39146D220FE90FF0C3CBBB5F3
SHA-256:	D53A71A18299B5B744B3C927B10D8C206B5A2879CC5A8CB787B91655AB5EA381
SHA-512:	AC8BC03D5AF2A51FE623590CD589E6057877235566E3F8F07F14A6A97226FA30DBED9A07CE5CB214F8EF041FC8DFE3EA8FAF2DFCD6E7F8DC7F4583DCE394176E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Slab on Grade" GUID="{8BE69968-07EC-4D70-A6DF-E83D077A0715}">.. <Properties>.. <Property Class="Text" GUID="{54551B0E-0F03-4163-A519-40B050B71716}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{8BE69968-07EC-4D70-A6DF-E83D077A0715}</Property>.. <Property Class="Number" GUID="{C61EECFF-CAEB-4F47-8B97-B3DFFC09B3B7}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Image" GUID="{29EDE0BE-4556-4EDE-A538-327F4A706C04}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="5" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZfmgZG

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\03.0 Concrete (Div\Spot Footing\#4 Rebar (Priced per\is-VSHV5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	11324
Entropy (8bit):	5.598824877557431
Encrypted:	false
SSDEEP:	192:MWjMISr6eKG5bmxz/lDouinhHvtxKdcehfZ7GPntNkO8XP6+DsMiqhQK4LP8a:5AISe/DDousPtxKdfhfZqPtNkOmfQMi3
MD5:	F2E0918C84ACD0BD89A10E46DBCAE948
SHA1:	F1F2AB5861268F08305B3F6D5741D3A990E0DE3A
SHA-256:	28967C872A49D456DE034D83CD286B6E388ED0F8F9576A1C3F1E4A0A27397795
SHA-512:	693CA93076876DD5F80CD4C75322D78EE38E96AD744B6B6ED226EFD656233208CA3D2E49AC7C432DA836FA6A142D711B8BD658515DA41710B94F49C701FF9AB5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="#4 Rebar (Priced per LBS)" GUID="{E00CE94D-F508-4F66-93DA-90847295F610}">.. <Properties>.. <Property Class="Text" GUID="{5A219DD0-E592-405B-82A3-831C8CA093A2}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{E00CE94D-F508-4F66-93DA-90847295F610}</Property>.. <Property Class="Number" GUID="{74DB4FA7-226B-43D0-812A-7A96B354FBA6}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{7EC657E6-5662-48BC-8EEC-E29FD070E218}" Name="Form Layout" systemhidden="True" OrderIndex="11" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Rebar Size" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length of Piece" Order="1" ShowUnits="False&qu

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\03.0 Concrete (Div\Spot Footing\Concrete (Priced per\is-1UIBG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (378), with CRLF line terminators
Category:	dropped
Size (bytes):	7830
Entropy (8bit):	5.60805678557635
Encrypted:	false
SSDEEP:	192:lr9j5MshbXlHLl+63utDA8O3+DS2Rui+pkmnvL:XSEp+/tUK+2Rui+pNnvL
MD5:	3EAF81C3A243FCDBDED877262A707EA8
SHA1:	7365C76122B29809918F60E07B3836E9C8EF726D
SHA-256:	02C1EED8310690ED2E56CD0A395977B02B2A3F2724CDF36FDE5B0E9838DFE104
SHA-512:	CD9BA781978B51F0037FA62B086B04DBE4FD6D84A0259CF0B19FB1629AFEE9F6EE6C14501B821AA333691598C7E1AA529F156434CE620CDC06E53E08D4F3A673
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Concrete (Priced per CU YD)" GUID="{41F503D0-01DF-402C-8924-9FBB5247DE6D}">.. <Properties>.. <Property Class="Text" GUID="{FBCA7072-1FA8-4F6E-883E-E9198E492730}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{41F503D0-01DF-402C-8924-9FBB5247DE6D}</Property>.. <Property Class="Number" GUID="{00982DBB-0BF2-4CCE-AA6F-1CC08C02922B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{10717AB4-37BB-42A3-A9C8-10F1AF4B8562}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False" SameLine=

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\03.0 Concrete (Div\Spot Footing\Concrete Labor (Pric\is-RFIGF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (378), with CRLF line terminators
Category:	dropped
Size (bytes):	7475
Entropy (8bit):	5.583448786059794
Encrypted:	false
SSDEEP:	192:YlHjWO/b4zdDp8tA+DE/2OzD1GEE1yL+XL:aPkJdq+2OzDY1yL+XL
MD5:	1AE4B7647ADF2F3CD4B84E849F6ECF69
SHA1:	121651B7337A2942B489395086770F7D58AE8145
SHA-256:	23E0EEC5D6ED170EAFB76C8AD0BC7D0A69D475BBBAFB21FCA0AE517F2A4773CD
SHA-512:	0ACCC7547083AF56CC9589DB527838F4D19A7D77B12CEB12ECE54E3C01FC1B74B6BD44F8BF1970B5CAB11B55C5EB06B0C5DF4FB2E2CE6D21B05A0F6B4577D70B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Concrete Labor (Priced per SQ FT)" GUID="{F1F66B2D-AB6F-47CF-A265-F313B5DFA2D0}">.. <Properties>.. <Property Class="Text" GUID="{70133734-DA1F-4203-B0CA-6915F7B8B5E6}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{F1F66B2D-AB6F-47CF-A265-F313B5DFA2D0}</Property>.. <Property Class="Number" GUID="{FCBA7302-72CE-409C-B1AC-5256B202AF80}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{05BADFA8-401E-4FAA-A1F5-CA9CA13ACCBD}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Labor Production" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="Fal

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\03.0 Concrete (Div\Spot Footing\is-BVCCB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1314), with CRLF line terminators
Category:	dropped
Size (bytes):	22018
Entropy (8bit):	5.584233541085102
Encrypted:	false
SSDEEP:	384:i9uBoojBzgz6wZFm78T4Ap5Dc9y0Keri1wfPA30MdrDm0FfcZNs/kFMdZxhEh:i9uoojBMz6wZFm78T4ApZkTgOXoFrDm1
MD5:	2BCB70D1F3B2E5AAF85F7B07C84E1B58
SHA1:	FB27568362772EE6048205F98681D3E5BD87C057
SHA-256:	647C49F605DB9A87995A74BCF5426496EF613B75EC38B3EC27B3A822DFFC0CB1
SHA-512:	020CEE01F255198477195CFE9D74CEFECAADFC86078E2C60789EB248320211F32FCC325FE64D93058BA75A83B82B96448A6E20E7EA8FFFDDD331965D88CE828D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Spot Footing" GUID="{2AFD06B8-E18C-482D-9915-C27E2B9A6736}">.. <Properties>.. <Property Class="Text" GUID="{5FD617CD-8460-4816-AC52-D28009480DEB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{2AFD06B8-E18C-482D-9915-C27E2B9A6736}</Property>.. <Property Class="Number" GUID="{BCC4DDEC-3000-4501-8F49-653E714333FA}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{6DCE4228-EE59-4BB2-A09C-75EFA903FFC3}" Name="Form Layout" systemhidden="True" OrderIndex="8" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Width" Order="1" ShowUnits="True" SameLine="False"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\03.0 Concrete (Div\is-3FCK3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	955
Entropy (8bit):	5.43144703741256
Encrypted:	false
SSDEEP:	24:2d2j63tX24cf2WAdOcK3OzQnh1OcauoWgAWa/X2i/CApWf3v:c663tOB3qkGM2mWf
MD5:	FB5B063B9FFAEA2DD6B504D913D5F054
SHA1:	9C4C9D1207F50CBCE07C54360EF15616BD7B65B1
SHA-256:	26CD9DBFE2E65B5C931FB8A18A6D9FC16C92FC5235CF485AAE942B51B939B8F9
SHA-512:	E7BA52DDE7C58E7250838522563BDB7F69A8E0557034347948024731C52224D54CC7942BAF2F5E83DB8B8211D6DE8EF9AE2479D00DE0D1B50DCA0B89363B6BD2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="03.0 Concrete (Div 03.00.00)" GUID="{30C69EF2-DB8B-4F67-B801-311FB8029F16}">.. <Properties>.. <Property Class="Text" GUID="{5A45DB67-CE66-4202-A168-64AFD9BE5022}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{30C69EF2-DB8B-4F67-B801-311FB8029F16}</Property>.. <Property Class="Number" GUID="{3D405C6E-8E4F-4F96-9BF8-AF9CCDCEE3F2}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Type" GUID="{782D694B-957C-45A9-B0A4-4A90656FFB99}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{3D4255A0-DE59-4576-A054-77F4B91BF0CB}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">03.0 Concrete (Div 03.00.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\04.0 Masonry (Div 0\Brick Wall\Brick Labor (Priced\is-D8VVI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (378), with CRLF line terminators
Category:	dropped
Size (bytes):	8100
Entropy (8bit):	5.587335008279214
Encrypted:	false
SSDEEP:	192:2ejq6UIbB9RjDzB8jJ5NA+D92jtvfdv4L:2e/UEFvBg5Tp2jtdv4L
MD5:	F55259213666D8DF42F2C5D9C9A2AB7B
SHA1:	B02A05369303F2BBB284D3581511BA73C5088436
SHA-256:	253421149722197F46B166BD7AE7C82EE743A9A55EC058C31557C34ABCD489F6
SHA-512:	4EB5C0C192281BA40E01DD607196DF8DF7FFF78D7874B3FC0663756EF9ED7250A4C1AAA4C92CCC41445ECA3518CBD85FB715B93BEE2C9356EA3DE5B686348DC3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Brick Labor (Priced per SQ FT)" GUID="{1BA6F97A-EC86-4DCB-B4C4-A0C881AC8660}">.. <Properties>.. <Property Class="Text" GUID="{F1434E96-7055-4FB0-A424-DA5D16313CA2}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{1BA6F97A-EC86-4DCB-B4C4-A0C881AC8660}</Property>.. <Property Class="Number" GUID="{4627F512-874F-4084-905D-B12495AD3D8A}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{8D2153CE-E8BD-486B-92EB-85C9A3C11EE8}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides" Order="1" ShowUnits="Fal

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\04.0 Masonry (Div 0\Brick Wall\Modular Brick (Price\Brick Mortar (Priced\is-SUU8S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (379), with CRLF line terminators
Category:	dropped
Size (bytes):	6913
Entropy (8bit):	5.599174753095883
Encrypted:	false
SSDEEP:	96:4Q5AVnUJzTjWhVLhxQQ0tdGOpHvtLqDrJionXOD08O2ILQfVtLnzRLpPLL:4tQPjW7gbGOJ9qDtiA+D+2BLVL5LL
MD5:	AF6D55DD5DDD701AAF92CF0A7D0020F6
SHA1:	4B1CE584AF286542739C8AF2576ECB161B4C3E7D
SHA-256:	09D96ECE062BE93527B9C9085BDC0605980035BD8A4A2A02F33C5476FBAFAB77
SHA-512:	27DC78809852AE5885F8CAFAED2D90DACAD2D88864580258804D1A34C5E4FE6394A0DF1D60120815E9D36AADB9D968D3F00D33B3151CD775E45D99159D24C28D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Brick Mortar (Priced per BAG)" GUID="{0BB313D5-84E4-439A-9AD8-008BAD0700DC}">.. <Properties>.. <Property Class="Text" GUID="{A58E5D22-2FC3-415E-B927-FED241025BDC}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{0BB313D5-84E4-439A-9AD8-008BAD0700DC}</Property>.. <Property Class="Number" GUID="{212D7F94-0EFD-4C37-8F22-41B31E233D8B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{47348644-1CC3-407C-8623-D8DCD00DB7CF}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False&

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\04.0 Masonry (Div 0\Brick Wall\Modular Brick (Price\Brick Sand (Priced p\is-3VARS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (365), with CRLF line terminators
Category:	dropped
Size (bytes):	7151
Entropy (8bit):	5.599366634812138
Encrypted:	false
SSDEEP:	192:kicjW/+qJbAkOojyIr5Di8MA+Dk2/BCNv8gDf3L:kVifOBK5mXg2/BCN0gDf3L
MD5:	CA1B67880586F11444E96590E4FB2603
SHA1:	2408892CD0FB523A432D17EE4C2BC222306E117C
SHA-256:	47346947484B69A1DCA9D458835E31ABD8A16851A6E859330D358022B9A26DAB
SHA-512:	F9A6F0AF1CDF98DA09C51F6893D559C79155D24E97C25082EF94B3A81464B9A0172CA98A1C19C9D9F8D96CEE3772B0B64C2135ADB848BDD7892C9B77B1EEC33A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Brick Sand (Priced per TON)" GUID="{30190E7F-B639-4748-BE7F-410BAE9F6B0B}">.. <Properties>.. <Property Class="Text" GUID="{BFB5E5DF-1D81-490F-B0F9-CFC13CC2B698}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{30190E7F-B639-4748-BE7F-410BAE9F6B0B}</Property>.. <Property Class="Number" GUID="{BBA5D70E-B6E3-4D41-B000-1340E4DAC5FE}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{6FEB313D-D3C6-41AE-AA9E-2D4787C056BC}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False&qu

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\04.0 Masonry (Div 0\Brick Wall\Modular Brick (Price\is-IKVBO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (367), with CRLF line terminators
Category:	dropped
Size (bytes):	8521
Entropy (8bit):	5.609985298924991
Encrypted:	false
SSDEEP:	192:fj6TKcDTbilHTlV09uDgTmDd8VA+DD22fYqkWxh7I6L:fKTMBV09uDgqhyH22fmWxhU6L
MD5:	DCE87249823E0D0AB07D19D924D2BB3E
SHA1:	0DD140EA38214A90F1DEF4740E4989854FB9AF37
SHA-256:	72914A5F7F959EA278FAAA41D09DFC9B2E3DCF727EF4293EA620625FC3E87D34
SHA-512:	821996926044B9A1599E2CA4162F6514B2DA50D3FA8B0D9C1917EE4935F8615D8FADB62894E8533FD864BA0773B850A29DC8B786CB13CE4044E8B7B225B6DEE6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Modular Brick (Priced EA)" GUID="{3FD5EA45-23E3-47C3-BDD5-471A12DF18DB}">.. <Properties>.. <Property Class="Text" GUID="{B449A81A-FBD6-4204-B1A9-AE0B1D9E2066}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{3FD5EA45-23E3-47C3-BDD5-471A12DF18DB}</Property>.. <Property Class="Number" GUID="{857F18A6-A2B8-480D-8E1F-CCBD9FA1CB03}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{2B0C9222-4C98-4BD9-A595-1AE82F376238}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False" SameLine=&q

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\04.0 Masonry (Div 0\Brick Wall\is-TVLK6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	15169
Entropy (8bit):	5.657519683371853
Encrypted:	false
SSDEEP:	192:7C/qjUNUAb3lH6V8qBiCiNfV+DmR4HcQpiEeXVoUMbU2/Qf:NANUycVBiCieaRLsiEM+bH0
MD5:	E78083F6254ADEF2C1E4D6C43063A514
SHA1:	528B12E15B3264A6938651738061AF70C5A578A0
SHA-256:	DFDAFDD66416C618E107F77F78821DDCC4F96C8B41102DE00D280B818EC2892D
SHA-512:	E1B7BF69CC6DB720A3856FD4988289E37F690383646AD1313EC3A8D44407EB0B5EB3447BA1B580F938695DFABBE5CFA6510FC2C25D9331231DAC878EB9DEE597
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Brick Wall" GUID="{78F1A2D3-04AA-47F2-8B9A-3179B2511DE8}">.. <Properties>.. <Property Class="Text" GUID="{0942177F-F4BE-4AEB-AD0A-08179E3DE713}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{78F1A2D3-04AA-47F2-8B9A-3179B2511DE8}</Property>.. <Property Class="Image" GUID="{DBF2B9C3-5094-4CED-BA7F-C5152B80F977}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="3" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADCHgAAwh4AAAAAAAAAAAAAZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HZGRkZGRkZGRkZGRkZGRkmV0HZGRkZGRkZ

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\04.0 Masonry (Div 0\CMU Block Wall\Block Labor (Priced\is-104QJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (361), with CRLF line terminators
Category:	dropped
Size (bytes):	7999
Entropy (8bit):	5.594853395066227
Encrypted:	false
SSDEEP:	192:KaWEj2y/twqbKck65N8BA+Dx2awg7WvM5GL:gELw0Jza92Zg7WE5GL
MD5:	5D56C194653F5F0EC7FC47E3AD850E6D
SHA1:	137E6275203694057B4E51EFA926577F2E50F43F
SHA-256:	EC550DCF8B5417B32DCEF75970B4456283295911D74B081D312CD54BF76A5B0C
SHA-512:	D09C2091197DEFAAC809F3F4C24203B0B46D1B9822A61E043ACFB79BEA74D0BDFE63AF963AB6DDD9C526BEDFC200905E655014544285DC0014FE34D75AE0715F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Block Labor (Priced per SQ FT)" GUID="{BE295CDF-6149-483A-9F19-4CEC5FF0C37D}">.. <Properties>.. <Property Class="Text" GUID="{0DCFEBED-677F-415F-8A59-0734102BCC78}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{BE295CDF-6149-483A-9F19-4CEC5FF0C37D}</Property>.. <Property Class="Number" GUID="{371F2850-4E9C-4690-BDB7-0A2BBE363EA4}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{20A0C4E4-22F6-452C-9F13-F98C0141A275}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Labor Production" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False&

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\04.0 Masonry (Div 0\CMU Block Wall\CMU Block (Priced pe\Block Mortar (Priced\is-MC0D2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (379), with CRLF line terminators
Category:	dropped
Size (bytes):	7794
Entropy (8bit):	5.597304870416853
Encrypted:	false
SSDEEP:	192:A3Aj6Wl415bgJZOn67DatA+DZ2AjfJRpUeL:f21SJZOn67GzF2AjfJrUeL
MD5:	4630C20D0BA3C4813498B1375B46F0C4
SHA1:	C2B6FCDC8B475BB753A5113CC18F936D2BC24A93
SHA-256:	221D8ED6F973B2EC681F01A0B5C0B40C73CCEA31D124DA3D7A73722143772E47
SHA-512:	F1A6AE7FDEA79DCD4D648E674FD36AB7ECFFEECE6169297DBE9E83A860AC8BBEDCE909744D6D6897E0220C225B3FCD175D148B0BE5B78A0F9A086D1F2B1F24A8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Block Mortar (Priced per BAG)" GUID="{8F226BC8-A77E-4599-9824-4F149D274B79}">.. <Properties>.. <Property Class="Text" GUID="{4E6E8A21-CE8D-42BC-B461-BA6D2D6D23CA}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{8F226BC8-A77E-4599-9824-4F149D274B79}</Property>.. <Property Class="Number" GUID="{C4A935B4-2817-40EF-95F4-FEF9BD4DC089}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{C345A9F1-9CA2-46FB-B5BE-0199C3419C11}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides" Order="1" ShowUnits="Fals

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\04.0 Masonry (Div 0\CMU Block Wall\CMU Block (Priced pe\Brick Sand (Priced p\is-GUO1V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (365), with CRLF line terminators
Category:	dropped
Size (bytes):	7150
Entropy (8bit):	5.601215685214275
Encrypted:	false
SSDEEP:	96:iIpYJE9TjWYU7ymMqosQ0tdnqOrsLa+xD3C18BIonXOD08c2IQDbKl3nn+Aw9EbL:djWLnNbnqOyaUD3i8CA+DM2ol3+Aw9oL
MD5:	6EC62C76C6955FC3BE79D6BA8089802F
SHA1:	40C8FEFFB78F5A759401D17D730026858324533C
SHA-256:	83EFDD9A42757032025CBCF30B3904CE6FF1FC29CD9DDBD27B479FCE9AF960B8
SHA-512:	89AD83D84815ECD08F7035D88DF980EFE6B920FB5345434517EC5FEFB79942BAD91EB05E0093B5DC9F7EEF74C3B6CF91245C50533E9326082DA1B5F18720BE15
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Brick Sand (Priced per TON)" GUID="{EB3B2C89-C5F8-485E-8031-1E74222F9362}">.. <Properties>.. <Property Class="Text" GUID="{982D1D7A-1B65-4A31-993F-D17DB48E3F4E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{EB3B2C89-C5F8-485E-8031-1E74222F9362}</Property>.. <Property Class="Number" GUID="{B69D1C64-07E8-430C-89D3-F782AE3CEDCC}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{76FBAF2E-28A5-4F7D-8208-8F80DD7BDA56}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False&qu

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\04.0 Masonry (Div 0\CMU Block Wall\CMU Block (Priced pe\is-II7M4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (367), with CRLF line terminators
Category:	dropped
Size (bytes):	9467
Entropy (8bit):	5.609067337580328
Encrypted:	false
SSDEEP:	192:kgxWju5q+dbTlHmlsdDlDFDA+Db2eE2Lv2TkMULL:9WGdLAsdDlxtP2eE2LCkjL
MD5:	476ED6B225330528E8C3FECA6DAEAB2D
SHA1:	DC852CC9F8B801070C6A17EC375363C89ACB1F7B
SHA-256:	939F0E1FA024C4078072737FBE0D4262B85AF34F193893461805017D71213009
SHA-512:	917F7D10D4ECEBC2E2F190B856B20C83249CD06202C0FFD17BC0BB2A94D1FFC3B596E8B2284EFA5D030A08BDB4B57D7CD55BF7986E7081C10325142C1E5D4AA3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="CMU Block (Priced per EA)" GUID="{BCCDA285-21E0-4109-B5DC-82F7D5C74CA7}">.. <Properties>.. <Property Class="Text" GUID="{50C68188-BEA0-4C64-9760-EB44C6C04C42}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{BCCDA285-21E0-4109-B5DC-82F7D5C74CA7}</Property>.. <Property Class="Number" GUID="{3BBBA1DE-A7CA-466F-BC4A-4478B74B21BF}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{EA6A3B38-BBED-4D83-B11D-B74A72625177}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides" Order="1" ShowUnits="False&qu

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\04.0 Masonry (Div 0\CMU Block Wall\Rebar per OC spacing\is-U02LO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	11710
Entropy (8bit):	5.605277758552738
Encrypted:	false
SSDEEP:	192:HjTZvJGKLRbzlNv0piCnTi4TvFettspB1nlZE7qc8Ue6+DuMiKxEKxPFEH:H5hGKLfd0piCnTjTvkttyB1lZOnFSKMK
MD5:	0D4898B400D056752C51BC10502F4573
SHA1:	E30C538EE69AC8B2A3B8A3FD2573DA21A3325D77
SHA-256:	0CEB9CF99F814F7FCD29C7099AAC1BED0AA65FBF673BC82AB8BF7F9C664325F9
SHA-512:	58CCF7D0AF8FC5363DEECA70699769D2C03C565500BA1CCB974100684D20C087B2ABB0F71FD7E258A70F0A0F5F2D69DA59257B11DBB462FF5E9E1A679155C952
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Rebar per OC spacing (Priced per LBS)" GUID="{AFF0A06F-8620-4E3C-B450-63FCF11D7E29}">.. <Properties>.. <Property Class="Text" GUID="{75538771-FC83-47B1-9C69-DD51DB4ED5CC}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{AFF0A06F-8620-4E3C-B450-63FCF11D7E29}</Property>.. <Property Class="Number" GUID="{F032F611-75E7-4F6E-82B3-34826F557FB6}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{7AB3FDE3-B90F-4BC8-BA8D-8766E06F5F5A}" Name="Form Layout" systemhidden="True" OrderIndex="11" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="OC Spacing" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\04.0 Masonry (Div 0\CMU Block Wall\is-FJC14.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (616), with CRLF line terminators
Category:	dropped
Size (bytes):	16857
Entropy (8bit):	5.605021744368196
Encrypted:	false
SSDEEP:	384:yPUl8ew1QiSmfipwbrzfIYLjXZsdwzbF7DlgtpTZCPLi:y4bwRSmfipwnLfLjpsSzbFPlgp
MD5:	00A82E848572D8640B83EBD415D98001
SHA1:	53CBAB81776665105EC5CA99C00D003101558B2D
SHA-256:	176A9279C7180C443AAE4F192A0C34B2C8A2A6FC1145ABA442A71E71F7C674C1
SHA-512:	4AB47105FAD280F0CA32B19306F680599C836CCFD914140476C94566C44033ED64ADDC521FC51E028FC347F638F63FA640F00E20AC6AF6349E387CD1BF8EDA80
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="CMU Block Wall" GUID="{84669F98-EC94-4CA1-9086-13D07EC940BB}">.. <Properties>.. <Property Class="Text" GUID="{15027EF2-D67F-4524-ACD4-358A659B1432}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{84669F98-EC94-4CA1-9086-13D07EC940BB}</Property>.. <Property Class="Number" GUID="{FCDF12C6-09D4-4646-871E-65D9923E8BA4}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{9F107ACA-4FF3-4421-B4D8-868DB443B7AE}" Name="Form Layout" systemhidden="True" OrderIndex="12" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine="Fa

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\04.0 Masonry (Div 0\Exterior Brick\Brick Labor (Priced\is-540IE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (378), with CRLF line terminators
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	5.592554588579471
Encrypted:	false
SSDEEP:	96:DUJ+v1rj0UG2SrhQ0tdXnckLzMK/D+r8BHJonXOD08sN2Ic6YXBG2SnW3rqulsL:yw5j0NfbXcGTDc8JJA+Da2oYPSW3rDsL
MD5:	433DDC8C5578E9B9D8FDB317DD307638
SHA1:	4CB5721250F367C0D728D8AAC611B73AF727F4C1
SHA-256:	7D8E122BEC8CB771609DD4A91AB680C636D711B70AAFB29DB01005BE48B9CAB8
SHA-512:	A11E398EC3B278502D64665D527ED18756346504C22113EA6A48B3FC1641E42A601EAD7F2918D4DB7EDD1F30D534EFB2CC3D64AC6B5715EDE24136F3624709BA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Brick Labor (Priced per SQ FT)" GUID="{4DFCA4D7-1B8F-4B59-B6ED-9844113DD1BD}">.. <Properties>.. <Property Class="Text" GUID="{A5AD0991-2782-481D-B9E5-46DD8AC0F9A9}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{4DFCA4D7-1B8F-4B59-B6ED-9844113DD1BD}</Property>.. <Property Class="Number" GUID="{D69BEDED-0A7D-4FAE-AF2E-CAF2379F93A9}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{CE5F6A71-AA9C-442C-8B32-426A644BFECC}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Waste %" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False" S

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\04.0 Masonry (Div 0\Exterior Brick\Modular Brick (Price\Brick Mortar (Priced\is-R6BA0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (379), with CRLF line terminators
Category:	dropped
Size (bytes):	6763
Entropy (8bit):	5.598974886111802
Encrypted:	false
SSDEEP:	192:4mSR5q/dQyjxXbM1OOm9q8qBA+D82lccCVkI9I0CL:NQydZOmAfg2lccMkI9I0CL
MD5:	31F6C1EF72CDAC1D8EC34C9141FAA47B
SHA1:	6BAB680E4D713A243E895C0B06D9F4D0EB107FD2
SHA-256:	49F5A8058988D44491BD6CEE95F7C34B6D03E5F66CFC35A6C129815F51D0BF7D
SHA-512:	BF4A07EBB9C4A5C40D5B26FBFCD3FF5A0D9E1A706F10BDA7C17233C4185E2F6D4DB45B13AA8DCB82AFD263AE39100AC4DD8B16468F0424C39B8D6CD709064458
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Brick Mortar (Priced per BAG)" GUID="{0E9E43F2-CECA-4DD2-9502-094A6A24D062}">.. <Properties>.. <Property Class="Text" GUID="{30DF1AA1-95FB-4B49-A76D-186ABC236373}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{0E9E43F2-CECA-4DD2-9502-094A6A24D062}</Property>.. <Property Class="Number" GUID="{03E6CC9D-C0CB-4C47-AF9B-FD112DB5E0E5}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{503B0EBD-28A0-4CC1-8FA4-0C7F90C7E280}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="True" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False&q

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\04.0 Masonry (Div 0\Exterior Brick\Modular Brick (Price\Brick Sand (Priced p\is-Q9BP8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (365), with CRLF line terminators
Category:	dropped
Size (bytes):	7151
Entropy (8bit):	5.59966095018205
Encrypted:	false
SSDEEP:	192:K0DjWA1rgQbbOp4LDwm8aA+Db2izG5Or6L:7OCOp4LcmRn28mOr6L
MD5:	EC26DD61E35507ED99D34836A6504374
SHA1:	D07E80BBCE80556C5606D56F739191199BC0EE1A
SHA-256:	A8B24783D9297120341C2BFD4DC9D4EBD64056B3D955AAC78A0F5B4066B8B87A
SHA-512:	1D91CE91027F1D8C56C875AF7BD5A99520F3B4DB3A2AF618B7F87FB9670D6F2C987FF4DC6447AAE567A64BAAF596741CF6598C7D4BA2759D36FE81AE6EFBBC4E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Brick Sand (Priced per TON)" GUID="{BD8CE1C9-B36F-43FC-9D05-F0651FBE68BE}">.. <Properties>.. <Property Class="Text" GUID="{8F72F9A4-337A-4EB9-A567-E567EA9F2AC5}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{BD8CE1C9-B36F-43FC-9D05-F0651FBE68BE}</Property>.. <Property Class="Number" GUID="{CEF9B79D-4D07-40E2-AE65-9BF2CC544046}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{3FE22D19-7B59-4310-839D-1B28A08802FE}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False&qu

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\04.0 Masonry (Div 0\Exterior Brick\Modular Brick (Price\is-25FNQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (367), with CRLF line terminators
Category:	dropped
Size (bytes):	8514
Entropy (8bit):	5.6078186791539775
Encrypted:	false
SSDEEP:	192:rxj6HQvkQbllHxlLeH6nlDBz8JmA+DKn/2pHFBRmL:laQk+jLeYlNSke/2plBRmL
MD5:	5C3B1181CA73E314E4379EE432FB25F0
SHA1:	A3DB835621E977B3D09B15869A650B5FC9A9BD72
SHA-256:	EA043B7D83338DC5A41AB12299285B347BD51ADB6B14E27C273988825BF2E667
SHA-512:	C75174BF198BCFC9DD3415A4C9BE0F39D2DE195EC9943D2F43B1CE75962DE3FDB074A8EB823CA543B28688D91DF5F91E82738E68E53C8C21D14D8AAB14881036
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Modular Brick (Priced EA)" GUID="{BEB5FF7D-5BAD-4843-942C-9AF4E88683C9}">.. <Properties>.. <Property Class="Text" GUID="{EDBF4863-2555-4E9A-88B1-F909BD5C6475}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{BEB5FF7D-5BAD-4843-942C-9AF4E88683C9}</Property>.. <Property Class="Number" GUID="{143FE9C6-D1D2-464F-9E29-90322BAFBCDC}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{F02ED3F4-CB35-4D58-8D42-6F910414D1CC}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False" SameLine=&q

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\04.0 Masonry (Div 0\Exterior Brick\is-RC5H0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	12457
Entropy (8bit):	5.621753671435522
Encrypted:	false
SSDEEP:	192:lbij9bjdbkTVYk8N4h+yVtl+Dyol4mFEXfBo1IAdnru:Mxbjqqk5vVOGolzFef1Atu
MD5:	D223586C776CE293E496CF6FD64527A0
SHA1:	A25C9FFBF0B7A9F75D4A062CA446841FCDE1B51A
SHA-256:	DE7F74C77D0E48268AFA5B2200B2DE8F4A95868C50EFEAA4DD01BCA33B986EAE
SHA-512:	C7D31157FF74FE739CC889D1256EDBD2152C65B3821D60EF3DE561E836A03C61CA9B3299F4E976ADEDF72BF7ADC1E956D93D5C3B37D0F722C25D06822879C360
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Exterior Brick" GUID="{CF8C2F1D-3367-48BA-BCD5-E85F7AB79791}">.. <Properties>.. <Property Class="Text" GUID="{74DA05ED-3327-4E6D-AD9B-09C9966854F3}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{CF8C2F1D-3367-48BA-BCD5-E85F7AB79791}</Property>.. <Property Class="Image" GUID="{70585B69-4C72-4A57-B711-9FD754AFEB3C}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="2" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZfmgZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZfmgZGRk////////////////ZGRkZGRkZGRkZGRkZGRkZGRkZGRkZfmgZfmgZfmgZfmgZGRkZGRkZGRk////////ZGRkZfmgZfmgZ

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\04.0 Masonry (Div 0\is-0MIDI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	953
Entropy (8bit):	5.440215015478085
Encrypted:	false
SSDEEP:	24:2d2SUwX2jf2WAdOcdB/B1Oc82NVgAWadf/CApW+2v:cTaOmqxnk
MD5:	0DB72B1E2DF8D1C2092278DE03E1F3D8
SHA1:	CB891517E50A507A7584CDD22AB4266F427445BE
SHA-256:	EA7774BC902898515CBDFBBFE1A3F0414DAA51F1297A823D30D85DA068F3200E
SHA-512:	8648C47D58E15C48BC67DCC62D33BA0A3B31565B6EF9A127EEBB416D5738DCF6B24F4757FE4DD37A031E91D280CE8397A3B315BB0C88E0CC9B80D20FAAFDC5BC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="04.0 Masonry (Div 04.00.00)" GUID="{D29D875F-1CD0-4D95-9251-E677FB7F77F5}">.. <Properties>.. <Property Class="Text" GUID="{135647F9-DF7D-4F77-99EA-B6B3033C5658}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{D29D875F-1CD0-4D95-9251-E677FB7F77F5}</Property>.. <Property Class="Number" GUID="{2E10A09A-3D66-4F88-8CEB-A3439C0E1C71}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">5</Property>.. <Property Class="Type" GUID="{305F9491-EE8F-405A-9F07-851AB351691E}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{60A617CB-008B-44F0-BC74-9790D2455087}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">04.0 Masonry (Div 04.00.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\05.0 Metals (Div 05\Metal Decking\20 ga. Galv. 3' x 20\is-729O3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	7507
Entropy (8bit):	5.596367700877043
Encrypted:	false
SSDEEP:	96:7OrKzWNThujxMxEKYlQ0tdoIHVabLdD38B8onXOD08zv2//neOn2TI1L:KetjxMFYrbLHwXdD382A+Dz2/WOuI1L
MD5:	F3B32C6CBDB27ED6B657620ADF38E697
SHA1:	76130F3E2CABC2F15B10BDB0B92579C73A5A7D9B
SHA-256:	0A979E497A1D9970DE6F7CD4A33C2DF358D7D92B4F84BC2798F66A2C62A09739
SHA-512:	1A99C51EECEBCFD695D6F15494EB123FBE4C0D82CF394BADC3B4627066B2D1849D3BAC52D10745237FC811944B04380DCD47D2676329BFA05AB63F4B2A490B77
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="20 ga. Galv. 3' x 20' Steel Deck (Priced per EA)" GUID="{2A891ABF-78AE-4D62-B823-FACAB4BF2934}">.. <Properties>.. <Property Class="Text" GUID="{88B8B92B-E9BA-41BC-9AB7-2A5D78797F6E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{2A891ABF-78AE-4D62-B823-FACAB4BF2934}</Property>.. <Property Class="Number" GUID="{7DAB229C-176F-413C-8A69-D382B8E02ED7}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{77817526-FFAA-4809-9D4F-C799FD3A3D14}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowU

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\05.0 Metals (Div 05\Metal Decking\Metal Decking Labor\is-FF9IL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (378), with CRLF line terminators
Category:	dropped
Size (bytes):	8395
Entropy (8bit):	5.603494951094982
Encrypted:	false
SSDEEP:	96:4KYNrj0O8GDDQ0td6ncHL4DF8BtGtMS80yBonXOD08B2ITCW+cnaZ1JA+L:Cj0iBbScr4DF8DGtM3BA+Dx25caZ1JzL
MD5:	C309B007B16AFB39A31941797238EC9A
SHA1:	5BFC5D338147064DC39C1AAF049D87EE22207FEA
SHA-256:	56C3A57E4EBB35417E5EF861A0373C07AEB58D8E799123749465431FC4A8B5C4
SHA-512:	CE7CD71477F96B19614BE30F4D33A0FE43A0B226EBDFC01B208E54C48FE1A19387845B3D823705A2477476517B3E9B1040AA4E42DC9D7DC0F095F91584CDBA10
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Metal Decking Labor (Priced per SQ FT)" GUID="{B7CE9696-1998-4EA8-A85E-8CD575E165DD}">.. <Properties>.. <Property Class="Text" GUID="{C88DDDA6-5734-4A8E-AFBC-5F72978FA6D4}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{B7CE9696-1998-4EA8-A85E-8CD575E165DD}</Property>.. <Property Class="Number" GUID="{C202EDBA-CD7A-4C05-8441-BE3B41A99557}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{D71366D4-1112-4CE3-A08D-53746CC32297}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Waste %" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\05.0 Metals (Div 05\Metal Decking\is-10MSE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	13562
Entropy (8bit):	5.625374484738888
Encrypted:	false
SSDEEP:	192:0WYj7kxQA6bnYHW8Nzn7+yBl+DDl95/L3MLtX8lb1RHu6CLk:GPLlBovaHlzoLp0uLLk
MD5:	FEC7485FDBC2445A27F3CC8564CE0B59
SHA1:	870EE7293F95C57D420142DA236AE1461B3CDBE2
SHA-256:	BB4DA6F6C5CBD141AC5254B22F71237C7532900B373D78BC6CDF1DB1D7B4DDC2
SHA-512:	6C4E269705C153CA1F779C3200E7B21D533FD5CCF7A9DF97B377DEC6F001A8982FE2B3DC137D363AF60C3C31F78BA8543E63FCE3DA79304C2045C948BF18F88E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Metal Decking" GUID="{93394F2B-E468-4A3C-A9BD-3D131C046DA2}">.. <Properties>.. <Property Class="Text" GUID="{42939C09-5233-47CE-99F7-3DD394EE9545}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{93394F2B-E468-4A3C-A9BD-3D131C046DA2}</Property>.. <Property Class="Image" GUID="{5F9D3BD5-3B92-4AC8-BD87-D06E0207206F}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="2" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZfmgZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZfmgZGRk////////////////ZGRkZGRkZGRkZGRkZGRkZGRkZGRkZfmgZfmgZfmgZfmgZGRkZGRkZGRk////////ZGRkZfmgZfmgZf

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\05.0 Metals (Div 05\Metal Railing\1-3%2F4%22 x 42%22 Round P\is-UENDI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (328), with CRLF line terminators
Category:	dropped
Size (bytes):	5608
Entropy (8bit):	5.58640024062422
Encrypted:	false
SSDEEP:	96:YAlOECgnMjmCkroQ0td9L4XnXOD08kYePwh1g5iREd1:OvjmNEbt4X+D0Ye4h25yo1
MD5:	19D6F2EFA97E9331F3ADA315FE766E2A
SHA1:	C3AE3BCC0FE253D8DF5C57596E4DF274354FC8B8
SHA-256:	3A513C926A4966EBFE016C209FE2FC87F0B30F7BD8F74798A9B439448E448698
SHA-512:	ABFCAB43B20905C29BF828F2E57042F541B454CD4B8316299E6B59D04E90ED11CEE605EC0DB5A9A2BAD5B826F281E12DC9FD6A63AF63B80B1B9A6714B69C5F2F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="1-3/4" x 42" Round Post (Priced per EA)" GUID="{87F7C980-D295-4983-84B1-2315148EDE7F}">.. <Properties>.. <Property Class="Text" GUID="{921E27C4-1D73-4B83-975E-6068AD27E258}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">1-3/4" x 42" Round Post (Priced per EA)</Property>.. <Property Class="Type" GUID="{DD79A684-7122-4979-96FB-8BBB9AC38DF9}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Material</Property>.. <Property Class="Text" GUID="{A0685AFD-C2E2-483D-8DAF-348A93E338CA}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{20B1A55C-C657-4024-8B84-1AC0EE76516E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{87F7C980-D295-4983-84B1-2315148EDE7F}</Property>.. <Prop

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\05.0 Metals (Div 05\Metal Railing\3%2F4%22 x 30%22 Round Pic\is-Q17KO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (325), with CRLF line terminators
Category:	dropped
Size (bytes):	6113
Entropy (8bit):	5.608777781427751
Encrypted:	false
SSDEEP:	96:w6heEfSaKFE3UoanLlcMjm4krvoQ0tdOLmXnXOD08a+YSH11d1:lh8nFENa7jmbrQb8mX+DBYeN1
MD5:	352ED22FF228F87317F5F0D1018327E0
SHA1:	E0D188875ED95539BAA13ED298640ED180C03CDE
SHA-256:	EB11D5A96E5726F409184A7632E0A87250144DF34799B59717EE52E6CE1A2A13
SHA-512:	AABE2796D6361534A891A0A3B2F0B826D6765F232B4F894F9BFF125570F02BDC8B47C52EB51BC75B9327EB7F42FF3D4A4D948E275DD2EC8F575C14F0F23DC8F7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="3/4" x 30" Round Pickets (Priced per EA)" GUID="{56331553-36F9-4BAC-9E2D-FA359662EDAC}">.. <Properties>.. <Property Class="Text" GUID="{7F310FB3-FA6D-4C2D-840B-D339A8A92E7B}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">3/4" x 30" Round Pickets (Priced per EA)</Property>.. <Property Class="Type" GUID="{6AD796EE-FAF0-42B9-BD9B-094C38B3F304}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Material</Property>.. <Property Class="Text" GUID="{72F53440-6A2D-4931-B2D3-A192BDD55918}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{8207B135-E4E9-4479-A63C-3F57E9480FF8}" Name="Picket Thickness" input="True" group="Item" OrderIndex="68" DecimalPlaces="2">[..]</Property>.. <Property Class="Number" GUID="{4E824C3E-48F8-479F-B859-6F88A

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\05.0 Metals (Div 05\Metal Railing\Railing Labor (Price\is-VD74V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	7724
Entropy (8bit):	5.58669626459192
Encrypted:	false
SSDEEP:	96:4Zj4c1Lij2/tfjyv6Q0tdTncTVjLoxDv8BvonXOD08iI2IB9daIndrF7L:q2j2/FEWbzcTVP0Dv8xA+D72YyItF7L
MD5:	0FD4201D6199FE34F4EF7AE88A0BE84D
SHA1:	C9B083AFFC3896E6B3BCCFD3A2481BFD23376269
SHA-256:	3CEC6C35F4F51D3A0D7C4DB4BDC8B3AA57DEDF267FA5F7F8241B06425C25845C
SHA-512:	8270A5AC8E1881C56A6F564E47110441F265880EC3F39E1B3BFA94C3191941638BC8BDA8233A6034C707E17537BF1CF06B6DDEB6D1DCA032A1103FE295E7374D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Railing Labor (Priced per FT)" GUID="{874FEF8C-C796-46B1-9222-C2390BDD4399}">.. <Properties>.. <Property Class="Text" GUID="{B75EA269-455F-4270-8436-83D1CB325B44}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{874FEF8C-C796-46B1-9222-C2390BDD4399}</Property>.. <Property Class="Number" GUID="{6B4DA86A-D5FA-4896-AA10-ADBB921D4764}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Memo" GUID="{BC51C1BE-3E3B-4CBA-9C02-A24C11DF953E}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Labor Production" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False&q

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\05.0 Metals (Div 05\Metal Railing\[Intermediate Rail T\is-2AKJ8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	7394
Entropy (8bit):	5.586280031936582
Encrypted:	false
SSDEEP:	96:Wki8GiCTjsetTnE8ro3Q0tdXLrD798BTonXOD08p2IS2HSMlnsNZ9FtL:Q7js+EmoZbbrD798ZA+DZ2YPyfFtL
MD5:	C4CCAD2E0238CE825C7DE24D55A47323
SHA1:	3A4CE31D4025453E561B6ED26FF3928E8395A747
SHA-256:	4282F27EF0F25D4F094D2FBDF5E663456ACABB5C6C7FDEC702014A7FDE0D817D
SHA-512:	DE5857193B84F728FC14F8A623A003250DDDB7FF7D4E63BC0AEE7825D38939D6DE74A00C21D434046065F49274EAE34A86DC429F86AFCB75D746479D0ACABD38
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="[Intermediate Rail Thickness] [Interm. Rail Shape] Interm. Rail (Priced per FT)" GUID="{83735266-BEB3-41B7-ADEE-B1DD1AD72952}">.. <Properties>.. <Property Class="Text" GUID="{446B7770-8CD0-4EDD-9B4F-3B9A1CD13FBF}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{83735266-BEB3-41B7-ADEE-B1DD1AD72952}</Property>.. <Property Class="Number" GUID="{7A8E9B7B-5AF9-4B56-A844-9A5EBD94534E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{B7E20D20-E331-435E-A884-2E41003C160D}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Length" Order="0" ShowUnits="False" SameLine="True" Tab=""/>.. <Item Name="Waste %" Orde

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\05.0 Metals (Div 05\Metal Railing\[Top Rail Thickness]\is-QAFCV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	6839
Entropy (8bit):	5.5878413014355495
Encrypted:	false
SSDEEP:	192:UjXC/1nbz6F+UTzD28mA+DtD29nuzCK90fjL:Um/1CF+AKlx2puGM0LL
MD5:	67E5D02678E64294BF6068E38BFBE982
SHA1:	1FD6B9BFE3F502C5AE9BC8C71C169BEFA36DF767
SHA-256:	6BD743E02F15FF8C3B43883C28C25F383855A1C71319760CFB95C0E3809E8EB1
SHA-512:	065E13992F5C57AAFBAFE2AB297D779A1675AFD7DBC4183FC893630FBA3ABB1A0DA309AB1C2CF166D185652A6DC7327B3919BE6770B95EFCB95A5A1A949152F6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="[Top Rail Thickness] [Top Rail Shape] Top Rail (Priced per FT)" GUID="{A0C0238A-CA79-4465-AF84-DB40293BA881}">.. <Properties>.. <Property Class="Text" GUID="{492B5FFC-317D-4D4E-A7B1-BA98C01B73BB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{A0C0238A-CA79-4465-AF84-DB40293BA881}</Property>.. <Property Class="Number" GUID="{3CA52AC1-6AE6-40F4-8BCA-93A95C14A271}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{10CA25BF-CD6A-4995-820D-2843ABB4A51E}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Waste %" Order="0" ShowUnits="False" SameLine="True" Tab=""/>.. <Item Name="Cost Each" Order="1&quot

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\05.0 Metals (Div 05\Metal Railing\is-21O8P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	18934
Entropy (8bit):	5.629681556866856
Encrypted:	false
SSDEEP:	384:iej0Wsqw5p3rRo+OAwW9l6SY+dXUHE53pq+L:5jlhG3N2a9UHE53pL
MD5:	4FF91654F8E4C1B0E04D69AB4FB928A2
SHA1:	E6E4176834EDDFDB2A76F89EDF54CB50821A2C31
SHA-256:	F2525B285936505942E00E3B47EDB8A5E4E4EE1922C0C14B2BC5314990483A28
SHA-512:	B28BC1764FF18974B333D90DF06528AF0020C2C6F6D55F8E9356A84F3AD0F2D5672B536D4492527416FC012269F5A18B968ED77E0CF8CFAA94C6FB6FD2080831
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Metal Railing" GUID="{95470C61-9C49-4A3D-82CD-E4D6769F26F2}">.. <Properties>.. <Property Class="Text" GUID="{58A1054B-6B71-433A-85CF-A6DC0C69C699}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{95470C61-9C49-4A3D-82CD-E4D6769F26F2}</Property>.. <Property Class="Number" GUID="{41218AA3-FD2A-4979-939E-12D2149840D3}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Image" GUID="{EFEECF3E-071F-4BB2-95B0-1F3EFD072C2E}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="6" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADCHgAAwh4AAAAAAAAAAAAAZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\05.0 Metals (Div 05\is-EE7AO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	951
Entropy (8bit):	5.440055968020536
Encrypted:	false
SSDEEP:	24:2d2aReK3X2wJFqBf2WAdOc+8eKlE7Z1Ocx65ygAWay5//CApWEv:cTeK3kTkeKlxhh
MD5:	521992430F980EE6D8441D90476182F1
SHA1:	DAD4E6D3326C0D5FDD744FA57392A0B3566E876B
SHA-256:	19638B7CBBD5CE441C41A47DE783BDEB7D99408A83A1146FE575A3DDC8B1BC98
SHA-512:	4EEEE4C9B23E0AC9DA0950C07A67A3A95749281A4B03FCE8564AFB6BA28F7164950F5FA9CC7D1F62E9A56936440B6A20728FCDEB258BE80B7C557080FCC3A074
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="05.0 Metals (Div 05.00.00)" GUID="{1F721FDF-83AE-4C0D-8153-99F79B22FE3D}">.. <Properties>.. <Property Class="Text" GUID="{D43FE9B6-5730-4332-8A31-3AE181736FBD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{1F721FDF-83AE-4C0D-8153-99F79B22FE3D}</Property>.. <Property Class="Number" GUID="{59D114F6-5082-4B7C-A524-326033C113A1}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">6</Property>.. <Property Class="Type" GUID="{40323086-F9A8-4C33-8B7D-A3E2C6EE3A69}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{88321D1A-B889-4D24-8FE5-5824242BA1C6}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">05.0 Metals (Div 05.00.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\05.4 Metal Framing\Dropped Ceiling\Labor (Priced per SQ\is-8RH4U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (329), with CRLF line terminators
Category:	dropped
Size (bytes):	4306
Entropy (8bit):	5.570004766475426
Encrypted:	false
SSDEEP:	96:KXoUkoojNRkcoQ0td4VdxXLmGgexXnXOD08OYII:zjNOfb4Vrm1EX+D+Yj
MD5:	1983F4425E440F917960DBC1D907D0B9
SHA1:	97F47C838D51E576F38440DC6EADFDCE54E86152
SHA-256:	9F64D2D108D77F643C1358B4897E7CE69225BE6312124F033A4EB426901AACE7
SHA-512:	73920F2CCB8035692B3C011277AC7BA127CE170BBD564B35827E23157BB5204707124FF51FA6DC9A9C661D550753141CF867CC7A58644A68DFB812E494565AFB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Labor (Priced per SQ FT)" GUID="{3EFEF2C0-8222-408D-A94B-46A8AE5289D7}">.. <Properties>.. <Property Class="Text" GUID="{3B576813-6056-4028-8EA5-509992F1FBE0}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Labor (Priced per SQ FT)</Property>.. <Property Class="Type" GUID="{59A1CBF6-F974-4286-9AC0-1654E2877E0D}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Labor</Property>.. <Property Class="Text" GUID="{40E56DBD-0D8F-4E94-A86A-ACF8809D9716}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{3EFEF2C0-8222-408D-A94B-46A8AE5289D7}</Property>.. <Property Class="Number" GUID="{47E5DD29-8513-4AA6-BA75-0A3E94A4494E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Memo" GUID="{6C934F41-910D-46CC-964C-1B0136C1B94D}" Name="Form Layout" syste

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\05.4 Metal Framing\Dropped Ceiling\Metal Furring Channe\is-G3V0C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (361), with CRLF line terminators
Category:	dropped
Size (bytes):	6838
Entropy (8bit):	5.59497549810333
Encrypted:	false
SSDEEP:	96:r1lBVzuUjATSF48FQ0tdrL+DGH8B8onXOD08p2JPQS8dV5nwk2OL:51ljqF8LbH+DW8iA+D52xQx5wk2OL
MD5:	B995C73F693FF95E518AB91F884E11D8
SHA1:	F78F393E0D50E96827EB8F9FD653B0F762A670DE
SHA-256:	148F64746C92F5DAE8D69EA2EE61563DAF341B38FE29777FBD59145A9D20FE1F
SHA-512:	7AD873104C7553190494C2BC04DBED36D9138C4638109476D23A1C0A1FB9DE7F3F771BD192A1D9404FB69074239722C754AB4D452E84B8FB2342E921BCE78614
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Metal Furring Channel Clips / Tie Wire (Priced per EA)" GUID="{DB4FD6B9-FAEC-4511-84F3-C19CE2B7E4D0}">.. <Properties>.. <Property Class="Text" GUID="{054017BB-58CA-440D-BD54-B59AE273064B}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{DB4FD6B9-FAEC-4511-84F3-C19CE2B7E4D0}</Property>.. <Property Class="Number" GUID="{69D48113-8F64-4B35-8B56-4BE8850B94D6}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{29BB9F54-4071-43D7-98FE-EA3B82DA813B}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="U-Channel Spacing" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1&quo

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\05.4 Metal Framing\Dropped Ceiling\[Furring Channel Spa\is-HN5GQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (361), with CRLF line terminators
Category:	dropped
Size (bytes):	7246
Entropy (8bit):	5.5963113873316574
Encrypted:	false
SSDEEP:	96:YJEBLZDjWz9BJfqGQ0tdVLZzc8OEu3nXOD08qfOOx/ly+ndqBHQ:YSZjWz9Blzb1Zzc8pu3+Dafzx4+dGQ
MD5:	5902E98B9E667BB069BCCE5AB0D71E76
SHA1:	90B38391A2A4CBD53DDFA3830D07F02D05747FF1
SHA-256:	C03B7B86D55BD4EC93D8398C217D6D9EFCFB83DBFE9ADBF98199EE59BD6CBA38
SHA-512:	A322F5ED0ECF6CD436E5C4712A96C995405A413B634A2CAF90B6ACFE67B5C9ECC72922938796B37940A18AE069F61EDE7A186F3359A2455BA5A33160BB64DC6C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="[Furring Channel Spacing] [Furring Channel Length]' Furring Channel (Priced per EA)" GUID="{87C25115-2A45-4BE8-9043-B03C1D18E159}">.. <Properties>.. <Property Class="Text" GUID="{9CB1BB1E-F664-4657-852E-5B8A94FC26F7}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{87C25115-2A45-4BE8-9043-B03C1D18E159}</Property>.. <Property Class="Number" GUID="{B6204AA7-D1D4-49E8-AE6F-A798CDBE9789}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{D67ABCC2-BF00-4737-8B7D-65E363F1973A}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="OC Spacing" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Wast

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\05.4 Metal Framing\Dropped Ceiling\[Hanger Wire Length]\is-8JK77.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (361), with CRLF line terminators
Category:	dropped
Size (bytes):	7062
Entropy (8bit):	5.598474844973295
Encrypted:	false
SSDEEP:	96:BEXQtZRVqUjuS5TG8Z+Q0tdqWbLkDu8BaonXOD085l2kVOISnEvzn6YYgM8L:BJjG8QbqWXkDu8AA+DL2kgIHz/YglL
MD5:	1F80CE0C00A3CE35E1E6AB5F7D694572
SHA1:	FAA0BD6684656429083DD29F44FA504029EAB84D
SHA-256:	2288D94B13928EB485BFCD262DCA6BE0F729AFBE05AADB729442505434E2568E
SHA-512:	7BDC8541E70925820C6495126B0A0E83FDE710B3F6BD1EAF5037EA579D2FE803131119D8CA414F4F97CDC27C9C60F3205CE82102724599BD491936EA2E056CDB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="[Hanger Wire Length]' Hanger Wires (Priced per EA)" GUID="{33EE725B-9E00-422E-8964-2AC7E89EA26B}">.. <Properties>.. <Property Class="Text" GUID="{67A7D035-A87B-48E8-9085-9BEB820C2285}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{33EE725B-9E00-422E-8964-2AC7E89EA26B}</Property>.. <Property Class="Number" GUID="{320F962A-E39B-41B1-90A3-D2D8A6C81D02}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{50DFA47A-2194-4F51-B5B8-2668D4D69C69}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="U-Channel Spacing" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1&qu

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\05.4 Metal Framing\Dropped Ceiling\[U-Channel Thickness\is-RSCCI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (361), with CRLF line terminators
Category:	dropped
Size (bytes):	7073
Entropy (8bit):	5.600455968576915
Encrypted:	false
SSDEEP:	192:Cwjc98Dbw9Q2ADDo8JA+D42etYdEl7Fe7MvL:dA98Q9QDs2M24YdElM7EL
MD5:	39B8B5F0AA525EEE0D437D9DD43D6598
SHA1:	A9C1C9513D3633B2E6DB461F31B60DEDFA9472FA
SHA-256:	126489D1CC18BC7C7A6BC13E0BBB4B5380AC890F01A07EFCF1C4E67297F086DD
SHA-512:	4FAD465A8AD8DC377EAE51FD160203C7ECB27E73E812C3C4AAAF1EE2501133B04EF1892AF248056883B834A4B1C66DC771F0565EE1D6B09300FB5A4B44BD59EB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="[U-Channel Thickness] [U-Channel Length]' U-Channel (Priced per EA)" GUID="{8F751A45-C344-4A81-AA46-B4E77DF3926F}">.. <Properties>.. <Property Class="Text" GUID="{704776F1-2F83-4915-A840-767813D77C54}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{8F751A45-C344-4A81-AA46-B4E77DF3926F}</Property>.. <Property Class="Number" GUID="{9CC0C148-7148-4B1B-B471-F38F37F0D96C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{7284C3D1-F377-420D-8C1F-6360DD59893A}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="U-Channel Spacing" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\05.4 Metal Framing\Dropped Ceiling\is-K63RT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	15430
Entropy (8bit):	5.614234399320352
Encrypted:	false
SSDEEP:	192:AoEnqjF2Pqb5z7a8NHQ+ytl+D7l7X9/GnXYTj1z6GxCuOe:7R28zm7vOXl7X9/GXc63Ze
MD5:	6382B37D48912279B1C17D554A2A7E15
SHA1:	C41B408AEEDA1654760D7037281208F5DDB66FE7
SHA-256:	993700A5DAE89D267493BC441193CF3257C4F0625B79F998CB06AA96A9224740
SHA-512:	1D83D093DBC88640F5C6997B5468B285813938ED252F8F63C0AD58091CB3D98B7F1CDF8EE01ED578F830A8296EA9CD4F0C64EFDC4B668AB1150D07615A076819
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Dropped Ceiling" GUID="{104F6690-C932-4784-A5B0-7DD51738A123}">.. <Properties>.. <Property Class="Text" GUID="{27B0119D-6FF9-4336-99B2-D1C3546449BB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{104F6690-C932-4784-A5B0-7DD51738A123}</Property>.. <Property Class="Image" GUID="{0A9C1F12-0FC1-4011-9CC9-A592199B8DE0}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="2" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZfmgZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZfmgZGRk////////////////ZGRkZGRkZGRkZGRkZGRkZGRkZGRkZfmgZfmgZfmgZfmgZGRkZGRkZGRk////////ZGRkZfmgZfmg

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\05.4 Metal Framing\Typical Metal Framed\3-5%2F8%22 x 10' 20 Ga M\#8 Screws per EACH s\is-KHVQM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (379), with CRLF line terminators
Category:	dropped
Size (bytes):	7892
Entropy (8bit):	5.587275891308106
Encrypted:	false
SSDEEP:	192:gFPjqYsSzubfRl8GQAD3M8/Ms0QA+Dhm2rDfJR5kkL:g/zY8fAwGLdm2fh7kkL
MD5:	0DA0856AF44B49F6C1910800D9332E5A
SHA1:	EC38599D4A351967E73ADEA6071EA329601625F7
SHA-256:	D5D9C2A184C80C14870C92BE09F56182DF744EBAE9456CFDBEFF2BA20A3F0463
SHA-512:	E9B863A1FA73E1425D30B8FD95D483703ED6E4A6454EFBC6D14628E06F7806D22C0598A1C4709DC817E962D6E3BC181C36AB3B5FEB5397085338CF22842AEC5A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="#8 Screws per EACH stud (Priced per BOX)" GUID="{7D47CBAF-1E2D-4FB3-8E02-161F95869124}">.. <Properties>.. <Property Class="Text" GUID="{2690D40A-94C7-453A-9689-B51FC1527101}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{7D47CBAF-1E2D-4FB3-8E02-161F95869124}</Property>.. <Property Class="Number" GUID="{90BB809D-7783-4B9C-8FA8-779EEDE1B6E6}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{0C267CF7-70A7-4E27-A445-142743EE7B69}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# per Box" Order="1" ShowUnits

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\05.4 Metal Framing\Typical Metal Framed\3-5%2F8%22 x 10' 20 Ga M\is-I67TM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (361), with CRLF line terminators
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	5.6036232440823115
Encrypted:	false
SSDEEP:	192:CsjWQdbtRTYnD181A+DvM2VkBqvknIPkL:CsPjRTchuY2VHvkIPkL
MD5:	A800948194702825220F0321F1F82898
SHA1:	ED32712E5D0CD72CE34E23669C3129A183FF341A
SHA-256:	FFEB5071E0F056C7187A2C1F7DD1858C17B536B9DC5C26881BCC7E61E1B66B64
SHA-512:	103D88428F7F38F9B2371B484ECAEE11F4E6EADCF03995831BC491C4E83AD41DDACE35BAC41DBEAC654B8E34137374F9CBD1559B8B5F841B6A5F95323385A41B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="3-5/8" x 10' 20 Ga Metal Stud (Priced per EA)" GUID="{27350C75-5EB2-4A21-9BA4-F23063A31FA4}">.. <Properties>.. <Property Class="Text" GUID="{E7E19ACE-0F76-4AF9-9760-4141686ECF06}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{27350C75-5EB2-4A21-9BA4-F23063A31FA4}</Property>.. <Property Class="Number" GUID="{1F1EBB04-1E08-4CFB-AD5F-8E2BE73E6D32}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{A4ABCCFD-C2F3-4882-A4F5-6FEAA9652D9A}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="OC Spacing" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" Sho

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\05.4 Metal Framing\Typical Metal Framed\Framing Labor (Price\is-A64CT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	7327
Entropy (8bit):	5.576270361494811
Encrypted:	false
SSDEEP:	96:2SFqoij20D3ikQ0tdwLzl3i8BMrZonXOD08E2IoUZK0uZnzBcaWqL:qj2eysbqzl3i86ZA+D02LBNZ9VWqL
MD5:	90876AEEBBC56C18AD95C82F32DF89C0
SHA1:	8F892E60B4522C25F4DA6A6FB02E570482AEF7C4
SHA-256:	2B4B1013966BEAADC331FA0144DE49A82DB95E5A18029E58A1C75F982D9C5D64
SHA-512:	8411A23A7C6CB19E20F304917605C88C9813EC4F0C38F280D2A173E35ED89EEB5DC1ACA98E30FDE9751CD201CCFC474CCB0A95D44951BAAF4132893616F5616A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Framing Labor (Priced per FT)" GUID="{C248E3C9-C73D-4045-9625-C2C1C7CEE964}">.. <Properties>.. <Property Class="Text" GUID="{33210A2F-4ED2-461D-87B0-14F9DB7E9479}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{C248E3C9-C73D-4045-9625-C2C1C7CEE964}</Property>.. <Property Class="Number" GUID="{57765DF6-4EBC-4D3F-81DD-F58CE6935655}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{6559504C-B523-414B-A0C9-B4FDC2840208}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Labor Production" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False&q

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\05.4 Metal Framing\Typical Metal Framed\[Wall Thickness] 20\is-9J4E8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (361), with CRLF line terminators
Category:	dropped
Size (bytes):	7726
Entropy (8bit):	5.60964402787078
Encrypted:	false
SSDEEP:	96:w9ATpdVjxNTlQ0tdqnlLeDRxLwPzM8vGJnXOD08IJBvFeVIefnvh5/g:jjxVrbClLeDnw7M8u5+DY/v4KefvhNg
MD5:	CBEDE3648C760E29C86B89965BB08338
SHA1:	058787B0708E7871A5671A1A724AACC5A8B102EC
SHA-256:	E480A25A8B3546ABAC520A27C4DDCEF15C9A776D6FC983FE61A28BDBF40DD052
SHA-512:	FCA9606F1C668BA9CC528F8A6B4C9D13E2AF40DEC326DDAC2EAA446366B988FDC04AF26EFE88F9E0C5ECD3FD97676E46F6C6BAF2BF4095BBB701902F0F754CFD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="[Wall Thickness] 20 Ga Metal Track (Priced per EA)" GUID="{355C7EA9-9BB0-4E4F-B01A-7755151F5E32}">.. <Properties>.. <Property Class="Text" GUID="{F21727A2-2370-4431-B826-D7E34D37A589}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{355C7EA9-9BB0-4E4F-B01A-7755151F5E32}</Property>.. <Property Class="Number" GUID="{C2251AFD-75C9-41D3-AB21-743448BD3AE4}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{9D13C116-6B91-4BF7-8831-BFAA1E4A460B}" Name="Form Layout" systemhidden="True" OrderIndex="10" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="# of Track" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnit

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\05.4 Metal Framing\Typical Metal Framed\is-O9MHI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	15658
Entropy (8bit):	5.656115708398374
Encrypted:	false
SSDEEP:	192:ZKQqjFbPb6lHLHZd8PB2F5shV+DGRce24HLDCTXVjkUfEexN4:AhbAPUB2Fn6Rc7gDCTpEexN4
MD5:	9CF7C22A05DB9758A9403DF5439BE6D3
SHA1:	06C38AC998FFE1864F2419E83F5268EE397DF329
SHA-256:	A5B5BAC624CC711E3DCB88E36C5E5BD0C0293C2B25EEB40D3B6A0302D7FB599E
SHA-512:	3B350EB5C541559FDFA6282E03F23B0475CCEE453367B9A7C08CABF3CB1F22CD4EE68C7C56D1EBE14FAAE4F8CFAA9821A5423F6B7C49FC13B1A1BCEA6C14260B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Typical Metal Framed Wall" GUID="{E31EBAF2-EE16-4F28-9A60-1E5BFA0965F6}">.. <Properties>.. <Property Class="Text" GUID="{50A0724C-3C6F-4480-BDC7-A23F90D72AC2}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{E31EBAF2-EE16-4F28-9A60-1E5BFA0965F6}</Property>.. <Property Class="Image" GUID="{F0FC24EC-7662-4475-B792-A81460212471}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="3" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADCHgAAwh4AAAAAAAAAAAAAZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HZGRkZGRkZGRkZGRkZG

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\05.4 Metal Framing\Wall Furring\Furring Labor (Price\is-Q4VE2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	7327
Entropy (8bit):	5.579089329000911
Encrypted:	false
SSDEEP:	192:pjGj2/eTbyZrp8hwA+DVg2nXCVeAwgv5L:5Gti7t5g2XCVxDv5L
MD5:	F0508C73F01CE05CC971ABCBD34EA88F
SHA1:	DDB81C838790AD5F371AC7667AC814B0CC949F9E
SHA-256:	5A37B5ADE6ABD8B1901D9CB165D78FA571CB232BA2B12A2F418945C4D1BAE35F
SHA-512:	9764D191A2102BED2AF1645F3FDF977BADC4FB701C89EC02A574CB5619A476235220287E80A83B006D40099A10DB5CE1F29CA1D49070EAA300ABCF64E4EE716E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Furring Labor (Priced per FT)" GUID="{4971DE00-4C43-414E-8F46-1EBB267EC7DE}">.. <Properties>.. <Property Class="Text" GUID="{6ECA9317-A4DF-42F3-8A02-BCE995106EC2}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{4971DE00-4C43-414E-8F46-1EBB267EC7DE}</Property>.. <Property Class="Number" GUID="{708A2E24-47A8-44A9-967F-763A77B122C9}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{2D3D51CD-557F-43F6-8671-D5331AE556A6}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Labor Production" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False&q

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\05.4 Metal Framing\Wall Furring\[Channel Thickness]\is-ARCSN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (361), with CRLF line terminators
Category:	dropped
Size (bytes):	7666
Entropy (8bit):	5.596234142476722
Encrypted:	false
SSDEEP:	96:du4UTp2jCoiVTnQ0tdVeTL8Dg8BLonXOD08o20SYH0yYSn3UNxGVdL:h1jC3TpbQf8Dg8pA+D420jHcS3UNxGnL
MD5:	3AE1858FE119BE8503359B1A879D4E9B
SHA1:	E25B42830DF050ADF14C87C8F855037BE8C2994D
SHA-256:	21FB114D334DF4CFBA3A5E0ACC8F04CCCAA2E47F4E7713CDB0FDDDDFCFFB8237
SHA-512:	B324EB2A2450E1698017D27A1A3DA8E3BA690B920BFFC307B017E1BFF716C7CC11B2E914CFE33B240340BF3687F0FC4E62E0BA9D7BB622D79C3162A425B300FA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="[Channel Thickness] [Channel Length]' Furring Channel (Priced per EA)" GUID="{C60189CC-CE9D-4E50-B8AF-2CA3CABEA66E}">.. <Properties>.. <Property Class="Text" GUID="{7CDC38D8-0059-4563-B124-3C02B2400164}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{C60189CC-CE9D-4E50-B8AF-2CA3CABEA66E}</Property>.. <Property Class="Number" GUID="{500EC5A2-9934-4EDD-A384-68CEDEC4EFE1}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{D5D767E5-B564-4D52-A92D-CBDFD2DFFCCC}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="OC Spacing" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Channel Length&quo

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\05.4 Metal Framing\Wall Furring\is-QBQK6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	14370
Entropy (8bit):	5.65599366303688
Encrypted:	false
SSDEEP:	192:urT3Yj7zX3dbQqLDV8IV+DXRDpYj9AtwtrXyPn30zLcZXL:BPzHOqLB27RDpWJtbI0UZXL
MD5:	20FCAEB468F133FEE02ED5E1DD494CBD
SHA1:	A56615C7E12B677243A264F2FB3BAA1DDC98BF3A
SHA-256:	6C8FD27B126175CEC476807699EDCA7CCF495B930901DDD7E32E648958736EC7
SHA-512:	7B94CB0DE1395566AB7946003C5F7E2AB631B6B54A22DA1101EE8D166311BB339687BD1BCAD3CB29513F3E71EF19232CFB613B42B560AE85DC43660C06182277
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Wall Furring" GUID="{1305E17F-60D7-4BE2-96E0-7ADEDEABC2FC}">.. <Properties>.. <Property Class="Text" GUID="{6665170F-4747-41A4-9DEE-671167DA385B}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{1305E17F-60D7-4BE2-96E0-7ADEDEABC2FC}</Property>.. <Property Class="Number" GUID="{FC25094C-3C43-4C70-BBAF-0C58DBEE7CDB}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Image" GUID="{6A1A7557-A54B-421D-BA75-3553CDAC58EF}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="6" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADCHgAAwh4AAAAAAAAAAAAAZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\05.4 Metal Framing\is-F3J8O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	965
Entropy (8bit):	5.438915547446332
Encrypted:	false
SSDEEP:	24:2d2aiMDX2q9f2WAdOcFMdIc+mp1Oc+PRgAWao4Q/CApWtv:cg6v/ulc+mOZ4c
MD5:	A945DCCE40E37D05FDE25406EB2607EF
SHA1:	1F1DE966D2C659DB75964D3441AD669BA8E07CEE
SHA-256:	6845B2EF9A661EF8A253D8DF0FADFD974C6366F9124C840CEC8A07C2527FA565
SHA-512:	828DB927C9661E9987AD95BAA94507C87365CD41DA738D3032E0CEF4B71E6DC2E692EFA130B26EC1674BD29B7B695204E8D6D11C90CB579E0B65D6A1C562F768
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="05.4 Metal Framing (Div 05.40.00)" GUID="{A97F4FF9-F7FB-4271-8660-0A92E8C05454}">.. <Properties>.. <Property Class="Text" GUID="{662B4488-105F-4BCD-9D6B-EFFCC1A857F0}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{A97F4FF9-F7FB-4271-8660-0A92E8C05454}</Property>.. <Property Class="Number" GUID="{03E3F7D6-0205-4467-9E45-F7C9F29CB353}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">7</Property>.. <Property Class="Type" GUID="{8F8A234A-D514-402C-B20F-500BD9A54A9E}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{11E4C2E9-D695-40D3-AAE0-5EFA02E3331A}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">05.4 Metal Framing (Div 05.40.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\06.1 Rough Carpentr\Subfloor Sheathing\3%2F4%22 T&G OSB (Priced\Subfloor Adhesive (P\is-6E56M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (330), with CRLF line terminators
Category:	dropped
Size (bytes):	8260
Entropy (8bit):	5.598581459870814
Encrypted:	false
SSDEEP:	96:hDGRlQwYDMLMjmL+Vwfhd14ZBkJoQ0tdZLhXnXOD08WYI/g+kN:lRn3jmLVnGZ+GbhhX+DGYEg+kN
MD5:	B24B76B146728E73E2AF56DCF55F77BF
SHA1:	4E2DED9CE5B81EA5F22D6CC2FD61A0F4B16C8530
SHA-256:	851EB4AF6DE02AC7803AA7DA251CC1165CEE7F13AF4F263F40DB82B29D6ADCF3
SHA-512:	AADEE075C7A5829BA6D23B5E862D9D1C0B091A096A3775A931D73AA1FC26FAD3EE5CA3B5DDF2F47699075D926E28586AA51AB72E3E39BDA43E6A7549256CE87E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Subfloor Adhesive (Priced per TUBE)" GUID="{E1FAA56A-CACA-49A2-948F-1775111B54FD}">.. <Properties>.. <Property Class="Text" GUID="{CF0866E2-A991-4F2A-97BC-B12263FCB994}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Subfloor Adhesive (Priced per TUBE)</Property>.. <Property Class="Text" GUID="{732626C3-C981-4802-9FFE-16093820DFDD}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Type" GUID="{4542EA9E-B999-45F4-B337-46514A2CEB06}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Material</Property>.. <Property Class="Text" GUID="{6C134921-41A4-4A15-9FE3-03F4636FBE3F}" Name="Item #" group="Item" OrderIndex="3" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{A56DE495-E4E5-426C-91C2-0C7733FB021A}" Name="GUID" inherit

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\06.1 Rough Carpentr\Subfloor Sheathing\3%2F4%22 T&G OSB (Priced\Subfloor Nails%2FScrew\is-617L6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (329), with CRLF line terminators
Category:	dropped
Size (bytes):	8501
Entropy (8bit):	5.592110219088728
Encrypted:	false
SSDEEP:	192:DDFseQZyjmACme+MguGabJCoX+DXYl9rynv32r:uh8GkMjGlpDYrY3U
MD5:	6E5627215A65B5654223DB2EEAD30D2A
SHA1:	2D18AF06F28896FC462BCCD9802058E01E215C70
SHA-256:	081BA7DEC04511BCA5A52B8FB34B3B62A6D9F48A07174AAFBDBEF4C49DC268E6
SHA-512:	81884E3B45672F171EE5822DF8A5025F2BB9B237C839D934397C217487CE65DCE0B79BCB5F5C0528A15901A970DA82B4306D73681797215658C3A3F93A2CF697
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Subfloor Nails/Screws (Priced per BOX)" GUID="{E1718693-8D35-48DB-B07C-12EEEE435B16}">.. <Properties>.. <Property Class="Text" GUID="{4BECDCD1-1C65-4367-AAD4-A2CE01F6298C}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Subfloor Nails/Screws (Priced per BOX)</Property>.. <Property Class="Text" GUID="{FE86A9DC-F0AF-42DB-9D75-E4E19C93CBB6}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Type" GUID="{48E34CF4-36F3-4355-87B8-5ED1E99531DE}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Material</Property>.. <Property Class="Text" GUID="{2B2F90D3-9E1A-4BB6-9204-E6FA95D5F25A}" Name="Item #" group="Item" OrderIndex="3" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{93171145-903D-4D94-8298-D0E44CAE68A4}" Name="GUID" i

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\06.1 Rough Carpentr\Subfloor Sheathing\3%2F4%22 T&G OSB (Priced\is-R5QT2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	9621
Entropy (8bit):	5.61842798960844
Encrypted:	false
SSDEEP:	192:/XjxoooDTFxy5t7uGbRb4lHzl8RDDAVnA+Dk2WWagj:/X6o0s5t7uGbMh8RQA2LFj
MD5:	8FFCA664E175EB3EB2A591C5FD4ED89F
SHA1:	E6E375D557C762C69799D13848B47A222F32F292
SHA-256:	93DFA0B67A586F0E37C7CB65770BD1BC24816A7DA8B0BEB09E5928664DCBDC76
SHA-512:	C7BB46C127AC8DF9A9226861D9CEB95DE80743AEA75A7407F2D75EEF035DD79FB22BC8722CE289ABAA20AB43468650426CB0D6650EE2305B81637443DD4826B9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="3/4" T&G OSB (Priced per EA)" GUID="{C2BBD95E-9CB9-4CBC-871B-E652491D393E}">.. <Properties>.. <Property Class="Text" GUID="{1FA90CDA-1BB0-4764-83BF-8C450BEBA029}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{C2BBD95E-9CB9-4CBC-871B-E652491D393E}</Property>.. <Property Class="Number" GUID="{AC8B9DE7-83A1-49D5-A295-20A813A13C35}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{1CFC3D4B-1AE1-4D35-9B24-6EB2E6563F09}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\06.1 Rough Carpentr\Subfloor Sheathing\Subfloor Labor (Pric\is-PM6KR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (378), with CRLF line terminators
Category:	dropped
Size (bytes):	8974
Entropy (8bit):	5.607450705797492
Encrypted:	false
SSDEEP:	192:1j0BRRPXY4hsYbfcRuD+ZKvA+Dkz2/T1Mj:1QRRPXY4hsdRua2q2LKj
MD5:	67B3A75FAB9332484657AB22AF997D34
SHA1:	74BC792EA656CC8AE14F24021271277218288325
SHA-256:	A067FA8CC57525EC39D20E58E6680DD552CFBA599979539DBDEAA7807C7C4BCB
SHA-512:	EA7A0FBE5AEF21BEAB33F0C4F18A64A4E1E25AE69D0A54E5565798791E075E033988BAD066784E0C7C935ABFEC3A7E23014EA9D5DE715420A106A10469B6AFDA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Subfloor Labor (Priced per SQ FT)" GUID="{459E283B-2158-4596-B9A1-DF09ED156A05}">.. <Properties>.. <Property Class="Text" GUID="{148E4930-C89A-4AB2-BB5B-34AB9BD5B461}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{459E283B-2158-4596-B9A1-DF09ED156A05}</Property>.. <Property Class="Number" GUID="{5ECD1A9F-EB52-42C4-B22B-DFD2C3119740}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{8275715D-73A8-4AF1-AC42-9322FFDAFC24}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Waste %" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False&quot

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\06.1 Rough Carpentr\Subfloor Sheathing\is-3SQCV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (416), with CRLF line terminators
Category:	dropped
Size (bytes):	13420
Entropy (8bit):	5.550941033124131
Encrypted:	false
SSDEEP:	192:Aij9mUXdyM1ZRbV/J1+yLl+DglCi4VXV2ps/jQOM:3xmCdbzDvEElCi4h2EQOM
MD5:	B33B271D426A755B848255214C132423
SHA1:	CF04557405B05F3A1BB883FC114807FDA3849F13
SHA-256:	FAB2C2DBDA60B801A672D4724123A78A0A6A26493B371CFE9D1D988EF529B4BD
SHA-512:	EAE3CF05BA13E22BF10672A45B01D8D103A98C403DF10BBFE469599243BF596A227BEDE4161F9E9FD5DDC33921F936BB1C636E69B3391882451A563556858CC6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Area" Name="Subfloor Sheathing" GUID="{A30C10A2-0DC0-4834-896C-3CA650D1D472}">.. <Properties>.. <Property Class="Text" GUID="{5508DFE8-A0B1-4F69-BD54-10F4E9C846B0}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{A30C10A2-0DC0-4834-896C-3CA650D1D472}</Property>.. <Property Class="Number" GUID="{F3DC1E50-C905-4A72-9F53-2EDEC9327516}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Number" GUID="{E0279000-A23A-4072-8453-AFF39CF78C23}" Name="Line Width" hidden="True" OrderIndex="8" DecimalPlaces="2"/>.. <Property Class="Memo" GUID="{1969F76E-606D-465D-94DC-B672BD1CBEBF}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine=

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\06.1 Rough Carpentr\Typical Wood Framed\2x[Wall Width] [Actu\is-N2E9L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	11396
Entropy (8bit):	5.617569020657301
Encrypted:	false
SSDEEP:	192:H3ajWfGtoesbfmHg7iDNI8A+DR29uaiUWFbDwILLMGo2vlC1Ow5j:Xa6eg7iRF2RlWFbDwInMZ2v4B5j
MD5:	8A787228024B8F4455759EAA5385D7EF
SHA1:	D8DD0895FE1015CDE2F63FEF807B85B78314F592
SHA-256:	AB8C644F849F1176F3DD6D756AFB075DD9D0347D3F0BD497CA29084DAB7C173F
SHA-512:	9261AE7DF1C20DD03741F8012EB7FA67D9A429A2E6D52B7F1CB4520F5885676D1A3759F962F6223BF78ECE921B42496B2706E1C6B4B1353C9B4EB0F122BBEAA4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="2x[Wall Width] [Actual Stud Length]' Studs (Priced per EA)" GUID="{0B6347E1-6CEE-4DA4-8E50-96E2A4C0BFA8}">.. <Properties>.. <Property Class="Text" GUID="{5F550620-3171-4B84-B036-3DDF4123B5FC}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{0B6347E1-6CEE-4DA4-8E50-96E2A4C0BFA8}</Property>.. <Property Class="Number" GUID="{4FD52C72-7A5D-4416-8007-3EAC8FA2B232}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{E5653867-AF7C-4F23-8746-5D368A99548C}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="OC Spacing" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1&q

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\06.1 Rough Carpentr\Typical Wood Framed\2x[Wall Width]x[Leng1\is-M07CI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (361), with CRLF line terminators
Category:	dropped
Size (bytes):	9498
Entropy (8bit):	5.605933987173077
Encrypted:	false
SSDEEP:	192:JDtwjx9mxfb+OBHA7a0yDcCAA+D7J2zNwli1lzeoj:JhwnmxSMia0yynJ2zili3eoj
MD5:	1A733173D75AD1BDD80F2D862EEFA5BD
SHA1:	1910113C461E43AB15199C942286C1D28C8E168E
SHA-256:	3BE64554EB3EE1C96719AE39BA27399F4053543E56538AC738E3846E51C0FEAB
SHA-512:	FAE54C0911B60E8D221FF6FEF62EA282B0E63BF7643C1160E355C4C34196146E90D8C1D027156B757DECAF7D74C1E4D19AA16AD2A764FED4A958D96F5BDFED1A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="2x[Wall Width]x[Length]' Presssure Treated (Priced per EA)" GUID="{F4B9C045-DE78-4797-BCBE-B72620021FF8}">.. <Properties>.. <Property Class="Text" GUID="{979E4789-AC4D-4210-A8A9-C958B8660C6C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{F4B9C045-DE78-4797-BCBE-B72620021FF8}</Property>.. <Property Class="Number" GUID="{2B557A69-F771-4161-A1D0-882E18078E77}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{576BF095-D459-4049-A809-00397A887122}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Length" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Plates" Order="1&q

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\06.1 Rough Carpentr\Typical Wood Framed\2x[Wall Width]x[Leng\is-0DEEU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (361), with CRLF line terminators
Category:	dropped
Size (bytes):	9975
Entropy (8bit):	5.621043773945449
Encrypted:	false
SSDEEP:	192:JgjxJThvBKo/gTd4bp+ltXHYW0DjZ2A+Ddu2L/Ef2ml6j:JgXTh5Ko/6EIpYW0ZUBu2L/Euml6j
MD5:	B2F20D7785C7711AE8CE251685BE7DBC
SHA1:	09CA8F396FAAD23FBF354F380230B0B8DBFCBA68
SHA-256:	D881CF24252FDDC5CD19BB1AE333B38CF3FBAF525BE5B9C4B3444362748BB1A4
SHA-512:	F3EEC198543A7E70CB3BF9DE2A8A84977D9A592C9804690B8EBC7008618DF3E0C0A304F4796ABF7F816E0CB13366F985399330393F55B2754276C77BEF6F4287
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="2x[Wall Width]x[Length]' (Priced per EA)" GUID="{6105C722-BA04-4A5D-A62A-D9E16F484CDE}">.. <Properties>.. <Property Class="Text" GUID="{65512777-B45A-4787-8BA2-3AD01CA4751E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{6105C722-BA04-4A5D-A62A-D9E16F484CDE}</Property>.. <Property Class="Number" GUID="{CAC911A9-F3F5-402E-A5BC-B6B41C704785}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{7F7D55DA-F8B6-4521-8111-F62ACBCA3385}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Length" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Plates" Order="1" ShowUnits=&qu

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\06.1 Rough Carpentr\Typical Wood Framed\Framing Labor (Price\is-JK4GV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (380), with CRLF line terminators
Category:	dropped
Size (bytes):	9090
Entropy (8bit):	5.60459276601379
Encrypted:	false
SSDEEP:	192:4j25oHUbMAcz8ByA+pJIA+Df2wjEvSK1DL:4ZDzk72wjEvSK1DL
MD5:	D15A52C4B0EBC7A5629AA3F8987BA589
SHA1:	175726D2A5814C2408810350782E95C84DA5AA79
SHA-256:	0CAB4F0165AE63B124AE88D49E7C705EF4F12318B71B74012E06F643C5B796BA
SHA-512:	27EDC7E8097E7C7ECD13444922CA0FB31DEE7EC4A17294DF74B45F253DB2AC977203370CE462E308E40EEA800E1B1DB2D5E6555D93A568AB6998F242F6F5DA5A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Framing Labor (Priced per HR)" GUID="{5B9E6256-308A-42ED-B0DC-02C3502C6FF3}">.. <Properties>.. <Property Class="Text" GUID="{AC77732F-DBAF-4FEB-97E2-19FDC015DA80}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{5B9E6256-308A-42ED-B0DC-02C3502C6FF3}</Property>.. <Property Class="Number" GUID="{4C9C6C8E-D95C-4E31-8246-03D1DCE5F4DB}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Memo" GUID="{8F30783E-EF5D-46EB-A571-EE0077F8E2C8}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Labor Production" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False&q

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\06.1 Rough Carpentr\Typical Wood Framed\[Sheathing Thickness\is-KU0OA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (361), with CRLF line terminators
Category:	dropped
Size (bytes):	10241
Entropy (8bit):	5.623276290578134
Encrypted:	false
SSDEEP:	192:wJb3jTrJDNsbHlH6jWDSmG0LA+DYdQ2wYzeXDTG6j:wJb3LJDNoajWU0192wYzeXDTJj
MD5:	2F2FD72D5D41D4AA566CAFD5AF3705C1
SHA1:	ADE4846FEA5741CA60A8681620D7C69847DD964B
SHA-256:	332523717FE997E9B5BAEE9848CE6ACB6505555D5878CF1909AEDDEEFE954DF1
SHA-512:	44D353E8B9E68B29CAF53AED3AC106FF9134346DB9F3933DFF319D84D2EC970A3BC53587EEB96614E442B45ED3FC43D770F6FEBD449A04710B1C1AA986C14966
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="[Sheathing Thickness] [Width]x[Length] [Sheathing Type] (Priced per EA)" GUID="{FE22109B-D8C3-4D9A-ABDC-FBDE2B419359}">.. <Properties>.. <Property Class="Text" GUID="{186BE8FD-9E8C-485E-B6BC-59A280EEE343}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{FE22109B-D8C3-4D9A-ABDC-FBDE2B419359}</Property>.. <Property Class="Number" GUID="{E96813A4-84AA-48BC-A336-103B298D45AC}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{5E199018-24C3-49A5-AB3F-8131DCEB381A}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides&quot

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\06.1 Rough Carpentr\Typical Wood Framed\is-6A77E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (416), with CRLF line terminators
Category:	dropped
Size (bytes):	26563
Entropy (8bit):	5.567821857914547
Encrypted:	false
SSDEEP:	768:bxBnzXdocSseJs77DH6PCN/v4wApzwNbwBHA5qlpJt:TnzXdocSseJsPDH6PCN/v4wApzwNbwBP
MD5:	5EB10836A921A3E65D78FA6B2D486FEE
SHA1:	88DF44CB4021883D08F62C358D27BDFD2A4657E8
SHA-256:	E4B24A05B8B1F61866F8D14843DFBF0255824138085BB3C10DE069A97FFCC73C
SHA-512:	FC1F3194D511CEB8E7BFA4235BB5F590927A1A42511B461091C48797DB905620203F24FAB2387B8FE536D920073ADBD68945EF366AB47EE522A48ED3B6FC6F28
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Linear" Name="Typical Wood Framed Wall" GUID="{30CFDEDE-E65B-4C3F-9891-05A06D741E70}">.. <Properties>.. <Property Class="Text" GUID="{C4807CC9-9A42-4A33-91C9-6056D4414CDD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{30CFDEDE-E65B-4C3F-9891-05A06D741E70}</Property>.. <Property Class="Number" GUID="{88F1AEA7-6E90-443D-B442-4B2394E6F64F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{C0EFC832-5BAC-4D21-A3C4-B8532009DE42}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Wall Height" Order="1" ShowUnits="True" SameLin

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\06.1 Rough Carpentr\is-DS387.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	969
Entropy (8bit):	5.442065874664886
Encrypted:	false
SSDEEP:	24:2d215O2uX24f2WAdOc9Yfb1OcjLJ6gAWa6KcfI/CApW+QOUv:cc5O2uX6YoU3IsO2
MD5:	88AE62B3DAFB35FD2AF42DB626AB8AAD
SHA1:	5BE5CAA5AE0D1A1A43460D52D0F87CAC2A8CF50C
SHA-256:	3BC731096FE13E9C21E77ED957E614DB041C91CA8D3DFBD135C462CF0D0A8217
SHA-512:	62C0FB98E09729CEB7A57EA003CF9E2AA58ABD098F795AA3B4C250F374943DCF3369182D03EA1085602512584A8F2F82D20257D18584E56768B47272E5ACF02A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="06.1 Rough Carpentry (Div 06.10.00)" GUID="{CD9A8B5E-CB0B-4BCA-8E40-313E3CBD4437}">.. <Properties>.. <Property Class="Text" GUID="{4399BA3C-0269-45E5-A18D-FADB3F2C3236}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{CD9A8B5E-CB0B-4BCA-8E40-313E3CBD4437}</Property>.. <Property Class="Number" GUID="{13702AAD-96CC-4706-8C3D-53AF802F5431}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">8</Property>.. <Property Class="Type" GUID="{ACE6834E-88CB-416F-8D3E-C411D78DC6DB}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{0960736B-9CFC-4935-BA0A-A8B06FC476A3}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">06.1 Rough Carpentry (Div 06.10.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\06.2 Finish Carpent\Base Board\Base Board (Priced p\is-FQS1D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	7221
Entropy (8bit):	5.5903823780332536
Encrypted:	false
SSDEEP:	192:Q+jqYkOmbmlOjDc8W9A+DvS2+y/NuGSuEBjL:rZJOjwRO2+wYFuEBjL
MD5:	430B893EDCE9A9D901CA7017BEB50F56
SHA1:	40C377752B7CF26809A88A6A1F7FEDAB77280284
SHA-256:	9BA88C054B55A55EDE7C7294FAD107F145DF4F6D3C073E7C9986D478F4375C92
SHA-512:	0532DE7CC2E37C2ED46382F26DA5EC2DB9FBBE9C318548248B2BEAE58050D8EA4F5101411713BB5B6F58D1CF325944344D160122AFDF80167A153D481D6A551D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Base Board (Priced per EA)" GUID="{BD4D314A-685C-45EC-A6E0-21743416A710}">.. <Properties>.. <Property Class="Text" GUID="{6A275CF5-DF28-4F61-B483-055D9D5818E1}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{BD4D314A-685C-45EC-A6E0-21743416A710}</Property>.. <Property Class="Number" GUID="{D4B57B83-ADC0-4A49-80C8-A64A3311CF67}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{AE69CBA8-6DF5-41A3-8E9C-926759A2426A}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False" SameLine=&

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\06.2 Finish Carpent\Base Board\Base Board Labor (Pr\is-CL2PD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	7730
Entropy (8bit):	5.585338998184546
Encrypted:	false
SSDEEP:	192:Oj2cI9ZubMDtc2MUD3q8RA+DY72BTpQBvXEL:O2TJq2MUOyo2XWvXEL
MD5:	E9C55EFDFED19BB5DFB7431FE726BA6C
SHA1:	10C6ADAADE2C2BD3592BF5D33957205126C831ED
SHA-256:	AC93C85EDD4E5AEC64F8A509C7A7F42D5B01680685DA6DE773E628138857A267
SHA-512:	76A3C90F40F0B49AA6C60BC2ECEEAE6FBD1E3E3158FB6CCC4697868E9A8CF7A40EBEAD0C33B3D7527D2701006F66DF197891EE29E18B58F79A7628EA7C69FFA2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Base Board Labor (Priced per FT)" GUID="{2E698A4A-B24E-438B-816A-39467ED86754}">.. <Properties>.. <Property Class="Text" GUID="{9A761AC7-E979-4EF2-AE48-773459D68B5C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{2E698A4A-B24E-438B-816A-39467ED86754}</Property>.. <Property Class="Number" GUID="{2C761C43-BD06-472C-9D87-0852F8909171}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{E82E85C6-D84A-405E-B8C8-E629271AA4B2}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Labor Production" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="Fals

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\06.2 Finish Carpent\Base Board\is-MMJ8R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	13576
Entropy (8bit):	5.655657886527253
Encrypted:	false
SSDEEP:	192:aUUij8oNtjSb48qhjDP8j8dceV+DFuRyQnX4UiYwdo0FQrYkUVL:9YK6qd7xcXxuRyQX/ido0GrQVL
MD5:	1AA32B5B4A3B92F6DB985CDE7B80613A
SHA1:	5998650A9463C1216AC7F8837FA1692335BBAFF7
SHA-256:	1B528A0F9B78E54C999F883620E91073132196704B192AEC1D3594722FAB6162
SHA-512:	5A4C8C5121887A07DE2B2FECA25CEBD6CCA8C295942C15CC8AD9F044E772A85E85783D18388E1C82E698DF6211221F8662D4FD83D50A2523A94E4B8785A8CFAE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Base Board" GUID="{F7EDD904-65CE-4F47-8FBB-BF90BAEBC44A}">.. <Properties>.. <Property Class="Text" GUID="{4FE90644-D738-4BCC-B34D-EC22DB7F8578}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{F7EDD904-65CE-4F47-8FBB-BF90BAEBC44A}</Property>.. <Property Class="Number" GUID="{20A6CBAE-7115-4FF1-B394-9C00F71B9767}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Image" GUID="{EAAD7DF4-AAF1-4995-87BB-41D7FDE34909}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="6" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADCHgAAwh4AAAAAAAAAAAAAZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0Hm

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\06.2 Finish Carpent\Crown Molding\Crown Molding (Price\is-95LIF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	7227
Entropy (8bit):	5.593197915017661
Encrypted:	false
SSDEEP:	192:WjqLBILJbxl06vDf8U8A+D92QiH1aLp4L:WbJ0a7pmh29VGp4L
MD5:	5A1F314AF5172E0FD8DCE02BE0788C4D
SHA1:	F28C22A2B37AA8A77C9E3B60B12B2C2725534D79
SHA-256:	9D38F19C1F948C9D1B788DD6B6E23F6317F9DA8CDFA7CB8392389CFD8AE90817
SHA-512:	F7946B2656402A2E5FF42FB514BE105EFCADD513E4D88DAF6E9F7FAFC89CA8CC73CABC6F4BA0880A5FBDB22A84FE0F8A54CE3D7C8CC408E33DCAA706DC694196
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Crown Molding (Priced per EA)" GUID="{C8B1B69D-75F2-4B95-B44F-620BECF54767}">.. <Properties>.. <Property Class="Text" GUID="{96132301-2063-4583-B0A1-8CB710D7AE4A}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{C8B1B69D-75F2-4B95-B44F-620BECF54767}</Property>.. <Property Class="Number" GUID="{270E8029-2CE3-4CB5-8700-4A5E179EF78F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{216A2E47-1C60-4725-8008-883B5E622628}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False" SameLin

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\06.2 Finish Carpent\Crown Molding\Crown Molding Labor\is-TSU4F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (375), with CRLF line terminators
Category:	dropped
Size (bytes):	7736
Entropy (8bit):	5.586026886084009
Encrypted:	false
SSDEEP:	192:7Xj2prYIbhchVDXc8DA+Dl2uQ2n+1PDiL:7X5XhVLcwJ2Q+1riL
MD5:	7124BC4E7F622F37E31BE4208926AADC
SHA1:	51783E2EC1DA7B662723BC125CE95EE56043FE52
SHA-256:	643D007937390A8B32A260C4AED31B771E4EFCC8A94BC1F264E8253545BD46E2
SHA-512:	1913016381A1562920BD6CACB0E62C6779B89A19A99F763B57E61C9D986E7B9829FF9D9182736150E351951465931E3A5ECBBE87CC8EF030CF91CFF8926A91B5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Crown Molding Labor (Priced per FT)" GUID="{95EBD092-0032-408E-ACE3-395F097C0CED}">.. <Properties>.. <Property Class="Text" GUID="{29CE904A-300B-4B28-8496-0465DF5455A5}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{95EBD092-0032-408E-ACE3-395F097C0CED}</Property>.. <Property Class="Number" GUID="{7E5202DB-CBE7-4B5F-96AE-CF27F5D57323}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{FE2618CC-B8D8-4E9D-9B0A-B42EF8F97DEA}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Labor Production" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="F

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\06.2 Finish Carpent\Crown Molding\is-4LJ3N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	13582
Entropy (8bit):	5.6566181599481
Encrypted:	false
SSDEEP:	192:fNZij8lDljt5ZbqYqXDd8MozB+V+DRRpBUPv8XEXEgpbDL:WYnbqX5s3dRpWPvGUECbDL
MD5:	9868210B073B159EC292F1C278728368
SHA1:	6E0B34B4E91E4C51CC12890FC5FB60B5A25F1BF8
SHA-256:	5FB29489624BE91327EEC9087F4FE5E454F6872F57EA7464C9FA080FA926F471
SHA-512:	045FD953FEF218BF5151A4E889B7F74A85F7180CF3076654DE7EA83372599B2C9593BC33F06F932B207319BEDB9B2604EA4EEC2E10820E497393BB7E030F3A17
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Crown Molding" GUID="{70C5854E-9EAF-4C73-A84E-9800D485E0D7}">.. <Properties>.. <Property Class="Text" GUID="{3F92CC23-3C88-47D3-9233-ECD5F264ADF8}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{70C5854E-9EAF-4C73-A84E-9800D485E0D7}</Property>.. <Property Class="Number" GUID="{DD2396AD-BB72-4ADB-958E-2D7080B32943}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Image" GUID="{A594E6F7-DEEE-4809-B57B-0E482D622AC8}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="6" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADCHgAAwh4AAAAAAAAAAAAAZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\06.2 Finish Carpent\is-D8AJ6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	971
Entropy (8bit):	5.441586524679959
Encrypted:	false
SSDEEP:	24:2d21RYX2e9f2WAdOcNVxf1Oc8rtbgAWayQxmQ/CApWX5v:ccRY/s/ks4Qx
MD5:	D80172E4DF98049CEC454EE017F2B86C
SHA1:	6DC5F0ABBFFC844CD29AA8D6133C334006B1B11B
SHA-256:	3C4F103339D2E9FB5BC3728BCEF673E9E04C3B61DCD17B370683422288FA3CB0
SHA-512:	6E4600B0CB1AA320C4DFC3C3F54E3ACF52A145D9E0095EA60943C6AB9739FA4D7A1A33B2FC63400462621EE3A3F8CE08A158BAAA14725010FA19981BE1834255
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="06.2 Finish Carpentry (Div 06.20.00)" GUID="{67E08593-52CB-4AFC-8FA4-80216827D0E4}">.. <Properties>.. <Property Class="Text" GUID="{33DB9804-4314-4745-B715-204FA0E364CE}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{67E08593-52CB-4AFC-8FA4-80216827D0E4}</Property>.. <Property Class="Number" GUID="{ABF842C5-0EBD-43B9-90E2-765E699BAEB5}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">9</Property>.. <Property Class="Type" GUID="{79C72D46-8AD9-4920-9D78-4CBFBFD88A0B}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{A95E7C13-ADA2-495D-A841-51347E427F55}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">06.2 Finish Carpentry (Div 06.20.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\07.2 Thermal Insula\Insulated Ceiling\Insulation Labor (Pr\is-NCK65.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (343), with CRLF line terminators
Category:	dropped
Size (bytes):	4815
Entropy (8bit):	5.571360654514462
Encrypted:	false
SSDEEP:	96:qCfz9ojNekmoQ0tdDURUeL5XnXOD08wYIiy:z+jNptbgX5X+DgYvy
MD5:	98A06DC171C322EEC7F9DD4D02069EBF
SHA1:	5D0B7AB970F55E15E735AC29C2CBB5866E9CF2A6
SHA-256:	B78E718C7BDC5143899D2CA34881C48A24A1E1478F4A910F3520FC4097E6B673
SHA-512:	6A498A6CD210D2B7B467327097989AA3548D6B06E9BF3ED40B38FF1224E050C47D454408A5D880C1F2504FBAAB36DE6542BF2E57CF6D9BCACCBE8D06DA30A06D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Insulation Labor (Priced per SQ FT)" GUID="{7E5C78B7-456B-4E7C-BDC5-A24F39EEB467}">.. <Properties>.. <Property Class="Text" GUID="{ED8F4C9A-F9C0-4AB6-9493-83A00F1091BE}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Insulation Labor (Priced per SQ FT)</Property>.. <Property Class="Text" GUID="{285ACF6A-FD71-493D-8D00-6F2073F82AF6}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Type" GUID="{19055717-C977-41C6-A241-54A8A576F50A}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Labor</Property>.. <Property Class="Text" GUID="{3CE2DE4E-1A8B-48D7-8841-7F460B7E5BCD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{7E5C78B7-456B-4E7C-BDC5-A24F39EEB467}</Property>.. <Property Class="Number" GUID="{5F3A3527-37E8-411

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\07.2 Thermal Insula\Insulated Ceiling\R-30 Insulation (Pri\is-UB09T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (380), with CRLF line terminators
Category:	dropped
Size (bytes):	8139
Entropy (8bit):	5.6017328665272705
Encrypted:	false
SSDEEP:	192:xaj6sWNFbmSckiHrYD308eMCQA+DJ2nsJKXL:8wSxHrYIjTaV2nsJKXL
MD5:	65429439C7CC6294AC2EB22C5347196C
SHA1:	BABDC5339FCEB399C350A96E53AD0AECBD10EAAC
SHA-256:	4A3FAA7A9424FDFD21BC91CAC93B2DCA0EBE72606176B4590F6521EBDAD80A11
SHA-512:	BB4B022F9ACDFC4103435BF19D2A4AAA0C512CF387D6C1D083AC850E72EBFB8DB39F8F2DED6FF752E69E196A632EDF6D38C8741E02F9642DA11A2D82EA8250BC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="R-30 Insulation (Priced per ROLL)" GUID="{1A8F4D48-C47D-4FCF-AEB4-19B10794087A}">.. <Properties>.. <Property Class="Text" GUID="{8857E90F-6FFA-4F5F-8D3D-3475BBBFEBDB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{1A8F4D48-C47D-4FCF-AEB4-19B10794087A}</Property>.. <Property Class="Number" GUID="{88182B9E-B570-46D6-8841-424CE92B94DA}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{CE218A04-AFC0-4B13-AE9C-8270DEDDE410}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Manual Subtract" Order="1" ShowUnits=

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\07.2 Thermal Insula\Insulated Ceiling\is-PLH68.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	12463
Entropy (8bit):	5.62219792428878
Encrypted:	false
SSDEEP:	192:PCLCwIirij9GWX4qOb6rnV8NxA+yOl+D4lFSObZ0XhOlh1mqM107K:aGwYxGWoqbVFvTUlFpuUMaK
MD5:	53AC7D7F098D947864019BE8F8E07C83
SHA1:	A53F80CA2C6F5720BBC0186A2A540A1AA7D2C24A
SHA-256:	42883D0F908B7ECE73A47EA7781C19145981F9E8F466818F629F694078E157E4
SHA-512:	B92A09D537522522D10256B8FFA4293795F8B3D62AF668046628AF24D08CD36C87645079EEB2A02D512D188768C0928326F94C36A05A47F6C4C9DC6895CC793F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Insulated Ceiling" GUID="{A7AFAAA6-864B-4BFD-BA48-AC2F0A24FABD}">.. <Properties>.. <Property Class="Text" GUID="{E5F601EC-AEF2-4EB7-8F1F-15ADD495134E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{A7AFAAA6-864B-4BFD-BA48-AC2F0A24FABD}</Property>.. <Property Class="Image" GUID="{EA7F60AD-97BF-409E-AE7B-BF3196889A02}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="2" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZfmgZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZfmgZGRk////////////////ZGRkZGRkZGRkZGRkZGRkZGRkZGRkZfmgZfmgZfmgZfmgZGRkZGRkZGRk////////ZGRkZfmgZf

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\07.2 Thermal Insula\Insulated Wall\Insulation Labor (Pr\is-TME4H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (343), with CRLF line terminators
Category:	dropped
Size (bytes):	5428
Entropy (8bit):	5.584632404112817
Encrypted:	false
SSDEEP:	96:VjX6z5hamRojNKkSoQ0tdYC4Rf/LzXnXOD08BtYISLCh:NiyjN1xbYphzX+DjY1A
MD5:	3FFCFF06033A4392AE3BBDD723C9E7C8
SHA1:	B6ECE70B9D507F47AD7302D055969D3F83651809
SHA-256:	D644C4AFEF55F4CF2DD1325DE7B75B141DA5AAD6D21579D22943A4ECE7193030
SHA-512:	11A055FC663DC2258B92FF0158A30C0A7BB8CF844AA0652EB82D8675E8F97CA0548930AF979962B0208D146102B9D6FBC55D92C8A3F2F4512C922EF32F0D2905
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Insulation Labor (Priced per SQ FT)" GUID="{99D8CA70-22C9-421C-8A05-A740995B39D7}">.. <Properties>.. <Property Class="Text" GUID="{B0AA9559-24BB-4943-8EC1-D1EAAF87E1B6}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Insulation Labor (Priced per SQ FT)</Property>.. <Property Class="Text" GUID="{229C0B27-E5FF-4461-8622-CA7FF4736655}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Type" GUID="{471B33D0-498D-446B-B3CE-1DA621A74D31}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Labor</Property>.. <Property Class="Text" GUID="{0B5AED08-A607-48F8-8AAA-55FF45EC3ED1}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{99D8CA70-22C9-421C-8A05-A740995B39D7}</Property>.. <Property Class="Number" GUID="{C66B

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\07.2 Thermal Insula\Insulated Wall\R-19 Insulation (Pri\is-7KLKL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (380), with CRLF line terminators
Category:	dropped
Size (bytes):	8500
Entropy (8bit):	5.590391677628169
Encrypted:	false
SSDEEP:	192:XUj231WQmFb1SKCHDAz8m0A+DXE2Bjhl6DL:XUvQFKCHMzveY2BjhlIL
MD5:	7C45BC826AF6158D558F1258B4357ACC
SHA1:	59720AFB1637E4F46EFE174EA6EE202071002C11
SHA-256:	74E396A5BC7EE0BF94BB057591CA1698AF2DCF11980BAF9B6735019F2BE4D1DA
SHA-512:	F054948966F740C1FE8D4112C80C2037687BC6C7A99632734F1CC2B176E3118260009AC31D3ADA1E6507BD1B9CA983331A9CB79257430E98197D44D54969524A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="R-19 Insulation (Priced per ROLL)" GUID="{55C5A43C-C81E-49FA-8B0F-CEBFD14EE354}">.. <Properties>.. <Property Class="Text" GUID="{78F58779-897F-4410-8FE7-2AEFD6646079}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{55C5A43C-C81E-49FA-8B0F-CEBFD14EE354}</Property>.. <Property Class="Number" GUID="{6F1B293C-FEE6-40D6-8665-1385CC96B5DB}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{220411D3-3133-47A8-B065-75EF41C49D28}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides" Order="1" ShowUnits="

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\07.2 Thermal Insula\Insulated Wall\is-25MHV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	15177
Entropy (8bit):	5.655086948078084
Encrypted:	false
SSDEEP:	192:tUtAqjU0hQYbWlHKnY8LYBxMfT7V+DrRxEHt+jOm41XoAUZZQY9gkS:tEA0hQ3eYPB+f4fRxe+jOvBoBZB9w
MD5:	3B547FB82AED3158464846A97A073C6A
SHA1:	51C81ED2D02697D575A1E2DC3DF8DE3F9E433A8C
SHA-256:	C98CA16FA8FD877BEE20125A83895914FD28F4A5D9C5B7BC7FD1EBC7D84A3A53
SHA-512:	D5FE71CAF59BA5FB16D127178ABA87F54730B981A93DF4D87D46EF171B09D1C7C5328567C8B4C0999851F0C5C5AF1A37E107AD17B4E986C2C0BEC8212A27F007
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Insulated Wall" GUID="{693DC1F5-804D-421D-8F6A-1602C9BE8EAC}">.. <Properties>.. <Property Class="Text" GUID="{2791E9A2-8F8D-4A06-A46B-509BD6CF3094}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{693DC1F5-804D-421D-8F6A-1602C9BE8EAC}</Property>.. <Property Class="Image" GUID="{4B55A980-C5AD-4872-825B-081562DC7FBB}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="3" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADCHgAAwh4AAAAAAAAAAAAAZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HZGRkZGRkZGRkZGRkZGRkmV0HZGRkZ

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\07.2 Thermal Insula\is-53U7N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	976
Entropy (8bit):	5.4476675039390186
Encrypted:	false
SSDEEP:	24:2d2gMnv51X2+1wBf2WAdOcy5SsW1OcpeyAgAWatQ/CApWK8nIv:cgnx1PwT57hwUnS
MD5:	B7CA1310D36F7614952D1B62474EA450
SHA1:	94035070907F77FB7ED7C429B5A037348A20FBA9
SHA-256:	FDC6271A55E30233D73DC19FFAC313D76F257EE0854FD8673D2A6FF74B39BAD2
SHA-512:	1E0357FC287108947428822F22C8D7EA00463CFD7115D5861AA75E20ED1C710B02652B6A4D141C2C229AD79F39A2D77D2C4AC828621EF7E30032F939EA855405
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="07.2 Thermal Insulation (Div 07.21.00)" GUID="{B503C40D-D73A-4CBF-8B5D-616EC42FAE26}">.. <Properties>.. <Property Class="Text" GUID="{5A8B4368-C839-4109-B8F6-289C1F93FBD5}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{B503C40D-D73A-4CBF-8B5D-616EC42FAE26}</Property>.. <Property Class="Number" GUID="{3AB3DE59-0F45-4085-BD3D-8E5A1457398E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">10</Property>.. <Property Class="Type" GUID="{B92B30F8-CA7A-4DAA-ACED-111EB22AD113}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{69456322-D58E-4832-930B-A9A10EB90616}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">07.2 Thermal Insulation (Div 07.21.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\07.3 Roofing (Div 0\Asphalt Shingle Roof1\#15 Asphalt Felt (Pr\is-TPUFE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (380), with CRLF line terminators
Category:	dropped
Size (bytes):	7796
Entropy (8bit):	5.607859620455091
Encrypted:	false
SSDEEP:	192:ljcgW07FbMhcswGRD338+MCA+Dj2wQmiRLHAsqL:lG2swQzrnv2wfihHAsqL
MD5:	2CAAE043D28124F9AEF928309E61E4EC
SHA1:	4A619019B4B7F0978D3E0A175BA4F605276C4E6C
SHA-256:	CE72F6E6139EF791B2F26D9C7E7062AE5FD2441BAFDCB6E339C695B1FBBE7435
SHA-512:	0522D3E5CC2397ECEE507BEA572B429F195B07D47BBBD45D0E65C4E84E6BC2A557719896D1214D0C19429461F935D346E864366996195904D3D1BE3BCAD85815
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="#15 Asphalt Felt (Priced per ROLL)" GUID="{A58F08F9-7C76-4080-BBE8-6FC7604EAAE6}">.. <Properties>.. <Property Class="Text" GUID="{74D51A67-620E-43A6-BE05-3C6FAE0DF6A3}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{A58F08F9-7C76-4080-BBE8-6FC7604EAAE6}</Property>.. <Property Class="Number" GUID="{1A8A1D61-E4D2-42FB-BF21-D0FBDB5A522E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{95274475-3A39-40EC-A600-5E846C489CFB}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Pitch" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Material Coverage" Order="1" ShowUnits="Fal

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\07.3 Roofing (Div 0\Asphalt Shingle Roof1\30 Year Shingles (Pr\is-9T296.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (377), with CRLF line terminators
Category:	dropped
Size (bytes):	7788
Entropy (8bit):	5.6087967777810945
Encrypted:	false
SSDEEP:	192:W7VjcEtWqb9bc7I6DT88aMZA+DD26er5YxKL:4jtg7I6MDU32Tr5YxKL
MD5:	8EF618A38BE6493D0961390F3F424AA8
SHA1:	D67CD8BF7427F770F0B910CB2BD76E9FF25A4853
SHA-256:	E405CDB82E99EE2FE19D0D011AFF7251902EC2CD3211E0130304AC8E61C22FA5
SHA-512:	46A4D0C3C02F916BE0FC2CD8EF99B8D4A93AC445B12F00F2BFE074A1AEA20A1EB8BFA1770FBBE443B60C81C4C75617B5C70CBD37A66A47DD50F7BA06A3813815
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="30 Year Shingles (Priced per SQR)" GUID="{CE0E82BC-3C76-4237-8C71-DB0F4FA45964}">.. <Properties>.. <Property Class="Text" GUID="{5A783809-2843-48D9-929C-408513659507}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{CE0E82BC-3C76-4237-8C71-DB0F4FA45964}</Property>.. <Property Class="Number" GUID="{0616EAA8-4E27-49B1-B7B7-8B14B1D5C083}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{C3EB3DBA-F6CE-4CB8-ABE5-D59194CD008C}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Pitch" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Material Coverage" Order="1" ShowUnits="Fals

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\07.3 Roofing (Div 0\Asphalt Shingle Roof1\Roofing Labor (price\is-0M123.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (378), with CRLF line terminators
Category:	dropped
Size (bytes):	7874
Entropy (8bit):	5.599161815480907
Encrypted:	false
SSDEEP:	192:hlgTCj0B8g1b8fcWRMwD/8kA+DI+23tK704bML:hl4CmtnWRJbvE+23t404bML
MD5:	C9F0214A253C43C012DBF24462EA0219
SHA1:	FD8C17AA008A78087E145EF448C562FA38908BA7
SHA-256:	BF51FDFCABB76D64E401CAB9B459B761D5C5B19B80B750BB34346AF4836E6FDC
SHA-512:	34471BD41E95ACC238A4B6CA7697C37C97D9A3D5B579EF6843D416C234AE12844AC50C0C5FFE08550399C0C2BA64EFE32A218833703392468C85C20E0B8B2A03
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Roofing Labor (priced per SQ FT)" GUID="{15FCC1F8-99E8-4AAE-8021-88CABC8C0E70}">.. <Properties>.. <Property Class="Text" GUID="{6A835515-61BB-457D-8C06-1E257AAD4153}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{15FCC1F8-99E8-4AAE-8021-88CABC8C0E70}</Property>.. <Property Class="Number" GUID="{185C0935-F597-4D23-95D4-5B74E625FB88}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{6B25B66A-50F6-4354-9315-40062B9B3534}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Waste %" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\07.3 Roofing (Div 0\Asphalt Shingle Roof1\is-ORFPB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1401), with CRLF line terminators
Category:	dropped
Size (bytes):	20144
Entropy (8bit):	5.665244100838035
Encrypted:	false
SSDEEP:	384:lzL+4uAUHD2oK4efQTe04L+9jDZ5/SgyrXcIqMqRL/NpcSqR3i5jUIDheZaPysJ6:lzLPuAUHKoK4efQTe04L+9jDZ5qgyT2i
MD5:	24BC633FAE720B60B96B4AF2F9F91119
SHA1:	60E1648E33E2AF5263A87219E97F9F60A24778D1
SHA-256:	CFA54D319B03294E001BF82CAACFAE9AD9D3DA5F73EA14C2C51D31370822BD7B
SHA-512:	530230D4AA5C4847A20F0A889A93AD34C14282EFCD5958F44606C9B606EFAE7ED636B226DBD93F84AEC3862CD5CC2998869D65FEAAFD8DDEEB23F0295A70A904
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Asphalt Shingle Roof (Plan View)" GUID="{8E69792A-E206-46D4-87E8-530C8456820C}">.. <Properties>.. <Property Class="Text" GUID="{E9EA006B-CB86-48B5-B5BD-C7F0DE93389A}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{8E69792A-E206-46D4-87E8-530C8456820C}</Property>.. <Property Class="Number" GUID="{C9DB6BD7-CFF1-4A2B-8797-FA0F0DB1D576}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{1A52C264-1792-4412-8A37-E569A75C3C12}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Pitch" Order="1" ShowUnits="True" SameLin

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\07.3 Roofing (Div 0\Asphalt Shingle Roof\#15 Asphalt Felt (Pr\is-071CC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (380), with CRLF line terminators
Category:	dropped
Size (bytes):	7803
Entropy (8bit):	5.609047349472761
Encrypted:	false
SSDEEP:	192:xgQ0jc+1WiFbWca6cqDgb8eAMPA+Du2pSbDnL:xgDU4Lcqwm0K2pSbDnL
MD5:	CE345A6FB0C7517CCE80EC2B19071C73
SHA1:	D589C315E143F2A007C3892FF1CE177F51EC96A9
SHA-256:	19148A95455362594736328B9E70CB798658BEC1B4B21ECAD7156B6DB6A6F728
SHA-512:	ECE0FDA7515E3A8C570B6E8D9B3724432779A448AADBB59E3CF1EFDA287549B46389421139A2DE7D0DE3587F97AED78C89EB6FBD2030CE9E6E93468AEFC9ADF8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="#15 Asphalt Felt (Priced per ROLL)" GUID="{38787DA1-DEC7-4CAA-A882-1F672926A837}">.. <Properties>.. <Property Class="Text" GUID="{71758069-BC10-49A6-84DE-64AAA3899180}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{38787DA1-DEC7-4CAA-A882-1F672926A837}</Property>.. <Property Class="Number" GUID="{0E0265B9-08B3-4A6B-8F1D-05C63DA9ABB8}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{D452B076-4EE0-41C5-BC7D-DF097A1BF669}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Pitch" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Material Coverage" Order="1" ShowUnits="Fal

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\07.3 Roofing (Div 0\Asphalt Shingle Roof\30 Year Shingles (Pr\is-8D72O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (377), with CRLF line terminators
Category:	dropped
Size (bytes):	7795
Entropy (8bit):	5.609805129270918
Encrypted:	false
SSDEEP:	192:Mjcks+ebec1GlDV8jM+kA+DQm2x4Q1DoMcbL:MxC1Glpq1ucm2xH1DDcbL
MD5:	6A81F289FE3BE654AC090F0AD4BAE097
SHA1:	98B106B5F32CF791EBF1418D3B9E49037C99801B
SHA-256:	713F1999770F10518D0CB33EA1B711A044B5674A01FB4F1863CB822C0C893A50
SHA-512:	3D8F671ECBEF6AE624C17DA0137A9179439FC2C0C4CB7364B33E60FBD3663B61AC9BABE410D0458F7DD8D65DBEF365D7F7F992DBF693AA9D8AF7B38C2552664D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="30 Year Shingles (Priced per SQR)" GUID="{658109E0-BC2F-4367-9D01-8E3D02C37E8C}">.. <Properties>.. <Property Class="Text" GUID="{EA72121E-9B3C-4D4B-ABB9-219DEACB183E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{658109E0-BC2F-4367-9D01-8E3D02C37E8C}</Property>.. <Property Class="Number" GUID="{6154BE25-3273-4E04-B308-10ADDED64746}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{86F20CB4-A5E5-4C4D-9031-58193F7D60B1}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Pitch" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Material Coverage" Order="1" ShowUnits="Fals

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\07.3 Roofing (Div 0\Asphalt Shingle Roof\Roofing Labor (Price\is-4P8EV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (378), with CRLF line terminators
Category:	dropped
Size (bytes):	7881
Entropy (8bit):	5.601656082061179
Encrypted:	false
SSDEEP:	192:hlHj08u3TEbpcLSMKD3/8HA+DO2wHMjZ3L:hlHDujDLSvrQa2wHMjZ3L
MD5:	6AC3894F693EDE1F8628765CDACB5E5C
SHA1:	414D7E6FDC6B96C663464CBB4150F20B4EC1E78B
SHA-256:	26EF24BFC6A8B7B041B05246B410B530DFF1A13A8FEC61CE8DEEF714307A487E
SHA-512:	09D127708442459C50418261208848E0B38BB76F02BDB54E14B7CE3FB1D64A6BAF7183B6B3D9599D7FFAC2E0D7CA19A58DD83E22F67645C149784B5B2F6F55A1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Roofing Labor (Priced per SQ FT)" GUID="{BCA90D5E-C87D-485A-8472-69B64C89C0ED}">.. <Properties>.. <Property Class="Text" GUID="{1F446F41-1E3E-428F-985C-F99D23681F19}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{BCA90D5E-C87D-485A-8472-69B64C89C0ED}</Property>.. <Property Class="Number" GUID="{8DCB3F09-4088-4C21-8C54-A9AF1593EDE3}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{46CFADF0-FAA6-4EEF-8583-356F3BD71EAC}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Waste %" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\07.3 Roofing (Div 0\Asphalt Shingle Roof\is-PNUQU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1401), with CRLF line terminators
Category:	dropped
Size (bytes):	20161
Entropy (8bit):	5.66436041202935
Encrypted:	false
SSDEEP:	384:SLTcuAKG3z+FgQeek/VlmXwQrHgu3XcEqIqS/yGrJHR7KL06jUODh7Gk2U3fL:SLAuAKiz+FgQeektlmXwQrHgunGPdGrE
MD5:	9CBEDDE553CC45CA5B9621E556EB8537
SHA1:	3C284341EC3E3F0D8D0383435DC715ACB98CBE3E
SHA-256:	8495A6759FFBDA88C87F84CADA33D63B9CDD72B4F1C49A4882ADB8A56EF4267D
SHA-512:	93BF2190D1C62E860A087A6DFCC5E28C5269A05EE4F6FC73DDABDE9B47E6D7C0648E5CA715E2FFBE9BDBB5BF71E1B448833087C8D912422D3A31763E98D79337
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Asphalt Shingle Roof (Elevation View)" GUID="{8CDB3E6E-FD3A-4ADC-925C-3B6464C74717}">.. <Properties>.. <Property Class="Text" GUID="{291CF072-A2AC-48F5-AA32-ACF17A4597FE}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{8CDB3E6E-FD3A-4ADC-925C-3B6464C74717}</Property>.. <Property Class="Number" GUID="{0F650C2C-AE3E-49B5-8B64-9941FB657E52}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{8DD72FCE-FE11-4D16-B853-19A2269CC813}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Pitch" Order="1" ShowUnits="True" Sa

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\07.3 Roofing (Div 0\Drip Edge\12' Drip Edge (Price\is-QA33I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (325), with CRLF line terminators
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	5.617407818748308
Encrypted:	false
SSDEEP:	96:2PiuYJPq6Ejj51d1kdoQ0tdyWaLLNXnXOD08nnYrWl1Pz+dnc+MSL:2lj5jCCb5wpX+D3nYql5SNc+Mg
MD5:	59EC4BDCAD40589376C0B593424943D5
SHA1:	EDEB38B97CA59E706CE4F467EE9DB0D8E81AF54A
SHA-256:	51A9FAA67F085E38940F10B898A1F5BE52F961607AF982C806AA013D20826419
SHA-512:	3287F7B15D375FAA49EA8B5F5C78A9EC737A7DC9F7C165A522D683BF51AE061C92F550A51B01E2CC65583CD6A82C218E3CD158FAE00D6BAC52D626F29CA27424
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="12' Drip Edge (Priced per EA)" GUID="{2B013756-2BB3-4AAB-9B73-C025B55184AF}">.. <Properties>.. <Property Class="Text" GUID="{9DE83118-C4C6-4A57-8A79-D5BD345B0F7A}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">12' Drip Edge (Priced per EA)</Property>.. <Property Class="Type" GUID="{C1BAD83F-DF27-4165-8DFE-F14A86AD1113}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Material</Property>.. <Property Class="Text" GUID="{BC6F2E06-5502-472E-9A4A-AABCA18C859C}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{D26D2496-034A-48D5-B122-D81274B849C7}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{2B013756-2BB3-4AAB-9B73-C025B55184AF}</Property>.. <Property Class="Number" GUID="{8FA

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\07.3 Roofing (Div 0\Drip Edge\Labor (Priced per FT\is-EOJKM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (343), with CRLF line terminators
Category:	dropped
Size (bytes):	5597
Entropy (8bit):	5.589702177516748
Encrypted:	false
SSDEEP:	96:jQ1iIbJMXjpz+kRoQ0tdzARhRqLg8XnXOD08z9YIP43ncaiYMS4m3:YiIMjpzJ+byhag8X+DD9YVcadMha
MD5:	DAA19A6E1C3C6967A343FFC85F856CA2
SHA1:	5CAA56BD2F135C1F484299BCE8DD69032A768657
SHA-256:	268451BE0E4D1E747A55BD9D5A30F75B9A151A3F803B5F59FC88166F795BD91D
SHA-512:	85F60E1E5F8504EEF4BC1E02BE28D86B6806DECD5BB3BF1350AF3E4B8BFBFDCBCB809823CA56154F6B85CCB4328E2DEEFE0145687A8CD757C3A0530F7E771133
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Labor (Priced per FT)" GUID="{69D92FC9-E723-4E34-84A2-E0C35197EE4B}">.. <Properties>.. <Property Class="Text" GUID="{65B57335-7134-4667-A3F5-7AA0533F5E3F}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Labor (Priced per FT)</Property>.. <Property Class="Text" GUID="{744DB14B-D6D1-433E-AD44-08BA72591058}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Type" GUID="{BFA021E2-B915-425F-A78A-342B3D2A8558}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Labor</Property>.. <Property Class="Text" GUID="{8F5DD94F-99A5-404F-8564-3DA6425382DE}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{69D92FC9-E723-4E34-84A2-E0C35197EE4B}</Property>.. <Property Class="Number" GUID="{AFC68B78-98EA-4F49-82DE-1DB026AE

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\07.3 Roofing (Div 0\Drip Edge\is-U1TNV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	14287
Entropy (8bit):	5.662738199047476
Encrypted:	false
SSDEEP:	192:9JDYEj3KEbBqFDL86kV+DMvRCaRucYyMktDYbitXRtE3RqmqZ3uLL:pLKqqFvxIvRCaRNYyYbipnQRJqZ3KL
MD5:	8E66802277E69FBE242D38104AA22D72
SHA1:	4EDAD2CFBD08A2E217F27FFF3201CA9644E8F7C0
SHA-256:	ECDDE14E71B1343CFD5C73857FBB3ADB1C20E3E212DE7D48B5778F00DE521959
SHA-512:	2BCE57FBD85866C972C7F6C21B36A17681BB48CCA495ADE1BC844213B8C420E46307E721F43A54700FE987177FBA95204FE8019914746D69AAF7D50CACD34E48
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Drip Edge" GUID="{9C0CF74B-0B2C-44AC-8A15-896ED8AEB404}">.. <Properties>.. <Property Class="Text" GUID="{0DB8328D-3386-4655-9AC3-A3D213CEA4CF}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{9C0CF74B-0B2C-44AC-8A15-896ED8AEB404}</Property>.. <Property Class="Number" GUID="{409C2621-A6D8-4829-B02D-B923C7AB7CC8}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Image" GUID="{426D934B-8C8C-4F9A-8DEA-C0D627681D83}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="6" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADCHgAAwh4AAAAAAAAAAAAAZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\07.3 Roofing (Div 0\Ridge Shingles\Labor (Priced per FT\is-MOELH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (343), with CRLF line terminators
Category:	dropped
Size (bytes):	4942
Entropy (8bit):	5.560506621548946
Encrypted:	false
SSDEEP:	96:fwNE0/XXjpz0kPoQ0td5QlR5LTXnXOD08xYIiNJ:ejpzHwb5WjTX+DhYvNJ
MD5:	DB7B76157DE7D74EA28871BB041CC377
SHA1:	0B5D0D083B80483E05CA2506583AF5CEF265586C
SHA-256:	55EF66B3DEAA4251B454E205BCB48C6633138DCB71B0D0E7545016881B36D600
SHA-512:	86D92EFCE128921CDD4CCB92290566C7C7BC093EAF7FA7D96F05EB15EDB4AC7BDE675BE455F68F2EF8F7CB7B32AA7EFD98EBD76BFA408C3BD8BEC1F095B575B2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Labor (Priced per FT)" GUID="{AF215966-585D-428A-ACF0-3A5B73F69A0E}">.. <Properties>.. <Property Class="Text" GUID="{21AC6C1A-C9C7-4643-B164-137E4347E276}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Labor (Priced per FT)</Property>.. <Property Class="Text" GUID="{9C77F0F3-76CD-49D4-BB7A-BD8A88A3E62D}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Type" GUID="{7AE1A8AC-B5F1-4509-A990-4979D8A7795D}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Labor</Property>.. <Property Class="Text" GUID="{F73A8EF2-2229-4719-AA63-9127BE3871DD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{AF215966-585D-428A-ACF0-3A5B73F69A0E}</Property>.. <Property Class="Number" GUID="{28B44BA1-B21E-442B-8994-E8B41CBE

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\07.3 Roofing (Div 0\Ridge Shingles\Ridge Shingles (Pric\is-9G52D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (332), with CRLF line terminators
Category:	dropped
Size (bytes):	5012
Entropy (8bit):	5.580954098249513
Encrypted:	false
SSDEEP:	96:bj63Br/DmvMjmudSkQoQ0tdOXLqXnXOD086FYIcUGm1p:b+X1jmadbbObqX+DwYTCL
MD5:	E1E4164643512E07D28F2F5A7F78DA7D
SHA1:	1F3752B0846AF4B068D6DB1EBF3EFAF29FD3012F
SHA-256:	EBEE8035C23A83E642C5E756601DCA9F52A0229CB8FB26EF32A43D7683415C47
SHA-512:	F8276BAAD68AF2EFC3CA8792D3EA4705F692C54D7445DAA0278DD81178D8EF2C41FC86FE133374B120276C77EF7B169BF2141329A7DE06262915B3A2C1642BB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Ridge Shingles (Priced per BUNDLE)" GUID="{B4EC485B-EFC1-4356-9A5B-3D82B1566651}">.. <Properties>.. <Property Class="Text" GUID="{BFE2F0FD-A857-4574-95A9-8F974369DED7}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Ridge Shingles (Priced per BUNDLE)</Property>.. <Property Class="Text" GUID="{64C1BE79-ECAA-4F4B-B963-EAC37CAC4DB2}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Type" GUID="{547DAD63-A9FC-4D68-8287-663138A9359B}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Material</Property>.. <Property Class="Text" GUID="{0B252D24-E5E6-472E-814B-09F32455848F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{B4EC485B-EFC1-4356-9A5B-3D82B1566651}</Property>.. <Property Class="Number" GUID="{61B

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\07.3 Roofing (Div 0\Ridge Shingles\is-PSQUK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (416), with CRLF line terminators
Category:	dropped
Size (bytes):	12618
Entropy (8bit):	5.544582260506377
Encrypted:	false
SSDEEP:	192:b6Yj7zdOnL1bRhrxh8Ma+D3/oYkOHmp0yqXvpmtdOpZ5Z/RFh:brPE9rxhlr/oYkOHi0Bod+Z5ZJFh
MD5:	7E4272776B7E45D83574F3D702B810AC
SHA1:	AC003A98DEAA8957B87D188120906FC70DA9B3CF
SHA-256:	93B00CE319E9FF37CA13E0E2854FE7D49CFE55A0A62ABB7A8BD46B30EDF60ABE
SHA-512:	17C22FF70EB1A738E16929E74D5EC0E3A99D9A0F23A50B87122DD77A3579BCE249E044C9D8DB83A1C54E5EBACED3D5E1D2962121E52FED8628F535EEFCD19DAE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Ridge Shingles" GUID="{F5059D3E-29DB-4048-AF69-90CFE030C107}">.. <Properties>.. <Property Class="Text" GUID="{F1435FE2-F025-4FEE-9AAE-FA2DB35B33FF}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{F5059D3E-29DB-4048-AF69-90CFE030C107}</Property>.. <Property Class="Number" GUID="{BD33D0ED-0F71-40E8-91A7-6635A029DF7B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{E5001683-BA0F-4EF0-B53F-21986B135B2C}" Name="Form Layout" systemhidden="True" OrderIndex="12" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Wall Height" Order="1" ShowUnits="True" SameLine="Fal

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\07.3 Roofing (Div 0\is-JRR5G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	954
Entropy (8bit):	5.465101480413901
Encrypted:	false
SSDEEP:	24:2d2naqRX2Y2f2WAdOc+sE91OcVZGbfgAWaQ+/CApWKPv:c+JRT6BdSVb/
MD5:	B1B4C53150EFE76C6960B9362007A960
SHA1:	F988B969C8DEBB25B153C8006250232CEB9B3A9B
SHA-256:	F04D94DAC888947E633BD984EBAE8547947D80851AFCB5354DE04CA5B5B67633
SHA-512:	7BCD5E249F24A83AAE72F75C11C3E12E0EF15E25F5BBCEC12E0A23945B9A389AEABB2C182A00C1AA5D3047AA9BC925415EA2E091C086080B547B644F4021AB86
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="07.3 Roofing (Div 07.30.00)" GUID="{B1476AFD-6DD5-45EE-A473-BA2453CA6008}">.. <Properties>.. <Property Class="Text" GUID="{CD576D81-74E9-44B8-9C77-4C96CF91D389}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{B1476AFD-6DD5-45EE-A473-BA2453CA6008}</Property>.. <Property Class="Number" GUID="{B7FCF83C-83A7-46BF-99E1-DDB55F1750C0}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">11</Property>.. <Property Class="Type" GUID="{618DBC51-9F11-4986-A8A6-94D145DB7B08}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{4B466733-B503-451D-8FA2-A4B860633636}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">07.3 Roofing (Div 07.30.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample CSI Assemblies\is-4168P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (4062), with CRLF line terminators
Category:	dropped
Size (bytes):	11380
Entropy (8bit):	5.964371019286513
Encrypted:	false
SSDEEP:	192:bC9pjcaOvQiD3D748j6ZsJR8AqJ8a1q5Xs+7aR8YU3JFrfluMb6:buRcxvQibn76ZsJR8AqJ8a1q5Xs+7i1d
MD5:	0EC90B763E0E036BEA632232DB7C754E
SHA1:	9AFBF87E399AF389162675531FA722E5A617B58E
SHA-256:	24A099FC1231F281E8B09BD43F64BF49986CFC9468DFF3B5914BBDB88F563501
SHA-512:	9EC4977B2D67C20CF43519C1AF87C12BF5D5CF10C60D9FDEDD6937FCC8DCFE8A8CAD48EA5B2EF47906921FA3D17E5B4F4DCA92D49879F8E9E3380BA695A6E8D9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Sample CSI Assemblies" GUID="{D8B2E2AC-028F-46DC-B2C1-3FD4B57FDB24}">.. <Properties>.. <Property Class="Text" GUID="{59E054F2-DCDC-4036-A144-61B48C660E39}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Sample CSI Assemblies</Property>.. <Property Class="Type" GUID="{8AEB52E9-07E5-4FFE-8B4E-60A7F9917C2A}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="2"/>.. <Property Class="Image" GUID="{C691B9D2-55F4-4F74-9CB4-6F909EF269F4}" Name="Icon" group="Item" OrderIndex="4" DecimalPlaces="2" Transparent="False" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAALGOfPtRkwAAACBjSFJNAACHDwAAjA8AAP1SAACBQAAAfXkAAOmLAAA85QAAGcxzPIV3AAAKOWlDQ1BQaG90b3Nob3AgSUNDIHByb2ZpbGUAAEjHnZZ3VFTXFofPvXd6oc0wAlKG3rvAANJ7k15FYZgZYCgDDjM0sSGiAhFFRJoiSFDEgNFQJFZEsRAUVLAHJAgoMRhFVCxvRtaLrqy89/Ly++Osb+2z97n77L3PWhcAkqcvl5cGSwGQyhPwgzyc6RGRUXTsAIA

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\05.0 Metals (Div 05\Metal Parts (Manual\Welded Steel Stair T\is-CA2S2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	15129
Entropy (8bit):	5.5863495087495405
Encrypted:	false
SSDEEP:	384:4U1gcAC9YrC9QJCLDJdXcpBPKb1mEX2PjljU3Dhcr+stL:4U1gcAbrC9QJCLDJFEe1mEGPjGFcr+E
MD5:	F580A8F86C1E6176E5D638264ED66DBF
SHA1:	139B5DA5F4FFEA6BF1BA4F48142C33CB249B8D9B
SHA-256:	6E570ECCAAB509BD54AAC1EB34748601C8F15145494AD6C1209D79F860902A2A
SHA-512:	AC1743729B68A66FE236F14B588C271BAA445866B13738833D97C7C4C9EAD84BA8A885E8018CE62A7118081496C8A719909B78027D9E94CFA5A27A283ECD3922
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Welded Steel Stair Treads" GUID="{1991E0DC-336F-46CB-87B7-6EE535ED25F2}">.. <Properties>.. <Property Class="Text" GUID="{5C658853-BC8B-41EA-B74D-6431A3DB4FE5}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{1991E0DC-336F-46CB-87B7-6EE535ED25F2}</Property>.. <Property Class="Number" GUID="{8352EAEC-E279-4C09-B30E-234C0A83EFC7}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{A5BC6DAC-E787-4489-8227-0B0843F4173A}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Manual Qty" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False" Sam

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\05.0 Metals (Div 05\Metal Parts (Manual\is-5CN7C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	945
Entropy (8bit):	5.431391350588945
Encrypted:	false
SSDEEP:	24:2d21dwX2AHlbf2WAdOcPx1OcCIWgAWaP/CApWYJv:cswvTM2GKnh
MD5:	102A50A60E836DA87F4DC2BAC9BBD5FD
SHA1:	C260C1DDED66C4E61755649987BF78BF59D58843
SHA-256:	06BECF234659F2A31992E2E4E8C2ADDF22DCC16AC68BEE3939508314D0B3182F
SHA-512:	DF764243D50E4EB001DD6DABC03AF56F5CA247C1EE6E02F9BCF3FC7C123B76779CFD1E24F365B3B8A6D632F62C96D0A15598EEEFCFDF57DBDB581A6091262401
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Metal Parts (Manual Qty)" GUID="{E15649FE-9AF0-422D-BB81-BB6D62B69928}">.. <Properties>.. <Property Class="Text" GUID="{94AC3FBE-D005-43D7-A53E-8E63F48518FE}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{E15649FE-9AF0-422D-BB81-BB6D62B69928}</Property>.. <Property Class="Number" GUID="{A290CC77-5C38-48AD-83D1-CAA33548CD6F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Type" GUID="{C6CC3E31-A82E-429D-9C72-BD6BBA407882}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{40EE6EAC-4DD2-47E3-B16D-9CE22AA7DEE1}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Metal Parts (Manual Qty)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\05.4 Metal Framing\Metal Framing Parts1\#8 Screws per EACH u\is-9SNM8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16577
Entropy (8bit):	5.590733538655276
Encrypted:	false
SSDEEP:	384:rDdlY+EVSOmhVRXLGWdIgg5XcpBxtqIpdoTWO2+1VjUVDh0YdTySL:3A+EVSOmhVRXLGiIpp0xUmoTWp+12z06
MD5:	6733AE4AD239B3436D8AB85AB0DB6941
SHA1:	EE08342D6B7B4FFA132B94FAAB400FAED5D6DC6B
SHA-256:	744734590626EEF4022A61990C40EE913FC1169BE31490FE4C77AD5A2D9EC582
SHA-512:	42A24F62CE07438F72892F9C2768AB583E588C02EC04974EAD7879793BED1FD2A01F4054EB0260B17993122791A3B821B057DCBCBBF0C79C3BA0A556AC89918B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="#8 Screws per EACH unit (priced per Box)" GUID="{8607E631-B892-4FBE-9CD8-3E6F2DE0A8AA}">.. <Properties>.. <Property Class="Text" GUID="{A022848B-4EF9-4FD4-9468-1B2FF3DF4829}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{8607E631-B892-4FBE-9CD8-3E6F2DE0A8AA}</Property>.. <Property Class="Number" GUID="{C5E2E396-CD81-498B-BB1E-718CFB57882A}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{E19DA361-C07A-4F32-987A-F17ECA5DAF5B}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# per Box" Order="1" ShowUnits

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\05.4 Metal Framing\Metal Framing Parts1\is-R1LEK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	987
Entropy (8bit):	5.410880185826635
Encrypted:	false
SSDEEP:	24:2d2jKHX2G6f2WAdOc8OXeJh1OcCM1tXUBgAWauz/CApWpv:ceituEh+3jy
MD5:	1B14DE3F7E1C8FC0534C08D60B48524B
SHA1:	83DD529FED90B14C84A7D77E3C7971A02C01AF07
SHA-256:	F392B76A4C89B0EDE481CD6D1AD285518848CCAA728F4BEBFE716AD6C42334AB
SHA-512:	60D7FF3DCC52163F3BC2EC77C6ABD79D997BD639E230744D36E356D02BAAA3E638DC9B17EA0506E8D3C3C93349EB1A789C1300FA7129FE7C53AA05164EE33F77
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Metal Framing Parts (Inherit Qty From Parent)" GUID="{078EEB21-7083-4C07-B9A4-4D5873887BC2}">.. <Properties>.. <Property Class="Text" GUID="{680541A0-9AED-427A-9A9D-0A8CDABBEDED}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{078EEB21-7083-4C07-B9A4-4D5873887BC2}</Property>.. <Property Class="Number" GUID="{D0AB076B-243E-451F-B38A-93DFFC1F6672}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Type" GUID="{D9EA8AEF-67CA-4314-99AF-7C5A34A9E4C7}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{71A0A1CD-5F29-4213-BEFA-A96A0BE8772E}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Metal Framing Parts (Inherit Qty From Parent)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\05.4 Metal Framing\Metal Framing Parts\#8 Pan Head Screws (\is-3UO5N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (379), with CRLF line terminators
Category:	dropped
Size (bytes):	15735
Entropy (8bit):	5.592457603046399
Encrypted:	false
SSDEEP:	384:Ku64930TNUVwD7fBv7+UcDv3IlklbUKVvTZ7BQjhSDObXntklvg:Kuv930TNUVwD7fBv7tY4IbUKdV7BAdbp
MD5:	7AA6DD02622C012947F67B901D473DCC
SHA1:	18B9EC75180C85B6C79F8656348B94379AE8E953
SHA-256:	5BF0B096F233E426F086D4B908B63E022A814CA208378EDFF2C3FEB55363E8AF
SHA-512:	E67FFEB1F1227A3A62D4553F8A956D5B40D68B1274783BF8FF3EF3DC93B5D7B57173FA2318DF6C7BA493DE26AC0F218454A3B011ADDCF831A4D90A11694C3CE7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="#8 Pan Head Screws (priced EA)" GUID="{FDA0DE50-45F6-4C79-A312-DD881905562D}">.. <Properties>.. <Property Class="Text" GUID="{CA8A81C6-FFEE-4190-A023-4A0DF6DB946D}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{FDA0DE50-45F6-4C79-A312-DD881905562D}</Property>.. <Property Class="Number" GUID="{630AE19C-9B59-49D1-AB74-C98E2EE17904}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{56057A68-C955-41C0-983C-EF7A785BF09D}" Name="Form Layout" systemhidden="True" OrderIndex="10" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="# of Track" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\05.4 Metal Framing\Metal Framing Parts\2x6 Wood Backing (pr\is-LML6N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	15132
Entropy (8bit):	5.589486189696493
Encrypted:	false
SSDEEP:	384:fySl6dFtvVb2JANI9iGxinZ2XcUByZ0AR/US2HqojU/Dheo3T9wTL:fySl6ftvVb2eO9iGxinZCVVC/UlHqFdg
MD5:	F6BAFC2319BF25CA2A07BAD810AAAD07
SHA1:	832E33776471A17C99DA83BB3CBDEDEECAE6F829
SHA-256:	11267F9228BDB0A554DE2C611BB3DBA9677820027A6A5ED636420A2E210FB2F0
SHA-512:	11B7B350A925F83EAE3083706FF6B420ACCD899895CEC4BDC6D5C07DFD4A5BFB0A3830B1B76E62E97BCCC43F6C99E882EA0151BFFB5E556E082ECC7D64BF2396
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="2x6 Wood Backing (priced EA)" GUID="{5BA185AA-D1FA-4E07-A32C-432CDB8AB738}">.. <Properties>.. <Property Class="Text" GUID="{4F2042BF-EB13-40A1-A440-A5291DEC8F7B}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{5BA185AA-D1FA-4E07-A32C-432CDB8AB738}</Property>.. <Property Class="Number" GUID="{86D6873D-D4E5-460C-876E-DB1A5B1D2523}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{3DDEA724-58A4-4931-98F9-E1479146C580}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Manual Qty" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\05.4 Metal Framing\Metal Framing Parts\All Leather work glo\is-1K3T0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	15153
Entropy (8bit):	5.589178279437429
Encrypted:	false
SSDEEP:	384:U/qOCeLATI23e7i+dXclBT3kzsjSjV2Kz/jUgDhECA7S0KL:U/qOCeLATI23e7i+FcTEsjSjUKzgIZAk
MD5:	1A9923E7862B5BB1A05F7FDFFB245049
SHA1:	E3B36082F28389C71FB436DFA3FCBE78A6936B4C
SHA-256:	8513643540C9511B2B4CD5DE1A8DBE0D5322A26C94459475B22A765F88234FE8
SHA-512:	424A88EC7FAAA095432ED7CC7FACC6F2CC1344033B3AC894D0DBB3A2CBEBE609EFB254989B97A3541A01D26B733C7A4D55A2D5F9BAF33043AE2FF10428795A39
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="All Leather work gloves (priced EA)" GUID="{6120A104-B07C-48B6-B430-6FB18F4711D6}">.. <Properties>.. <Property Class="Text" GUID="{A4DD1BE9-0F16-4933-BCF4-54FA76B3DA7A}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{6120A104-B07C-48B6-B430-6FB18F4711D6}</Property>.. <Property Class="Number" GUID="{B2D3D051-7055-4599-B776-B73376ABCD02}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{40C1AEF6-7C14-4D64-BAEB-AA749BE796C3}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Manual Qty" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\05.4 Metal Framing\Metal Framing Parts\Safety Glasses (pric\is-VU92O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	15137
Entropy (8bit):	5.588831770114209
Encrypted:	false
SSDEEP:	384:+uvSSu4qvNei7N2AtGXc7B4Ix2zGs42hR2jUX3Dhfb7ba0mL:+sSSu4qvNei7N2AtSKH2zGsjhRDVfb7Q
MD5:	16462AC7E353B3E6C3B41F199EA57984
SHA1:	46801C6A5A1446BEA9B31A6E54859265AC1E8FF5
SHA-256:	A2E4AA19D81B47E551BFC60BA4D1C30E2F0AFCCFCDA2A39A2CB51C522953DCEE
SHA-512:	7A9DCF218131FDC6B1DA3FD408191189BAEBA48CBBB4D73941338D1651D762F8BEE8FE20ECE692FA1445B3048925D154555AA2240371198FAC008FB6BD474E3B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Safety Glasses (priced EA)" GUID="{4E836A76-A895-4924-9DCB-2E4CC2D00F4C}">.. <Properties>.. <Property Class="Text" GUID="{C49FCCEC-AD11-405B-913E-40C442542683}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{4E836A76-A895-4924-9DCB-2E4CC2D00F4C}</Property>.. <Property Class="Number" GUID="{C157EAED-627E-41C8-B0AF-61E5AA299EE3}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{388E7B54-7608-4236-A061-FC3CDDEF67DD}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Manual Qty" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False" Sa

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\05.4 Metal Framing\Metal Framing Parts\is-VDN2B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	961
Entropy (8bit):	5.427586455088843
Encrypted:	false
SSDEEP:	24:2d2/d8IwX2yOEf2WAdOcyjiYT1OcIMvRjgbgAWaW/CApW6Jv:ca8FVOcyY4NMRE6th
MD5:	71691C672E36B6FA2EB36C19928308B4
SHA1:	D878719FBF85EE3C9CF3B939C8300DB39CEC20AB
SHA-256:	4101AD70FAD999988428656714A8A82B421ED4253685F45FDD985826FB9CD59D
SHA-512:	7261937B70E45011FB6EB6B3D3B039394F85815A1580FAB41DADA5D61F9F8D1183785AD8FA914641DF3706F95BCE082011D599B20A7D6878A2D0E9E05DB9832C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Metal Framing Parts (Manual Qty)" GUID="{0463CD76-8B1E-4743-8A7A-804D787CC1DE}">.. <Properties>.. <Property Class="Text" GUID="{F9B69FBE-3EAA-4421-A2EC-13647A2FAB29}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{0463CD76-8B1E-4743-8A7A-804D787CC1DE}</Property>.. <Property Class="Number" GUID="{77319304-AF2C-4EF7-ABE6-D40F2E031283}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Type" GUID="{1A0598F9-1253-4E7D-AD6A-C51EFEA2C4FE}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{D847D7CD-6398-43B2-83B6-FBDA030C3662}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Metal Framing Parts (Manual Qty)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\05.4 Metal Framing\Metal Studs (Linear%2F\#8 Pan Head Screws (\is-BQBTC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16345
Entropy (8bit):	5.596318028767615
Encrypted:	false
SSDEEP:	384:6Iaa1IFOGGZ9ckCQL2FpqN2Xc5B4qAST5mg8o2271YjUbDh0k8+36L:6BauFOGGZ9ckCQL2FpqNCIfDmg8z273O
MD5:	D8C3B9D0ECC7E4615B2BD09CEEC6B43E
SHA1:	11F46A87DE0AF0B31803F518694B10B3979ED11F
SHA-256:	43B3A07B59247C45F152510590F164AB22F482ECD5B79C8F6E596428EC79AFB5
SHA-512:	D5FD80050EF9FB48D93557DA8A8FCE8AC2C39E90EE80E7278FBD6AE987E9383DD59F8136C144F85AB5F1EAE6A6F625F89E027936899CAD4B877137EE64E48C5D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="#8 Pan Head Screws (priced per box)" GUID="{F8E166BE-D87A-4873-8530-8307B1976CF1}">.. <Properties>.. <Property Class="Text" GUID="{A7902C37-618A-440C-9354-8CB9B3FD3848}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{F8E166BE-D87A-4873-8530-8307B1976CF1}</Property>.. <Property Class="Number" GUID="{9E4B3B1E-D8D3-4D3A-92F4-B551CA3B77B3}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{91DB3908-EC49-453C-BF1E-79F62D063892}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides" Order="1" ShowUnits=&quo

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\05.4 Metal Framing\Metal Studs (Linear%2F\3-5%2F8%22 20 Ga Metal S\is-Q8VAR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15746
Entropy (8bit):	5.595436473212247
Encrypted:	false
SSDEEP:	384:sCgI1jUUnvzW3kDUvvu+XcCBsqFcPCuMD2LoSjUJDhJndQyVL:LgI1jTnvzW3kgvvu6bj6CuMKLoHfJndB
MD5:	9EF047368960C98B7659930A019B95A4
SHA1:	DFCB388CB386E23FE70B7BEDB222A6B69ADBA744
SHA-256:	67DB4BD193EECC4A3E6D3CCC0A8D60386A860E409424A9BFDD9DC140E6FD9ED7
SHA-512:	2C4F8DB727AE975F072834AA8C48D5C40A5359B1EF87F10925B6664615710F219BFA480A0BDA3AA1D0BD073A788D328364C86F63B5F753A03A9798A82AD4F826
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="3-5/8" 20 Ga Metal Stud (priced Linear FT)" GUID="{3A37D9CB-E84B-449D-A5D3-9C1D61A5FD7F}">.. <Properties>.. <Property Class="Text" GUID="{366EF587-9A7F-4ABE-AD1A-45745DC8E297}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{3A37D9CB-E84B-449D-A5D3-9C1D61A5FD7F}</Property>.. <Property Class="Number" GUID="{E5CD71FA-EBAD-466A-8145-0C3816AC98C9}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{FE8AD2DA-69BB-4864-BCDB-EE1EFFD46ED8}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Length" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="OC Spacing" Order="1" ShowUnits=&q

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\05.4 Metal Framing\Metal Studs (Linear%2F\3-5%2F8%22x8' 20 Ga Meta\is-RUJME.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15702
Entropy (8bit):	5.5938073986898456
Encrypted:	false
SSDEEP:	384:eaTl8o/f6qMDLg03f1QXc7Bsqc4owUTD2l01jU2DhfBRKmL:eaTl8o/f6qMDLgEf10yjuwUTKl0W+fB9
MD5:	8F2B065BE90A923578E5EEE8824EF2FC
SHA1:	A70EF12FD6A3F15041EA471B5F2764EA94B35CB4
SHA-256:	26581A6ACB3F071111C17731030DB3EE7B74FFCF5E85C782EDF451F1F80CC15D
SHA-512:	B997BAE20453442D30927DEA4455C39040D7A84894F1E7B6217EF9E000CDC813E6A2DDFF114DFE96610624D2B0D274E806414018F84ABAB9E7BF2CC0873387D5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="3-5/8"x8' 20 Ga Metal Stud (priced EA)" GUID="{B0439335-50BC-43C7-B054-57A00C72EFD8}">.. <Properties>.. <Property Class="Text" GUID="{BB3563D4-E003-40E3-9D83-A3B56F4FE8FC}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{B0439335-50BC-43C7-B054-57A00C72EFD8}</Property>.. <Property Class="Number" GUID="{5913EDEE-E25B-47C2-9E74-8297153C8B3A}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{2ACA2F44-FDC1-4B62-A875-F6DCE96BBE74}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="OC Spacing" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits=

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\05.4 Metal Framing\Metal Studs (Linear%2F\6%22x8' 20 Ga Metal St\is-2Q1PL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15694
Entropy (8bit):	5.591441762003757
Encrypted:	false
SSDEEP:	384:F23pW2DRG+rZ99nRVPYPMG+ZcXc1B6qW2C8A6zh2b94jUgDh1EaMzVL:F25bDRFrDBRVPsMG+ZoQVzA6z4b9VI1k
MD5:	5E6F805D69B34F588C88324609749481
SHA1:	04510516624DA6B66824AD51D7678262BB18014E
SHA-256:	79B6A07566661E4FBCCE2CB61CA2224AA44E98D1D9F6DAAE73E3D9CADCDFAD0C
SHA-512:	A7BDB90645E4DE6454D21F17B4F0C63B20AADB0842928A9C938D74FBCDA9DC62F80D54CCC27F623EC9FAF71A3490E9A0DFE7CA79DEE875C079A9190D265C3AF2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="6"x8' 20 Ga Metal Stud (priced EA)" GUID="{D92881F6-3C79-42B9-8D9E-3BD5A6B4733A}">.. <Properties>.. <Property Class="Text" GUID="{D189F303-1C28-4C9B-BEF0-FE7172D2D6CA}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{D92881F6-3C79-42B9-8D9E-3BD5A6B4733A}</Property>.. <Property Class="Number" GUID="{D9572243-1DD5-4124-BD02-F08B89765E81}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{1A632832-921A-4E1C-8B0A-EEE5EF618E4F}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="OC Spacing" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits=&quo

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\05.4 Metal Framing\Metal Studs (Linear%2F\is-DB0PO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	971
Entropy (8bit):	5.469971279949384
Encrypted:	false
SSDEEP:	24:2d2zn3fX21Lf2WAdOcAnr1OcLgX1gAWarpAZ/CApW3Hv:cc3fse37CwP
MD5:	9F98FBF7F0D44EC170C6B91A2BB64059
SHA1:	579F923C1BBA73E0C0832712941CE5FD70F998B0
SHA-256:	41F7E6F2A68813740DCF6D492900AD6C487609959856DA3B0AB8B4DB712CA350
SHA-512:	AD312A4C5056ACE3729FD2CEBC12EE1B1CE90E838EB3FF77DDF375446187F2F9A9657ED7D13E1A4F2DE8ED64B8AB7FA002355A369830D4C91F3B05CBF778D63D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Metal Studs (Linear/Segment Takeoffs)" GUID="{13F41CEA-BF8E-4FDB-8DAB-4180095575B2}">.. <Properties>.. <Property Class="Text" GUID="{66750E06-8BAF-49B5-926C-4FA8EDAFC37D}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{13F41CEA-BF8E-4FDB-8DAB-4180095575B2}</Property>.. <Property Class="Number" GUID="{62360F81-2E8D-4FB9-9489-495C1AE3A0B6}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Type" GUID="{76D3EBC9-10E9-475E-90D2-E0AEC50CD93F}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{B3AB4600-217E-4996-9316-C6304167CE5D}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Metal Studs (Linear/Segment Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\05.4 Metal Framing\Metal Track (Linear%2F\3-5%2F8%22 20 Ga Metal T1\is-Q87N1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15738
Entropy (8bit):	5.595583979386781
Encrypted:	false
SSDEEP:	384:LL2wT1jSC55ia/unw2TD6UcqvGInwwuiHBlvOEXjhBDOyTuYNXTg:LLhT1eW5ia/unw2TD5pX4iHBNOEFgyTE
MD5:	C4486E6E794E5CB21A0C90201E7B68E2
SHA1:	48C917370A215C02611FD9A5EB752A1CEFB5DD91
SHA-256:	22D20C84A11FB9264F9F080363617680E2A00C7BE883E6C682BF4F72D25F4C67
SHA-512:	C1F9B4B444625D67274C0EDFCF77EEAC41A3C3A393796BB8A7C39DA085EE10001D58669AB90F10FA81901CA2C383913668ECF79AAD5B29704924553184011E3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="3-5/8" 20 Ga Metal Track (priced Linear FT)" GUID="{D9F32981-9745-4C01-9A27-B0095D66BA3E}">.. <Properties>.. <Property Class="Text" GUID="{772CF40F-E341-4A1D-8EB4-217A8AFFA49A}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{D9F32981-9745-4C01-9A27-B0095D66BA3E}</Property>.. <Property Class="Number" GUID="{913013BA-E60F-4B16-8E51-0189A4D3CAB2}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{3B839268-9290-42FA-B5D4-55748B53E15E}" Name="Form Layout" systemhidden="True" OrderIndex="10" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="# of Track" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits=

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\05.4 Metal Framing\Metal Track (Linear%2F\3-5%2F8%22 20 Ga Metal T\is-TCGN5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15724
Entropy (8bit):	5.597116323392112
Encrypted:	false
SSDEEP:	384:WGXXfFXhWG5eJ0iiOXVEUclvxIkGU0sQQ6vTFOjhqDOO2ulNOcg:WGXXfFcG5eJ0iiOXVLWqfsQQETFmFO2B
MD5:	88A02142D96363C8741C94C24F224A46
SHA1:	DB7A81927B59C29F4FDCC0882356DD0FBEDB612E
SHA-256:	554E5E2F03B0FCD61DDEBF42BF5880D27073DFB0A21785B538303DF142172D71
SHA-512:	48400C1F6EA0B0B2D894DDECF6DE06795D45E9B4F2F9B320D664641B9BF34FF95A3A30B07853174359B0AFB287AE71A05C56906597A0B4A3AD1D681B25F49FB6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="3-5/8" 20 Ga Metal Track (priced EA)" GUID="{34D52F13-EFC4-4F04-8AB4-7A9FCBB6C8D8}">.. <Properties>.. <Property Class="Text" GUID="{C2320A54-B81D-4296-B57A-A853E865E5D9}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{34D52F13-EFC4-4F04-8AB4-7A9FCBB6C8D8}</Property>.. <Property Class="Number" GUID="{CE3DCE82-3A18-4BB0-859E-80E9DF60FA71}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{D9C14A87-04C5-45D1-A71A-F036BDBD9363}" Name="Form Layout" systemhidden="True" OrderIndex="10" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="# of Track" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="F

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\05.4 Metal Framing\Metal Track (Linear%2F\is-30PO1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	971
Entropy (8bit):	5.4614683518355465
Encrypted:	false
SSDEEP:	24:2d2Lni8X2wDgf2WAdOcCjIf1Oc8ZHbxgAWapB/CApWfHv:cAZsekXbTdI
MD5:	177E4286982672D0D5CEC2B080AFA9C6
SHA1:	8949762F730AF7FC076064D9D8E17A7622E13C79
SHA-256:	76DA44C01AE30757F313DD6EFC6FF1557CACD9D92B732B2076C88191E94D914F
SHA-512:	1B2AE31D7A79C9B59949AC90F8A8F408C8C30E5FA0EB2EFEAE6193669157D789842348E4DCCDCEC21B49CCC6F0864001712327DA2BD365582359B3DF7BF95330
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Metal Track (Linear/Segment Takeoffs)" GUID="{C4BDA7D4-1B64-47B5-817B-E8E276797871}">.. <Properties>.. <Property Class="Text" GUID="{23774E93-FAB2-4A3E-A87C-317F616DCEC8}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{C4BDA7D4-1B64-47B5-817B-E8E276797871}</Property>.. <Property Class="Number" GUID="{F92DECAD-76BA-4F96-940E-0BF3F5B8E80A}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Type" GUID="{0909677B-129C-451A-A3A6-FE929F6C69B9}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{E05F1817-5823-4AD7-8AC9-FF28A766745D}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Metal Track (Linear/Segment Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\05.4 Metal Framing\is-F648N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	965
Entropy (8bit):	5.442192697909625
Encrypted:	false
SSDEEP:	24:2d2aeX2BSvx6f2WAdOctOWF1Oc8A8gAWa6iG9/CApWtv:cMfoNR0LiGRc
MD5:	283803B3C75018057A6B1D4CABB33F90
SHA1:	8B99632F40FA4C21DD67E38D3843B998604D2BDC
SHA-256:	24E17C31E2CF7C88F62805ECD302F8BCED4E56A381508747AEE9BA7203EB8F61
SHA-512:	3F8304D66E5BC901FD884B5E97C1ECAF495EA6E0DFB58C740D2A704FEE38F12B67E3309877D97BD1224A8F6FAB61EC6C45FD4BFEEF01F2ACDA0D29E85919F44F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="05.4 Metal Framing (Div 05.40.00)" GUID="{4B6E3BA4-21E3-4D28-B250-CA30E5DAF164}">.. <Properties>.. <Property Class="Text" GUID="{9BB918A7-6246-4F21-B58F-8A2734BF21A4}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{4B6E3BA4-21E3-4D28-B250-CA30E5DAF164}</Property>.. <Property Class="Number" GUID="{AD83FF8E-7C46-443B-B467-CD311F609D83}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">5</Property>.. <Property Class="Type" GUID="{F114C103-5CC9-4686-BF52-4CF201ED65DA}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{0724EC91-C0FD-4D7F-8EDA-B03D273BCC90}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">05.4 Metal Framing (Div 05.40.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Framing Parts (Count\4x4 Post (priced EA)\is-H7L4A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15845
Entropy (8bit):	5.587596767014127
Encrypted:	false
SSDEEP:	384:wK0oPksZSUAGnFdHYMBEXcUBDqcwa8xRW2aePjUiDhDBRoE2WL:wK0oPksZSUAGnFd4MBgRWU8xRxaewyDv
MD5:	6F3CF5C09B5D86251F1E909A6618BB3E
SHA1:	8C02EB85FBF29C28F91FDAAB58E6D6427750DCD8
SHA-256:	C01AF38D648D4CC62B15EC58CA966A7A3C5366E8CDF0F3AC3BD3E7A8698994A8
SHA-512:	380417F618D76294ECC09EEE56DD01968B5CC18EF0F300A4E8A45889DCA43BBE6E4322D5D2B14B2FCFC75A8C214DE93B770373C118421C3C86D90AE39B3CD438
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="4x4 Post (priced EA)" GUID="{1E727E8E-6B4A-4E46-BFCB-9485CDF571A4}">.. <Properties>.. <Property Class="Text" GUID="{4945D790-091F-440A-AB7C-EFBE741F2EAD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{1E727E8E-6B4A-4E46-BFCB-9485CDF571A4}</Property>.. <Property Class="Number" GUID="{B733AE8E-BBDF-487C-962A-088D3532AF3B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{96D67D80-6A98-4043-A3F6-94C30BD34541}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False" SameLine=

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Framing Parts (Count\6x6 Post (priced EA)\is-DB5BO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15845
Entropy (8bit):	5.588341564572548
Encrypted:	false
SSDEEP:	384:i+9TKFGVXraePQolMdz3i/fPMg7yXcSB9qKh8JpIZ2AxLnjUEDhA3j5qrRL:iyTzhraePQ1dz3i/fPMg7WDEdJpIwAB3
MD5:	2EC34269D2F430A0F84649EEA9D12CB0
SHA1:	701E0A6FD83B7C1DF69C74ABE8AA79563640E308
SHA-256:	C0C4391798572692B66D34154AEAFB47025468B083928EE0088E4AD87BA1E517
SHA-512:	5BE2D6AFC899A00DD04894CEF7ADF095093C9DBE45D96D4124EEAB27B13666750502C1EAA01A23467E082AF7E452117ACA0954EB2FB52806747DEEA1BF4CE4EA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="6x6 Post (priced EA)" GUID="{C27751FF-4C3C-4DB5-A408-249532F6EE96}">.. <Properties>.. <Property Class="Text" GUID="{C84BB313-CCE8-4615-B2E4-36C9140A3CD9}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{C27751FF-4C3C-4DB5-A408-249532F6EE96}</Property>.. <Property Class="Number" GUID="{29D049B7-B97A-4175-8021-DF30896B6D85}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{F81001DB-B296-48F0-8BD2-52B060A4DF6C}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False" SameLine=

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Framing Parts (Count\LUS28 Simpson Hanger\is-DEHI5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15676
Entropy (8bit):	5.583263839379308
Encrypted:	false
SSDEEP:	384:dkVE3PJANVSkhhsFLyFuNXcZDBTqFstgy/ct20L/jU+DhaHnDvEtZL:dGE3PJANVSkhh6LyFu1A1GHy/cs0LgWl
MD5:	22C4F32A6874C10FD7C82C0B95C04674
SHA1:	9AA0EFAF62FED13F88490832B07F316429A3A48C
SHA-256:	839464476233E68C36F71BE205144C121B255C6CD7C3D10683756A5614E70FD1
SHA-512:	786C5AFFA61A4B8CC3A6A95F17675E2EA3E35550E9E5F63BC44016F4150064D41DF59EF4CA0AA9ED27A773567BC1CD44A5D5905155E84E1438E23207F59F028D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="LUS28 Simpson Hanger (priced EA)" GUID="{B118A164-A654-4216-814F-5A4599BDBCB6}">.. <Properties>.. <Property Class="Text" GUID="{C1C1D6BD-FE75-4EF3-931F-86FCF791138A}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{B118A164-A654-4216-814F-5A4599BDBCB6}</Property>.. <Property Class="Number" GUID="{BCD271EE-D983-4E81-8B62-DAB6BE1A5EAF}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{FBB783DB-01B1-4567-8125-25911B315047}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Cost Each" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Markup %" Order="1" ShowUnits="False&quot

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Framing Parts (Count\is-B9SSF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	957
Entropy (8bit):	5.441334580022617
Encrypted:	false
SSDEEP:	24:2d29/mKKX2I8Tf2WAdOcGKoB1Oc8SR9gAWaWR8/CApWtv:c+S/09mWRNs
MD5:	493BEAAD22A67B6F0F0A8B45E32CAAA0
SHA1:	1FD67B620A559B236BA88047A3DFFBC54BC5AD3F
SHA-256:	2C511BAC7B1E3266B6E08C94B5EA63B6B096094D08D7DD3EBE13428D4DFE6577
SHA-512:	AB5A1EF9CD690CA1D01CE70065847D7FBCC3ED7860DAC5F4F6E23B9D5382FE7AF8E2DEF33812A7AB4C61A73B8C0B610BFEE3A11E732B3B99A86E1D9D7D20F9ED
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Framing Parts (Count Takeoffs)" GUID="{B100E448-B16C-42BC-A26B-5B5CCCB9AAF7}">.. <Properties>.. <Property Class="Text" GUID="{A6644E47-975F-43CD-A833-91ED2688488F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{B100E448-B16C-42BC-A26B-5B5CCCB9AAF7}</Property>.. <Property Class="Number" GUID="{C9B3CB7B-E706-4B72-A3A7-AAC3DFEC7855}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">5</Property>.. <Property Class="Type" GUID="{A4E3D4F9-3C27-44BD-928A-1986838E81A5}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{715E9C6B-9616-45BA-8961-7EF66DEE70EF}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Framing Parts (Count Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Framing Parts (Inher\Nails per EACH unit\is-GTEN1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16589
Entropy (8bit):	5.588258210325796
Encrypted:	false
SSDEEP:	384:LE0FFrpAf5GSbsWvlAXCXcjBcvqk8jNmJcU21cZjUwDh5LYqPMjL:LE0FFrpAxGSbsWvlAXmaci9NmJcn1cyR
MD5:	D464451D7F953D51AD1A73A785A47576
SHA1:	A49F36EAFB748A5FE688225D86C87FFF36B16494
SHA-256:	9C9D84EF3A367AE77B243CD2FC205B0A549CFBEC3518BE5284DBE6AC6302DC6A
SHA-512:	CD24691A7FA33E35E601C5BF94314065C49FEF9BB6FE4B2C9490FC4BB2E37FFDB4183A9CFFD08EF12EEE304783A55888BD14C959D366FF58BB933ECE5EFAA3D7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Nails per EACH unit (priced per Box)" GUID="{2840F039-6730-40E3-957B-F7DCE7C1E0E8}">.. <Properties>.. <Property Class="Text" GUID="{75FE38E2-56FF-4D42-A88A-66CD88670FF3}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{2840F039-6730-40E3-957B-F7DCE7C1E0E8}</Property>.. <Property Class="Number" GUID="{0604C7E8-864D-47C5-8BC2-867906DE44F3}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{214E826F-07EB-4C44-949E-4E168B728A0E}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# per Box" Order="1" ShowUnits=&qu

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Framing Parts (Inher\Nails per SQ FT (pri\is-FJFCB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (379), with CRLF line terminators
Category:	dropped
Size (bytes):	16528
Entropy (8bit):	5.5919806758473305
Encrypted:	false
SSDEEP:	384:FqSW4/Jlcf1tPVkmvAYSMXcPBBq5NhMSdVz2oLSjULDhpuDWX7gFL:FVW4/Jlcf1tPVkmvAYSYe45ISdVaoLHy
MD5:	0C8531FEE61E58746C8B19276548187A
SHA1:	177741C0F976801C7C21DC8166D12DDF656BD9DE
SHA-256:	DA21371108BE923D06CFDD73DABA8C73B36894D59DDC10BFCA18117B64F85979
SHA-512:	22C1CB096B8377A5B2C15E68C2D994619094D15CC54F8510427FC2CF1C16020C98F7362D61418097594515B02BFABB55F33E0F206B9811BAB5DF076083247049
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Nails per SQ FT (priced per Box)" GUID="{F812B576-4EDF-4DF0-BB89-6BCD6906D6AD}">.. <Properties>.. <Property Class="Text" GUID="{4077C2AD-0C2F-4CF5-A0AB-315BDD2940C9}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{F812B576-4EDF-4DF0-BB89-6BCD6906D6AD}</Property>.. <Property Class="Number" GUID="{862EA9A7-7557-4E1C-83F2-2EA8354F998D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{D66CBBA9-37A2-4AA6-9391-4E4FE98FD2B5}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# per Box" Order="1" ShowUnits="F

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Framing Parts (Inher\is-01TOD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	975
Entropy (8bit):	5.403927690294574
Encrypted:	false
SSDEEP:	24:2d29c2rX2/O/8f2WAdOcxI6g1Oc+c8gAWa8BL9/CApWkv:c+c8yhKljYLRd
MD5:	C5E77E0184D15222CD9772E09F4F1C2D
SHA1:	2F0894784641A05A30D5CFCDAB612F0AE08F4C78
SHA-256:	206644C5224C4BE276456EA5045237CCB389F1FEF4EAF1871B07129576168E2D
SHA-512:	F042300A72804E94DC6819DD4F2F1C0640EBE08513A75A2A86F9E549F215085662CB14C5F060951B9F01C2EC0EAD656D698211B86FF3F0596EBFCDE1DD062B26
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Framing Parts (Inherit Qty From Parent)" GUID="{3FF48046-F137-493F-B9BD-DFE6DDECFE7E}">.. <Properties>.. <Property Class="Text" GUID="{E2DA7C58-A5B6-445B-9F8D-2556F705589E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{3FF48046-F137-493F-B9BD-DFE6DDECFE7E}</Property>.. <Property Class="Number" GUID="{946D48BC-E0D8-4C8D-B9A3-D85F74817ADC}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">7</Property>.. <Property Class="Type" GUID="{ED54AC0E-8633-41DB-AA2E-94452047A4AC}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{15B0A136-CAF9-4104-86BF-B5320D050920}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Framing Parts (Inherit Qty From Parent)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Framing Parts (Manua\28 oz. Construction\is-DKGTK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	15127
Entropy (8bit):	5.5868734986146364
Encrypted:	false
SSDEEP:	384:xzo7fBBNNwR/0H0k+So3VXchBJuTjFFE20hVjUUHDhnJaQMWdYaL:Zo7fBBNNwR/0H0rSo3NQIjFF30h2YnJV
MD5:	58F1259E8236C8E3CCE1CBD6F3A76E0C
SHA1:	577E9965DD2EDD94384FEBF02ADA21679A9A1C28
SHA-256:	328A8B158E07DA113011425A48132B6768219F37D3837A72602B2851C08E2EBC
SHA-512:	60702E3729AC7708D125E9BC56777A4B4F08CBF0A7CA56BB03AC5F7F49D8856C42ACC9F80FA31E7BDFEE73EB44EEBC98FFF1605433A542AC15DD796D882049F9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="28 oz. Construction Adhesive" GUID="{AA7AAF39-20D6-421B-BBDD-84632A526E88}">.. <Properties>.. <Property Class="Text" GUID="{76EBD0FD-704C-4BF5-A78D-C1AF0BE8565C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{AA7AAF39-20D6-421B-BBDD-84632A526E88}</Property>.. <Property Class="Number" GUID="{3159BEA3-443B-4DB6-9574-E65289D91C5B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{61D7D40B-D7D1-4192-8F2A-D05B486607EF}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Manual Qty" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Framing Parts (Manua\3%22 Framing Nails (Po\is-SHS83.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	15159
Entropy (8bit):	5.587650962643532
Encrypted:	false
SSDEEP:	384:Xg+uI6fzk4FYb5MNrsaEarDHXc4BMPLVTCD27aMjUyDhrm2oB/ZPL:w+uXzk4FYb5MNrsaEarD3xSVTCK7aRCy
MD5:	599ABBDD455D2D6BE96C169D7FA759A6
SHA1:	734D99604FE583BB55740600A327C1036330073F
SHA-256:	822C66760D908D73BA1C26121BC4F01BA09C201DFA34CE2D77C9F5411AAD7410
SHA-512:	74FCEF729D7555797C59A77A57419273528DB915A8AA35CF76767DD3B2E5B39BE0F310F8DD620C055E56C42B3C488ED16B4A0E0CDE610830A5B2FC47F6D78F18
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="3" Framing Nails (Porter Cable)" GUID="{6278DC12-DBDF-4817-9E5D-F0835B9335FC}">.. <Properties>.. <Property Class="Text" GUID="{D5E8695B-8250-41AD-AB0D-9781F28E5B8D}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{6278DC12-DBDF-4817-9E5D-F0835B9335FC}</Property>.. <Property Class="Number" GUID="{8ECC5235-5F3A-4DFA-B893-E2B91B73CB9C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{94822FFE-ACCD-4E3B-8664-F89F100BF546}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Manual Qty" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="Fals

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Framing Parts (Manua\is-93M46.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	949
Entropy (8bit):	5.429528902685435
Encrypted:	false
SSDEEP:	24:2d290d0hXX2rP7ff2WAdOcTV6fVh1OcxyJu5gAWal8/CApWJJv:c+cCyZYDU7ceh
MD5:	75430C8A6E6B3A9681BC21562E1DDBA5
SHA1:	8373263DEB0A5FA0C44A33A07AA327723BC919B8
SHA-256:	0BEB3B07D831A80AD12D8B215C32C5137CB22CB7D449C8707353ECEED5E4A799
SHA-512:	E5AD0BE131BF4805EE3FF5180C11FDEF76E566515DB56924E5DEAF11A69FF185AAF18F997203615DD005EFC0D3489F98D4B21F505B3185F70EBB4D2ECB2FE1A3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Framing Parts (Manual Qty)" GUID="{886AF357-115B-45BA-A309-806FEE30C01A}">.. <Properties>.. <Property Class="Text" GUID="{2697B6E6-F9B5-4D83-B335-9D41911BD1B1}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{886AF357-115B-45BA-A309-806FEE30C01A}</Property>.. <Property Class="Number" GUID="{A91AEDF2-162A-4DB5-A0D8-E196451C3998}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">6</Property>.. <Property Class="Type" GUID="{3B3F0181-A30F-49D5-8033-13161E6DA513}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{91030650-21A5-47BF-815E-662AF87D7A06}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Framing Parts (Manual Qty)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Sub-Floor Sheathing\3%2F4%22 T&G OSB (priced1\is-JP51R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	16001
Entropy (8bit):	5.591181805117737
Encrypted:	false
SSDEEP:	384:SzvmP0gB+FMZUbD4jg30xoXc0BlqN27FNGGg82DQkjU6Dho3+0QTL:SCPvB+FMZUbD4jgEx8lc4ZNGGgvDQZad
MD5:	9347D1D09EE326804BC2EE475C8EDEA4
SHA1:	BF951908776880D920B5795DD0A707F41258A358
SHA-256:	B39F114564CA7641E86B86136534A6BE3004036DD80CE7394975AC70F31A0147
SHA-512:	9573E3AA6E22042220B23B405D475CCED3C39CF0AF4C5B8E7E0B1359900B0A794C3D22F720E0D59784F164840E3895EBF34CBFD62422A7A15E6ECA144F6FD696
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="3/4" T&G OSB (priced per SQ FT)" GUID="{1AD6B4DA-0F1A-4907-8311-34E5C226F54A}">.. <Properties>.. <Property Class="Text" GUID="{09847D48-01B4-4E34-91AE-89F952C711D6}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{1AD6B4DA-0F1A-4907-8311-34E5C226F54A}</Property>.. <Property Class="Number" GUID="{5B269F8B-26FC-4C94-AFDC-71021A696930}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{774BD309-8C49-4761-94DF-BFE09DE90660}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False&qu

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Sub-Floor Sheathing\3%2F4%22 T&G OSB (priced\is-5EMCE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	15987
Entropy (8bit):	5.591616712759856
Encrypted:	false
SSDEEP:	384:2ZmK4Aoz5YCqdFvi0ffXcxB4qymO1HWDbAK2DLxrjUy/Dh39RBOR7L:MmK4Aoz5YCqdFvi0ffQf823A9Dt0yd3O
MD5:	DB06405B968B016DB6DAA8136DD5765D
SHA1:	732A9F397DEDF7D00B91D4F05578B725EBF886FC
SHA-256:	993A4E3353856EF496369361341B90B5345367D7BEBD62170B080B45F2109C17
SHA-512:	8B49EC424C7074FD3FF383BB17A555DE1660580F60F6C4718C5E855048162DF4C9A93EC62596EB49BFD3564AE2B33ED5C6FAD712F3922FA6BE631CE07CE8F0B1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="3/4" T&G OSB (priced EA)" GUID="{A2CEBA39-FE8F-4880-B8DC-A94863E06840}">.. <Properties>.. <Property Class="Text" GUID="{2B12A451-CB7D-457E-814D-B345BABFF318}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{A2CEBA39-FE8F-4880-B8DC-A94863E06840}</Property>.. <Property Class="Number" GUID="{E4880426-4A76-4949-825E-06D6AD918F96}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{1E80330E-DEF7-4E7C-A2DA-79E1F4A8C867}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False" Sam

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Sub-Floor Sheathing\is-55NKJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	967
Entropy (8bit):	5.459422007710433
Encrypted:	false
SSDEEP:	24:2d2mxQRX2nE8f2WAdOcsLS1OcLqubgAWam22G/CApWjcSv:ctycEk1LtQV2SSD
MD5:	CC11E135DFA4313C92E4FDC6C01573D2
SHA1:	E4E3F8EF348005224A659B7D01923E9E7897A629
SHA-256:	92255198350A64345B697035523061F5567BD51D105FB228B75D47B639CACFB8
SHA-512:	B8CA707DD0A00ACA54DCFB4278EFA09E36C8D7351B132AED074348C69483A800EDE228F33910DED730393287559B2FDED234D726B0AC978F84FB3E4B1890B455
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Sub-Floor Sheathing (Area Takeoffs)" GUID="{75E6686A-2A09-46E8-ABD6-1C67FC5280C2}">.. <Properties>.. <Property Class="Text" GUID="{EDA9BDA3-8BA0-4D40-AC01-65E8DC2835A7}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{75E6686A-2A09-46E8-ABD6-1C67FC5280C2}</Property>.. <Property Class="Number" GUID="{C20888B4-5FC0-4F3E-A442-3F6C67A68766}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Type" GUID="{EC57836F-308B-4742-A1A7-299137ECA8EA}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{44E757D6-0D97-4419-8B08-0ABD1D89EB59}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Sub-Floor Sheathing (Area Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Wall Sheathing (Area\7%2F16%22 OSB Sheathing1\is-9B59K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	16007
Entropy (8bit):	5.592912365454382
Encrypted:	false
SSDEEP:	384:dyRJAFCvRRwoqRjoRbsXcnB/qXgLoolIe2Y6PjUHDhMRwYx5L:dyRJAgvRRwoqRjoRb4aSsvlIZY6wVMRd
MD5:	DE4478EC633DDAD89704299CEF549A57
SHA1:	B0ADBC5E59450C36F6EBE8369627A54BC11F2EC8
SHA-256:	2C7BE3F9AA8697E73EED2EE69902DA5D5724B7AFFBCD991069B1AFC15CC61C32
SHA-512:	5917DC5C106D22DDDCECCB78FBC05E77085EC7749079D8877DFD509094BA5D344535205FDED8B51158988E46919F58DDCC88DE9E27CCBA66BDE399BE14E9D5A3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="7/16" OSB Sheathing (priced per SQ FT)" GUID="{53A95CE1-14A3-42DC-9D2D-11010F6E558E}">.. <Properties>.. <Property Class="Text" GUID="{6E4BECDC-F2BA-4BE5-82BC-290693C8C86F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{53A95CE1-14A3-42DC-9D2D-11010F6E558E}</Property>.. <Property Class="Number" GUID="{1CBAFF0E-765B-4FCA-A526-BEB2FB3FCD60}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{1748DA17-48BE-4634-AB64-433350B562F5}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Wall Sheathing (Area\7%2F16%22 OSB Sheathing\is-3LT48.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	15993
Entropy (8bit):	5.59422644320106
Encrypted:	false
SSDEEP:	384:gtOsY1SaoUbPr2ttTn8XcUBxq9uSl0xno22eMjUrEDhTROndUL:gtOsY1SaxbPr2ttTnI1IBl0xnz2eRwTN
MD5:	9F18610112ACAF54CCEE0D5BEBF2DDD2
SHA1:	62D3A0BEC5BE0C73FAA2D1D53F2852933AE2A3EA
SHA-256:	428DC4D8A3142386AFF66ABE0485326DE529DEF828593CF26738425E1E4BF1C7
SHA-512:	C78D1E07CE9B24B3B8A4A193373CC55B680855AB239431C9AB28D3CA32A199D6F38BFA463128A52CF13813ACF6405DCAD548B8DD35A3DEB2BA96C158741BBEEA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="7/16" OSB Sheathing (priced EA)" GUID="{1ECF8CAC-B70A-4EFB-BB42-2DBDE5005895}">.. <Properties>.. <Property Class="Text" GUID="{6D3AD0B7-F404-40E8-8235-3055E5C7F2B6}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{1ECF8CAC-B70A-4EFB-BB42-2DBDE5005895}</Property>.. <Property Class="Number" GUID="{8CEB0B6D-7435-4151-91D9-B6F036CB54C5}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{7C9F7BA0-2FC5-4591-BF7D-24C9A3F156B1}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Wall Sheathing (Area\is-J7V47.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	957
Entropy (8bit):	5.463589894245937
Encrypted:	false
SSDEEP:	24:2d2PQKPX2jwf2WAdOctM+ZSm1Oc8ZJ0gAWayIqD/CApWLSv:ccT4SRZUO5
MD5:	94B6EBCB00384D9E2FFAB80541EA3C41
SHA1:	E59B0425D6ED2D7A64517A9C3278F971C3FED805
SHA-256:	E6A64B0C8B7FC019581B61090DECF752A467E3DA9AEAE684EE89398F23176F7B
SHA-512:	7B99DA783FDBBFB450A9D274130463ACD3C8DD41CD6947E552484277D2AAB1FB729B6EDA61A910CD96AE2EBFBB62F654EE7CE8DE75E4A82F6800350534E829C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Wall Sheathing (Area Takeoffs)" GUID="{42AC6E67-0A06-4155-81C2-4B2F5ECC73CD}">.. <Properties>.. <Property Class="Text" GUID="{A8A3EC33-D749-4230-9084-43F59D25042B}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{42AC6E67-0A06-4155-81C2-4B2F5ECC73CD}</Property>.. <Property Class="Number" GUID="{974F7C60-E5A7-4824-BE94-3E676970E204}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Type" GUID="{91FB8656-34EA-4433-8EFD-8B09BF5DAB7C}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{8DDF1CBB-D851-42B1-96BB-DAAA617A62F5}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Wall Sheathing (Area Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Wall Sheathing (Line\7%2F16%22 OSB Sheathing1\is-179V1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15965
Entropy (8bit):	5.595058751864882
Encrypted:	false
SSDEEP:	384:6yXH1ZnEnUFi+ZPDudeVwEnXcXBdqciGQc9fT2z57jUEDhxg2qnPCL:6GH1ZnEnUFi+ZPDudeV3XOkbRc9f6z5P
MD5:	0C7D68D0199C13DE133B390FAF2466A1
SHA1:	5B8243F9C517E2C6942CEB2377675C1C6C56EE53
SHA-256:	5979AC4A8C778E1222CF82031FD290176CD6E10BD100EECB73B6A4BEC444407F
SHA-512:	1590C2E71C3605858A56E1F8AC3127F9F2EBB90EC00766B7443E3C97A78538C08A848B992199FDB3EB356DD38FDFB279AFD297D47DA25EB71D75FACD235139C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="7/16" OSB Sheathing (priced per SQ FT)" GUID="{90C76F4F-4F80-4A82-903E-496F28F87EB5}">.. <Properties>.. <Property Class="Text" GUID="{49B98E1A-8466-4557-BB60-4CF69AC97D7E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{90C76F4F-4F80-4A82-903E-496F28F87EB5}</Property>.. <Property Class="Number" GUID="{E677F87C-A642-412E-A6CA-85B5B201B833}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{BCFEDAAD-EB23-4894-94BB-79CE72B2AE4B}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Wall Sheathing (Line\7%2F16%22 OSB Sheathing\is-1L1C5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16282
Entropy (8bit):	5.596543451428882
Encrypted:	false
SSDEEP:	384:KDaBHXVQHWMMJxOwZd0CU0vyN1LXc1WBnqE3X76582bpljU8Dh4dhBdHK7L:calVQHWMMJkwn0CBqN1z1qO765vbpGsL
MD5:	0419DDABF060E7EF426DD9B88DBB320E
SHA1:	C69B986C0B11E00505D5C30094A8A30D8708F163
SHA-256:	BB9313389FA8FB9C8920A0455D8B4337D130AEB365FE921E53A3018DFA9484FA
SHA-512:	BB76D696B68626D22FF33A1073A36C9C2DA8886E0655A0E8ABA414283FB48EC3732B959A92A9F705BFC33C39BFADCBFBEB6C2ADA7C3EBD715DDB0B4069A29679
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="7/16" OSB Sheathing (priced EA)" GUID="{049FA582-9254-4015-996B-3BAA3149778E}">.. <Properties>.. <Property Class="Text" GUID="{88E41983-AFDE-4BCA-B715-F10C736F2F77}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{049FA582-9254-4015-996B-3BAA3149778E}</Property>.. <Property Class="Number" GUID="{3357E1B2-1069-4F30-85EA-ABC8C2EBD978}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{6ACB3F2E-9214-461B-8AAF-6BEC587397CF}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides" Order="1" ShowUnits=&qu

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Wall Sheathing (Line\is-IGGUR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	977
Entropy (8bit):	5.462678108121896
Encrypted:	false
SSDEEP:	24:2d2Cw0EX2wf2WAdOcQ0LK1IW1B1OcIMHuCgAWaV/CApWAv:cgDHnGcIWINubj
MD5:	DCA7E90CFFE028117DE69A711937BF3A
SHA1:	6BCD3F93D2F9BBAECDD8F28051668DA92669D12B
SHA-256:	89B41FC58EB02171B277C105658A3B232BBE2413FDAE137C4C96294D4351E6AA
SHA-512:	AEACB30C1603788671E50BBFA655D301E1C1741D50BBB279A596097FE666C6353F8D5D9CC6CB0E2FA5E36DA7D17B1EF90BFE47F5C4BBEBD46F20DBF1DCED5195
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Wall Sheathing (Linear/Segment Takeoffs)" GUID="{65F237F3-7575-49E7-8895-73379773781D}">.. <Properties>.. <Property Class="Text" GUID="{728DE7EE-C540-4028-B45A-709B25B8FEB6}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{65F237F3-7575-49E7-8895-73379773781D}</Property>.. <Property Class="Number" GUID="{0F135963-45FF-434C-93F4-8B6506224224}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Type" GUID="{09F7B9BB-5AB5-454B-BFE4-BC53184A0C56}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{EAFCDE6D-2CF1-409F-8AC3-773B204D30DD}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Wall Sheathing (Linear/Segment Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Wood Plates (Linear%2F\2x4 Wood Plate (pric1\is-UORKM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	16166
Entropy (8bit):	5.589692811466067
Encrypted:	false
SSDEEP:	384:+uMO9/quWs45kAyfEdkXcMB4Fqvkm/UeJZ2pNcjU1DhlmaAAhkbL:+uMO9/TWs45kAyfEdApNDUeJwpNhTlmb
MD5:	EAC1B6DE57A9396CD03E4616480A778C
SHA1:	556219857E619B104E82E4FF2BF26C54B5215C2F
SHA-256:	FE00074668888C1459AD81E53FC6B20F0598FC6BF22C503CA04BC6C91CBEB36E
SHA-512:	FBC71436DFC97635CAC196D932643C0F04063E89115321AED572DC89287F2D4FFECF92E5E4D3FF2A3B6D95D1854736546F7724C4089D9EE0D20D95BFDD8997DE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="2x4 Wood Plate (priced Linear FT)" GUID="{56830228-48ED-4E97-A004-D10BF0881468}">.. <Properties>.. <Property Class="Text" GUID="{73C3748D-3B13-4AA8-BEEE-CEE80BCB8AF0}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{56830228-48ED-4E97-A004-D10BF0881468}</Property>.. <Property Class="Number" GUID="{F34913BA-7DB5-452D-84E6-2F4283E499FA}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{D3D3E8F2-2664-491C-96AA-25070899E7C9}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Length" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Plates" Order="1" ShowUnits="False&quo

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Wood Plates (Linear%2F\2x4 Wood Plate (pric\is-D31IB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	16014
Entropy (8bit):	5.589688057409953
Encrypted:	false
SSDEEP:	384:5AdDLeOcVq1RZpNSeqCEMfkXckBUqh8HYs6nL2WJHPjjULDh5J5E2WOMHL:5AdDLeOcQ1RZpNSeqtMfAl7Sf6nSWpks
MD5:	F6D24BEFC855C9E83A0754F0D9E631E1
SHA1:	48999379AAF0B46B3EE97CF11B94E7885142F6B8
SHA-256:	FB3A16685D7E5C5DACCBDF6F5A75053E3A083DDF144F61346D3805A060B8231A
SHA-512:	8AFA26A5B0309BF6C7B95868324DD2A32B98A3B3D57D9B204B3612FA9EF8996A46F71FA8FFD382744ED9CBDE0D2566DF688115D533C3426ACA53F97A433AFAB7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="2x4 Wood Plate (priced EA)" GUID="{8A437202-1482-40A1-B4AA-00F3B1C547D6}">.. <Properties>.. <Property Class="Text" GUID="{B56B62D8-35BE-4F1D-AB6B-7172A57D0088}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{8A437202-1482-40A1-B4AA-00F3B1C547D6}</Property>.. <Property Class="Number" GUID="{B817F4DC-0BDA-4A1B-9509-E50741F9ACB8}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{26682E91-BD0D-480D-B6A1-CB106BB6B0B5}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Length" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Plates" Order="1" ShowUnits="False" Same

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Wood Plates (Linear%2F\is-D5DEH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	971
Entropy (8bit):	5.457274590847302
Encrypted:	false
SSDEEP:	24:2d2VnuY6pX2bBhyf2WAdOcSpY6yBdo1OcCFBugAWaRP/CApW5Hv:c+uY2aWjpYLLPm3CP
MD5:	87234D18CC8E0C9359A9891390BDDC00
SHA1:	870059F9971795B789D3DC989F536BF25358AC98
SHA-256:	EFFB954755DEF888D4B792516E2F536AD79856BA05D61CDCBC98AC7CD1656BC7
SHA-512:	4AEC238A4E75E1233C2831E5BE7FA902CD8E5EB8D145D6838825856799FADDEC60092BE3379C2C569AED4AE6DB88BAAF630EC3CB5154B4F1EB5F9D5C2FF17D98
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Wood Plates (Linear/Segment Takeoffs)" GUID="{D45F1F2E-479C-4333-8684-691450299C6D}">.. <Properties>.. <Property Class="Text" GUID="{EF382BD6-C646-4F9D-B86C-1B1E10DB7F2A}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{D45F1F2E-479C-4333-8684-691450299C6D}</Property>.. <Property Class="Number" GUID="{D55C250E-5E48-4BE0-8608-9CCBB43AA1F2}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Type" GUID="{94F6A76D-6FE7-4A02-9B73-A4AB1390FCFE}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{ED38B2BE-5796-4C7D-99A3-ED681FCE85FE}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Wood Plates (Linear/Segment Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Wood Studs (Linear%2FS\2x4 Wood Stud (price\is-5N71S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15844
Entropy (8bit):	5.594967879922249
Encrypted:	false
SSDEEP:	384:Gwaldk6ts4NatWe5iAeOIXc/BQqhqLmMR1e2BOujUGDhk0dc2sjL:taldk6ts4NatW0iAeOciHhtMR1ZBOrO8
MD5:	1C4D95A2FEB9E020D3F8C65813DCB420
SHA1:	466B3634C4ED6E6790F81AFC3F9E3634058E5D7B
SHA-256:	3FBCF682306CA27D84677457979B78674F0E673A29E157DCED170019CDE52C8D
SHA-512:	ED059953EF8F63C0E0BFA98B246CCD537707D859787FB80A11FD7A18461F2FC0DA6B3E12A5D45964503F3C8110223CE2D4C3A8260782447D741780B0578A4361
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="2x4 Wood Stud (priced Linear FT)" GUID="{ABD9C5C0-EF14-4B6A-A39E-C87F3B4C658B}">.. <Properties>.. <Property Class="Text" GUID="{4920B54C-5AB9-4226-9660-5B6DB8AB0F5D}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{ABD9C5C0-EF14-4B6A-A39E-C87F3B4C658B}</Property>.. <Property Class="Number" GUID="{0231700C-4A2C-439A-B411-CE9FB745E3AD}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{7B2A7174-5485-4D81-BDF5-ED0231075DD4}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Length" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="OC Spacing" Order="1" ShowUnits="False"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Wood Studs (Linear%2FS\2x4x8' Wood Stud (pr\is-MG7U4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15674
Entropy (8bit):	5.590465752475789
Encrypted:	false
SSDEEP:	384:+Ri4V8kODo5HXvzGLQcKXcKBkqhSW1vyo2o4wjUzDh5O6Eb5L:+Ri4V8kODodXvzGLQc+DrZ1vyzo4955o
MD5:	85CACD76F732597C70609E92B363302D
SHA1:	F61853E612A6D664CE659994DA45562B03425A38
SHA-256:	026B289361FF5665194EEB781C8601053F43248C406A88D55D692EBB89FBEAAE
SHA-512:	B555E7B975F8A6E541EDE23A17F8618E3C862CED579487DC8C9F006CA69F4846D6960F161A91BC86B1F1FE1FD19C27E2AE7CC75B5294721D0087AE572AF8F2CE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="2x4x8' Wood Stud (priced EA)" GUID="{3FB4A333-A147-4CA8-8C13-64FDD36711F1}">.. <Properties>.. <Property Class="Text" GUID="{A4E7E895-ED7C-47D9-B443-06DCB702772B}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{3FB4A333-A147-4CA8-8C13-64FDD36711F1}</Property>.. <Property Class="Number" GUID="{4BDDE5C5-9F19-46C4-B77C-7126DA6ECFA2}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{1EABCCFD-AD47-43CE-AA30-82B7C7517621}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="OC Spacing" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False&quo

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Wood Studs (Linear%2FS\2x4x9' Wood Stud (pr\is-OAR6I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15674
Entropy (8bit):	5.592996819635361
Encrypted:	false
SSDEEP:	384:8tKr95KJ2ojYLS+kqp9VqC767XcfBhqb6lthpnB2VNPjUKDhCEZjz9L:8tKrnKJ2ojOS+kqp9VqC76jKYothpnYj
MD5:	000BB777ED266BCECFB99172D6C7413C
SHA1:	BAC7461E17E72E3D7543A99CF854E2C29BC2A7FB
SHA-256:	E56CB9214F5E6DBC837D1250775592B81214A9BF812A811093E789A091C977AE
SHA-512:	EE7DBD707659E79D5526E3EB3AA8CD752E2D21463FFAF20BF1DF574D34FB10712E0A94157F1FD147B040FDF4D6734838D2404AA2EB9DA2C7652A4577820DFFD1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="2x4x9' Wood Stud (priced EA)" GUID="{3693A423-894A-4C8E-8AF5-8C0D915495B5}">.. <Properties>.. <Property Class="Text" GUID="{B565B1D8-A19F-4FE9-AEDB-1A8A21D87B03}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{3693A423-894A-4C8E-8AF5-8C0D915495B5}</Property>.. <Property Class="Number" GUID="{3CFB9DA8-B44A-4DA5-A6BD-474E9DCB8D80}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{3554A822-632F-476E-9328-56EB2C8A781E}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="OC Spacing" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False&quo

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Wood Studs (Linear%2FS\2x4x92 5%2F8'' Wood St\is-56DP0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15696
Entropy (8bit):	5.594821703311194
Encrypted:	false
SSDEEP:	384:QYOQh874Dvh16a6GSx5Xc9BV3qTksXHkS2kYQjUvLDhkIAZKGL:QYOQh874Dvh16a6GSxpow3XHklkYdpkP
MD5:	46A78F7EBC83BB623A87810EB6DCD0DF
SHA1:	A37D5217B516405073F20915967C76070830EBD2
SHA-256:	9F6222E858D074E8B18D2B92F95332CE1461A7E79D7ACA43DDE231FD0B1C46C4
SHA-512:	8DDBD223FBABED0BD96AE6FB13F23EB412B15B7D0F3EFBBBBC51F8B0F72FDC84D3D18BA25ECC34FDDE3DD19B91B5680CC30FCF26B47DD57B94B25FE314AEE659
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="2x4x92 5/8'' Wood Stud (priced EA)" GUID="{46073FF7-968E-4F4E-8CBB-446C338EF82F}">.. <Properties>.. <Property Class="Text" GUID="{E10759F2-5F3B-4616-A64C-7687E5F04750}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{46073FF7-968E-4F4E-8CBB-446C338EF82F}</Property>.. <Property Class="Number" GUID="{CB4F3328-90DC-41F8-8E70-535FBD01F3D7}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{E9A227B0-7DFA-4DCE-8A66-BAB66AA52B5E}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="OC Spacing" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits=&quo

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\Wood Studs (Linear%2FS\is-A5HCM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	969
Entropy (8bit):	5.458890334047305
Encrypted:	false
SSDEEP:	24:2d2nnvX2x3Z3Pf2WAdOciG+1OcauvJ9gAWa//CApWDHv:cGvg1d+6xyP
MD5:	21D3E3B8E724EEC5A7AF0C7439CC4971
SHA1:	12317B879CB75E70E0D859317A4606E8CF428F8E
SHA-256:	ABFFC0AFE8901EB5D17F260C113CB446D9402962591D18FB51F811A967F55BD0
SHA-512:	C1E39D3ADFE8B3910C89436A1A42FFFE0438EC77AD6AB3CD8CFD2FA23242A7DA3F6330E48FAC9E5796C087FBC3CCDDDBD778C45323800C978D36F76D00545D3A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Wood Studs (Linear/Segment Takeoffs)" GUID="{13304833-9520-43E2-B79C-7B8B9DE32C65}">.. <Properties>.. <Property Class="Text" GUID="{A5C50472-5828-43F8-BD0E-52CCEC327D01}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{13304833-9520-43E2-B79C-7B8B9DE32C65}</Property>.. <Property Class="Number" GUID="{A2601C91-439A-45D4-AFC1-38B3D05CA9E1}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Type" GUID="{599C3141-D736-4059-8E46-EABC304B4610}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{3EAC0C61-48EF-4D0D-9CF1-3FEEDA8222A9}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Wood Studs (Linear/Segment Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.1 Rough Carpentr\is-K4NBI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	969
Entropy (8bit):	5.4556689876106805
Encrypted:	false
SSDEEP:	24:2d215OjuX2jf2WAdOcElE1OcxNP0gAWatnv/CApW+QOUv:cc5OyiRCPGXsO2
MD5:	F1641ECF7C40C93F75112432D3B243D5
SHA1:	3E0305BB102173B376552F4ABBCD0DE9BEFB4C92
SHA-256:	0E89316DF9EFBF010262CDB4A482B50222409F8390798DADE82E51473892CA1A
SHA-512:	077ED3656FD9BDD3B30BF79A14509849555164E6D99FCCA13130AA731E22073FD3966AE9FB33EB7149571ED24E37EADA41FA12145231B428CC67EB086E5A4050
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="06.1 Rough Carpentry (Div 06.10.00)" GUID="{74931098-F92A-44B6-9B57-83F5415B3A15}">.. <Properties>.. <Property Class="Text" GUID="{CAF4D4F3-151C-438E-A3C2-51FE49986F8C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{74931098-F92A-44B6-9B57-83F5415B3A15}</Property>.. <Property Class="Number" GUID="{A443267C-AB07-4636-9068-1F98C363FA7F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">6</Property>.. <Property Class="Type" GUID="{2A1EF4C9-04B1-4BEF-98CA-67C8801763F3}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{C8E69002-8B21-4693-9740-18982A15242A}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">06.1 Rough Carpentry (Div 06.10.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.2 Finish Carpent\Cabinets (Count Take\Cabinet Units (price\is-OC7UG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	16412
Entropy (8bit):	5.593428002405073
Encrypted:	false
SSDEEP:	384:iwhtpX+SiSYN/huJLlQ2ZMbzXcZBHqaU2sLC+25sVjU9DhtegI9VjhL:iwhjXfT+/huJLlQ2ZMbrQKCsLC55s2Le
MD5:	C6C4574C35E9EDB1CBD43EC4CAF67AD5
SHA1:	81D719F0F3592147CD5D6E3BB4A736D6A497E20B
SHA-256:	1A2B9A99A7D092424CC54B6A5C2AA56B7995E453F50EF6A1D9B5BDAE2FD0F8AE
SHA-512:	3DF95278C7677F3CD82B58C2C7481998F0AB28986BEA7DADD245596CD168631CCD87469ACAFC9AD1803B28CC83CB01D251F6B194847C932097685EC3AFF8E2E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Cabinet Units (priced EA)" GUID="{5CC0FE00-C28D-41DD-B5A6-CD088A4D49F8}">.. <Properties>.. <Property Class="Text" GUID="{7E90DBE9-B44F-4DFE-8BA2-34FD9507CCBC}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{5CC0FE00-C28D-41DD-B5A6-CD088A4D49F8}</Property>.. <Property Class="Number" GUID="{39D57ED5-E0A1-4755-A3FE-BA0E300C7377}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{31BAF0D7-3424-4DB7-8B8A-45A4D14FB257}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False" SameLine=&q

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.2 Finish Carpent\Cabinets (Count Take\is-2V77T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	947
Entropy (8bit):	5.430901074924466
Encrypted:	false
SSDEEP:	24:2d2se/Wx+X2n346f2WAdOctg/WxRKB1Oc8ZQgAWatonj/CApW6v:ce++Luh+YmWonzj
MD5:	4F908338202E8EF53A371325066AE75B
SHA1:	D3460384DFF4A68B15E5B7739D45B790F58D3197
SHA-256:	41C6C98B6FC81B476F983B7B7BEB319FFA7CCC59E6F355AD2B00970DCAFF149C
SHA-512:	FBE9B2FA3BEB86B765745D38301AE8F7FC8CD9FA702A783575F909183D8789152F7FD062FEFE2B3B8EF91DFCC61D4FCF9FF7BE20290037E82D4C22BBA0FECFF1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Cabinets (Count Takeoffs)" GUID="{4D4203DC-B0BC-40AD-9F04-454C4F44C052}">.. <Properties>.. <Property Class="Text" GUID="{3E06EB8F-0EE8-4F0A-809B-3FD5EB43FDED}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{4D4203DC-B0BC-40AD-9F04-454C4F44C052}</Property>.. <Property Class="Number" GUID="{B9605837-325F-478B-8E73-25F7617FF827}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Type" GUID="{3129A5D1-E5D2-49BD-8749-AD7286721D52}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{ED6B1790-CAB6-45E2-95D3-B79B3B885055}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Cabinets (Count Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.2 Finish Carpent\Countertops (Area Ta\Countertops (priced\is-P2NIV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16256
Entropy (8bit):	5.590655523799357
Encrypted:	false
SSDEEP:	384:r9KSA8p82oGb8EzXhZ8rXcKBBq1pTVDw1fF2dO+tjUnDh2kzxDL:r9KSA8p82oGwEzXhZ8Tj41Dwhks+e120
MD5:	C21F0D654FE43BC1D00D9A59D86AA874
SHA1:	027C4796E625DEA9D44AE118FA6B8B87E80E2444
SHA-256:	50283E476718EB04DC60D018A10F71E41E4E3AD748413BCD95E94E7D31160A13
SHA-512:	B644FE01DBB5F1BB7E306F6D0FA4E9FA10B85BEBA3CA4E02763A4DDC4AF6702AACFA5CE141AE2879C977075FAB40302B07CF71F6D53C36EA0876B5BF2D5CF0EF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Countertops (priced SQ FT)" GUID="{D4F41098-07C8-4B84-8FAA-096D39ECC2EF}">.. <Properties>.. <Property Class="Text" GUID="{19C2EA06-8E97-48D4-A9A6-833459E359DA}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{D4F41098-07C8-4B84-8FAA-096D39ECC2EF}</Property>.. <Property Class="Number" GUID="{E9A18FC1-0460-4585-9DBB-CED78C5842D5}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{E63032D1-584B-42B4-AFA2-A9C9873B1719}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Waste %" Order="0" ShowUnits="False" SameLine="True" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False" SameLi

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.2 Finish Carpent\Countertops (Area Ta\is-L4UJN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	951
Entropy (8bit):	5.420931285708125
Encrypted:	false
SSDEEP:	24:2d2xEk6YFMX2j9f2WAdOcaYFz1OcL9igAWaR4RTb/CApWCuv:cqmjC/BlpSnO
MD5:	E5511EC01DF060F52AF4828576096CF7
SHA1:	6F61D23740E08EC67DB3F56ED8B3369252B347BE
SHA-256:	4FBD438C54926E04C9D1F27E9A1A0BC56CDC4FE00673E4CAF1FE11022469CF8B
SHA-512:	F24A65F9E72B379E83E11496AB5A8A5587E9C914B31E88CDB274878F77B4AE8562922B016699F717C12299532048B43D29FEB54A48FC3AD5184E2B03992C4A45
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Countertops (Area Takeoffs)" GUID="{D08BA998-FBC8-4C41-9609-DD0602091931}">.. <Properties>.. <Property Class="Text" GUID="{F82787A0-5804-4DE1-822B-7E0FCFD2A28D}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{D08BA998-FBC8-4C41-9609-DD0602091931}</Property>.. <Property Class="Number" GUID="{50B82ABB-6B46-42BD-849D-5CAD7FFEFEEB}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Type" GUID="{9D162DE7-0830-4F59-8C38-31D6B915D3B1}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{4E0B4D96-F155-4E66-8762-A65E09776D1C}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Countertops (Area Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.2 Finish Carpent\Finish Parts (Inheri\Nails per EACH unit\is-LFAD9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (379), with CRLF line terminators
Category:	dropped
Size (bytes):	16524
Entropy (8bit):	5.587334045894995
Encrypted:	false
SSDEEP:	384:w8Yy2ApuyEhLLKXokyuoXc0BKqqIH2Ywytv2JkNjUuDhoo+fYidL:XYy2ApuyEhLLKXokyu8RKlINwyteJk+n
MD5:	30B9A707207DADCA0C05A21FD00A780C
SHA1:	ED880A2EED52465F3B2E8C51333FF3D62D03E50F
SHA-256:	351D6D774E9EC8F9D8A52AC7458C417C4E100DAF868647913DC9BCEB565477B2
SHA-512:	59839BCEE878498C91C4E692FE6B7799BA04C52C7EB97CD55C64458E68FFBB049E1B2A4FD62A1DAD699034EF5C99AB81A5DF4FB18B3C2DB41A7A7216F60E9A90
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Nails per EACH unit (priced per Box)" GUID="{266E3433-990C-47EA-A478-148C8E89AFD9}">.. <Properties>.. <Property Class="Text" GUID="{8E7C9A48-84DE-42C4-B01A-A0982994A76D}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{266E3433-990C-47EA-A478-148C8E89AFD9}</Property>.. <Property Class="Number" GUID="{237E1B75-5B01-4642-8B9D-7C619783E97A}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{9A723E74-4D19-4ECE-9101-88788CBEF132}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# per Box" Order="1" ShowUnits=&qu

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.2 Finish Carpent\Finish Parts (Inheri\is-202PF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	973
Entropy (8bit):	5.411553764313002
Encrypted:	false
SSDEEP:	24:2d2GJS8L2X20f2WAdOc67S8LQVRHze1OcCcfgAWa0yj/CApWyUv:ctJSzftS7Vizp2
MD5:	A111107B5678E53C614CE027D1C82BBB
SHA1:	66A28C61BCFBBB02BB2EA3FCE6FF55BA48A82367
SHA-256:	3E7F78736E2FC62B9BC0CBDC2515FECC0D3C532989365A005CBEB35D4024CDB1
SHA-512:	41962EC613E0375AD7BB9C36AD2A9071F90195080E75F885D812D0966A00FE122570BC59E180172B31713033834CE9D5EF88FA6EED968F4E9B9F3A4E9622177F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Finish Parts (Inherit Qty From Parent)" GUID="{C62B5E99-2F77-4861-9EF1-A313D8646CA7}">.. <Properties>.. <Property Class="Text" GUID="{9198463D-E2D4-4049-8040-927988B7A4EE}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{C62B5E99-2F77-4861-9EF1-A313D8646CA7}</Property>.. <Property Class="Number" GUID="{99447663-D818-49EF-AD35-357198A7901C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Type" GUID="{71ED5725-4D42-4B7E-BDC8-F5B765EBEB0F}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{79AF562C-C967-4C55-92A8-7D8759A67D7F}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Finish Parts (Inherit Qty From Parent)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.2 Finish Carpent\Finish Parts (Manual\Stained%2Fglazed Mante\is-EB925.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	15172
Entropy (8bit):	5.588870682094434
Encrypted:	false
SSDEEP:	384:CJOsL5a5Pd37NMqehsFqJXclBoGghu0N2WR9jUEDhTX29UL:CJOsL5a5Pd37NMqehsFq5E0hu0MWRukx
MD5:	867C2E6722146601F99D9A311C5E38C2
SHA1:	4F9C80F29FDF0CC64F4927B9830F773069A484BD
SHA-256:	C75F0691298A430C7155639C67ED18ECFD1D7E3D9B8B2AA630583FFDD3CA635C
SHA-512:	4076BA9BF6E2F3F7C0557728BD53B2AE480374FCB82885B8955F0BDB56EE34AC6FC9F4C0C261523DE856CB913094338EDCBC5B28DE25FB740583DDB8FF50DB22
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Stained/glazed Mantel Shelf" GUID="{028C14A1-C0F9-468F-80C4-F667476B1C62}">.. <Properties>.. <Property Class="Text" GUID="{31628B9C-F138-4B44-92A1-C751E08D86D0}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{028C14A1-C0F9-468F-80C4-F667476B1C62}</Property>.. <Property Class="Number" GUID="{95577C0C-09EA-45D6-A669-F1429970AB59}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{9104D39E-2C65-4BE1-97DE-5039D9CAA9DF}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Manual Qty" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False" S

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.2 Finish Carpent\Finish Parts (Manual\is-G56GH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	947
Entropy (8bit):	5.433882121886056
Encrypted:	false
SSDEEP:	24:2d2G6dkX2ylf2WAdOcZGFB1Ocau882gAWaN/9/CApWy5Jv:ctCkVWd8SJp5h
MD5:	F5E02543D3F4495CB3C196F1FC2211B2
SHA1:	10E4A4308E9BAEF10A75C4EEEECB7B5F6F1FED26
SHA-256:	CC7C5AA475931527B6CA3990B3824FD1B766392B3E8E85BEAC539E0CE4E90BF6
SHA-512:	C73D97230219E52068EA9A4DD57A9D81A62372E514B5E602D45F4B9CED745285463774A3B2D62C8AFC4FE43BA6A68E2AD660173214FB0DD5414BF74C9AB8AAA7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Finish Parts (Manual Qty)" GUID="{F20FB4B5-DCAE-411C-975D-27305EA82B1B}">.. <Properties>.. <Property Class="Text" GUID="{83ECF901-1A2F-4ABA-A112-FABB1FAFF72C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{F20FB4B5-DCAE-411C-975D-27305EA82B1B}</Property>.. <Property Class="Number" GUID="{0ED3F1C7-A867-47DE-BAC0-0110907DEE7F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Type" GUID="{D5881627-32B3-494F-A978-72266FBADC57}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{407CE314-A4C9-4AA2-86C0-B73014E7025A}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Finish Parts (Manual Qty)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.2 Finish Carpent\Trim (Linear%2FSegment\Countertops (priced\is-73HNK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16023
Entropy (8bit):	5.587066115486912
Encrypted:	false
SSDEEP:	384:nBDWmia+OAr82Poiza4cRycXc5BTsq476xFob2DqLjUVDhXBG47L:nBDWM+OAY2Poiza4cRyoMHbxFoCDqUzx
MD5:	2D82FAD52D0935D2A85542C1DE943DD6
SHA1:	1CB88934E579601BF690769C82D7F5652E8AC563
SHA-256:	F45C1F1F015358EB8DFEB449CC8C03252136F56126C74C8ECBF5024BA44B9D39
SHA-512:	6F75FE191A8B2BDFA32ECF6E7B8978824171EE23475F4B40FC84269D040A63764F8638D246DB267280359EF6383EDC87455184E38C90B0B3745ACAE5E32B0F22
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Countertops (priced Linear FT)" GUID="{A162421D-C896-488E-84B4-FB33F9488882}">.. <Properties>.. <Property Class="Text" GUID="{4060B7BC-0D51-4CA9-A956-ACEBD2B5FD0F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{A162421D-C896-488E-84B4-FB33F9488882}</Property>.. <Property Class="Number" GUID="{B9BA0E0F-D0F8-4A50-BEEF-75DEAAB0F42C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{20A03E28-8F8C-4BFB-8C40-77FDE46C6B51}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Depth" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False" SameL

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.2 Finish Carpent\Trim (Linear%2FSegment\Trim (priced EA)\is-BH979.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	16188
Entropy (8bit):	5.588944291930757
Encrypted:	false
SSDEEP:	384:OXYNBRUoRX0OT1NgVKOS7gXcmBSqSrRZb3Oa2KCVjUQDhOj49lL:OX4BRbJ9T1NgVKOS7ErdS/b3OtKC24O0
MD5:	BCA0E62C88AF0399C8B585E425014185
SHA1:	4AC3904CA29CF3AA4879A912B34EDC04593D8166
SHA-256:	BEF2812D9037B630C9145F9BE2B4B2475D1A26897AE727C3D039385908A86BE2
SHA-512:	87E8EEB99A4D2E6041BF3C2FAED78E1F36B6A6AE4F786F10B694375F52007A7260A80A52DED5FFED4A0128C9B044D3104AC7D44197CA5CC4CE6EA6C575E20949
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Trim (priced EA)" GUID="{6E35105D-7E8F-49FA-80E2-403325D8C141}">.. <Properties>.. <Property Class="Text" GUID="{2D0BBB49-FF66-4609-9081-37D284FDFE6E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{6E35105D-7E8F-49FA-80E2-403325D8C141}</Property>.. <Property Class="Number" GUID="{D8B16F8E-A532-4962-BCE9-26F61CAF1E4D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{7E9C6E8D-9DA6-4884-B59E-69012BC26C8E}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False" SameLine="True&

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.2 Finish Carpent\Trim (Linear%2FSegment\Trim (priced Linear\is-ODD2R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	16202
Entropy (8bit):	5.5883628780111305
Encrypted:	false
SSDEEP:	384:Ghe4qTl+gbM3o7CvG3SpXcQBJqx0kXlrGo2mX5jUqDhpyBaI+L:Ghe4qTkgbM3o7CvkSZBwdXlrGzmXSKp5
MD5:	598086AEDCE370783464E9E50BCFC7E1
SHA1:	B32B402FE9BE9464CCEEDDADA15FA843EE8FA5C6
SHA-256:	88B96ED7AEAED523F09021F1AF592D66C18AEE6DFAE53E2BE0A7961C81A5CF62
SHA-512:	0ADDCA16F0E1FAE39B26126BC5E1EA2087B299F69CC5EFFC0A07F3312AABFCE6E1E6A48357025121626491FC8DF0B4290231A6A269A6AC6E32B5DDF201F96539
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Trim (priced Linear FT)" GUID="{CDB8F342-23E6-45DF-BC3D-24B153F42AB2}">.. <Properties>.. <Property Class="Text" GUID="{2317CF64-F120-4692-AA1E-79ED96D93062}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{CDB8F342-23E6-45DF-BC3D-24B153F42AB2}</Property>.. <Property Class="Number" GUID="{1AC520E6-75C4-45B4-9D59-CA3F7BCE63AB}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{AA4B97DC-102F-4202-8244-05F009F719EC}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False" SameLine=&quo

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.2 Finish Carpent\Trim (Linear%2FSegment\is-CEC0H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	957
Entropy (8bit):	5.45357096630539
Encrypted:	false
SSDEEP:	24:2d2VRtohZX2AUhIBf2WAdOcxtohj2Dc81OcIMdgAWaBCK/CApWmyv:ci4946i8NG/8
MD5:	50FB4D3CDB039344E01D9CAC8707EA46
SHA1:	E61ED5ADD0924083AB0AABE002C26C89FDF75A82
SHA-256:	71B48D28E2DE395006787DA415BC37EFC530E0AB447B277AED44761C521D82BC
SHA-512:	DE6AF5EE121FC192331D3807AB29A4BA8BBFDA12E0299A3ED73355BC667F55E366CCF6337B373CC84910D289FBE4E5146CBAB9BD45F4757E4E560F8EFA60128A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Trim (Linear/Segment Takeoffs)" GUID="{10033790-7A7C-4FE7-A584-D8D843B695B9}">.. <Properties>.. <Property Class="Text" GUID="{6351DA34-11BF-44B0-B5AC-9D64159B727A}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{10033790-7A7C-4FE7-A584-D8D843B695B9}</Property>.. <Property Class="Number" GUID="{B3261799-D457-481D-B213-070AC95215D7}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Type" GUID="{38E6395F-B2CA-4253-B476-3F537947C626}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{F41291E7-81D7-4F79-B88B-A22889EFDC6E}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Trim (Linear/Segment Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\06.2 Finish Carpent\is-MHDUE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	971
Entropy (8bit):	5.422768992037101
Encrypted:	false
SSDEEP:	24:2d21RewX2ytf2WAdOcyndQxw91Oc+qnpO6hgAWa6Jbpuh/CApWX5v:ccRewBjOxwSoiJbpu9Qx
MD5:	1C1986FE71605C6B27E0FA4C9B850DDB
SHA1:	807D125AA6C3B1C9786C76C6217B66440FA05610
SHA-256:	0EFC243B937E17A9D407664EF253433D1928D87FAFABF3C9EA8B7806EB5F005B
SHA-512:	672740ABE47244319B4435BBAF7D411863AFFBD0FCF9BB4F4C6906BD4A5F96F0D03393C06F99800B5DA290ADF24149EB20573744FD6CA9377A72ADC43AF4D63E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="06.2 Finish Carpentry (Div 06.20.00)" GUID="{2DC6C9FF-29C6-4E6A-A56A-32C9F949B4A2}">.. <Properties>.. <Property Class="Text" GUID="{8864FBE1-EFD9-49A2-BFD6-F0AFA5324A06}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{2DC6C9FF-29C6-4E6A-A56A-32C9F949B4A2}</Property>.. <Property Class="Number" GUID="{ABB001E2-70E0-4FAF-BAE7-9908980C78D0}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">7</Property>.. <Property Class="Type" GUID="{107B7F12-EA7A-43D0-9DA4-222D28EDC71A}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{09AF5C5F-55F9-4285-8999-93AAF114E913}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">06.2 Finish Carpentry (Div 06.20.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.2 Thermal Insula\Insulation (Area Tak\R-19 Insulation (pri1\is-1B9VN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	17096
Entropy (8bit):	5.593802735286248
Encrypted:	false
SSDEEP:	384:UkUHCLquSoyHhWsD8tRdiSXcqBbqCxIEQzP2uyljUjCDhK/NVBL:UkUHCLquSoWhWsD8tRdi2r+NEQz+uyGP
MD5:	C9C380E14C83113E6D09A31661BE73FC
SHA1:	1FA64B7863771AEE876F47A49FED24A5CDDA17C8
SHA-256:	D4AACA110957C07D41DB18A80EDA6801E516F32A4B2231B2BB7AB1CA7D9711FD
SHA-512:	3BAC539D0982585F0B0190566F1634482F54737260B44C532BF9DC2E707D1DE02567627F2166F0E106BB62846BF4E5CBF6C08656370B14EBAEE89CE0A4781DA5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="R-19 Insulation (priced per Roll)" GUID="{654BE2D9-9D78-417A-BF23-E476C576B95B}">.. <Properties>.. <Property Class="Text" GUID="{2E005613-03F6-4E30-8FD7-8FB557411765}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{654BE2D9-9D78-417A-BF23-E476C576B95B}</Property>.. <Property Class="Number" GUID="{5B2CF5A7-62FA-404D-971A-D537A08B7A06}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{01693CA5-934D-41BA-A4A6-D5819B4CFD2F}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Manual Subtract" Order="1" ShowUnits=

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.2 Thermal Insula\Insulation (Area Tak\R-19 Insulation (pri\is-3V9JL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (397), with CRLF line terminators
Category:	dropped
Size (bytes):	17098
Entropy (8bit):	5.5935421229832905
Encrypted:	false
SSDEEP:	384:gpvEk2HMXTUQIiQCzfdemsXcpBSqTnuaI7f28uDjUhDhI1/5tMFL:gpvEk2HMXTUQIiQCzfd74cdiaI7u8u8L
MD5:	86120DEA350138DE758F9AC87FF203FA
SHA1:	42279FE7E4E1AACEC497384BD26BD71D89635280
SHA-256:	A6A90389074AFAF97E198AD51C188716A3602749DE72B0ED1E0ED8D9C4A29F30
SHA-512:	EC73EB24E4E1C522391B216FBF0DD1A3C34DF96DEC2E5CCFC40682BA2FD973F039D05A062F4F3D5F724AADE54A6A8717EE0698E168D77F4965EBFDC1CE10F06A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="R-19 Insulation (priced per SQ FT)" GUID="{0EBB4334-926C-4CCF-A33E-72BF9291ECCB}">.. <Properties>.. <Property Class="Text" GUID="{A1800EA8-EB1E-4059-8141-6E19932796B2}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{0EBB4334-926C-4CCF-A33E-72BF9291ECCB}</Property>.. <Property Class="Number" GUID="{5BFD5CA5-E827-4C6D-9A59-D8CA4274513F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{5E141CCF-85F8-4F92-87A6-50EA49936E61}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Manual Subtract" Order="1" ShowUnits

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.2 Thermal Insula\Insulation (Area Tak\R-35 Insulation (pri\is-QG7Q7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (397), with CRLF line terminators
Category:	dropped
Size (bytes):	17098
Entropy (8bit):	5.593860759334446
Encrypted:	false
SSDEEP:	384:F1P/C5wNA0mIAGz8uHIK64ZXcoBeqXusISqzsI2EfSjUlDhkMgYIJ9L:F1P/C5wNA0mIAGz8uHf64Jl5bISq4TEe
MD5:	DE3B651DBC18A9CA02AEB499550F7D03
SHA1:	FAB4D59B45CFE6D3E2E7F1546165E16DD62976C3
SHA-256:	8F79CE1A06AF7A95971126C91F0B686DF7A7BCAB3E7E724C1A79869049912F0B
SHA-512:	210DB0CB4BF60C654AC636B054BB4D7C20A9C0B754125CE4CF0CD193E3B834B3228E5377A422E653A12C1F11F73009D8DD0BDBBBD565851A4039990C36A96413
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="R-35 Insulation (priced per SQ FT)" GUID="{D9E269FF-2F1C-4AA1-8E60-D8EF323B37CD}">.. <Properties>.. <Property Class="Text" GUID="{BC00276C-AA1E-4972-B0AF-5B1778F6291B}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{D9E269FF-2F1C-4AA1-8E60-D8EF323B37CD}</Property>.. <Property Class="Number" GUID="{28F45BBF-EBFC-4713-B5F6-9DA4F8C5D459}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{688C6580-E0D6-4E27-804F-2515682AB242}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Manual Subtract" Order="1" ShowUnits

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.2 Thermal Insula\Insulation (Area Tak\is-VMPM9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	949
Entropy (8bit):	5.42944772366096
Encrypted:	false
SSDEEP:	24:2d2lBudjjX28lLkf2WAdOcG5djXJ1OcLWJmKhgAWaI9/CApWRv:cPp3gb5JudJDWRI
MD5:	86F40AED74AAA5AFDF510CFA6E4BC3D6
SHA1:	582F2EC9A1EEB28D3478779437E344DCC61B51A3
SHA-256:	1FE2A7AE9234CCBAE3E2D223E548E41569C25860D7ECE26B6A14AD50CC2E0E37
SHA-512:	08C52A648DBEFF856323E4A324AAAA1EABFAA9EA6C622AA31BDC375D63ED2525B114F8C6064F8BEE14BE7A607303EEA4ABA4AA47CE3940A6F6F524D2D26E16F1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Insulation (Area Takeoffs)" GUID="{85EC028A-0BDB-4971-A289-1ECCD4DA596A}">.. <Properties>.. <Property Class="Text" GUID="{30F7CCEE-196B-4329-9E0E-C7383C0CAFFB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{85EC028A-0BDB-4971-A289-1ECCD4DA596A}</Property>.. <Property Class="Number" GUID="{65E7D8EE-06E0-40A6-A08D-56E865C27C85}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Type" GUID="{446E65DF-58AA-4A57-8601-A4293219E289}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{61026CFC-8DA4-4FC2-94A3-FA0759AABAD0}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Insulation (Area Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.2 Thermal Insula\Insulation (Linear%2FS\R-19 Insulation (pri1\is-T1NNH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	17215
Entropy (8bit):	5.594844013935652
Encrypted:	false
SSDEEP:	384:4gB8mIuN2a8y9FQCyiBbqGc/fQFXcABRqdyOVSeL29zEjUsDhvIbJa+nL:9B8u2a8y9FJyiBbPc/fQ99odVSeS9z5Z
MD5:	802E53C249E386B026B8CE784D35C466
SHA1:	BD37D0DE14459FC0BB28F426C2AD45DC2E6DCF6D
SHA-256:	5068A60EEFA902F5E87F0CE9FDD11CD9E6801F554679F7EBFA09DEF7F7692402
SHA-512:	F5D471EEF10D57513FDF3E5FD517DD32433B83E76CF02976273291359976B983AB0C7FC6A78A07B889189A8D42AECFA764039F4D8AAA4E64843C9B336EF7307D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="R-19 Insulation (priced per Roll)" GUID="{85F2D8D1-949E-475B-96B4-60A8CB8FA4EF}">.. <Properties>.. <Property Class="Text" GUID="{33B862D0-1C98-4C78-B8D1-998A4CA9EC67}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{85F2D8D1-949E-475B-96B4-60A8CB8FA4EF}</Property>.. <Property Class="Number" GUID="{41808518-1B85-4631-BB3C-FFDB9488B278}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{8FB8E525-6B86-4365-9F6E-D750161FD060}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides" Order="1" ShowUnits="

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.2 Thermal Insula\Insulation (Linear%2FS\R-19 Insulation (pri\is-HG7LD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (397), with CRLF line terminators
Category:	dropped
Size (bytes):	17217
Entropy (8bit):	5.595320613793364
Encrypted:	false
SSDEEP:	384:73TiO98HBHjUDdECZEcLdXc2BrIqFhDWRsE2CuAjUUDhRE3x123AL:rTiO98HBHjUDdECZEcLF3L/WRs3CuN0s
MD5:	BDC63A426E4067E644AFC34B641D4B1F
SHA1:	069BEA64B8426205EC663005450D6EB773C0BC49
SHA-256:	3034E4929B44E4A67D1853B6C5658E67AB722EF581BECB13AD268229B98DE81A
SHA-512:	F5042B130ABAAC546FC7677513E4385D43F30A38E87F6782B08DC5E70734BDE3319C1CB958D3D6F095E0A561C1E0FF49415932AFC467ECCB8EB035C6C1D983CC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="R-19 Insulation (priced per SQ FT)" GUID="{4E252EBF-5F1E-4E36-A878-05E6A6C3BAC3}">.. <Properties>.. <Property Class="Text" GUID="{98E4CD5D-1C1F-40C8-A05B-88F73BEF8488}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{4E252EBF-5F1E-4E36-A878-05E6A6C3BAC3}</Property>.. <Property Class="Number" GUID="{7D8AAA39-9012-4538-B346-011841C11647}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{CCB61126-29F5-4E21-B8D8-FD65952E042A}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides" Order="1" ShowUnits=&quot

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.2 Thermal Insula\Insulation (Linear%2FS\R-30 Insulation (pri\is-JO1SB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	17215
Entropy (8bit):	5.594943782466281
Encrypted:	false
SSDEEP:	384:lA27evYISt1lO2Dx7ww5qMF5Xc/BTqT6oqGVeT2MxTjUheDh34Pq63VL:+27evYISt1k6x7ww5qMFpmGRqGM6MxMV
MD5:	5CF8A6BFE4894CC6BEF77461DA830C4C
SHA1:	BB3721C270A5867EA50B421BDDDC909A1E6DA2BD
SHA-256:	4F5AF3BE24DE580E03E3D6FA6C71F3D29E724E799F62BEA509C1D431BEEC4CED
SHA-512:	F9A41AB42F28AC05650B340A21FA82598DDA1B61CEF4D48525EC43DDDDE94F8D27BC85651EB399F487135B549D69E156CED4496B51E03A9825B0CE643417A947
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="R-30 Insulation (priced per Roll)" GUID="{52CEBA8D-DD7F-4C1D-8720-1D75E24B6794}">.. <Properties>.. <Property Class="Text" GUID="{927E42B7-2C51-438E-A338-75B6E63BD462}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{52CEBA8D-DD7F-4C1D-8720-1D75E24B6794}</Property>.. <Property Class="Number" GUID="{78894661-CDFE-496F-AABD-661022D42FD2}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{343BA884-3B02-4FBB-BEAB-A7EC18E640DC}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides" Order="1" ShowUnits="

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.2 Thermal Insula\Insulation (Linear%2FS\is-LRGM1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	969
Entropy (8bit):	5.45517302192655
Encrypted:	false
SSDEEP:	24:2d2/8nKLX2gJf2WAdOcGKyUhB1Oc8ZvegAWaN/CApWDv:cJnKLZLNKyZoy
MD5:	8DF5E50132B591BD920FCF24AD4B8526
SHA1:	79F407A4194105B5895B5CBD933993E2558856D2
SHA-256:	8BADB144472909BFF8D3E88A04DCB9B84C93C3E44D46835450258A881C8913B9
SHA-512:	C192103C7E47CEA99E30E63D625B99D99322BBA797203AA977CB51011C2B9F7F1914B8C7AC1745290DC045C8AD274992DE1EAF9FB139C08B9660D2F6FB0A2AAA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Insulation (Linear/Segment Takeoffs)" GUID="{14C9B8DF-EA43-4949-80FF-62B235FCFAD4}">.. <Properties>.. <Property Class="Text" GUID="{53343927-1716-4856-BC6E-1F79A0C758B2}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{14C9B8DF-EA43-4949-80FF-62B235FCFAD4}</Property>.. <Property Class="Number" GUID="{43243E4E-FE78-4BD0-8F11-DD75D60DAEAB}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Type" GUID="{F8BAF6CC-2CCC-4681-AB51-4E4E97301BBB}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{7990A237-EDBB-46AD-AE61-7638EACC3426}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Insulation (Linear/Segment Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.2 Thermal Insula\Insulation Parts (Co\Attic Access cover (\is-UNUGA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	17132
Entropy (8bit):	5.591556543217124
Encrypted:	false
SSDEEP:	384:f3+zLhxwoHkSfPi6Srqw0BOHXcJBS5qsR6+6B92R2MqjUNDhIMUCBbsCL:f3+zLhxJESfPi6Srqw0BqQbZ+6BcR2al
MD5:	D36531984114D7DD6CE8BC05B56FB719
SHA1:	58C857ECFC605588559A65B8122E7F80D147BD32
SHA-256:	2128CD2F6763F49D3D7D32014EC05131E7DAF744B89D25BDF5D5A45222CED042
SHA-512:	78FB6C29E960644638A0C3BFD974784BAC8D7BEDAC0D43A544737C9981E9AFAA91A9B37FDA4F4269A14AA94315E076E2993258D90D0C290BAAF58834FCD2AC3B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Attic Access cover (priced EA)" GUID="{F61ABEB1-3B1C-4FAF-B71A-42ED29A0D3D6}">.. <Properties>.. <Property Class="Text" GUID="{0544D0EB-CCFF-4E7B-8F12-7B90DF002A8E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{F61ABEB1-3B1C-4FAF-B71A-42ED29A0D3D6}</Property>.. <Property Class="Number" GUID="{4FE99BE0-0C3B-4168-81FB-ADEAE3CB48FE}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{C67DFF16-AEBE-4257-A289-5575B102A312}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides" Order="1" ShowUnits="Fal

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.2 Thermal Insula\Insulation Parts (Co\is-E3TNK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	963
Entropy (8bit):	5.437044066553103
Encrypted:	false
SSDEEP:	24:2d2rJX2vu/ff2WAdOcWv11OcIMzlvgAWa2jeA/CApWHv:c8RlbqNpHE
MD5:	9A996A84CBBFA0EEB891FEB73ABC39AF
SHA1:	C3EC476F90998044DDAC80E80F5C05A425FB295F
SHA-256:	C9658B296185704CAA132CC8BEE13FBD47AB530772C6C4D40271BD5CC5877C6D
SHA-512:	7BF673DA36D08C49944CBB84818F97C33C66F63DA378F025746C3FC9B53D74211F67A0DA451C45373A8AA285FB51711B15A2A61DC029091690F13C65FA04D329
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Insulation Parts (Count Takeoffs)" GUID="{C8E87738-728C-4957-AEF7-1139523B081B}">.. <Properties>.. <Property Class="Text" GUID="{FD9B11C2-6CC8-4476-86F5-6EC610679F8D}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{C8E87738-728C-4957-AEF7-1139523B081B}</Property>.. <Property Class="Number" GUID="{232EA3D1-9294-46B2-A9E4-6841BEB672BA}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Type" GUID="{A1DDBE1D-4819-4750-9B92-00B0D61CD487}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{C1C6EE2C-3AE7-4A06-9987-9E2CA950FF69}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Insulation Parts (Count Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.2 Thermal Insula\Insulation Parts (Ma\16%22 Wire Batt Suppor\is-K1KIV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	15129
Entropy (8bit):	5.587262114979856
Encrypted:	false
SSDEEP:	384:4reMAjhFxrnGJtP4x7XcZBmzwiYSvVz2bI5jUUDhtteKvL:4reMAjhFxrnGJtP4xjcfiYSNabIS0ttJ
MD5:	DABE0207FFAA5BB644821AB3F0CEEEB0
SHA1:	EBD57D7AB364D57313853DD469637D2D62F856C3
SHA-256:	CED13814793CFF1622BCE8329C32274F7FD10E0FFD135BAEB048A91A49C0FDCE
SHA-512:	A417088C2F26073A894CD357C5D24B3FA386332DECF471597AB02A4401C1F4C8B510B8121C4C6BFAABE1192C7E35FF69A5E335C5A8BFD1D4BBE35739B61D64EB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="16" Wire Batt Supports" GUID="{747D4F43-16EC-44AC-8570-8F3BD83D97C7}">.. <Properties>.. <Property Class="Text" GUID="{D721B6E5-B855-429E-A1BE-DBF6892329F8}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{747D4F43-16EC-44AC-8570-8F3BD83D97C7}</Property>.. <Property Class="Number" GUID="{33C536A9-EDDC-413E-BEC3-41F81FE11C89}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{F51203A5-AB78-43D2-85DA-2DFDE99E3920}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Manual Qty" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False" S

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.2 Thermal Insula\Insulation Parts (Ma\5%2F16%22 Tacker Staples\is-V26FP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	15145
Entropy (8bit):	5.58770236965922
Encrypted:	false
SSDEEP:	384:0+fNTN3NRzUMSszuvZeXcWB2BFQ13YD2sfsjUyDh7qxIvL:0+fNTNdRzUMSszuvZaH883YKsfxC7qx6
MD5:	8705CA71980F38B8ECEF942E37E8F922
SHA1:	A5FA5920BBB0782B2D8AB5A18FD2A1C77CB7FAB0
SHA-256:	0D620AB32EA6DAD0E5CF3A5EC3543ACD9677E058FAD28CDB17D743F2F3995C3B
SHA-512:	81E0420B2468A361B2DCB0FABE267F541C1D0F9D3E996A14A9CAC5D06C9D39329A3C3B0B765A731EE46AA5036E2619D008A0320E90EEDFEC82ED90CD4E8ABDAA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="5/16" Tacker Staples" GUID="{D4818731-E234-4105-990C-A82BD8B37052}">.. <Properties>.. <Property Class="Text" GUID="{7CBE36DA-C56C-488E-9DE1-C132AE3302E2}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{D4818731-E234-4105-990C-A82BD8B37052}</Property>.. <Property Class="Number" GUID="{9790C046-6F3B-46F6-B5B4-F4DE5102B6CC}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{9D16EB26-65F3-4D0A-BBBF-E3C85F3B2F2C}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Manual Qty" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False" Sam

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.2 Thermal Insula\Insulation Parts (Ma\is-RFLT2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	955
Entropy (8bit):	5.432556115043636
Encrypted:	false
SSDEEP:	24:2d2wdOX278/2Bf2WAdOcQm1OcCKgAWaVht/CApWDJv:cJOJuTvRqh2h
MD5:	075C45E80BC346CF4C7412885204048D
SHA1:	B805DBBA186753240EB1F839DF00BD17A9ACDC18
SHA-256:	E8421F93932A0557C60005719A5478738C07E40DC5BFEAB6C3DFC06D49078B25
SHA-512:	B6D4963549995FCACD344F95BFFAD4B7AAD3855A8FF55F7B19F833E37F4741A5DD7EC24641289BE2E9F9C057B12CD66228CB8C49481DBE2B54D1ED31A04181CB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Insulation Parts (Manual Qty)" GUID="{61979639-2E21-4562-B8CE-27D8D180877A}">.. <Properties>.. <Property Class="Text" GUID="{1DDCEC31-F299-4FA7-A21B-B06D19B6FFDD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{61979639-2E21-4562-B8CE-27D8D180877A}</Property>.. <Property Class="Number" GUID="{3B241927-4694-49D7-ADA3-07A9536A66CD}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Type" GUID="{350BC959-5249-41A1-8B00-1CCEEB775786}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{A8A27F26-1FD8-40E8-AF9C-2D3B3598BD1E}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Insulation Parts (Manual Qty)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.2 Thermal Insula\is-Q4GES.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	975
Entropy (8bit):	5.445225766027589
Encrypted:	false
SSDEEP:	24:2d2gMnqcX2wff2WAdOcpTj1Ocj7VbgAWafouc/CApWK8nIv:cgnZzPIIu8UnS
MD5:	EF4A9A20A3D0B8DF4EEC8312177A9F5F
SHA1:	9E92C3D9A56CFBB2BB2AD65AB676A208910A59CC
SHA-256:	883A459399932644EE5DED3B4125F6644F29E69255168874F35B0BBF18EB2F8D
SHA-512:	FA95FAA960041F5AB1813EB07A2A522032E5F8D1EBEC39D8476ABB36694D6F720D0605DD6E0710120770DA0AF7E34ED441080CCFC5C1DA74280735711AA5CD8C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="07.2 Thermal Insulation (Div 07.21.00)" GUID="{D0B521C3-21D0-4C30-869F-03B57934CC55}">.. <Properties>.. <Property Class="Text" GUID="{C2CE81DA-9A7D-4ABA-AEAB-0D45B8B51483}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{D0B521C3-21D0-4C30-869F-03B57934CC55}</Property>.. <Property Class="Number" GUID="{EAA15B81-E9A9-46FC-8C70-2BC73ADB6A5E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">8</Property>.. <Property Class="Type" GUID="{9F08C67E-2930-4EE9-AE65-002624EF546A}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{49D67709-D67D-4FBA-999D-C5DF13646D57}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">07.2 Thermal Insulation (Div 07.21.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.3 Roofing (Div 0\Roof Parts (Count Ta\Roof Vent (priced EA\is-899VS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	16011
Entropy (8bit):	5.592158892912813
Encrypted:	false
SSDEEP:	384:hypsGsU1XPrxsiP/18ciXcWBxqf6Z6n2u2f5OjUMSDhLvjhyL:UpHsU1XPrxsiP/18cGHI06n2Jf5LHLv2
MD5:	0D08C2359E16F0498A6E5D39E1292BE9
SHA1:	99DF2841D18A910E4A9EAE3072036A0D5F4645C3
SHA-256:	CBF10EEB4D52D20B10F64C8774F1186D24E52DCFA308F7307C664432D4890D59
SHA-512:	1844FDD36405E644A74EA935D8C1582143B2B0C0A3909D232450B7BADAC61A9C60C3B008BBA5D17CCDC86FCC29CD5DE5C184D42F3DDA976327DA10999D3407E3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Roof Vent (priced EA)" GUID="{75BE389F-C978-4583-A1CD-FB9F8DBF088E}">.. <Properties>.. <Property Class="Text" GUID="{79E6F7E0-848F-4A27-8F26-F7D76158C018}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{75BE389F-C978-4583-A1CD-FB9F8DBF088E}</Property>.. <Property Class="Number" GUID="{7262C799-4C7A-439A-81F7-52102125FE9E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{61077268-2DB1-464E-AF2B-E9F33E6312FD}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Pitch" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Width" Order="1" ShowUnits="False" SameLine="T

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.3 Roofing (Div 0\Roof Parts (Count Ta\is-8R1N1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	951
Entropy (8bit):	5.435564888406767
Encrypted:	false
SSDEEP:	24:2d2aoj9HrX2yAf2WAdOcdDU1OcCPekhgAWa/t/CApWfv:cZELy4D7hk
MD5:	DF2EF46E96EF767C064FEDEC57D81CF0
SHA1:	B19C254EF1791BF9AE8CB41570C327E60F76FD24
SHA-256:	2A5D1CE1230FE0B81AF80655A9044B13E2B27366DE74847038288461AFD74A2E
SHA-512:	9A2E8F6A2E0B2F042FF314AF8A319A263F37F758B12F6912F15B7028EF3FE207BEC3E28BC5C292B0D235F1081725575BB18CA54A2029592CC5782CCC155AB586
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Roof Parts (Count Takeoffs)" GUID="{574B1A56-D15C-40C0-8A16-D48D0AA16ACF}">.. <Properties>.. <Property Class="Text" GUID="{80CCDFA0-3DF4-4821-8090-A6E2AF333637}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{574B1A56-D15C-40C0-8A16-D48D0AA16ACF}</Property>.. <Property Class="Number" GUID="{D68E4905-9902-4BF5-8579-0FADB3DE22F8}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Type" GUID="{8BF462CF-A946-42F6-8690-A0D606219FCA}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{9F003FE7-E408-43DF-97EC-7904C441D5FA}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Roof Parts (Count Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.3 Roofing (Div 0\Roof Parts (Linear%2FS\Drip Edge (priced pe1\is-12C07.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (396), with CRLF line terminators
Category:	dropped
Size (bytes):	16579
Entropy (8bit):	5.58815510528693
Encrypted:	false
SSDEEP:	384:OWx53aQ9cWFMvbqr/TTwZsPXchBNq64MpYCpH21LojUhDhkiUANL:j5qQ9cWFMvbqr/TTwZsPU0QpYCpW1LFx
MD5:	F95AD1D50B540B4BC5EC33FE5C9CE5C0
SHA1:	515E192999AE52A3D05BD524155B39D50935FB9B
SHA-256:	DF21E6E7FE0B4737D79BC2F52C5B43B41A079B80380CAD784BEA63A7549AD14A
SHA-512:	E1C11EE95B582BF3208B246DB21257B3C22AAEAD0750C9AED49868AB6E4B48D71DB92D6B5ABA0844DF27D22C74D746341FD7D4129A64737A965E2C6D916B40EF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Drip Edge (priced per FT)" GUID="{E406779D-D014-4D0A-82F2-ECB0843647B2}">.. <Properties>.. <Property Class="Text" GUID="{5C0E8A6D-E9BA-474B-9EB0-A25645D694B9}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{E406779D-D014-4D0A-82F2-ECB0843647B2}</Property>.. <Property Class="Number" GUID="{8B625D26-CB53-4629-A9C4-DA8C8C4DD6B8}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{F67529A8-0619-4F1C-ABAF-FF6E5E444954}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Pitch" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False" SameLine=&q

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.3 Roofing (Div 0\Roof Parts (Linear%2FS\Drip Edge (priced pe\is-67UKI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	16581
Entropy (8bit):	5.58916055076889
Encrypted:	false
SSDEEP:	384:vXpUPp7A/QsOGaGTyug/BAbXc9Boq23Dl9e52eoFjUeDh+hblOCoTL:xUPp7A/JOGaGTyuOBADkvAl9eQeom2WU
MD5:	5072373B79276A283F74F0487D38DF85
SHA1:	B704CFCBD87741A6D219C58B920B1897452186BF
SHA-256:	FEEF171EA9FDDA291052DB57F0C38E2C77AF1EB1928641E63F12F30B202D0C6A
SHA-512:	A53E14FFF4010FE4BEE281FE8EC3A6205C6B17E42756EE158CC09F2583EDBD21C27A53B58CC78BF1CEF77442858394AF26552BD5BA68436F402F2DDF7E7D69DC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Drip Edge (priced per Box)" GUID="{073F3ED4-C3B2-4E6B-B4F4-5FA97C9DE4F6}">.. <Properties>.. <Property Class="Text" GUID="{142E8E3F-8A05-40F9-8B0F-421D4F8F174B}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{073F3ED4-C3B2-4E6B-B4F4-5FA97C9DE4F6}</Property>.. <Property Class="Number" GUID="{F97D8E2A-0518-4AFC-860E-9B1290CBB5FB}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{81CB1A32-2540-4F90-8A98-B6D47392A150}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Pitch" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False" SameLine=&

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.3 Roofing (Div 0\Roof Parts (Linear%2FS\Ridge%2FHip Shingles (\is-JQE8P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	16600
Entropy (8bit):	5.591531425946459
Encrypted:	false
SSDEEP:	384:DDgtsPRxQg2qpwgYSGn5HXcrBKqd+CCkqYi2aQbzjUnDhoa7PY6tL:DDgtspxQg2qpwgpGn53OFtCkqYVaQbsj
MD5:	21F063A0DC134E5DD713931589BE54EA
SHA1:	4FEC3C2B2336E4A7C889C6E6F9DE21CCFFFF456B
SHA-256:	0540C100C76487C180C9DE7C1F4164052E2AC068169BF8FBEFC07FBE05F2F942
SHA-512:	A6584D1BE299857A740AB93E764E46BCF056A5ABED8A0AB86E2CAC80A9362B99658F5F98538520FDE58F145A05217730068A67FB4FD5D6D06BDDEF610352A020
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Ridge/Hip Shingles (priced per Box)" GUID="{EDB81A6F-C38F-4DC4-8BA8-8D089C86482E}">.. <Properties>.. <Property Class="Text" GUID="{2B0A3B78-BA81-42D6-A668-B3B5ECFD3F95}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{EDB81A6F-C38F-4DC4-8BA8-8D089C86482E}</Property>.. <Property Class="Number" GUID="{FB5BF34A-2FF8-4B46-A92D-A682460CFDF8}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{21EB425A-B477-4684-8DC7-8AFF3E927D81}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Pitch" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Bundles per SQR" Order="1" ShowUnits="Fals

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.3 Roofing (Div 0\Roof Parts (Linear%2FS\Starter Shingles (pr\is-2CUQR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	16609
Entropy (8bit):	5.587307780153848
Encrypted:	false
SSDEEP:	384:pEJGDoiQEUR+stOlCrncXpYW7YXcSBR5qpxnuuJI26+ojUpDhcNc4mL:pEJGDohEUIstOlCrncXpYW7sfRA/uuJp
MD5:	AA0B0F326A67C419AAFD352D8DF68F10
SHA1:	D7189A8D3173B79F7524D0C44425308F17450A49
SHA-256:	5BD988C7BB41EE721D725835F8A551880AA5413D175D8197904F0D516775DFF7
SHA-512:	21765150D8911B219CC0B8149C9926A246D29716F700740C449B2B6F06B37BA75AF530918F0DD1A52B4F27CFEBE16C3E4744E87357D29D965A7DB92D020BED00
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Starter Shingles (priced per Bundle)" GUID="{E9D062D3-3EE1-4C85-B384-9CE1E3D90AAC}">.. <Properties>.. <Property Class="Text" GUID="{3B09E096-FE2C-4863-964A-590FECA88285}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{E9D062D3-3EE1-4C85-B384-9CE1E3D90AAC}</Property>.. <Property Class="Number" GUID="{663233F8-70B6-4F67-9324-A55FA3847876}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{44ED0C18-AEC2-426F-BA3C-099CB3F43C9D}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Pitch" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Bundles per SQR" Order="1" ShowUnits="Fal

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.3 Roofing (Div 0\Roof Parts (Linear%2FS\is-GTL79.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	969
Entropy (8bit):	5.447446006519845
Encrypted:	false
SSDEEP:	24:2d2ao52X2YEtwNBf2WAdOcbYxh1Oc8ZPL7d9gAWau/CApWtv:cZJJEuNTRGdMo
MD5:	7BCB471DC447DFFC7F72F5C7CDC7C304
SHA1:	FD75C8318E7DD69508F7D480D674BEC4CAABCB82
SHA-256:	A5428B6EC72491080D55840546E215DD517C15CEF0DED03A14184E3A9DB34B5D
SHA-512:	A92E15C9A0936779EF6C62D6B3B965A4347742EAB19CCEC17EAE76FB944EC3E7D488D90D0D74B8E223AD40BDBA1A62068D4E47F656833C4057274BEBFBC82D74
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Roof Parts (Linear/Segment Takeoffs)" GUID="{CD4421DE-84D6-49E6-9926-A7353B05D439}">.. <Properties>.. <Property Class="Text" GUID="{F9944B0D-0A09-46F6-BBFC-3B3895B64D28}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{CD4421DE-84D6-49E6-9926-A7353B05D439}</Property>.. <Property Class="Number" GUID="{D53BA0A0-981E-4E5D-83C6-2F97877B2E8C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Type" GUID="{8081FFCD-F8BD-4199-AD4E-F4D4A4F8B900}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{46CA6455-FE92-4D4D-8890-A912A393EE98}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Roof Parts (Linear/Segment Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.3 Roofing (Div 0\Roofing Parts (Manua\1-1%2F2%22 Galv. Roofing\is-4BF7B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	15139
Entropy (8bit):	5.59116792095557
Encrypted:	false
SSDEEP:	384:FwUou/ikHe6BfW2KFHNXcLBZA8wqkHi2sJEjUqDhs4FTRL:FFou/ikHe6BfW2KFH1a5wqk1sJ5Ks4F5
MD5:	9A090D51EE816E78D6C1904C1956B2AE
SHA1:	83996CAFDE1168BED83EB9C6FA22D64E4648CCD7
SHA-256:	862CB9C3FDEB1390EB5247913AD907DF73D8AA4294A863055EB7DF09A3E75B3E
SHA-512:	92D7E402958FAB8B62F8DDEEEFD483D3CE8D0FFCF380CAE0C6DF5D97A0C9040A8DBD17290DB0E6020B5FFD7DA1879113A4F452C2DDB1ACD94871C19C253D9332
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="1-1/2" Galv. Roofing nails, 11 Ga" GUID="{A1D385BF-7F3B-44AC-80E9-0E897F03C096}">.. <Properties>.. <Property Class="Text" GUID="{49A3DDE7-2CC1-4E82-84F0-E9C7A7C6744C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{A1D385BF-7F3B-44AC-80E9-0E897F03C096}</Property>.. <Property Class="Number" GUID="{B4549778-E271-4277-94CB-BEE6D87223C5}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{2127A8B6-DC35-4F8F-BF2E-711EE323E2E0}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Manual Qty" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="Fa

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.3 Roofing (Div 0\Roofing Parts (Manua\is-VRJPC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	949
Entropy (8bit):	5.444416399966053
Encrypted:	false
SSDEEP:	24:2d2axdsHX2ENf2WAdOcrk8ms1Ocau6agAWa61pf6/CApWJJv:cZPsHbvK+vHvpfuyh
MD5:	48A6998971925B6789CA7DCB2CE15E8B
SHA1:	A25A09A72479F7E9A6E048258E2FBD65E2C75009
SHA-256:	2628A22F1E329B6174C7EBD63DDB10D6C6416BC209C7D0D62B763EB67E3B492F
SHA-512:	5C66133DA807B5F2AFE1100E4C318075BDB3F6527D7C3F293DB9C6146CC7E4E53F7E89F005345AD9A9AEF341EB682F50EB60F307F8C417077C172551F920D89E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Roofing Parts (Manual Qty)" GUID="{9877700D-0382-4487-88C4-46970D381A31}">.. <Properties>.. <Property Class="Text" GUID="{BD8302A3-5708-44EA-9D7B-257A3DEFEB77}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{9877700D-0382-4487-88C4-46970D381A31}</Property>.. <Property Class="Number" GUID="{EF9B5129-DA6F-4AAF-A376-DCB9CC3D83A9}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Type" GUID="{D34FEE4C-6EAC-4359-81D5-4E72120FADAB}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{3BA7327D-8672-412B-95D6-72293DAD438B}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Roofing Parts (Manual Qty)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.3 Roofing (Div 0\Shingles (Area Takeo1\#15 Asphalt Felt (pr\is-AS8B7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16081
Entropy (8bit):	5.592535040307356
Encrypted:	false
SSDEEP:	384:Xorl+mjyi/zZqrTZakhwhfXckBuqHuzgKab32mfSjULDhDRAd7L:Xorl+mjyi/zZQTZaIwhf9pegKabmmfH+
MD5:	4AC1BBF8269CCD94D8653607E0319F16
SHA1:	4A3C4AD81F45FD38E6F34B2AE5E86A2AD530E706
SHA-256:	60608DC6DAA6087BE0EF1131E92F2522E3386B6ADECD651B8A4DAFA0B64A89CF
SHA-512:	72FEDC1343896C96F86B7630916F90C8D92D4DF796779C99F8A0A0EC2E92ABEA93D0A55BF3C12E0B8D81B831F7D0420E4153EC32E006069A87804D2710C57A49
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="#15 Asphalt Felt (priced per Roll)" GUID="{B579F059-7E20-4CE3-A4D6-E2A300559799}">.. <Properties>.. <Property Class="Text" GUID="{8B4B5E9C-D14B-4AC8-8967-3BAA5DB6B296}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{B579F059-7E20-4CE3-A4D6-E2A300559799}</Property>.. <Property Class="Number" GUID="{99187BC1-36CA-44FA-A1A5-D5D1A1D01CEE}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{C3B41069-B488-45CD-A898-AC066CEF1B73}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Pitch" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Material Coverage" Order="1" ShowUnits="Fal

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.3 Roofing (Div 0\Shingles (Area Takeo1\30 Year Shingles (pr1\is-ANK14.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16047
Entropy (8bit):	5.595845652623524
Encrypted:	false
SSDEEP:	384:hnR5gcK7WGgTI0+Vklq+cIHXcoBAqgRk+GH2H2If/jUQDhKyQtJL:lR5gcKiGg/++lq+cI3VXD+GH2WIfg4K5
MD5:	ED4A50EEC9CE599A989A647E85B63124
SHA1:	CBCDC0B71B591E503FFBF927398EAE658543B046
SHA-256:	D39F5717AAAB01E85EF650398D5AAB30923D3713DD12DCF50A98E0E59D3D65D6
SHA-512:	0909E98B0DC65A6A484D37BD7F97DA1B2D40557DB38787EDC6531F2B4E3B77B80D2ED2DDAE23A4E367E76B55C69FD87299BEB89DB84032C7E639DBCB44AECB15
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="30 Year Shingles (priced per SQR)" GUID="{407F0883-5E9D-49AA-BFEB-2252884A966F}">.. <Properties>.. <Property Class="Text" GUID="{8404865C-1725-4098-8610-FE870BE24CC5}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{407F0883-5E9D-49AA-BFEB-2252884A966F}</Property>.. <Property Class="Number" GUID="{1ED0EC9F-3F4D-4A7E-9C35-24AE527E3433}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{454A8081-25ED-4B8D-A5E6-8356AE85B54C}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Pitch" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Material Coverage" Order="1" ShowUnits="Fals

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.3 Roofing (Div 0\Shingles (Area Takeo1\30 Year Shingles (pr\is-N1UEG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16602
Entropy (8bit):	5.589302587733223
Encrypted:	false
SSDEEP:	384:szsdQZHLVwizwXbU0WboXc4BSqAeq4g4h92G2CrjUiDhHGiq/PL:sgdQZHLVwizwXbU0Wb8ZdAug4hcG30ye
MD5:	94B1E537955BF6BEBB12A9023E693B94
SHA1:	833B4CFD6039B19BA54298B3758FFAA5BBBB5AB5
SHA-256:	75CB025BC820F17683A3882DAF6FCA1278F16010F30A278069FF17DD4CF126CA
SHA-512:	0A1D1536C1FEC0C2306D2871D55FE60F23707B7DA279C343AEC3F3339AA066CD45A64EF59ED385A5D314A2EB12D5B078ED35C095E443B91F5A9453789674846F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="30 Year Shingles (priced per Bundle)" GUID="{38A6C0CC-E293-46B2-B8EF-30F7FF64228B}">.. <Properties>.. <Property Class="Text" GUID="{417E7F5E-DFB3-4C43-8A1B-673E92519665}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{38A6C0CC-E293-46B2-B8EF-30F7FF64228B}</Property>.. <Property Class="Number" GUID="{23AFC430-2A6B-4C42-B516-498C46AF2598}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{C9844B80-7DA6-49DE-9D23-19C8B6670E7D}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Pitch" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Bundles per SQR" Order="1" ShowUnits="Fal

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.3 Roofing (Div 0\Shingles (Area Takeo1\7%2F16%22 OSB Sheathing\is-CCB9G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16165
Entropy (8bit):	5.595184980367029
Encrypted:	false
SSDEEP:	384:04A7sjlLX0NOkNwYCNQm6cGKecDVMrS81EJOX9AAKYudO5ZTH6M:04A7sjlLX0NOk+YCNQvIXirS86JOt5KY
MD5:	579A290DFA549A2B1A9130EB002155FD
SHA1:	10494D356867DB39F77FAADC34A3FF9CFCF2FC50
SHA-256:	BEB765112F3BA9AF3E51723D48BF5A580489BC3D12CBD8AFDB7D0886FF8C84CD
SHA-512:	ED2579EBE7555455686787CDC507847982B2B46F7B7E97F3922E61F7D2E0583473A0803796D0D7A7A4910A4C1C5E0C7C0ABA530F70E69633F2C17E4B73CAD33C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="7/16" OSB Sheathing (priced EA)" GUID="{BEEC5D45-21EB-4932-9514-26887FC23AFE}">.. <Properties>.. <Property Class="Text" GUID="{C5878660-F2D0-442D-8C38-A695E80454D3}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{BEEC5D45-21EB-4932-9514-26887FC23AFE}</Property>.. <Property Class="Number" GUID="{749D0C63-64BA-4C32-A67A-3FE6B8C4033B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{05437947-9F2B-47EF-82A9-B377CD9E4306}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Pitch" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Width" Order="1" ShowUnits="False" S

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.3 Roofing (Div 0\Shingles (Area Takeo1\is-4EFD7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	973
Entropy (8bit):	5.466112433139529
Encrypted:	false
SSDEEP:	24:2d2aKUtpX2rf2WAdOc0tU61OcIMemagAWaItE6/CApWesv:c3uKVNrlu2
MD5:	6D3653764D0E6D6E5EA32C0F6414E4F1
SHA1:	71028F1B8E2C710E6F9E8DB847BC0461CB783F43
SHA-256:	45185DBD18B1546F8F16D44763BD0C7D21C313FC8F15F03FC4AC738AD0D1CDDA
SHA-512:	AB16D5CEE8270A18D7C92EE79D13656564C6EBBC3D3DCBE3A90BCE16F2928DB93A47F2BBAC7BA976BC4397729C9442A819CA3B972FF6A51EAE8277CBAE3C098D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Shingles (Area Takeoffs - Elev. Views)" GUID="{D170A409-7466-4845-924F-F2D733C0883C}">.. <Properties>.. <Property Class="Text" GUID="{B582638A-C8E4-4825-9B19-C60243AD7128}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{D170A409-7466-4845-924F-F2D733C0883C}</Property>.. <Property Class="Number" GUID="{31E65411-5E43-40A6-9606-04F112C61802}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Type" GUID="{C3DABC0E-9F8E-4BAE-A631-72384FB98CA1}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{EBEA0A59-D2A1-487E-89FE-DC34513C7202}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Shingles (Area Takeoffs - Elev. Views)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.3 Roofing (Div 0\Shingles (Area Takeo\#15 Asphalt Felt (pr\is-458R7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16067
Entropy (8bit):	5.59044020715415
Encrypted:	false
SSDEEP:	384:gIjAZmcfICy9HznWRak0TFEXcwBnqwWMXA8A2xwMNjUyDhMYu0hL:gIjAZmcfICy9HznWRaFTFgJqQXA8rxwY
MD5:	B754B80ECB374F4150CFF01306864ACB
SHA1:	6AD03FEDAC66AE6C296B4D338CDD48EB8082B5EE
SHA-256:	7245F52FA5A119B9CE3D815515A6ED6311977C2A75BEF3C751E1A382C96D91FA
SHA-512:	171098F274A76DA31F98EA7F0EDCA88A080701D5D03A3B675812A2ACBADF1251B5A1A100FC2BE5504619C868C36A9763D0601BC2037A877911B438D0976D7462
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="#15 Asphalt Felt (priced per Roll)" GUID="{F402E418-3A69-4CD1-8E87-3DCE18325012}">.. <Properties>.. <Property Class="Text" GUID="{575B1CF1-5456-42FE-9068-BD3782B52628}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{F402E418-3A69-4CD1-8E87-3DCE18325012}</Property>.. <Property Class="Number" GUID="{5B8624F5-EDCD-4423-8532-62FE73C0992A}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{FD880D18-111C-4D59-9901-51A9230C1B56}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Pitch" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Material Coverage" Order="1" ShowUnits="Fal

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.3 Roofing (Div 0\Shingles (Area Takeo\30 Year Shingles (pr1\is-1V5F6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16033
Entropy (8bit):	5.592134142970175
Encrypted:	false
SSDEEP:	384:cl43+9AXSq3tZCgHGM0DlXcRBSqt7qEDYO2Q2SjUWDh/cTqWKL:cl43+9AXSq3tZCYGM0Dd4dsEDYpQ2He1
MD5:	E9C9146D95F89AF9A7188C572B7D8FEA
SHA1:	C02C687F65AA096C3301CFEC2D920D9650518B06
SHA-256:	28B607989D5DBF4549913EAB41ED9BACC6941773B3BB8A7E34DA44093F3EF9E0
SHA-512:	3CBE8877E3D4E595D678C0BA7BB76DB795292CCB504C8B67237D242F25D1994DBDDC556040BE2598FF604DDB0905B4F739BA16CAB9A88A06364281E6B645C38E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="30 Year Shingles (priced per SQR)" GUID="{4D482DDE-2CD9-4DEE-BACB-DFE4DCC336F4}">.. <Properties>.. <Property Class="Text" GUID="{86544F9E-965B-4D35-93A2-1AC7F152BC21}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{4D482DDE-2CD9-4DEE-BACB-DFE4DCC336F4}</Property>.. <Property Class="Number" GUID="{D8629EC9-E05F-4919-8233-ADC882204488}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{4DA015A9-5CF4-487C-8148-8DBCDBB33301}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Pitch" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Material Coverage" Order="1" ShowUnits="Fals

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.3 Roofing (Div 0\Shingles (Area Takeo\30 Year Shingles (pr\is-5BLEB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16447
Entropy (8bit):	5.589761493196833
Encrypted:	false
SSDEEP:	384:La9BcP6nfCrHkc3S7j8AY7uXc2BOqyeNbySx2XKXgbjUZDhFk+BdPL:La9BcP6nfCrHkc3S7j8A+qjJbbySoXKJ
MD5:	E2440C82EE1B0377F2C740E54D6F3BA0
SHA1:	1D3E7FD3F1A16D4F68D3721E977662E3D999F37C
SHA-256:	B4ECCD1DC74AE1E04766B02EA55B25CDBE65C771C5E377F0BA7146755E34A6E7
SHA-512:	A24A99953382425C24E6B1BEE6A15DF8C1C381D3BDF4F6F61DDE56EE0D015A036C971E09C6058AE9ECED2B49E792C76BD657F3A37FCCD40D3BAB6ED1CF14D1A4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="30 Year Shingles (priced per Bundle)" GUID="{A4604B62-5690-4738-AA56-3CF23AC50916}">.. <Properties>.. <Property Class="Text" GUID="{668CF5F0-1980-4BE5-B2EA-161B1DE16C7F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{A4604B62-5690-4738-AA56-3CF23AC50916}</Property>.. <Property Class="Number" GUID="{781D8C32-38B3-471D-A773-E51B7D3ACB43}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{7C20E77B-957E-46C9-B014-835D5E704D76}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Pitch" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Material Coverage" Order="1" ShowUnits="F

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.3 Roofing (Div 0\Shingles (Area Takeo\7%2F16%22 OSB Sheathing\is-8BIPL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16149
Entropy (8bit):	5.593742300871128
Encrypted:	false
SSDEEP:	384:caMhE8YtS7q8ffkfT5OHRCXcNBRq9VDNcNMY2yqzjU4Dhmjd5VjHL:cHhE8YE7q8ffkfT5OHRmwovNeMDyqsQE
MD5:	97A4D770B190CF345DD631250A4CC7A3
SHA1:	585DD1FBD8705F6A1162672985E74D031860B674
SHA-256:	6B903ECA00A40413CF3D6AA527DCA2C61E82F066B75CB6B1982CB758D60DFFA6
SHA-512:	A95216C25CD13CB9517ADB2096473C9A5F13F3BDB83F6DB2BB9727E83EFA09309D29D1FBE2FFEB81CFA526D001EFFC2303B195AC6EDBBD75F1A0D315165F0516
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="7/16" OSB Sheathing (priced EA)" GUID="{20A9D69C-DCBA-4ACB-8039-0537689CA922}">.. <Properties>.. <Property Class="Text" GUID="{7632D0CB-E489-44B2-8E42-8D1407304AF2}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{20A9D69C-DCBA-4ACB-8039-0537689CA922}</Property>.. <Property Class="Number" GUID="{16F4F17D-7356-4B64-84C6-18504293AF9C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{386E2C94-0E0F-48EE-9A00-1436071D1E1F}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Pitch" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Width" Order="1" ShowUnits="False" S

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.3 Roofing (Div 0\Shingles (Area Takeo\is-COTNF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	971
Entropy (8bit):	5.461908149730206
Encrypted:	false
SSDEEP:	24:2d2aH9WX2ACf2WAdOcdC61OcLZf4VRgAWa8/CApWenv:cwzGfVWYSH
MD5:	DCA8D9461FEAA974C0F9D63697F33103
SHA1:	516CCCAFECBDD7BB8FBC474C02674A22690595DC
SHA-256:	3B55C716489855C2148005DFCBE36F39A1F4C78A68B79FEF0A5232B916F3EBA5
SHA-512:	6FD4636A4C5CBD071D00787F069ED22475473CC351A11C42DE95B6F771DF478EC39F9813FFE0AEF7C91F7461D9286B655D1A8D67E785556BC4E76C27FE8D3CF4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Shingles (Area Takeoffs - Plan Views)" GUID="{32738628-E09E-4069-B34A-1F4A0828A762}">.. <Properties>.. <Property Class="Text" GUID="{65F574A7-8F7A-4701-9AB5-EC0659C9FA5D}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{32738628-E09E-4069-B34A-1F4A0828A762}</Property>.. <Property Class="Number" GUID="{ECA63F48-51E0-406E-A717-F999E4817B02}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Type" GUID="{F1BC4A30-2106-40EC-9877-64345AEDDECB}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{1F43AC02-177C-4528-9D16-9D9DBCFEE036}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Shingles (Area Takeoffs - Plan Views)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.3 Roofing (Div 0\is-2U2C4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	953
Entropy (8bit):	5.4671950306628645
Encrypted:	false
SSDEEP:	24:2d2nyaTX2Te1f2WAdOcHf1Oc8ra29gAWaK/CApWKPv:c+njOkfM/
MD5:	6E7779D8CB08EBECD7546E7D2BE6C523
SHA1:	069EBF1F1BB25DC38054749FFE5EB0380C2DD53D
SHA-256:	088C741C27A628BF67774DB38F8378DAA7B0724B0F3B6D6C2271A67B1849C0A1
SHA-512:	A5F6D4748867BADE2B022EE0231E7E40260AE0347E38FCE9EA4F70A1CC0533EA5A0F76CF9E2763A8F0039BC222F4E96FE38B0CAF299EEE52E7ADEC3994734979
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="07.3 Roofing (Div 07.30.00)" GUID="{8C7AF661-23A1-4D6F-AFB4-A7FA15782100}">.. <Properties>.. <Property Class="Text" GUID="{ABA9581B-F945-45E2-9AF7-216EE3E9B465}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{8C7AF661-23A1-4D6F-AFB4-A7FA15782100}</Property>.. <Property Class="Number" GUID="{592523B8-3A0E-4D37-A016-E14E56885718}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">9</Property>.. <Property Class="Type" GUID="{B1429FAD-184B-4FB2-80BB-D5020E4382F0}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{43D00D54-9021-41BB-9400-AF25704AC6E9}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">07.3 Roofing (Div 07.30.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.4 Siding (Div 07\Siding (Area Takeoff\Panel Siding (priced1\is-OCNSS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16817
Entropy (8bit):	5.5907628512276855
Encrypted:	false
SSDEEP:	384:DKL1Uk1eNIDsxNpUQ59XNTt8XckBOqWEb2aWZf2aiYjUSDh4WjPk/L:DKL1Uk1eNIDsxNpUE9XNTtIZJT2aWZu5
MD5:	3D9F75C1FFD000AB91A34C02B1254546
SHA1:	EF764FDF204DCCC48260D961AF222AF0BF4EC1C2
SHA-256:	BCA482030DABBD47D910EC0BC4D24FD2AC2C922EC8B960C1F6DFC2FEAFD64D87
SHA-512:	CB2F4AD31BE15BE4F0FD790A6BD31226BFC6A49FAFAAAFA61D589967DE078E3BDD7FE252FAB52DA9D95C942D6283905EC5C5C836D7CA7CAB2BDEAA5267EB8EE7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Panel Siding (priced EA)" GUID="{2265E208-64DF-4E71-A3A7-C7C92006D640}">.. <Properties>.. <Property Class="Text" GUID="{1B2F18C3-952E-426D-A543-C59AE114FAFC}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{2265E208-64DF-4E71-A3A7-C7C92006D640}</Property>.. <Property Class="Number" GUID="{C9A57DA4-F07D-42E2-A566-19EBAA5C586D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Memo" GUID="{A48B8101-C9A1-4013-BE5F-0DCDE48843BD}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Lap" Order="1" ShowUnits="False" SameLine="

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.4 Siding (Div 07\Siding (Area Takeoff\Panel Siding (priced\is-LT23J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	16831
Entropy (8bit):	5.591863121746842
Encrypted:	false
SSDEEP:	384:LpZm0duDqiQcunAzLMldRwXcVBeq510MxEPT27H1BjUmDhoeKRRL:LpZm0duDqiQcunAzLMld6U5AeEP6r1K1
MD5:	80E57DB85A084B2FF94E1C357C84191C
SHA1:	9CBEEC682C6B3A42D1CA5C063CC7D138271E6FB7
SHA-256:	5659D5C7C7C999E7B15B02FA9198808B196CE50E49A65FECCE651669D8ECB86C
SHA-512:	9F107471CC833A2E7DA43C8DCA0ABB8282443DF6E5AA3D20BE81F780B145258692C2F35E8BFDC5234CF97448CC5B71C41E0181ECFF7A8225F37226C2B5525317
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Panel Siding (priced per SQ FT)" GUID="{8F366399-06ED-4EF8-A675-1BE1DF56022F}">.. <Properties>.. <Property Class="Text" GUID="{B3C3CFF6-A72F-4251-8398-36678647B149}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{8F366399-06ED-4EF8-A675-1BE1DF56022F}</Property>.. <Property Class="Number" GUID="{8AFDA186-839D-454F-9391-98D013E1B08B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{4695EF93-6DBE-45B9-9036-4F8E93CA1239}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Lap" Order="1" ShowUnits="False" SameLine

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.4 Siding (Div 07\Siding (Area Takeoff\Plank Siding (priced1\is-PG7IE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16855
Entropy (8bit):	5.59267946170205
Encrypted:	false
SSDEEP:	384:1T+F/s2xM7WinPwDqkpqDtyXc4B9q5MihWRqY2ieAfjU8DhjXkMARL:1T+F/s2xM6inPwDqkp2tWBE/WRqDirAR
MD5:	699EC02A3D0A30E06C9881D6466C0136
SHA1:	3CDE964C80F6175E7FE2EC1DB478E124212EF05C
SHA-256:	34D9C32B9A9620FAF5E3C079ED4D73DE844076C98F540BC9198FDE2A0AA6ECB3
SHA-512:	4BF6792B3550E204734D79C3A6ECDA27EFD33DDC8545420026A82F4EB1F70F9B0A59FDE3C34B4FEACD9173417201B83BBAD3A3E66BE02AF202CCACA37FD82FD4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Plank Siding (priced EA)" GUID="{3AF10233-58C3-42C0-A1AB-599775CA506D}">.. <Properties>.. <Property Class="Text" GUID="{295FDCD3-B0D3-4D99-95FE-09F810947AD6}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{3AF10233-58C3-42C0-A1AB-599775CA506D}</Property>.. <Property Class="Number" GUID="{500F7A82-0056-498F-A487-AD4519C044F3}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{A9F85BC4-CC34-4866-9F8B-89BC3067992F}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Lap" Order="1" ShowUnits="False" SameLine="

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.4 Siding (Div 07\Siding (Area Takeoff\Plank Siding (priced\is-PJUFJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	16869
Entropy (8bit):	5.59180215656992
Encrypted:	false
SSDEEP:	384:nbM5EKRNW5ButliKnuODH1wXcUBDqgYNuBq2249ijUEDhB7ZvAhL:nbM5EKRNW5ButliKn/DVUxWjuBqR49Xb
MD5:	3664BE2EA9EFED531F7A96AA6A83862C
SHA1:	1ADA122BEB5367E2221085FE0B4CC0A604CDEF41
SHA-256:	F15A9D87381AAED4ED36475323B569F9A36447021E840161B88B4900F07EB239
SHA-512:	D0418E893D4E03A40BFB60832D8D3902F6A3EE62E833071FEA6E72BEA695A207C3F764F3E5CEF5BFA44E31CBE816E945F5E2CC57EB23219CDA0FD29DC2525B00
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Plank Siding (priced per SQ FT)" GUID="{AECE303D-E6A4-4791-A6CD-B53BB224DEE6}">.. <Properties>.. <Property Class="Text" GUID="{977C4031-1894-4211-A523-1562DC233C81}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{AECE303D-E6A4-4791-A6CD-B53BB224DEE6}</Property>.. <Property Class="Number" GUID="{F8EB58C3-467A-4F76-A61C-BC496AF2495C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{75C24265-F92F-4215-95B1-4D84EC540F74}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Lap" Order="1" ShowUnits="False" SameLine

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.4 Siding (Div 07\Siding (Area Takeoff\Stucco (priced per B\is-R45QR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16627
Entropy (8bit):	5.5881526315771115
Encrypted:	false
SSDEEP:	384:PaDq9gIsS8iJtcB8r28ufenHAOqXcmBMxqXpCyiWkKv2MAvjUmDh3pREJdL:PaDygIsS8iJtcB8r28ufenHNe3MI5iWb
MD5:	074483861C495EDA1320348319CE2BA3
SHA1:	DF537E609C31A64449AF335F87738F81399D3AB2
SHA-256:	CAFB41747E87AE6852D476136E4B5B343B31D1BC2EDA2031A76DF1FE95FC30C0
SHA-512:	FC67F79AFA3EB12D442FBB807A603A445B918C68A5A0630F7DA25F9BA1375A46E8CB210C42AA2A565660E3F9560D555A06D4F537C54AAF07CB8B777348C44E26
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Stucco (priced per Bag)" GUID="{0F1A2A95-2857-436F-B4C9-4DE3FE9F9EA8}">.. <Properties>.. <Property Class="Text" GUID="{884564EA-FE7F-4F1A-9282-F7BCF3329012}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{0F1A2A95-2857-436F-B4C9-4DE3FE9F9EA8}</Property>.. <Property Class="Number" GUID="{1BD243DA-182B-4F47-921D-8A9D019BD0A3}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">6</Property>.. <Property Class="Memo" GUID="{31611789-3D3A-44F4-806E-E7ADF55FEF2A}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.4 Siding (Div 07\Siding (Area Takeoff\Stucco (priced per S1\is-U5EQK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (396), with CRLF line terminators
Category:	dropped
Size (bytes):	16635
Entropy (8bit):	5.590874014910714
Encrypted:	false
SSDEEP:	384:5cOBtAMhu0gRuN3Jwe7mRYXc7BvqzU5XiNz2lMI0kjUODhCiiid6L:5cOBtAMhu0gRuN3Jwe7mRsCieXiNaqIs
MD5:	B04576DBAD52300BD792F2CF44F0A09A
SHA1:	074FD02415F801CDC126849C583BA89AA6F0C920
SHA-256:	E9EF78369CF597AA02D96D6852DE240EFB9B546CAD46AED9CEA0F7CE54BE8BAB
SHA-512:	4622691084D68F16D2EFCA6BA852BAE43790A66EB2D69D9267C23AE3F971404194E04C71DA22E7087962CCA91F9779C98A314BC9F816A9DC8F326E35B64739F3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Stucco (priced per SQ YD)" GUID="{95A9CFE5-8992-456E-8408-D9CA1E1F35CB}">.. <Properties>.. <Property Class="Text" GUID="{1A4EFCF9-1719-48EA-BB8B-D3C7DF6B4924}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{95A9CFE5-8992-456E-8408-D9CA1E1F35CB}</Property>.. <Property Class="Number" GUID="{84136D20-056A-46AB-86D4-ED4B5DA9F7B3}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">5</Property>.. <Property Class="Memo" GUID="{81E1154C-B019-484B-8D7D-3DB52EC399F1}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False&quot

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.4 Siding (Div 07\Siding (Area Takeoff\Stucco (priced per S\is-TAP83.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (396), with CRLF line terminators
Category:	dropped
Size (bytes):	16631
Entropy (8bit):	5.590171543761838
Encrypted:	false
SSDEEP:	384:+CgE3poL/zIsM33TdBeQj3+XcNBLSqSLPrGAn/M2kDMjUiDhuhJ/8QsL:+CgE3poL/zIsM33TdBeQj36IpKjGAnHN
MD5:	012364F5AC703D2E859B1D3EAD27DCB7
SHA1:	FC8EE8585BC07E9BDC1AFB2B4C14F92B7BA38CBF
SHA-256:	723140CDBA1CE83E80477BE35B30733A85180BCE65200A1A2BEA0C4028631ED3
SHA-512:	DFB64C9244A4276590B1DFBD6A6BDAD9C74CDE8133DD00B104A6EDEBE713D632D7374E5E283B62AF8707010732D2C5F55017E3D35333B012FC1070BF8B41869A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Stucco (priced per SQ FT)" GUID="{04AC1E47-C7B8-4A43-845B-16143E3BC05D}">.. <Properties>.. <Property Class="Text" GUID="{A33E6B09-3E2F-49BB-B318-CA4A6A100469}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{04AC1E47-C7B8-4A43-845B-16143E3BC05D}</Property>.. <Property Class="Number" GUID="{2CE98F3E-6CE3-43C6-8CBC-E6996379582C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{45357E0C-24E5-4A66-B642-B09B9807E9B1}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False&quot

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.4 Siding (Div 07\Siding (Area Takeoff\Vinyl Siding (priced1\is-QBU4J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (396), with CRLF line terminators
Category:	dropped
Size (bytes):	16805
Entropy (8bit):	5.591708994859701
Encrypted:	false
SSDEEP:	384:uotLh1HGe96NmGxq/G8emHRKNhXcGB8qLuB1jaHv2scSjUIDhMVmR4kL:uoBh1HGe9uBxq/G8tRKNhfTk1jaHescE
MD5:	F78CE70A1AF8163C3F80CAE84FF8988F
SHA1:	635A671E08ACECC6AC11248A182B0B84284557EF
SHA-256:	B029CECD81FEBACCF6430F60D58FC27D7E6842FC00F5BEE8C36C7975C8445953
SHA-512:	D1231E18E3185255CDE58C016B31B497D08D8FE0F2EA5ABA1914049D17B97F1A55A36AAD33EC6D82C79C04D648CE32C67CF6F9541F68526FF994BDD36A243F6B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Vinyl Siding (priced per SQ FT)" GUID="{EA589700-1AEB-4D2E-8DA7-0FFD453937DF}">.. <Properties>.. <Property Class="Text" GUID="{E79CEF58-7FC7-43F4-8B27-CD2A506E834E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{EA589700-1AEB-4D2E-8DA7-0FFD453937DF}</Property>.. <Property Class="Number" GUID="{7DFC525D-0E7B-4015-94EE-817A50B3038F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">8</Property>.. <Property Class="Memo" GUID="{413054AB-091F-4346-B28F-010EB8DADBD7}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Lap" Order="1" ShowUnits="False" SameLine

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.4 Siding (Div 07\Siding (Area Takeoff\Vinyl Siding (priced\is-O398J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16801
Entropy (8bit):	5.5920525085954385
Encrypted:	false
SSDEEP:	384:aQhAFl7faL3I3qkZeuxtwHXcwBNqSFW+uzrH2tkj/jUZoDhIifAHL:aQhAFlLaL3I3JZeuxtw3Z0KuzrWtkEZv
MD5:	C0A4E2C183676C67300600C7BFF24F9E
SHA1:	11F2B78B8F79E1FB6DD9B2B02364460CEB163CB1
SHA-256:	B00CAB34F88EC7B7435D55D7D223BCA2C5CBC6B05EF54B4196594230E8EB8A49
SHA-512:	A3156EF0B87A66AB192C72E113467156C60AE8752303E3FC781870F54755E3FFF140CC6DC7A807ACF19A4CE24410A829D265D363CE9352A5630E646FFB4165F5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Vinyl Siding (priced per SQR)" GUID="{B6735DA1-F49A-4D7C-AF57-193E26F0DD99}">.. <Properties>.. <Property Class="Text" GUID="{B2EB4736-0A0F-4F8A-88C1-CB7098846F85}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{B6735DA1-F49A-4D7C-AF57-193E26F0DD99}</Property>.. <Property Class="Number" GUID="{84E3EC5F-12F4-4A69-BE11-ED08666C133D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">7</Property>.. <Property Class="Memo" GUID="{80559CCA-350B-44D1-91A2-B0B55881315A}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Lap" Order="1" ShowUnits="False" SameLine=&

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.4 Siding (Div 07\Siding (Area Takeoff\is-6PLFV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	941
Entropy (8bit):	5.445319935126824
Encrypted:	false
SSDEEP:	24:2d2HVJX2EHf2WAdOcPZ1OcLEOgAWakGc/CApWLv:ccJx9kedZW
MD5:	DB27876A71D9407DEEF644930AB7F62B
SHA1:	1098C2B7915CFC04454B3B0476763C5271EB3773
SHA-256:	0D19B5F8321DA00503BA19451DD0B28CB60D6AD1E58340BE4D4A20B966E0BBAB
SHA-512:	1E5DF465C41C94AA9DFBE073BC3912810EAFB5C7BA2E98BFDCFDD87BB9B0BE073AE428843DEB14459F7E82C31ACE7818572C0FCB7AAFE0D44823FF334FF87A74
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Siding (Area Takeoffs)" GUID="{DBAEF0D1-159E-45D2-98B4-6C7BAACFA063}">.. <Properties>.. <Property Class="Text" GUID="{2F7A9DA8-8EE8-4DFE-B476-CE78B88515AD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{DBAEF0D1-159E-45D2-98B4-6C7BAACFA063}</Property>.. <Property Class="Number" GUID="{0C1A5AE3-4319-4C07-9B26-C3A0544C2515}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Type" GUID="{C68E22C1-772C-42DD-9648-AD10DE2BB98E}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{9948FCD9-F86A-4BA0-AF1B-CE98F84894BA}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Siding (Area Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.4 Siding (Div 07\Siding (Linear%2FSegme\Fascia (priced Linea\is-N56KI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16591
Entropy (8bit):	5.5885367995457385
Encrypted:	false
SSDEEP:	384:3hFfPlkwHL7J92/HwUYrHWjXcsBBqTBOzM1Oa23FRjUPDhHZUEnucL:fXlkwHL7J92/HwUYrHWbN44I1Ot3FatF
MD5:	963E6E41775796DBE7AC6FDD5F64CBE1
SHA1:	87AEAC4A3841D2777DA5BFDE8CAF32C7ED479ED7
SHA-256:	780348E65FDE2CFCF8F456E6E61B264EF1629317A351EEC8000838353EF640F8
SHA-512:	C2598F23735C64AD3CB9F5F435B98DE51FF43927D6F94C7483914CDD067777B7B639137EED5E0394B9B0208D48762027EC4C563A51F8EB82116A9EAF1C84EEBA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Fascia (priced Linear FT)" GUID="{E29F6FC3-C645-45F8-A3D2-4731FF261458}">.. <Properties>.. <Property Class="Text" GUID="{05FECA99-A51F-438C-B661-510CC195A429}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{E29F6FC3-C645-45F8-A3D2-4731FF261458}</Property>.. <Property Class="Number" GUID="{D65A15BB-0955-46B5-8872-BF2BB16B3954}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{90720AB7-F057-44D9-A80C-80F172BB66D4}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False" SameLine=&

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.4 Siding (Div 07\Siding (Linear%2FSegme\J-Channel (priced Li\is-1GSP6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16588
Entropy (8bit):	5.590121801857126
Encrypted:	false
SSDEEP:	384:dM5uu36ZzG4gMrGG4borsaLXcFBLqz3pR/kI2BKLjU+DhHJrbw6L:m5d36ZzG4gMrGG4borsazgOtR/kTBKU+
MD5:	DCB15A25CC594CEE691D47331939D0F9
SHA1:	B76D9BB36BDE5472CCADC616805AD6DF4A623446
SHA-256:	F436DC9A127E5658DA946308713E16DA400DC2E0EDC9F5DCBDD18AB3DFD62FC0
SHA-512:	E025C066172290BAFD43870ADB3384429C7D18BA10B160F183CB4387D94A095B4EC544B9CFDFBDC57585A479F52F6626E6BC2594D9D02B0C760755A15B974404
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="J-Channel (priced Linear FT)" GUID="{BAE489DA-BB34-4642-AE89-A78BA3CF6857}">.. <Properties>.. <Property Class="Text" GUID="{7B07BD4D-626B-427A-8EE0-6AE3BCC325EA}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{BAE489DA-BB34-4642-AE89-A78BA3CF6857}</Property>.. <Property Class="Number" GUID="{965E2F78-7FE9-49A2-83B7-32765460E733}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Memo" GUID="{D39851BD-2DA4-4E80-9BD0-93EFD53E4F90}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False" SameLin

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.4 Siding (Div 07\Siding (Linear%2FSegme\Soffit (priced Linea\is-39E2K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16592
Entropy (8bit):	5.5879996747978105
Encrypted:	false
SSDEEP:	384:i2FcH935E9zKsiTIbJdZdXcDBWqXI0YruB2vZDjU0DhfIWL9L:i2FcH935E9zKsiTIbJdHKhfYruYvZ8Up
MD5:	996640C552BB3ED2981A14F8A6E5E71F
SHA1:	44AE60FC680A1432982EF7E95B89943F8B14A400
SHA-256:	C79A1AFDDC3583D65ED015D9DB7CD6498A1B553FD43FAC7E2ED6B4E23C762CD0
SHA-512:	6BEE7750C5134118B6C4F9F1BD8FCD75F47E78F7C603EA5C4CD3458A98C898054ED558148CA9A92B22525988E3D6D53F002486D8BC372101F5F340B4543D1E71
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Soffit (priced Linear FT)" GUID="{203A4532-C540-4936-A0BA-22CC32B06BEE}">.. <Properties>.. <Property Class="Text" GUID="{A121D758-79EE-4115-807F-52A3DECD8E81}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{203A4532-C540-4936-A0BA-22CC32B06BEE}</Property>.. <Property Class="Number" GUID="{D859933C-E4FC-4A8B-B144-84311A723FC0}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{1060BA27-606E-4DAA-AF17-8BA87090C86A}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False" SameLine=&

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.4 Siding (Div 07\Siding (Linear%2FSegme\Soffit (priced per S\is-AKPD0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	16592
Entropy (8bit):	5.587843617630338
Encrypted:	false
SSDEEP:	384:tOEdXt1NwY8fttRu61GLVVZuVCXc6pB2qvi4OPZtXs2Z57jUHDhfQDqayL:tOEdXt1NwYgtTuWGLVVZuVmlBNOPZtvO
MD5:	6924502EC43A766465D68A04CE28DA99
SHA1:	B92A01F69EA8B268AD8D68AC4D669F278A01A5DD
SHA-256:	F11B3E52AA31E92EABDDC3E9FBB5F0FF29075033A49AD1145FFC4F7C001B1B55
SHA-512:	733B6F1CF1D2CFB597D53188910B234CD139DF83A2F91587B67AA85C0BC304032B214EDE8F1B839B3387F99E578C9D71B0A7F6CE66F415D472CC92F3D00560B4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Soffit (priced per SQ FT)" GUID="{47160F89-D01A-49B6-9001-47CA53EBC31F}">.. <Properties>.. <Property Class="Text" GUID="{BFB8B00E-392C-4A89-A703-24A8CA13A60B}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{47160F89-D01A-49B6-9001-47CA53EBC31F}</Property>.. <Property Class="Number" GUID="{255E1592-A70C-4618-82CD-F6A85B0B6498}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{7F50277F-B156-42AA-BC41-DC53FA0EB7DE}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False" SameLine=&

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.4 Siding (Div 07\Siding (Linear%2FSegme\Undersill Trim (pric\is-C4294.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16603
Entropy (8bit):	5.586052492206628
Encrypted:	false
SSDEEP:	384:aFCufrnZ2PbhhHCFK16Y6vtlkXcCBdqub497GuWgC2pF/jUEDhHHFOvL:OCufrnZ2PbhhHCFK16Y6vtlAfkuq7GuG
MD5:	1A729C2E53DEC2EE80C0D984488E5828
SHA1:	DEA3267D1D861BE10916342CE4C439A0789BC7F3
SHA-256:	0080B7143AD514AD875A8D7585D62CB2A7542C08378EAF43822F7F682A6CB51A
SHA-512:	00768704236ABE7A82683CC1D2AE286FCFB24E70D4F33929554524D07700395F844BC1D22749AD1FAD30A308E668ADED5FE1CC946DC31794F44A906E71488F80
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Undersill Trim (priced Linear FT)" GUID="{5847A99F-4B71-4D2D-84BF-EEFEB4F4978B}">.. <Properties>.. <Property Class="Text" GUID="{774EAE66-0907-46C7-8B9E-7A3FAAD69E16}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{5847A99F-4B71-4D2D-84BF-EEFEB4F4978B}</Property>.. <Property Class="Number" GUID="{442CEA20-39F7-4C79-B693-123F5124665E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{146B4FD0-29E3-403A-B115-AE0ADD7920C4}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False" Sa

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.4 Siding (Div 07\Siding (Linear%2FSegme\is-JN1VS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	961
Entropy (8bit):	5.45675907246242
Encrypted:	false
SSDEEP:	24:2d21ttrX2QGcYf2WAdOcNkAo8J1Oc8ZHs2ldSgAWaY/CApWhv:c2cjAqXs2ts
MD5:	F4E5FF0DBE49D7E44F1F7F5CA2F35960
SHA1:	861B09373445861748B5017458A327BD6C5DBA46
SHA-256:	BCE4B9162555F57B0902CC27B5C30CD23CE2F85764788E55C8D65E46CC788C3E
SHA-512:	AEDAEF883BE3B02339C576489D410E1A0DB8E974433EAA80009877E0162EE8FEC91FEEA77BA7910F0686DE99123479D72ADCC614F327BD2CD2C2D977246CFA99
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Siding (Linear/Segment Takeoffs)" GUID="{93A32F51-17F1-4210-B5A9-7D5872296494}">.. <Properties>.. <Property Class="Text" GUID="{DC7D2E92-9E1A-4D8B-AD2B-2E8F33DBD5E4}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{93A32F51-17F1-4210-B5A9-7D5872296494}</Property>.. <Property Class="Number" GUID="{5204F9F9-205D-48A6-84A3-B3734A0EA26B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Type" GUID="{0B57174D-2A23-47DF-B379-5676FF7791E1}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{A49C9C95-9EE7-4BDB-9F5E-C9D101AE89CE}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Siding (Linear/Segment Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.4 Siding (Div 07\Siding Parts (Count\Inside corner post (\is-J8AQL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	16599
Entropy (8bit):	5.584786946350874
Encrypted:	false
SSDEEP:	384:5Pf42igF7BdKHnKP7qSNdXcRtBFqOOIn/cMS2Ff6jUhDh4ZJoiL:5Pf42igF7BdKHnKP7qSNFiz8+n/cMlF0
MD5:	2D75E87FC8BEED06FEB913571349986D
SHA1:	67ED483A9C397588FCA95E2EAB6AE5D9DB4584B7
SHA-256:	C45D4E33BF31C77EDBCE69E0201F676A906E1CCAC1B6E0FB1547352B9E73F976
SHA-512:	CA097C498CA1BFBB4063EFD38D76C8F05D9D62453B14BC3A01AF609A2A75068D033501FA675993CAC6CD55D9D6A9C553F167E926B2B3490D3BEC9CD94552D605
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Inside corner post (priced Linear FT)" GUID="{C46D70C8-7DFE-4191-ABD6-9F37A03992BF}">.. <Properties>.. <Property Class="Text" GUID="{D9D0B760-FF8E-4350-B27F-E671AC153AB1}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{C46D70C8-7DFE-4191-ABD6-9F37A03992BF}</Property>.. <Property Class="Number" GUID="{66563C2F-C4C1-4FD8-B3CF-BA67EA69EBD0}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{DCB16A7B-2F80-4D7E-887B-BE207242DD1F}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Length" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False&quo

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.4 Siding (Div 07\Siding Parts (Count\Outside corner post\is-BS1C6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	16587
Entropy (8bit):	5.586419245197447
Encrypted:	false
SSDEEP:	384:t0+Qlk5xxzx6FXdK7t8YSa91QXcHB6Jqz1bVMUk42MUpZjUrDhORrOrVL:2llcxxzx6FtK7t8YSa910W6wpRMUkjl6
MD5:	FA10D6F56A013CC4F5FC2F6ABB48D246
SHA1:	97DEBC4F3FF3B102F1F0A0FB138C94F45D9C899B
SHA-256:	6FB281532D32F1E63850A5701FA3CAF2A95167FC4A0BE776ED19FFF2F72F5ADA
SHA-512:	3677090FEA9271F0A70007576129CD052F721C457CDD79BC692282D1D60551D3954F9022B6335FC22451C98FDE1E07023987ABFD4597A778E2226A3E388FC79E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Outside corner post (priced EA)" GUID="{A31C2FF3-6B22-47B6-9EC6-9FDFE4979DE5}">.. <Properties>.. <Property Class="Text" GUID="{3847BF01-0D84-4507-81A2-E7ADDEF3FD18}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{A31C2FF3-6B22-47B6-9EC6-9FDFE4979DE5}</Property>.. <Property Class="Number" GUID="{750E6D75-CBFF-4C74-A80C-72AC4B145E57}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{F8883FB0-D4AC-4FDF-8362-AA11D2800399}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Length" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False" Sam

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.4 Siding (Div 07\Siding Parts (Count\is-VH7V0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	955
Entropy (8bit):	5.452310180880384
Encrypted:	false
SSDEEP:	24:2d2RYrWJX2YTf2WAdOc8NiB1OcIMpv/gAWaHh/CApW1v:cPrWJ3XimNqvT9G
MD5:	6DE94D8FA6F30B46062AF4E99DD0398C
SHA1:	8615C3426AF92CCBB0358ACB6282C98BB31F470E
SHA-256:	7D0D1B68EFA7EDEB2273962C2DD936F79EC30C562C6FFF77D50E0AADAC504F99
SHA-512:	F0817AFB3F694C17D7420B3E3764EB45A6E6EFB927EAD41928E5D387DCA34B3F6BF4FA37A0F2493A81BD9701A579D7C1E5CCB35F7B83A45B50ADF2787259E103
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Siding Parts (Count Takeoffs)" GUID="{7DF814E8-386A-473F-887F-D5FE03C60653}">.. <Properties>.. <Property Class="Text" GUID="{2F719E13-CFD5-4006-9039-4AE5D74F4F4B}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{7DF814E8-386A-473F-887F-D5FE03C60653}</Property>.. <Property Class="Number" GUID="{A4CE65F3-591A-45D4-A61B-A4CCB12D7839}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Type" GUID="{551AD19A-2403-468F-A844-DB47BD66AC4A}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{6DEAB07B-A29A-4375-9B3C-10E1E2E923C4}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Siding Parts (Count Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.4 Siding (Div 07\Siding Parts (Inheri\Nails per SQ FT (pri\is-8DA8O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (379), with CRLF line terminators
Category:	dropped
Size (bytes):	16516
Entropy (8bit):	5.591960748949501
Encrypted:	false
SSDEEP:	384:Uyrved8fGxssURasRAOgXcvBXqmoXldgIE2bsFjULDhr7dr52VL:xrved8fGxssURasRAhu6mwdgI3bsmhHy
MD5:	D30D0DD4197A933AA0A513E19B00802E
SHA1:	134826525AE58CF393856D9D976C29BF92802367
SHA-256:	83B8FA3851E0E6B058273BB9917DCF52A346105E53C2F8090BB29F1D62D23DB2
SHA-512:	98C0B30B36E2109D1E730FCC8C87D42FF7F4CF1178479EF764A09DE9C6966DFA428EC8D32C927E2784DACB4AF609C3ED644AF48204AFC92BA4C8F736585019EF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Nails per SQ FT (priced per Box)" GUID="{6A07DAD4-4693-44B7-BF9A-3DFFE4A5A359}">.. <Properties>.. <Property Class="Text" GUID="{C148D19F-F6BC-4271-B5AB-E96E05C1CAC8}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{6A07DAD4-4693-44B7-BF9A-3DFFE4A5A359}</Property>.. <Property Class="Number" GUID="{85C4F263-146F-4F44-AC8F-D8DF13C645B2}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{1303EE58-A816-45AC-8C34-14D30B79C52F}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# per Box" Order="1" ShowUnits="F

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.4 Siding (Div 07\Siding Parts (Inheri\is-OF382.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	973
Entropy (8bit):	5.410207712145313
Encrypted:	false
SSDEEP:	24:2d2NACX2X+f2WAdOcuAyQ1OcC6gAWaeM/CApWcv:cHCySiyzKf
MD5:	D6DC8AB2B99372689F21843985ADE5C9
SHA1:	22BF94F7966BE83D5B0CF92AEC0AB78E50D7397B
SHA-256:	C06D48736F0868DF29E5C1052734F3AABF19EB21BC58508001D663F05EBB05EC
SHA-512:	721A0E8654F0D50A868C3E984A9CAB32FE4A261DEB8A6FFAD88E01741F4288FD782D1EA441DC4F745758B96EABC3681C32163A6A7FDA8564C7D21BAB72D4C0A9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Siding Parts (Inherit Qty From Parent)" GUID="{1EAA425A-10BA-4CED-BBB6-A4BD3B0F72E5}">.. <Properties>.. <Property Class="Text" GUID="{661E1E32-10CD-4E65-8F5B-4B6144D89C93}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{1EAA425A-10BA-4CED-BBB6-A4BD3B0F72E5}</Property>.. <Property Class="Number" GUID="{D955504C-0B8B-434B-881E-34C53C8B7F44}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Type" GUID="{A38A85EA-32DA-4F30-927B-DD713E5E9D22}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{FC8DB01D-DAD5-4B86-A124-5E7A4E4ABD75}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Siding Parts (Inherit Qty From Parent)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.4 Siding (Div 07\Siding Parts (Manual\28 oz. Sealant\is-2GSE6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	15090
Entropy (8bit):	5.586890128955308
Encrypted:	false
SSDEEP:	384:rpc6lixGSiWCsrHeCsCZWXcgBuPSFvG12WQCjU3Dh6xS7jierD1L:C6lixtiWCsrHeCsCcFNFvG0WQ3F6Gmeh
MD5:	0CE14114B65937ACDB6E0EBF5EABC132
SHA1:	4D8629E544A535DEC71CB9C4E790EDD2A5CBD3B7
SHA-256:	9804020BE10EEECAE74C74F43934B27EDF66D4462DF2C74B74EF6173F96E75E6
SHA-512:	C18B83F49AF28FBE56D3306C2C7066AB61DDB0A07FA48E9F55FD92BA764552066BA1F4523E54B74A016F10B158C36F630B9D6DA29C9E3BB92AF682B803D5AA40
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="28 oz. Sealant" GUID="{C888C237-53A4-4D65-B448-346F231F2297}">.. <Properties>.. <Property Class="Text" GUID="{C89ED10F-01C5-4D5B-B5B0-CAC252366E42}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{C888C237-53A4-4D65-B448-346F231F2297}</Property>.. <Property Class="Number" GUID="{E0C1F88A-B034-44EA-B039-B79B1C743908}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{3B4C26BD-CAE2-4E2D-BA71-50741B18E2CB}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Manual Qty" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False" SameLine=&quot

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.4 Siding (Div 07\Siding Parts (Manual\is-JS9ME.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	947
Entropy (8bit):	5.443687104839674
Encrypted:	false
SSDEEP:	24:2d2+dZbNX2/OfYf2WAdOcW3jDf1OcauPPJsgAWaJ/CApWxJv:cLZpE2QPDkEAoh
MD5:	938DB1DBAA1BF8CF76FD12E6D944A304
SHA1:	04E97AAC9CEEB034BC667C79B6272C239B07F017
SHA-256:	31C3D54ED35E3023EE47FAE79225B92EAEEE40B8D2CAE19F7CA66B3CD8523467
SHA-512:	9616529212CFD17D85AAE7DAB9C7BB7CF444150C57D730636135C976F35966099692469892E1B1A93B2F7825DDD49F5C73CFC8D41F69250830AB1195F1CEA831
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Siding Parts (Manual Qty)" GUID="{C80D4441-2B24-4CE4-8AC3-06A926EC37F6}">.. <Properties>.. <Property Class="Text" GUID="{434C2FD0-F0F7-4A02-B257-645381501539}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{C80D4441-2B24-4CE4-8AC3-06A926EC37F6}</Property>.. <Property Class="Number" GUID="{54882C03-ED17-4B35-853C-C41F176AFFF9}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Type" GUID="{7A82936E-686D-4E7B-852C-EDCD8B1E32D2}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{D0A9AF17-5AB3-4435-9EC1-09AC86A4B334}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Siding Parts (Manual Qty)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\07.4 Siding (Div 07\is-RH0BN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	952
Entropy (8bit):	5.456405807997405
Encrypted:	false
SSDEEP:	24:2d2CJX2Wf2WAdOc5uxs91OcpeHlFfgAWaqO8r9/CApWKBv:cFlAuCS9lFCRh
MD5:	6B723F3CEE5C1C5334F94035A811B274
SHA1:	CE2354973E268B7E1C4A4F89F55515BB73DBB85F
SHA-256:	96C241C8A9EA56C895AE3E5F0D6F01227CB06E19340BDAA36D9863D1E370BD10
SHA-512:	23039BA1A0B3B3AA6D99CEAEAF0CD4C80A0DCC9A799FC356D031287EF1480C393EB1C89B0186408B21F217BE12802A962C020A31762A4001E8F80075D9774187
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="07.4 Siding (Div 07.40.00)" GUID="{332F4AE8-4F63-4E04-B256-D7D3AF5848DC}">.. <Properties>.. <Property Class="Text" GUID="{FB9FB60A-715D-489E-896E-BD13A4E6BA56}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{332F4AE8-4F63-4E04-B256-D7D3AF5848DC}</Property>.. <Property Class="Number" GUID="{7B57FB80-ABFB-435E-B704-310AC48A1250}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">10</Property>.. <Property Class="Type" GUID="{0967C9A6-D663-4209-AE26-562D321A3A77}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{6622FDB9-5793-4C15-8F0F-2E0AB9CD4320}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">07.4 Siding (Div 07.40.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\08.0 Openings (Div\Door%2FWindow Parts (M\Doors (priced EA)\is-5JE3P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	17577
Entropy (8bit):	5.598851539375383
Encrypted:	false
SSDEEP:	384:zBgA4j+sh3ndPFYC3CO4XQAD/cGfYzZfNB36sR37g2rLjAnDd/2G1I1nZ0Q/H:zX4j+sh3nhFYC3CO4XQAzlmt36sR382F
MD5:	3D8DFA18F2B6716F60948D5D3CC8DCC0
SHA1:	9FAE1490B451BBBBE1D2A59711AF223CAC4038C7
SHA-256:	F22B1D9A868EC53625CC84290BA220D1CB4AB38252EC0FD6B494B214F96DFE45
SHA-512:	E082B3E6B4E9A8CB42393629C52B0322BDF323CF091E8F4620F4F120CEFBD7066EC80DF09A5925FBAC881E1D7E8658F4B8A6D326DA90D67F44053C7E36BDBCA8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Doors (priced EA)" GUID="{E69503AA-25DA-436A-9612-79D029A76462}">.. <Properties>.. <Property Class="Text" GUID="{D3EDEB7C-9D52-41F4-A5D2-6264943C8F8F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{E69503AA-25DA-436A-9612-79D029A76462}</Property>.. <Property Class="Number" GUID="{FF80B8D8-2A46-4852-B002-2F83566201FA}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{D7AB0A72-834A-460B-A69B-E4B39125BED6}" Name="Form Layout" systemhidden="True" OrderIndex="10" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Manual Qty" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Width" Order="1" ShowUnits="False" SameLine=&quot

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\08.0 Openings (Div\Door%2FWindow Parts (M\Window (priced EA)\is-TVJNP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	17418
Entropy (8bit):	5.597821770939288
Encrypted:	false
SSDEEP:	384:cKtwWvckf5OA0wHM32rVJiDSA/cCfOz8epJciVgiC5jAlDd1RZswqZSl/NH:cKtXvckf5OLwHM32VJiDSMhQ5JciKiCM
MD5:	C47B078A9EBE11F5463F354921B4505F
SHA1:	AA9E9161CC12117D76597DB4C02A5EF6C4012A49
SHA-256:	78449528036F4E887204D154E7A0797F54FB888FCDAC9D2F29B96F11ACDE50F2
SHA-512:	536F0E7C7E4748DE3595803F94902F8E57F76DB73A37413411CFC15CD9599153CC371DC5455663284D200BBAA451743252A57CF8A15336DB73A470021EA8BCF7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Window (priced EA)" GUID="{C4CB166F-12D9-46DD-ADD3-BFFD5173AA6D}">.. <Properties>.. <Property Class="Text" GUID="{7895DABA-65BC-4B1E-8B17-FF07CC92FA0C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{C4CB166F-12D9-46DD-ADD3-BFFD5173AA6D}</Property>.. <Property Class="Number" GUID="{56807A97-DE77-4B71-B8D2-D3DC024E4187}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{A9F769C8-68D8-4C76-8015-9405075F9F76}" Name="Form Layout" systemhidden="True" OrderIndex="10" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Manual Qty" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Width" Order="1" ShowUnits="False" SameLine=&quo

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\08.0 Openings (Div\Door%2FWindow Parts (M\is-32IP7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	957
Entropy (8bit):	5.451889454849537
Encrypted:	false
SSDEEP:	24:2d2bS1kdkxX2yZ2gf2WAdOc58KlO1OcIMX/OgAWayK/CApWS1rJv:cWMMkxj/qbDNyQBrh
MD5:	3010B3C0DAF145232FABC97E600AF883
SHA1:	677848E2E749A493AB795CF4ACE239184233A2C9
SHA-256:	D71AAB48033DDC4028E275257874FBDA634F3E00F8F444DE158224D8AEBB8EC5
SHA-512:	50BE24B31BB83E13357D526974A42FAE640F081DC09A213F1C9AD0B278CCB5CF05308377C8FCBC8B04D6805DF1BF79A0B8C6FCFCF0B27F6604E226B4DFA41E9D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Door/Window Parts (Manual Qty)" GUID="{BC3043A0-2BD1-45C8-B166-9FBC906EDD6B}">.. <Properties>.. <Property Class="Text" GUID="{845ED758-0111-47D5-BD5A-BF0DB9D55DF3}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{BC3043A0-2BD1-45C8-B166-9FBC906EDD6B}</Property>.. <Property Class="Number" GUID="{4AFBC41E-6A52-4A74-BAB2-2D11E6104362}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Type" GUID="{45CC89A9-3898-40E9-A5B2-4279E0559C85}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{894048CC-2A36-4A01-9FC7-2478D73CCDEB}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Door/Window Parts (Manual Qty)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\08.0 Openings (Div\Doors (Count Takeoff\Doors (priced EA)\is-B3M74.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	17442
Entropy (8bit):	5.597304568835805
Encrypted:	false
SSDEEP:	384:Y6UInOT6V9Ihc+iGbive0FRHg5/cufwzV1l8XSu1ghceFjA1DdjV2vJNMNQZmW/0:VUWOT6HIh5iGbive0FRHghJuF8iuqhcb
MD5:	188EA6790EE872DF215C22290502674A
SHA1:	25CB51310E271410DE0AB87DEA397A845E937FD8
SHA-256:	D8D967DBC2C5AEB6E672B26E824D8BDFAACD37B4254A2DAE5F3E2DB320A232C1
SHA-512:	72A3F36D0A5AC53DF3F3CEDA5B7E83B641B7FBFA832DF1A76CB049049D0306DA1DD38553B5F8E116BA9D7FA1A64D7DBFBBA1C14C5F672FC484F68CF30B0738F7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Doors (priced EA)" GUID="{9D3A177A-CCA0-4862-B064-185E0B8C60C2}">.. <Properties>.. <Property Class="Text" GUID="{C1D2D2B8-370E-4CE7-A6B8-C4CE1CC10EF6}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{9D3A177A-CCA0-4862-B064-185E0B8C60C2}</Property>.. <Property Class="Number" GUID="{83CD4FFC-A19B-4805-BC1C-9D664A38159D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{EBC5FF9F-4F27-415F-87A8-E6EF8366FD00}" Name="Form Layout" systemhidden="True" OrderIndex="10" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Width Inches" Order="1" ShowUnits="False" SameLine=&qu

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\08.0 Openings (Div\Doors (Count Takeoff\is-2R8O4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	941
Entropy (8bit):	5.420317019221592
Encrypted:	false
SSDEEP:	24:2d2baYX2D2f2WAdOctku1OcL/4gAWayDbVCoP/CApWcv:cWn06jZicaD
MD5:	D21E9376E4100748829505C5174B30D4
SHA1:	250428CC4182DBF00FE398D90EB3EB4BC1242054
SHA-256:	C6A409009742A11CB805B772E361BAF2B10E7D0199A74A33AD122FD767E11400
SHA-512:	FF8554388F346114D220FABF295730FED92486E64A6FB6C00367F8C4F6CF6ACEC6F41D05DFFE956D45CB474F6B0DEB4B12B35BFB123539AF2C6478A3CBB09034
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Doors (Count Takeoffs)" GUID="{4A6F0A8C-DACB-4234-A00B-4C34CCB20990}">.. <Properties>.. <Property Class="Text" GUID="{66ED0789-9552-4F30-9D92-28568A5588E1}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{4A6F0A8C-DACB-4234-A00B-4C34CCB20990}</Property>.. <Property Class="Number" GUID="{CAF192EF-4C9A-40DD-92D2-B6E936C13CB8}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Type" GUID="{FD25AD23-98E7-4AE1-BCCD-CBE74170215D}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{84ABB1B0-9B07-4B0D-AD41-5F66F44CF401}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Doors (Count Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\08.0 Openings (Div\Windows (Count Takeo\Window (priced EA)\is-IDT1N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	17283
Entropy (8bit):	5.59683519863232
Encrypted:	false
SSDEEP:	384:KlGGk6DiDYz2XWx5LxZ4C/cHf6zd/oSIzjgds3jAjYDdO6uaAxZHx7H:KlGGk6Dicz2XWx5LxZ4uYsCSIz0dscjJ
MD5:	6606C3BDB5CDE399389680DCE54741B4
SHA1:	9DF33E2BB242015C1AACFEBD887FAE95979E79BB
SHA-256:	B91F17198DE812D7C4F2AAEE3E432A8CAA5173EDC0EE51E2ABB225738A90F6A6
SHA-512:	6D67FA64B6989F0B6F2FA13128EB680C4FDBAFD534F01A951106F9AB963BC012D7B6D56B69D0475B0C8E14FB372313635BCE0045E08D5D9CB8122FE72FDCFA5F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Window (priced EA)" GUID="{5F9A5A77-238B-4175-A8A9-0DB3B75C232B}">.. <Properties>.. <Property Class="Text" GUID="{ABA86B8A-6DFF-4B42-B1CD-6E7AA9540ABE}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{5F9A5A77-238B-4175-A8A9-0DB3B75C232B}</Property>.. <Property Class="Number" GUID="{5F26E436-FDFC-4B2C-A7A4-21B6EA231E0B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{7EB1135E-0E9B-4B29-924B-758E10144C5B}" Name="Form Layout" systemhidden="True" OrderIndex="10" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Width Inches" Order="1" ShowUnits="False" SameLine=&q

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\08.0 Openings (Div\Windows (Count Takeo\is-9PNKB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	945
Entropy (8bit):	5.467082097580638
Encrypted:	false
SSDEEP:	24:2d2B0xCX2Y8f2WAdOcRvS1Oc8Z3rRTxI9gAWacj9/CApW1ev:cVCFkSln1K+jRX
MD5:	B277E50202059582D6EFF5E247E7B9E6
SHA1:	1FA982303541ABCF33A566068F9933F18F63D8C7
SHA-256:	713DA07269F84CDF2D02A1EC41FB3ACA23ACB6511893858D9A3CCBD4465753BA
SHA-512:	2D0A591BD2DD796DDEDFE0122F56A0CA933C90A3B1ACE923FFDBB0C9BC3FD72B7BB35CD1F3E2632019DD3CA56BBB0FFFB441AA6C3D40FF73AB55A9C20EA063C3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Windows (Count Takeoffs)" GUID="{BB03FAEE-B883-46B2-8FA1-F7159EB86E75}">.. <Properties>.. <Property Class="Text" GUID="{C2078120-201D-4CE4-93A5-ABAC1AC65201}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{BB03FAEE-B883-46B2-8FA1-F7159EB86E75}</Property>.. <Property Class="Number" GUID="{256BD77E-651F-4316-8B33-D9E1989D2411}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Type" GUID="{E1224496-D3F4-431C-BDD9-2269AFF04280}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{914B253B-59FA-4C23-AF33-D077844973D0}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Windows (Count Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\08.0 Openings (Div\is-J3E55.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	956
Entropy (8bit):	5.450419661055871
Encrypted:	false
SSDEEP:	24:2d2UokouCX2kDQxf2WAdOcmlouN9o1OcVZM0/gAWayV/CApW4oBv:cOHuCRMjHeuN9LNdyZ
MD5:	85D389C198055D3A115849EE59EFC4D7
SHA1:	116E577FD4E8EF09B5AD001B51B88EF5CB8A83D1
SHA-256:	817236C392C120C579EEC051754B81F257EC09CDC0CC20F467173A78D774EAF4
SHA-512:	F3F94D58EC2ED615B2A2EC195052EE96B86AB255648E7544B8B4923C1E1485C957F792AC8787B620EA5B5B6A795BBAE70CC1A0659C8C5B5E90782DE3C5F02B5E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="08.0 Openings (Div 08.00.00)" GUID="{9F691FF3-3C30-4F5A-95D7-4B16D3B5EA34}">.. <Properties>.. <Property Class="Text" GUID="{D42E74FD-A395-4414-932C-570180FD8999}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{9F691FF3-3C30-4F5A-95D7-4B16D3B5EA34}</Property>.. <Property Class="Number" GUID="{96FC217B-AB2E-41C6-BA7E-88AB2A28D817}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">11</Property>.. <Property Class="Type" GUID="{138CEE3B-4945-4BBC-9FC2-7D3E877524C7}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{817B5CBC-A345-4380-9634-3B5998C0D1C7}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">08.0 Openings (Div 08.00.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall (Area Takeof\5%2F8%22 Drywall (priced1\is-0H0ON.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	16157
Entropy (8bit):	5.594793740641899
Encrypted:	false
SSDEEP:	384:DQVd/4YM6YinF8TC2zVXc9Bkq5+eHO9yk2RZDjUaDhfXteNqL:Dkd/4YM6YinF8TC2zNsrjO9yXRZ86fXp
MD5:	45D2961CCB8E78E0BA9243ED6EF2F78E
SHA1:	D0DFC63E02CB6CC1F17B5D6BC8723A78712FC8AB
SHA-256:	72146E9D87B9FFA97B48577DE29F585B2D6337BA89560F3F4A587FE0275BD916
SHA-512:	6775AC6960F9AFCDD48A60AF92F470DAFE66A550520A11B59DCC79FD4BF6326F8AA2A1949AAA4CC27C090BC7496F6930C9CE8BECA4AA1BF2FB1842EA825A9854
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="5/8" Drywall (priced per SQ FT)" GUID="{53E7E605-EE3F-492D-912D-BF7CA6258111}">.. <Properties>.. <Property Class="Text" GUID="{4508FAC9-0F7F-4350-AEE0-E802F2A4C29D}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{53E7E605-EE3F-492D-912D-BF7CA6258111}</Property>.. <Property Class="Number" GUID="{97308338-6C2B-4249-906B-3C5BCC48E382}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{A18498DA-0FC2-4448-9945-90A707F77A90}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall (Area Takeof\5%2F8%22 Drywall (priced\is-7TFTV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16141
Entropy (8bit):	5.593355909967916
Encrypted:	false
SSDEEP:	384:MT3j5KgOQ44c7g3lNbXcHBrqZlSV8xa92UmbjUwDhfPs2buL:MT3j5KgOQ44c7g3lNDiu+V8UcUmkYfP+
MD5:	4B236018DB2764790A7944FE10314702
SHA1:	6370A21CBF907C1C93A7F6138D6EF654657CA5B3
SHA-256:	61084CD12A0F6117560C6ED2E31EF1D84208B9526A8B4DB6BE77FA823969F1E6
SHA-512:	C26C0B97D6ECCFCAEC42C7E602D1D5495FBC27B4F72EA9B8D52E95FF00133A4CD298A02846E9B4F18E440E46BC30C3CD421785553D63921520F85DEDDC034423
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="5/8" Drywall (priced EA)" GUID="{32802ECE-7E94-4073-BF8D-6F4B81CC3135}">.. <Properties>.. <Property Class="Text" GUID="{18AD30B1-B0A3-4EE9-87F4-5D2340035BDA}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{32802ECE-7E94-4073-BF8D-6F4B81CC3135}</Property>.. <Property Class="Number" GUID="{662204DB-7466-465E-BC19-4890D3C25324}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{E6B10883-C678-4728-967A-2D1373DB2453}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False" SameLin

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall (Area Takeof\5%2F8%22 Drywall Type X1\is-4D0QA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	16171
Entropy (8bit):	5.594990306600085
Encrypted:	false
SSDEEP:	384:4akiuP4weoVCO4NlpRUBXcsBmqgfaJDCIg2IrrBjUUDhcMrgDY0L:4jiuP4weoVCO4NlpRUBFRrJDCILIrrKZ
MD5:	CF94FBD0A37F89C3FE6C06D758FF2A55
SHA1:	8BB120489C2EBE30ACCFFE01F197BA7C8D09FD90
SHA-256:	3EE8D4D6DAAF3BD32C762378CC1DBF036869417F54ECAB2A4A8F8AFF42E82BF6
SHA-512:	B0D41D4B4E760669223C2F84ADB1FFABD27E477053B8F17DA3B7B46833D376C3A608108080A58235E07A79CFB9E76872DDA96AE2C3AFEDD044E178E78E4A8139
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="5/8" Drywall Type X (priced per SQ FT)" GUID="{FFE9EB88-2DAD-4487-994C-43DF3DA1A969}">.. <Properties>.. <Property Class="Text" GUID="{AE764DA8-DCF5-408A-83BC-E1E34D45C997}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{FFE9EB88-2DAD-4487-994C-43DF3DA1A969}</Property>.. <Property Class="Number" GUID="{DE1BC0C2-31AF-4A71-822A-7DE59351E052}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Memo" GUID="{2590C556-1B5C-4EB8-8F7B-484CFFD71BB1}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall (Area Takeof\5%2F8%22 Drywall Type X\is-4BTIP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16155
Entropy (8bit):	5.595394411048056
Encrypted:	false
SSDEEP:	384:BnLrEKbswSyiNcKKFQV2XcsBwqzPHjjDAN2+M7jUtDhUhU4kVjIL:BLrEKbswSyiNcKKFQVCRn/jDAM+ME7mB
MD5:	0B5C47F2817F627C926669E2DB33B21E
SHA1:	886D95F6236F128D12E09C3E4FE1CA036C9783F8
SHA-256:	9099D0F9EDC838A4A12538C4EDAB5D17237D496CEA772A6DEC1F0531CFB411FD
SHA-512:	90A5271ECD2BA3A597B396B901B5631436B92B8537891876C7AE0DC989FC2355BADA816BE77A84CD5602D1539662702DF8753181AE132495573AB181405FC7AF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="5/8" Drywall Type X (priced EA)" GUID="{67C515A5-AB5A-4322-95BB-88F664AC54C3}">.. <Properties>.. <Property Class="Text" GUID="{8C5B9155-DF30-42A9-A7A5-7B8A90731546}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{67C515A5-AB5A-4322-95BB-88F664AC54C3}</Property>.. <Property Class="Number" GUID="{13F6281E-D0F3-463E-899A-A1B6B19C000C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{B19654AC-C9AF-4A02-A758-4B7F23CABFC4}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall (Area Takeof\Drywall Fasteners (p\is-H4OQA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16152
Entropy (8bit):	5.5892673376848805
Encrypted:	false
SSDEEP:	384:YPIVOshtrRHUIIDYatXccBvqq32R5ihHG2pXHjUUIDhIjCuKL:YPIVOshtrRHUIIDYaVliBvihHBpX4DIm
MD5:	40B3CE2BC1780CD6DAA6295FB7C78A8A
SHA1:	CD55C1628EAD983682A1AF30B2BC5AE122426927
SHA-256:	F12BF4A9FC1E646A640C651DD88CB8F2BFB094E5462EA00A2536E3FD10C49651
SHA-512:	17F9778718ABCC76AEF66F9CB11DE8796C5A0F3552C61EFF42EB7EAB339DD94EDB93D5A161A2313A62B503184F0C364951FE146CA0B4823A3A3E13479B715E19
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Drywall Fasteners (priced EA)" GUID="{64803A63-8CED-48E2-9B98-F77CBA01CBEA}">.. <Properties>.. <Property Class="Text" GUID="{1490F5A9-453C-4C7A-BCBB-2AB5580E9064}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{64803A63-8CED-48E2-9B98-F77CBA01CBEA}</Property>.. <Property Class="Number" GUID="{3D32E529-91DB-4AE9-A342-5CC3F5E14A55}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">6</Property>.. <Property Class="Memo" GUID="{DF8C5622-3A1A-497B-B1A4-6A9D9F0373CF}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Pitch" Order="1" ShowUnits="True&quo

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall (Area Takeof\Joint Compound (pric\is-LOVTI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16269
Entropy (8bit):	5.589498731372455
Encrypted:	false
SSDEEP:	384:Snj6CJh9DggeSiMg8fJMgn5GsC7Xc3BbqV2Xu2cVH/Z2OJkjUhDhU6pONKL:Mpdg3SiMg8fJMgn5GsCjq+VocVHIOJZh
MD5:	8925F843A67BD18F4E84A04D612D641D
SHA1:	C47650327EC1412196DAA8D7B514F4ABB1BE7D3F
SHA-256:	1448F486540C3FE01BEAFE97A0BD5CAE740C40B9E76BD778C1A3E4D58740FA00
SHA-512:	AB4D99EE2E7802148DA09329353E5515DEF72A163B62B5BBFDFE7F749D11CC13E8D22AE3B12C63EBADAC69CA79909493D58939B17D9D9A25BADD79B1E1E88721
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Joint Compound (priced EA)" GUID="{5743DCB7-E3C3-4B63-B4AA-B690E07E8A1B}">.. <Properties>.. <Property Class="Text" GUID="{F0270790-8017-4DBE-8DE7-F34330BC4076}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{5743DCB7-E3C3-4B63-B4AA-B690E07E8A1B}</Property>.. <Property Class="Number" GUID="{71CD484D-EBE9-47ED-9130-F158340C40B9}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{E74B4750-BFD5-45E2-B781-26535E0766CF}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Pitch" Order="1" ShowUnits="True"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall (Area Takeof\Joint Tape (priced E\is-BSMTU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16136
Entropy (8bit):	5.5910755898238484
Encrypted:	false
SSDEEP:	384:v8z1AHbTdD0ihs6EJpqxXc7fBIqptpljM827mLIjUpDhAyiyaBnL:v8z1AHbTdD0ihs6EJpM6PhljMv7mLl/S
MD5:	1254F0BA33B871480FF6B47B3D617A45
SHA1:	6B8EFEF610DC86E438AEA1764BCB9C0451178818
SHA-256:	37F74D10C2AD113A83B192E09CE0D1EDE3DCEA2C66BDE6C255251516A084B882
SHA-512:	ED3DE91A96C2FA6E97FF3FEBAC2CA78724699A7665990196D08AE0FDA6BB676B950755D89D9A0F1B3D0798FB9CE24BAE544C2795B0D59A2E6ABE024DBCE95C23
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Joint Tape (priced EA)" GUID="{F368805F-99F3-426C-82BA-5BC5D92C7C7E}">.. <Properties>.. <Property Class="Text" GUID="{1F271C65-84CF-46E8-93A1-0BEEEC0D7100}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{F368805F-99F3-426C-82BA-5BC5D92C7C7E}</Property>.. <Property Class="Number" GUID="{5A6890A0-8652-4F8D-AECF-7AC2310D9344}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">5</Property>.. <Property Class="Memo" GUID="{F3499545-9F9C-47A9-B3DC-40D46E9F46C6}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Pitch" Order="1" ShowUnits="True" Same

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall (Area Takeof\is-Q64T8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	943
Entropy (8bit):	5.444552096195197
Encrypted:	false
SSDEEP:	24:2d2JkjeziX2Znf2WAdOc+BfLd61OcLQ1d8gAWabN/CApW27v:csi0fjdVpduj
MD5:	083BE2CB13DD3B2289F18F4FD3EDBB56
SHA1:	46791DB20A1D972C366DAFEA9CD718DEDE3B6B5B
SHA-256:	50CB7571F112B9D66ECBD3DDF8EB9169D7B2F3CD77792207FB950B473E630A66
SHA-512:	0944945FB0A0C160DC40D7CCE966F258DCF826444A09197480AC6D3631DD4BC1060F0E7955560CC59FD49FF8B82F12041E80C9F3EB8AA4DD4FD7AD62AD0517AC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Drywall (Area Takeoffs)" GUID="{1BC149DE-1687-4771-A65A-6A56C6427654}">.. <Properties>.. <Property Class="Text" GUID="{646DC5CF-8A1E-4158-9315-DD0BD62B4E0C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{1BC149DE-1687-4771-A65A-6A56C6427654}</Property>.. <Property Class="Number" GUID="{F953913F-777B-4FA9-9887-6FCCC5A03D8B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Type" GUID="{B2520C53-703E-4922-B3ED-1EE2F8EAF671}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{4DF01509-A466-4750-B817-154C2B56A373}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Drywall (Area Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall (Count Takeo\Corner Bead (priced1\is-V0Q4V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15847
Entropy (8bit):	5.586688049137782
Encrypted:	false
SSDEEP:	384:S6uQAY6zsDViKJ+RYftQa6cMKMzaojDVTSC0ELs2sCBdcRM1BZD9TH:JuQAY6zsDViKJ+RYftQbm6aKTSCVLs2z
MD5:	DE19ECC198463CBCB027FD68FE43DE81
SHA1:	36DDF4FB09B5EC41BAC59C8D1E9BBA34D1D68B41
SHA-256:	694C3769981F25CAF110550CCB89ED6C5EF021FC3906A7B428BE191FD4BD0C65
SHA-512:	3E089E3C598EB8C0A0A8B2B50FB74C122F5FD6DD367ABC17B78BC3DBF650ACC70CBC972D24F179E3AE24C61958957B61DB31BC703CC56B3500F00FB576921BC4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Corner Bead (priced Linear FT)" GUID="{95ABD4A6-8976-4319-B1BD-0CA9DD58397F}">.. <Properties>.. <Property Class="Text" GUID="{CAB410C7-1CE2-4D51-A738-0D9FDB86EE7A}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{95ABD4A6-8976-4319-B1BD-0CA9DD58397F}</Property>.. <Property Class="Number" GUID="{37C6E889-71D4-4237-917C-FBD7DD2A555D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{3B4E6545-6083-4BA6-B796-FD6F26E8884E}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall (Count Takeo\Corner Bead (priced\is-E3Q77.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15833
Entropy (8bit):	5.585312864644742
Encrypted:	false
SSDEEP:	384:vVGvFsvxABOczv+mcaBII6cvK/zHmIvC7cEIvvCCdWNg0KJtZ8+JH:vVGvFsvxABOczv+VaBIZZbVvC79Iv6qH
MD5:	41096C911BCA8140D9A441358DF5F4FF
SHA1:	6DCC949AB259326C7DDB05C67F45F5CE9C83A263
SHA-256:	F4E64D02A2638E9B93A45E810400E3B1AB32CA483AF6B7CC852A6A55CBC96C96
SHA-512:	4F962469205D01DBFB844D3BD909597BD00EC40D46E49498DD20AF0F770E54DDA1992F7BE01A21C7DD1914C9A312CC70B89A525E7F8C2F5F931BFD7C724B3DD1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Corner Bead (priced EA)" GUID="{124C1A68-1B0C-4113-B754-66B938A9B4FA}">.. <Properties>.. <Property Class="Text" GUID="{E13936D2-6AC6-42DA-98D3-B49F777A635D}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{124C1A68-1B0C-4113-B754-66B938A9B4FA}</Property>.. <Property Class="Number" GUID="{D92635EF-4A5A-409F-BEB4-29B8356D1C5B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{5542A5F9-44D4-4DCE-A177-C61C907665E8}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False" SameLi

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall (Count Takeo\is-T0JH3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	945
Entropy (8bit):	5.461131255765807
Encrypted:	false
SSDEEP:	24:2d2JkzoRX2/f2WAdOcIE1OcIMnrfgAWaa/CApW2rv:cQRC/HNmmD
MD5:	F0AABDC72A5DFE2079B2293C782A751D
SHA1:	3DB81C7680DB8A0794FB5611596FF4896B7A6C86
SHA-256:	904347602AA939712471B7A691D6D2C32C306266BB233667AB510AFD7861B09C
SHA-512:	4EF67C25CA3211CDB654D129FDEC4175B501A13A87EB4BFE672568069B59E4E989D3D50AEFE606547079FD0ECF8943A1768775CF34F6D65EA7478C9D4F5FCA5E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Drywall (Count Takeoffs)" GUID="{9617E380-4A1B-4143-B193-E622809F6C8F}">.. <Properties>.. <Property Class="Text" GUID="{EC907B50-AB0A-4FB3-BC3A-594E7B9EBD6C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{9617E380-4A1B-4143-B193-E622809F6C8F}</Property>.. <Property Class="Number" GUID="{4E58B827-F5A0-452E-B139-6705849B749E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Type" GUID="{19087C91-FEF9-4ACB-B27B-4AC5DB18708A}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{47C67D80-3396-4660-8A2E-F835FB713AE4}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Drywall (Count Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall (Linear%2FSegm\5%2F8%22 Drywall (priced1\is-A4G6B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	16272
Entropy (8bit):	5.593758094976168
Encrypted:	false
SSDEEP:	384:EeO793Xq3mfxPXH0SdkBIe6cCKRziVlKoUKEKMICTdZ70nEZdpQH:EeO9nq3AxPXH0SdkBI3ghoKoUbKMLpZc
MD5:	11DF13AFE36DC6E454429D70D5F3A57A
SHA1:	F70E92B2D29D3C50FE7FEE09E9329E45731AF124
SHA-256:	8978183D9F6C86B46EE4ED5CC60FD68870097C4826066E57E3233789E91A9CBE
SHA-512:	B8F89C0963587AAED17014F1A494F8F00C06008ED81C305129A5A714BE5461C206DA7FE56F132F64F023367FB278A1C814E4B84C15519FC3943EF840BEC88AB8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="5/8" Drywall (priced SQ FT)" GUID="{78187D94-CC28-4E6C-9C9C-D5A9837D6B55}">.. <Properties>.. <Property Class="Text" GUID="{B7D99227-DDD3-4BFA-96BC-2814062AE45D}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{78187D94-CC28-4E6C-9C9C-D5A9837D6B55}</Property>.. <Property Class="Number" GUID="{0D709E39-0164-4733-AB0E-0A8DF715222D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{07EAE18D-D151-47FB-BD25-4ED96931AD6F}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides" Order="1" ShowUnits="F

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall (Linear%2FSegm\5%2F8%22 Drywall (priced\is-1348B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16266
Entropy (8bit):	5.593828120014622
Encrypted:	false
SSDEEP:	384:2AnpCei6PpdfLJcpkFz1M6cUK/zfwA/lkclE3uDCjdw4z3qSZnXZzH:2spCei2pdfLJcpkR1FObD/lkcK3um5VV
MD5:	8E5E9DF890AA52912A79F8047C0187CE
SHA1:	2C30424F19633A34ABF79AA6A21450F0E998BC48
SHA-256:	10313F1465278D38BEEAC4CA6D2E92ACB8822574D5983C171BD7DCC48ACB701E
SHA-512:	2E32377A318EF19967FC2727624AE03276D969E46FFD99DB18F87845437711CF0CE43E303B8B8525C3930AFF51F75E21F2D59DABD488445C96408647BD23BD3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="5/8" Drywall (priced EA)" GUID="{3B050C54-3570-4CB9-9298-7D437B10F064}">.. <Properties>.. <Property Class="Text" GUID="{9A69089A-B962-466A-AD71-05268FD1C5F3}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{3B050C54-3570-4CB9-9298-7D437B10F064}</Property>.. <Property Class="Number" GUID="{E1FF9E76-957C-4660-9CB8-E8A5165D0A4E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{AE614699-C8F9-4193-A6BA-CCF7FC19AFD9}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides" Order="1" ShowUnits="Fals

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall (Linear%2FSegm\5%2F8%22 Drywall Type X1\is-GBKML.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	16286
Entropy (8bit):	5.596267739249068
Encrypted:	false
SSDEEP:	384:dIv7w5uHSnfXJsdROT60Te6cHKOzEa2HalRE5LsC/vddy0lM7ZoHVH:uv7w5uHSfXJOROT60T3JQCHalO5Ln9dL
MD5:	74DBD6AAE502D1AFEF23A8DBC814B550
SHA1:	6E72688D34EB322BB33DF426D6861D1CB747DF62
SHA-256:	3EF2127965E0181EE116AF9C1E69BFDC8041BAA06CEAC2AFBFD3F14BDB483A14
SHA-512:	7CAF90BD8C72B1668BD09B62ADDD8EA24166C60CAC6C3ACF63C42C455F22DBF449E573F59044C9ABB721B79F89F6078A4958C1750D9009247E73C0675F86AD9D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="5/8" Drywall Type X (priced SQ FT)" GUID="{0ADF627F-1AB1-4887-91DC-967AB816D317}">.. <Properties>.. <Property Class="Text" GUID="{3FDAEAE3-4635-416C-AC2B-197ACD0CD411}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{0ADF627F-1AB1-4887-91DC-967AB816D317}</Property>.. <Property Class="Number" GUID="{7F8DFC8B-4A9D-453F-8DC9-98548E790640}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{3DA05F9C-BFC0-4A7D-9446-3DD9E9918C67}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides" Order="1" ShowUnits=

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall (Linear%2FSegm\5%2F8%22 Drywall Type X\is-EJJNM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16280
Entropy (8bit):	5.596210230579653
Encrypted:	false
SSDEEP:	384:yRVft237m0eEwWsmB9zda03X6chKPz3xB3uq9vEkaJWCkdC1nsgZpor9H:yRht237m0eEwWJB9zda0abLbuq9stJB8
MD5:	B52C4952E8900ADEB5B107FC0FA30E1D
SHA1:	76EDC0755E896B23479BC970333FD3EB2E4332E0
SHA-256:	344CAA104F210FBD58854B9D85267EC826E06E945B084C794F0F2260385B683A
SHA-512:	3AD6AB853B7159723D5560B37AFB162C422E42DDD1B3F4808502724F52C6EEE4D768A5F7EA198DC22A27C2C11FEC06D55E513EFAE7965300A0F8B835A1E03ABC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="5/8" Drywall Type X (priced EA)" GUID="{92852F90-EC56-4770-8DC8-2DF36CC10DD0}">.. <Properties>.. <Property Class="Text" GUID="{5EAE5A56-F21C-4477-B24F-28AE35634C21}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{92852F90-EC56-4770-8DC8-2DF36CC10DD0}</Property>.. <Property Class="Number" GUID="{1A1E9C8D-BEBA-4376-BB7C-ED7FF6016B4E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{DD825AA6-3BD4-424C-9CF5-3BF3288F720F}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides" Order="1" ShowUnits=&qu

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall (Linear%2FSegm\Drywall Fasteners (p\is-DIDQO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16270
Entropy (8bit):	5.590484557357516
Encrypted:	false
SSDEEP:	384:TrqLAjrEzXZzAXDXWeOaXckBUqNsy7gdWb2B/rjU4DhJXIfwnL:TrqLAHEzXZzAXDXWeOOt7+WgdWCB/0Q1
MD5:	6A198B1F49644EEA2FB7E99EC76EA9D8
SHA1:	69ED8AB37E81F9AA962F1CB94529AD9D944B11AF
SHA-256:	6811831E8E26A84B2F2AE27A90223A4B65DA4E5FA36888556811C07555C919D6
SHA-512:	5179827D28D6F7D3F5029BD83F217BF53862D1C8F085868A7CFDB68DD233957189049A19B71F9E9FE2C1F934AC0CC53A7EE64E924671D457572AD2BBD4211CA6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Drywall Fasteners (priced EA)" GUID="{3FC96EE4-8049-4A1F-8FCE-2A60F39DC01F}">.. <Properties>.. <Property Class="Text" GUID="{7B43B910-5141-4256-9E84-790A3F8A8275}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{3FC96EE4-8049-4A1F-8FCE-2A60F39DC01F}</Property>.. <Property Class="Number" GUID="{89BDADFC-ADD8-4C79-9BCE-CADFDEC41158}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Memo" GUID="{4A505A5F-0B33-4596-9A31-C8CE727559B7}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides" Order="1" ShowUnits="Fals

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall (Linear%2FSegm\Joint Compound (pric\is-NEOTG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16266
Entropy (8bit):	5.591675067253554
Encrypted:	false
SSDEEP:	384:SGyNBOvgNHtTSwoPGomaXMXcmBiq6PKj2ok2BmmejUKDhzC9pLI1L:+3OvgNHtTSwoPGomaXYDNxj2oXBmmbqb
MD5:	66C669E4F6EFFE2B0C19EF09ACD17C62
SHA1:	F3993AA414B4F27D6C8631324E70F588ED3BA668
SHA-256:	CACA956285C2D121B6E752EBBA6C7C6FEFC9B66A5DA54652643EDE0AD9BA7E44
SHA-512:	3E108C5C7C485FC71F7910C88B46FDD84448F73E757E37AB00FE95E622F6369AA845587E559F26F77D17FBF3C777F13505B3850C9A60D86FC30C342B4521D3EB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Joint Compound (priced EA)" GUID="{58662B30-0CBB-4EEE-AFE3-8C0237AA28E8}">.. <Properties>.. <Property Class="Text" GUID="{3E32091B-0743-4E47-9AB1-999029D54908}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{58662B30-0CBB-4EEE-AFE3-8C0237AA28E8}</Property>.. <Property Class="Number" GUID="{42872951-175A-4D5B-9FE4-30BFEFF51632}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">6</Property>.. <Property Class="Memo" GUID="{58F44F1C-E376-46CC-A3A1-BFEC0FE5E0D1}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides" Order="1" ShowUnits="False&q

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall (Linear%2FSegm\Joint Tape (priced E\is-VMRIG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16258
Entropy (8bit):	5.591580033638411
Encrypted:	false
SSDEEP:	384:T2e/0TuZS4rehLl+3P4MnXc/BjqJd73HQr2XzWjUuDhBi4AjnJL:T2o0TuZS4rehLl+3P4MXK2X3HQyXzjGw
MD5:	0266D7A390E43D6E6D3938D90F6241DA
SHA1:	E04CD9A7CDC4AFFDEB8C9B9AD956BB690D68539A
SHA-256:	8D424490B8C90ACBE8766B36CDBBFF30928EB6A1561DDB4349E93703C0F8AFF8
SHA-512:	035E6B70F7A7EC8ED6BA0D169239279814EF1508E2EF490B9CB71EC98BCEF50943D9C8EFD41111D6F71D7DFD82EF9C5465FACD89AC712812B9984BABD491C1A0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Joint Tape (priced EA)" GUID="{C1409C2A-97D9-4E85-A2C8-16FB8DB10BEC}">.. <Properties>.. <Property Class="Text" GUID="{6BFCBF16-6389-49BE-9C37-E742F66F28DD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{C1409C2A-97D9-4E85-A2C8-16FB8DB10BEC}</Property>.. <Property Class="Number" GUID="{C877EAEE-E414-4AFE-ADDB-D1602AF519F7}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">5</Property>.. <Property Class="Memo" GUID="{15A804C3-2DF0-4C76-BA3F-AF328FCBAC56}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides" Order="1" ShowUnits="False"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall (Linear%2FSegm\is-U9Q5V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	963
Entropy (8bit):	5.463340409884256
Encrypted:	false
SSDEEP:	24:2d2JkJMnX+X2ysD9f2WAdOcsn/8a11Oc8Zmt5gAWa6LyL9/CApW2Rv:cSnX+9G/rnBqWtoOLRh
MD5:	B1DC7966E854F4C3131844A58DE7EDDC
SHA1:	5D4E2445D63D54A170AD7C996285BC052CDD3338
SHA-256:	A2D8706D7D9DC950AA1D8A7A6EF4DAF23759EABC37FBC3452DD9C9AC3224D1FD
SHA-512:	1A520A5DCEEC38E2B06F5829E34C5B3D839B6A4B0970E29DB786413F75B1A1D2E9A650FAA22D0A4B8C41E3BD2E929E5298C4577BD9B76C76CBE68BE8D5E60E18
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Drywall (Linear/Segment Takeoffs)" GUID="{19AFD32F-9727-4B6A-B5A2-81012963065C}">.. <Properties>.. <Property Class="Text" GUID="{A9694716-AA4B-41F4-8219-86B54862B65F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{19AFD32F-9727-4B6A-B5A2-81012963065C}</Property>.. <Property Class="Number" GUID="{DAAE473C-F9B6-49D4-810D-C35629893F63}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Type" GUID="{EA3BC324-11B1-4DFE-AD44-27BD871688F3}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{0DF87796-25DF-4590-BB0A-767F4719EE80}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Drywall (Linear/Segment Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall Parts (Inher\Drywall Fasteners (p\is-E6KN5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16568
Entropy (8bit):	5.5902281427868425
Encrypted:	false
SSDEEP:	384:3bzrfYSEaGlO9SPwyYoQ7XcpBRGqk1Jl+Xv22cxjjUSDh0Id0exL:vrfYSEaGlO9SPwyYoQjo3k5+XvRcxciv
MD5:	69D3B78F597F202EE94D654671A717FA
SHA1:	E949160E26D1228FF301B8707022A2BF1978175A
SHA-256:	0F6228931F2E1240950FF5BA911C98CCA49EC719E0395384B97368D6F6DA610B
SHA-512:	44380667193AE5C897008F6B2A94286B54512CD2AB6C385BB2884A45A08886EA14D6D33121FE0AEC52B156C6F29ABAA8D5B1120F5B25079FCFB737987FC7F6A4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Drywall Fasteners (priced per Box)" GUID="{28BCD8B2-0588-4523-A03E-10DE1D2BD763}">.. <Properties>.. <Property Class="Text" GUID="{61BF4A74-179E-4658-A420-F0376637966F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{28BCD8B2-0588-4523-A03E-10DE1D2BD763}</Property>.. <Property Class="Number" GUID="{98CF3093-1B6D-4246-B863-078FEEB1C957}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{CC67BFF7-8423-48A6-85EF-45C752F925BB}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# per Box" Order="1" ShowUnits=&quot

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall Parts (Inher\is-1I8VO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	975
Entropy (8bit):	5.409577696205192
Encrypted:	false
SSDEEP:	24:2d2JcBIPX2t6ff2WAdOc2Ij8b1OcCA9wlgAWaTsZ/CApWOUv:czBydl98NF2lX2
MD5:	763F06B7EC3461032AB19C7309B0A0CE
SHA1:	A84E3E219C36FF8EF25E47DA74DC72C11F7DBDBA
SHA-256:	DBD891BD8BFCB95085B193BB9A522811C8CA566A9D4FE1BAC2EF494298415FDF
SHA-512:	D6F5489A616B3D0FA6508AEA6CB4C7342DAEDCEA851CC44E20473416B688C2C154AF0C3EB114AE2CA9EBA0CAB03A43B674870EB621053BFECD1BD14A66AC1A8B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Drywall Parts (Inherit Qty From Parent)" GUID="{24026CAF-9EE6-433B-80F5-BA95393ED7A7}">.. <Properties>.. <Property Class="Text" GUID="{3B52064A-6E6F-4EFB-94E2-D49164519BDE}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{24026CAF-9EE6-433B-80F5-BA95393ED7A7}</Property>.. <Property Class="Number" GUID="{EEEDCC0A-46C6-44D4-9058-4DF6D8190D83}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Type" GUID="{D4A19D99-5CBA-45F2-9DDA-CE3B0F3C02CF}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{AB80B46B-AC2B-445F-A927-74ACE3054F48}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Drywall Parts (Inherit Qty From Parent)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall Parts (Manua\22%22 Magic Trowel\is-89H65.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	15121
Entropy (8bit):	5.589858092288373
Encrypted:	false
SSDEEP:	384:HK94ko741d7+sbcsn5SNXcsJBJlmHjQlOnP2RVvDjUaDh9JQf48L:HKqko741d7+s4sn5S1PJ6COn+R586fQn
MD5:	8F9C435B7E6B89F57C1014B7A3CB5D53
SHA1:	8FB25204A6CD7F860A450E6A7054C16119954E53
SHA-256:	9F7AD10DF1E9B8790337C19968BF38B6CEE2FDF3CA623CE3809BC2926EBAE32F
SHA-512:	7CA3321FDA62FDAC3A615A7288946B11169C10B03023579755A5513409FC414406833689FF50C206DCA6BEADB78EC6539691EBCFAEFD883DD192684910AD3D5A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="22" Magic Trowel" GUID="{50C3BBC5-45E3-4D23-9CCF-112133B6A89B}">.. <Properties>.. <Property Class="Text" GUID="{AD10A12A-B7B5-4539-A84F-87A92FCB3F3F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{50C3BBC5-45E3-4D23-9CCF-112133B6A89B}</Property>.. <Property Class="Number" GUID="{50AEE61C-6008-4821-9D69-BACE2F3067BD}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Memo" GUID="{FD118C78-9F9D-4927-A404-6786596A6AA0}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Manual Qty" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False" SameLin

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall Parts (Manua\Drywall Fasteners (p\is-S1CKV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	15907
Entropy (8bit):	5.587627744305253
Encrypted:	false
SSDEEP:	384:uh7yNUw0J/LiIL3iTxGJcnGXclwBNgqh7EZT/DwEC23UN8jUeDhPEjWbYL:gyNUw0J/2IL3iTxGJcnSE2N3K5/UE13g
MD5:	51F4221EB28A08D487A1214EC695C7E6
SHA1:	930CACC843F808BA8A56E1B94DD2BA60066215A8
SHA-256:	CFAF4F23365EB745E4CA57E0705C2C90B01ADD53FFC980EA42C43BD7D3E2FE1B
SHA-512:	29AED0289051026849B130A1EEABD387194917F4B0CEE7F79AC65848F238CEAF96061D5677A6F90D952FD937B2922A6F9DACDFE7983C7D005685173CD76B4D88
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Drywall Fasteners (priced EA)" GUID="{32DBB89D-A3D4-42F1-A8E5-F105E5EA46DF}">.. <Properties>.. <Property Class="Text" GUID="{BE3BB4BA-CAC5-4128-9B92-D90F092726DC}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{32DBB89D-A3D4-42F1-A8E5-F105E5EA46DF}</Property>.. <Property Class="Number" GUID="{79CFFB8D-191B-4275-A4E6-FB27A30AFA93}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{55BB0C3B-D555-4A13-B6F1-3EF1228348A8}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Manual Qty" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False" S

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall Parts (Manua\Joint Compound (pric\is-QTT08.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	15904
Entropy (8bit):	5.587589637614198
Encrypted:	false
SSDEEP:	384:ST0cZoBiMx9eCysIXCfYJ6gXcsBMqr3ALgNA92CkNjUBDhPSbBLpL:EzoBiMyCysIXCfYJ6EZD0LgNAcCk+HPE
MD5:	0A6FE49FE2662FE675C7A8524AAA97F7
SHA1:	FE76F28FF72457806CD9E7446C35E7C8917668D4
SHA-256:	F6E5BCAA303DEA6D7F4C3944BC64A5BF9BA1D484EF76209AAE77D5D14A9AE9D8
SHA-512:	5B7DDBF6217A32C7E555B9EC7D300936885A90D864DAD341DF45B496FD0FC045CDFBC6936002BBFC995CDFA84C82DB36DB160592EEE9A5C00ACAE46E66C1FD4E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Joint Compound (priced EA)" GUID="{587A903D-7509-4DF0-A489-BCEEDF54B119}">.. <Properties>.. <Property Class="Text" GUID="{7A6E49D8-65AC-466E-946E-AF7AC3807845}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{587A903D-7509-4DF0-A489-BCEEDF54B119}</Property>.. <Property Class="Number" GUID="{89839B4B-579A-4F2A-97DB-778B25E05E95}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{E4CFA27F-B75F-4B6A-AB53-168D83D37155}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Manual Qty" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False" Same

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall Parts (Manua\Joint Tape (priced E\is-UFPUS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	15896
Entropy (8bit):	5.5883709046455445
Encrypted:	false
SSDEEP:	384:WXT/B4UABbySrvSoVefXcfBEq+UC0UtnwK2kQRjUBDhJlvfusdL:WXT/B4UABbySrvSoVefSLfUtnw9kQaH9
MD5:	D58EE8CF30042D3544A9E8C14D20CC5B
SHA1:	3B4D5223A4641153EF1665D35F5A06BC69E761F9
SHA-256:	5C227E0F7879A5EC1A97B991D642AC73EB98C1EF0970FBDFE3A2517C047D50B9
SHA-512:	2DBF48ED4F7C84AD9D9E722702439345374C386F00789F4B69D2BA211F4C3F50883CC0F1B26A2BCBBF46B61AB857FEA72DF7352DC7EB201CC51A939FCBAB4C73
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Joint Tape (priced EA)" GUID="{4A024662-0C19-452C-A0D6-B9130187BDC1}">.. <Properties>.. <Property Class="Text" GUID="{DA469E5E-1FAD-478C-8191-E421FBCEB944}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{4A024662-0C19-452C-A0D6-B9130187BDC1}</Property>.. <Property Class="Number" GUID="{5E6E5042-0C96-4832-8D0C-CCDB952E030C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{1CF938FB-A227-409F-A3C9-BD37198A6F8D}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Manual Qty" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False" SameLine

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall Parts (Manua\Kraft Drywall Banjo\is-J8ANC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	15144
Entropy (8bit):	5.592028238498496
Encrypted:	false
SSDEEP:	384:O1xDAjbNsxOgI//p1yaNzb1XcGB5jf7zNo/G20mAjUtDhZ/GLgxL:O1xDebNsxOgS/p1yaNvt7tzu/B0mN7ZB
MD5:	D48610345BD55A17A0AA392792763A3E
SHA1:	88C24FBBE0800047F62A88CD9883964A94D59FA5
SHA-256:	03DCEEA3E739F20F3C1D97513BEAE205194303BC7B7AA36602065BDAA1923E4F
SHA-512:	CC0BEE861D9B3166B385DBC0CADA2C5C0A3F88D6FE993AB9ECE1D08A059106B37133961373AA245EEBB49D81668FCEE8240AE5498D4A16F54AE45AFBCB02E87B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Kraft Drywall Banjo for taping" GUID="{55776356-0DA3-4759-A267-6A29E8694CC7}">.. <Properties>.. <Property Class="Text" GUID="{CE291657-14E2-4269-89B5-37C9668E53C3}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{55776356-0DA3-4759-A267-6A29E8694CC7}</Property>.. <Property Class="Number" GUID="{5A72F511-3ACA-4952-B2FD-B8C9D27C2849}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{9F15B82C-E5A3-4338-BB54-A5E4FF5AFF9C}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Manual Qty" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False&quot

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\Drywall Parts (Manua\is-G22ME.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	949
Entropy (8bit):	5.426531559484425
Encrypted:	false
SSDEEP:	24:2d2Jc6dynX2bSf2WAdOcz0p1OcaumdgAWa6LaJ/CApWO5Jv:czCe82fO91X5h
MD5:	4358800EC2EEB4F743C232336C518531
SHA1:	5840F4F3E68797ADE56E000F42C7AAE8C54C651B
SHA-256:	D8BB23D4B9E533DD85B298BFE4B80AFB1647EE9454E61FBEA7FE043F58700969
SHA-512:	11BEA31E135F6935B9857F3C0E279D0D9235F97A78A451AB8B5722AC52A7765F4F21F542C2F390685E985F94C9043510BEEA5FEA606F6E233300C79AC32DBF71
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Drywall Parts (Manual Qty)" GUID="{A96B4406-9247-446C-8C06-656772DCA010}">.. <Properties>.. <Property Class="Text" GUID="{A8C047BC-26DE-4D75-AD0C-1B8FEFB2D165}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{A96B4406-9247-446C-8C06-656772DCA010}</Property>.. <Property Class="Number" GUID="{1BC6DCE6-DB2D-407F-A328-EB21A353684C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Type" GUID="{51E21661-29A6-406A-B82E-EB75D649A314}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{D8893324-F546-4614-A1C4-D1445FEF4148}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Drywall Parts (Manual Qty)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.2 Gypsum Board (\is-73NSO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	964
Entropy (8bit):	5.438640540695608
Encrypted:	false
SSDEEP:	24:2d2NYb+PX269CMBYf2WAdOcGb+VEh1OciRgAWao/CApWBxv:cTyP1bQtyHKk
MD5:	3957A40D4513B62D0994BC397BBF7AE6
SHA1:	17A29C8FAC5DA7BE4F8339D6BAD8E0DA6738917C
SHA-256:	D7825CDAC58F1CEB17E391FA7F17979F2EAE8BD7F85B337E21F5BA4878DF95BA
SHA-512:	7E174F197E2D592B18CF850EB4B3E05A0C8D953343ED7DE04C423C8140D557EBBA668FF5B8394DC054787B9B68CDC94C5919A3FA8433B93DE82B1B60DC33CCAC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="09.2 Gypsum Board (Div 09.20.00)" GUID="{56CADED2-88CC-42C5-9C54-D994D5923727}">.. <Properties>.. <Property Class="Text" GUID="{03280239-11CC-403E-B272-D30A6E1B1331}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{56CADED2-88CC-42C5-9C54-D994D5923727}</Property>.. <Property Class="Number" GUID="{28F1602E-DDA9-4EED-9B6D-B374990966A3}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">12</Property>.. <Property Class="Type" GUID="{E5E316B8-4079-4990-83AD-5CA67EA773BE}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{666ABB41-8C6B-40B9-96C8-F43F1E80E53A}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">09.2 Gypsum Board (Div 09.20.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.3 Tiling (Div 09\Tile Parts (Inherit\25 lb Gray Tile Grou\is-26N8J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	15819
Entropy (8bit):	5.593616594882784
Encrypted:	false
SSDEEP:	384:JPSiav58/KuCDMLvz4C1NXcbB9q4zoQbXa7d2OYQjUkDhbL1rEvL:JPSlv5qKuCDMLvz4C112ExQbq78OYdEg
MD5:	1485F190515594B86C2E95E2D64D14FD
SHA1:	8582670C6C11D98EB031A15A8BDD14C888DD315C
SHA-256:	70391D6E7C05AEAFF3CA52672783C3C9EF764BFC1C89EA9581DBA99EBCD0B3B3
SHA-512:	3E8089D8FFD1EF8F197CDAA6EAD735B623E160B41FE69A80F9122FF609EE5338F6DB750C8BB497C7D6192C9AEA860C8565BA3549CD4E7CCC80E40DF901BCCA08
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="25 lb Gray Tile Grout (priced per Bag)" GUID="{0C1798D1-F150-4462-98CF-58893D8D0F89}">.. <Properties>.. <Property Class="Text" GUID="{63004E40-AF9D-480C-B1C4-19D131AC2639}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{0C1798D1-F150-4462-98CF-58893D8D0F89}</Property>.. <Property Class="Number" GUID="{5F92E866-0772-4D5E-AF53-6EB59EC590CA}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{A7ABBA29-576B-4B00-93BC-70BBA2ADF1E9}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits=&qu

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.3 Tiling (Div 09\Tile Parts (Inherit\Thin-set Mortar (pri\is-46QUU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	15859
Entropy (8bit):	5.594442744716176
Encrypted:	false
SSDEEP:	384:evA8Blj7pG+9dhBzxN7Xc+Bkq3jXXZQXc26UEjUTDhc8ZPz0L:e48Blj7pG+9dhBzxNjDrzXZQXP6U5Zcp
MD5:	D3BF4465B83371C2DD5116A26247FAB6
SHA1:	37F5D62AB533CE4929AC23F2620B1016BC25CA07
SHA-256:	22BAE5C3A4361D5486B64642D79BEA61B229B0A6BDEB0AD91E6BA2454A93F3FC
SHA-512:	3C503C9F42C37F5A5976A9702AB7DE4FE9E5CF996B4EF48C4FB8AC149556896ABE784F93F5A3C08498DB886B0AA025C8A65C9E50A6D70A9074A1F669B3605ED3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Thin-set Mortar (priced per Bag)" GUID="{14B34870-541A-45E4-8260-9E42B0DC744A}">.. <Properties>.. <Property Class="Text" GUID="{8F6DD827-0BAA-4675-8018-8AC7638D93C3}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{14B34870-541A-45E4-8260-9E42B0DC744A}</Property>.. <Property Class="Number" GUID="{F6D37E34-0967-4764-9DBE-AEBCD5ABCDDE}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{114C6B21-842F-4805-9AAA-7FFA67FB59C8}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="Fal

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.3 Tiling (Div 09\Tile Parts (Inherit\is-150CP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	969
Entropy (8bit):	5.4130768007291685
Encrypted:	false
SSDEEP:	24:2d2K1/X2sTf2WAdOcj5zQ1OcCdgAWaHlTAW/CApWsv:cP9cz1ACH
MD5:	941E15D47A8599E1FAA3D38397F982A0
SHA1:	CBC5C0CC7C545D91EF6EA895779C1ADB1C39B69A
SHA-256:	342EB005A9A5EA9AAF20F866CD7C024B34CFC59DA4F0E6B78FA16F6BA7236319
SHA-512:	37D3B6F35DBEB13B1F71E482B065DFC8839A0D8EAAED3A38BC0C4C01C7A1DEB317F3F1AF979BB18ECE5D99891E57C1BB8062740B783DA9DBC63D08A462AAE5E2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Tile Parts (Inherit Qty From Parent)" GUID="{87D360F8-2CE5-4DE2-B96D-FA421E88F930}">.. <Properties>.. <Property Class="Text" GUID="{547077D3-D477-46E0-90F1-E5D6EAAA1C7F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{87D360F8-2CE5-4DE2-B96D-FA421E88F930}</Property>.. <Property Class="Number" GUID="{C7242561-889A-4CC7-8445-97A13E813BCA}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Type" GUID="{387BE8B0-58FF-4B57-B939-0519A77EF15A}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{49667920-546E-4310-9C08-CA269554FD17}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Tile Parts (Inherit Qty From Parent)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.3 Tiling (Div 09\Tile Parts (Manual Q\25 lb White Tile Gro\is-UD47H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	15128
Entropy (8bit):	5.58549581192048
Encrypted:	false
SSDEEP:	384:RxN/RbVtZ1vMOi66YF9QfXcgBVfDRFOF+2hfmUjUXDhlfoojSNygL:Rb/RbVtZ1vMOi66YF9QfN5RFOF5hfmJW
MD5:	63C245F1C2C91D60D75FD02DC8DA1436
SHA1:	16716B2F903DDB5D7BDA824E34038F918D9BE09B
SHA-256:	CAED60961CB7726CF7569247E845AF8EF4F9F8737499C2D82DA74B16192DD24A
SHA-512:	60FB5866A5D92BF0C49A7FD429DE37915AB3E6062C61502D055C12A61A3D364D2472922353F7C1A7FD7500E9A80B941CFDB1A8AF527C3CF8CCE6FE547F1C53B1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="25 lb White Tile Grout" GUID="{9F13584A-0B6E-4994-9271-98CCE6CDBC7D}">.. <Properties>.. <Property Class="Text" GUID="{19FF543B-897D-4358-8B8B-3ABED9E929AB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{9F13584A-0B6E-4994-9271-98CCE6CDBC7D}</Property>.. <Property Class="Number" GUID="{6C0AC54D-1AA6-4621-8B28-A217FCA25B79}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{07A404D5-ED40-4F19-9DCF-DEE0FB434C8C}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Manual Qty" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False" SameLi

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.3 Tiling (Div 09\Tile Parts (Manual Q\is-EGC6Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	943
Entropy (8bit):	5.432727336137625
Encrypted:	false
SSDEEP:	24:2d2ed1gPX2U7f2WAdOcugbyg1OcIMeNgAWajzOma/CApWBJv:cz121/OyjNlVzOmOgh
MD5:	680A8F077B4888BCD2C76D569C7C08D6
SHA1:	DF9392A488E68E226EC6ECF0EE93826F9B616448
SHA-256:	AC8E5ACFA3CD672DF5EC90855B1E647765CA8E9A5D6F5B60C186E33D02A61230
SHA-512:	E932B27E8A5B8307016258F2667514188AC36C354636DD9E5D10EC792E21BD3D36FBEEEF6C207BF3E67AB947FFB90BCFA5434AA31F44DCD7A0E66FB6F568B472
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Tile Parts (Manual Qty)" GUID="{F4E1775E-2B7E-4A1E-9C0A-4E5176EB7B4F}">.. <Properties>.. <Property Class="Text" GUID="{2B84D10D-F0DC-45BB-8732-D86353F2A42D}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{F4E1775E-2B7E-4A1E-9C0A-4E5176EB7B4F}</Property>.. <Property Class="Number" GUID="{0A75A5A8-B3B0-461F-8198-BAC257A3082A}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Type" GUID="{F96CB1E7-2AD7-4F9B-8CD9-5BA81B061FEE}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{7FC126BE-F4D6-47C1-981C-CBEB11815108}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Tile Parts (Manual Qty)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.3 Tiling (Div 09\Tiling (Area Takeoff\25 lb Gray Tile Grou\is-EDN9I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	15802
Entropy (8bit):	5.590774912820596
Encrypted:	false
SSDEEP:	384:E3Ba4d8fCGcuzPzaSH0XcLB/q2hOrGZV42r4LjU0Dh6hT+2gHL:E3Ba4d8qGcuzPzaSHQKSjrOVjr4UU6hQ
MD5:	AFECC6163F2D3FB20BCB4843C9C03BC1
SHA1:	B253AE8F777BD0E702C3C8B89143A17D06C1A1C9
SHA-256:	015FC5A239198C85F19737F26D7F4C7FFA5830621086EC7589C1DC7C4547F2EC
SHA-512:	E8FD27655715ABB94ED54B7251469207FC0184AB57AC5B71405EB833F1E90085684B94EF48088FA366F3B895D8F84EA30238AD3DA7D68F66A99AA43678B50DBE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="25 lb Gray Tile Grout (priced per Bag)" GUID="{B14D8BE9-B3DE-47AB-BABE-750475BE4188}">.. <Properties>.. <Property Class="Text" GUID="{B0DD4797-2241-4BB3-9008-B75E8285385C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{B14D8BE9-B3DE-47AB-BABE-750475BE4188}</Property>.. <Property Class="Number" GUID="{1E08DDC6-86DF-412A-8993-FEB343A2D224}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{8170FEBC-4A06-40DC-BFB5-26DEBAC39955}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits=&qu

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.3 Tiling (Div 09\Tiling (Area Takeoff\Floor Tile (priced E\is-UJ0UV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	15895
Entropy (8bit):	5.594094845442683
Encrypted:	false
SSDEEP:	384:dZfXGP+2qFTMDG2S88CEXclBdqHk0Il13285JmjUaDhADuJ8iUL:dF2P+bFTMDG2S88CgIk7Il1m85Jz6TJu
MD5:	41ECF83F8E1BB28E4095FDEEA253D179
SHA1:	10598F1A01DBC3AC2B9F1A016C8F16FF0DFB65BA
SHA-256:	C3456AAECE89B4C1E3945E0578BCCA7E15281D24EC70C857F1239EEA1F555483
SHA-512:	01B92B4494B8907683ADC5AF547D640D90FAC04E1B30EEC4B26D398F19DC1AD8BB26D6B53F1EA10B708E6E1AEE126B0E2507FC8EA0EB26D7E24766FAD778AC97
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Floor Tile (priced EA)" GUID="{C020204A-ADD1-4EC3-B323-BD56F18BDAD2}">.. <Properties>.. <Property Class="Text" GUID="{7C497D33-1981-4200-96E7-ECCE4A744785}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{C020204A-ADD1-4EC3-B323-BD56F18BDAD2}</Property>.. <Property Class="Number" GUID="{AA450C61-B225-4A51-8949-E7D69EE89D69}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{FE5A5356-6692-4964-841D-D75646D658F8}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False" SameLine=&quot

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.3 Tiling (Div 09\Tiling (Area Takeoff\Floor Tile (priced S\is-PUFF7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15901
Entropy (8bit):	5.5954960087176895
Encrypted:	false
SSDEEP:	384:sJ2ranaMt4Ner0bR75XcdBSqbzC2h63pI2BLdjUsDhGNMB1nwL:sJ2ranaMt4Ner0bR7pYd/Xh63pTBLOcm
MD5:	A45286CF07C2CE4CBDCB8C1C3FB61DAA
SHA1:	026D1F338B5C05B84C5FC364A5EED8009851B25D
SHA-256:	CBF4A9A2375614E212C6400387460A84EA051B5F5785A80C6FA19C97A3A9C406
SHA-512:	ACFBB9C36C98BF414AE34B261305BB6C793F3B2A96F7BBAD560737D446D803D122ACD4AF7B6043DA696F16FCD365B8BE81CD122E60C85D6EDB91954CA5F43723
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Floor Tile (priced SQ FT)" GUID="{5C812201-2B72-4567-920C-9161E0A99D41}">.. <Properties>.. <Property Class="Text" GUID="{77687D0E-48A2-4BE3-B645-CF0B65F63BE2}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{5C812201-2B72-4567-920C-9161E0A99D41}</Property>.. <Property Class="Number" GUID="{8DF355CE-2905-4A0F-B94F-48E3645BFE2C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{90BB0C30-24CA-4269-9BB8-C78E844C1CCB}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False" SameLine=&q

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.3 Tiling (Div 09\Tiling (Area Takeoff\Thin-set Mortar (pri\is-EPMQQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	15828
Entropy (8bit):	5.593977371621861
Encrypted:	false
SSDEEP:	384:17b07vOFwDtBePfB4R/4XcZeBNqpv4Puj42nd/ATQ3jUBDhosEMSjL:1307vOFwDtBePfB4R/My40WPujjnd/AA
MD5:	5D5A8E9A6E1D28CBB1C2312B16DE0440
SHA1:	8F2B217DE4C60836115242F89CD0B436CD751C0D
SHA-256:	53B65498EF940A5DA8620CEC19EEA9E92ABE3FD1D5FDC238C8756C5451B9271A
SHA-512:	4637BACBF48938541470DD37481D7917F9D48F4061D2481FABC358E10278F2B598CA52E0E22984BF07C475A613F5B6762F9706242FB451EDE2A5F9F4EEFB25AD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Thin-set Mortar (priced per Bag)" GUID="{48295ADF-D25E-4DA9-852E-68803894C397}">.. <Properties>.. <Property Class="Text" GUID="{99204D17-C390-4597-ADC7-C3E2302EACB5}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{48295ADF-D25E-4DA9-852E-68803894C397}</Property>.. <Property Class="Number" GUID="{18C20BD6-B8C1-447D-BB6F-957A4CC3BB1F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{9CB3A539-9066-4673-A97D-B58A8436237D}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="Fal

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.3 Tiling (Div 09\Tiling (Area Takeoff\is-AVD9A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	941
Entropy (8bit):	5.443162608213421
Encrypted:	false
SSDEEP:	24:2d2sNdStHCX26Gqgxf2WAdOc6tHY4DV1OcLYSgAWakO/CApW6Lv:ceC1Gqgj3YTlK5b
MD5:	91A4695E8848D8DE5DF87A0175220EFA
SHA1:	3876C7E8B80CE06CF3FB7D5919322177C7CE73AE
SHA-256:	49AA61D215C8D56922E910CC87CCE642666BA29CA020CDCA119D131EC2B835A0
SHA-512:	45C19CFCF354F7B4BB6F14BE799F0EDED86AAA70F8C43F04CC2FDD0755C5A718E2D92C62A74C4566130F6B535B9BFD913E36506978D43D2F6B4B976CDCF7A560
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Tiling (Area Takeoffs)" GUID="{C768AB8C-4655-4996-9E8E-6CC7C587D00C}">.. <Properties>.. <Property Class="Text" GUID="{0421332E-D12A-489A-809F-814E0916D25D}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{C768AB8C-4655-4996-9E8E-6CC7C587D00C}</Property>.. <Property Class="Number" GUID="{A0F7471B-C07F-41DD-B691-3F7E03437B49}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Type" GUID="{B6C20DA8-BD61-4D30-A4E7-939EBAD51FBA}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{D8C41C85-46F8-4DDB-BE59-21FEF36AA5F9}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Tiling (Area Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.3 Tiling (Div 09\Wall Tile (Linear%2FSe\Wall Tile (priced EA\is-GQIQ8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16179
Entropy (8bit):	5.59692170382118
Encrypted:	false
SSDEEP:	384:oCWKTKLxuPGNhrtD0HZqXcvPBTqSHivrGDx2z+ljU4Dh7IiCzlwL:oCWKWLxuPGNhrtD0HZeaGSqrGDoz+GQF
MD5:	FB214F643912606A3362886C2C377877
SHA1:	5FE39E4986F218C0FF6D86E4D0EFCAF4553B1F68
SHA-256:	50545BB5CA7885CC61FA3D30DA45A74C10C73EFFAEA7FA5F027762561A4B48AE
SHA-512:	5A05FA6D3520648231903CC17E82CD666B6C628A8B085AC41C0B6F4E8BDA3FBF64F0EE89ABF579E27EE6E9373F0A8272220272C50DE4A2E01087EECB4ADDA49D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Wall Tile (priced EA)" GUID="{7918B59B-3DC8-49B5-9223-AFD547A259E6}">.. <Properties>.. <Property Class="Text" GUID="{EA8CF66F-91B8-450F-B8D9-32D47D6FF071}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{7918B59B-3DC8-49B5-9223-AFD547A259E6}</Property>.. <Property Class="Number" GUID="{155BA43E-29D0-4EB1-8B0C-C4D1F902E6DC}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{A7CF3916-A3E0-4F00-B84B-75492F74E190}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides" Order="1" ShowUnits="False"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.3 Tiling (Div 09\Wall Tile (Linear%2FSe\Wall Tile (priced SQ\is-IO0MK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	16185
Entropy (8bit):	5.598081913381527
Encrypted:	false
SSDEEP:	384:GLFaFZu6wIy2t4TAGL/ZD8XcWtBOq4hwh9W42bzljUdDhiQiZwiL:8FEZu6wf2t4TAGL/ZDI1zJTh9WjbzGrs
MD5:	556D94F5B7BA97468A9F4F746E2C25CE
SHA1:	36DF5CE83844AC7B09DAF20B6D74FBE1BEAC1D18
SHA-256:	4077C1EB20F529089D5F0328C5919ED34489F7332151DAE8C56937C45324DC89
SHA-512:	2D41107F83C114E1C6291D71572E37F1A4F01945EF5E2B9671C7458AFBE9A3EAE6D1EDEAFA6CA25850BB61927629B815A3B171243D5EFE228B199C5DE3692D9D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Wall Tile (priced SQ FT)" GUID="{1C5DA8B7-3D46-473D-BC61-75CDBD88CBF9}">.. <Properties>.. <Property Class="Text" GUID="{88916FFE-10EF-46F2-A03B-3DF858671229}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{1C5DA8B7-3D46-473D-BC61-75CDBD88CBF9}</Property>.. <Property Class="Number" GUID="{52A178EE-88EB-46EB-A757-5A67B0A84F4A}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{2BD41205-9218-4C23-93D6-05BB6EFEB6E8}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Wall Height" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# of Wall Sides" Order="1" ShowUnits="False&quo

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.3 Tiling (Div 09\Wall Tile (Linear%2FSe\is-GDTO0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	967
Entropy (8bit):	5.456897357282506
Encrypted:	false
SSDEEP:	24:2d2Z55cwX2qICH7Qf2WAdOcZck11Oc8Zr+gAWajRV6/CApWdhv:cHwcx7YVuQ
MD5:	9DB1B37F8D7138AC95357A7E73AC650E
SHA1:	04213D3ECC0FD9296218A8B1D50336E95AC34F03
SHA-256:	202F323872078BB17C4DED3E20175232F1B1F59F5777024C0E1E23D41258DD5A
SHA-512:	0A384986FAB2950E569EE6596C1EBAA7BC9365EA1C3AFC0A7E86BB7881E783E1E1CA3FB4FA75EEDBD66A57F662C8337526D2174C01070FFB543181E931B9C451
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Wall Tile (Linear/Segment Takeoffs)" GUID="{241F88E0-2DED-40F0-8240-F4218BA2A84F}">.. <Properties>.. <Property Class="Text" GUID="{EBD120F9-A0DE-45C4-833F-3BD49937C786}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{241F88E0-2DED-40F0-8240-F4218BA2A84F}</Property>.. <Property Class="Number" GUID="{695BF313-ACCC-4BA0-AB1F-650467115B46}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Type" GUID="{DA7AE963-366B-4572-A7C6-10386B6188A2}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{1A0F4DE4-D998-4A34-A756-75E767F1CEED}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Wall Tile (Linear/Segment Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.3 Tiling (Div 09\is-T56E2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1081
Entropy (8bit):	5.438436013421632
Encrypted:	false
SSDEEP:	24:2d2CulWX2iITci0d6f2WAdOcRlwP0SB1OcdxwpH0Cr+gAWaSveM/CApWTv:cFulW/q0kWlM0Sm+vfM4
MD5:	24825392EF6A9DE16F4A8D9F4E126935
SHA1:	ECFA2923AE2A5890C4402DE3114AA2566F762F2F
SHA-256:	2705F9C88896C187BC292E2B5A4EA16DD30F7F1BAEB189DE4FD68157746670C0
SHA-512:	1C1471B6A1DFA14693CA21DB89E731C79D4FA8994EF6147B8EF58A4239FBB775105A88A8AFBFD1952F2E6EBA37F72AE8A3AFC3E75F8E7AF8401E30231BF1F220
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="09.3 Tiling (Div 09.30.00)" GUID="{3417EDC8-4B4E-4407-82E8-B111A0FAADCD}">.. <Properties>.. <Property Class="Text" GUID="{A3E27DBE-A57E-476F-B483-2E33296DADDB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{3417EDC8-4B4E-4407-82E8-B111A0FAADCD}</Property>.. <Property Class="Number" GUID="{55AF091F-EDCC-4B69-B0FA-747BDC2B43DC}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">13</Property>.. <Property Class="Text" GUID="{30DCEE6C-1645-4602-B510-5BA03DF822D5}" Name="Description" OrderIndex="11" DecimalPlaces="2"/>.. <Property Class="Type" GUID="{51CAA62F-0835-47A4-836F-AFA94C9CAECA}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{19FDDC91-8B1B-419A-B4B5-414E3C29B684}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" Dec

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.5 Ceilings (Div\Acoustical Parts (Co\Acoustical Tile (pri\is-4AP0D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16112
Entropy (8bit):	5.589848530952268
Encrypted:	false
SSDEEP:	384:rAGlWq7Wfm2feLRsYW55XcFBLqtvngHH72R2vApjUzKDhyV8GHL:8GlWq7Wfm2feLRsYW5pkOGHH72IvACz3
MD5:	A2AFFEFA2172415664E9AAFC1142C4E5
SHA1:	5A275F973F8F242D407ED9D1614EAF34C947D69C
SHA-256:	7BB8057F48573CE8D81FB238016F335D69CA7892CF16D02C3ED399C830C5E0BC
SHA-512:	74B930A9D86F11DC65E3CF5FEC89C1E18EAB706C10DE7BD5B956043A494CC7E59763B035A29A96E6B8472D50817304813EDA868007911B1F6780F822BD6F2248
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Acoustical Tile (priced EA)" GUID="{405C4F2A-6E7F-4B8F-A329-82E89C5DE142}">.. <Properties>.. <Property Class="Text" GUID="{B8DD1F4D-5FBB-47F3-B089-4B2E0F38307E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{405C4F2A-6E7F-4B8F-A329-82E89C5DE142}</Property>.. <Property Class="Number" GUID="{BA4F5093-BBB1-4363-8DA8-EFB2E5E2E1B3}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{D3836397-550D-4BB4-861E-0671144CC88A}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False" SameLine=

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.5 Ceilings (Div\Acoustical Parts (Co\is-DOQV1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	963
Entropy (8bit):	5.437445573242769
Encrypted:	false
SSDEEP:	24:2d2Lt4X29ngkf2WAdOcvlv9h1Oc8ZdgAWa6sv/CApWHv:c84T8Clgc48
MD5:	A984FC1712E312907C27963D0CFA09E4
SHA1:	3A1C92AC568575338FB7628EF4E547D2B3E915F6
SHA-256:	DE392505C49CCA5C9FAB51149D94B21BEA819623AA25E367C7622A3D24F15332
SHA-512:	6B90AE63E60342F98C657822365AD9B27B0F753C0487D0C57097DDF558097CC425FBA92182838A1AF6C0E0C235A966E7C8E4E48F6142B8522C8745E4D2AC1EFA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Acoustical Parts (Count Takeoffs)" GUID="{135CBFF3-3767-4F77-9443-BE1852F87FDA}">.. <Properties>.. <Property Class="Text" GUID="{9F7BAB45-0ABF-4DBB-8BB1-6CE8D55E5DB2}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{135CBFF3-3767-4F77-9443-BE1852F87FDA}</Property>.. <Property Class="Number" GUID="{A11A6E2F-451A-44F4-887E-656088FF8CE1}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Type" GUID="{AAE220E1-51B1-424C-97C1-F08E3B8CF3E3}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{03A774C2-5E28-4C2B-94A4-FF674AE59456}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Acoustical Parts (Count Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.5 Ceilings (Div\Acoustical Parts (In\Wires per EACH unit\is-VUCB3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16562
Entropy (8bit):	5.588678480082516
Encrypted:	false
SSDEEP:	384:/WzZ15kxKOI5P6v9J8qAfXc+Bzq4lfgixIl2UTIjUmDhsB9SzcL:/WzZnkwOI5P6v9J8qAfDm4+ixIEUTluU
MD5:	84ECC902293C577E1F0334DD51AB358C
SHA1:	18B303C144BC134C2FBD99A1E17156A74677A490
SHA-256:	DE9B9785E5E2DE99AD860CF8A8B05FCEA1B25AD96415DBF4FEBA9152F9003B3D
SHA-512:	4777BA3F515364FC1384EBAA125A915F3D176A17AE359704195DD99AB92C68ED833022414644ABB876280CEE9EB20CABAB5B6ACF849FBFB192B05938232A79B5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Wires per EACH unit (priced per Box)" GUID="{50FF1694-9142-4658-9509-93205B34880B}">.. <Properties>.. <Property Class="Text" GUID="{45397B5F-3D83-483A-91CD-7E0338300A0B}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{50FF1694-9142-4658-9509-93205B34880B}</Property>.. <Property Class="Number" GUID="{04508EE4-B82B-4721-B8E7-0261FA8CDE76}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{0F87E771-0BBA-4B93-A36A-27459BEDC7D4}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="# per Box" Order="1" ShowUnits=&qu

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.5 Ceilings (Div\Acoustical Parts (In\is-VC44F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	981
Entropy (8bit):	5.409042696389483
Encrypted:	false
SSDEEP:	24:2d2ZQZX2sf2WAdOctGQ0Mcf1OcCePfgAWax5/CApWWv:cCIbDnnk0PdFt
MD5:	B9870C05ABDAA10C736C626658924625
SHA1:	7797CEAF40CE727CA2B24629AC8D8D596E8A2F31
SHA-256:	C7D1246C5D2B430A3EBE82D1D516F050D2AACCE8A7EEECF207FE51FBC0A33BB2
SHA-512:	1558E97DE363D9577AB6781FC456C5F6F75097F67B51DAD1CCFB1F3D94A673F58FDAFD51A485A0E96F1D6D79B51BCA98D509365563C9979DF641D0FD9E6C5F04
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Acoustical Parts (Inherit Qty From Parent)" GUID="{4690C905-15FE-4A22-B978-6F33C566F7C4}">.. <Properties>.. <Property Class="Text" GUID="{A80BB894-FFF6-40ED-8B2B-6F3550D7FDB8}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{4690C905-15FE-4A22-B978-6F33C566F7C4}</Property>.. <Property Class="Number" GUID="{26BD1DB8-DE6F-4F6B-91F2-F1A47A3B1761}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Type" GUID="{983FF9D0-6159-4A9F-943B-D81076785E21}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{A65DAF66-9ADA-4436-8653-98BCF4372953}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Acoustical Parts (Inherit Qty From Parent)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.5 Ceilings (Div\Acoustical Parts (Ma\All Leather work glo\is-OVHT7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	15148
Entropy (8bit):	5.587335096203465
Encrypted:	false
SSDEEP:	384:EmX++kZm1ii3C8L9eXcvBwjyCkgUS2EITjUJDhbtmkxqL:EmX++kZm1ii3C8L9a2wnkgUlEIMfJmkm
MD5:	0955D22CC49F22F1716FD7934FF707DC
SHA1:	F5B0FF381E0ADAB539E23585C9C37E822148FD5B
SHA-256:	10F33C5E86D73B6E8FFDAF85204B69B27111F7AA1002F44F1D17A73CC6120B8C
SHA-512:	FE7EBA29CAD81001A407E34442C77976BC22C77BDADD3BBB588DFEAC74F7C0333023068CA9331C43D70763E9CB236530157522B6C53FA3BD5B790D709339AEF0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="All Leather work gloves (priced EA)" GUID="{0EF91B86-454F-4314-8C5F-7750C64242E1}">.. <Properties>.. <Property Class="Text" GUID="{7C4D159C-DA9A-4444-8116-7DB31096E4C1}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{0EF91B86-454F-4314-8C5F-7750C64242E1}</Property>.. <Property Class="Number" GUID="{7F6A639C-1FB7-4DE9-AA27-0138D17A027E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{37DF19BA-2B87-4BED-B521-F30DD36796E5}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Manual Qty" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.5 Ceilings (Div\Acoustical Parts (Ma\Safety Glasses (pric\is-5A9JH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (376), with CRLF line terminators
Category:	dropped
Size (bytes):	15132
Entropy (8bit):	5.588824635256047
Encrypted:	false
SSDEEP:	384:AnuBLmeg02TewioRwbrXcbBI1av5UKZ25JYjUVDhFLeTSH7mL:AnuBLm102TewioWbTux5UKw5J1zxeTSY
MD5:	FA66EFBD7A050D00C38727BDC2516956
SHA1:	43418DBEBBF6D291C507C9AD502498AE53E8ABEB
SHA-256:	D334F8B70FC87B279F900C14EE2BEFE35559EF7A9E001C00001E7B8748E5D95E
SHA-512:	B4539AB36FD32E2EB088B18AE8C23AC825CD9CE49F97AEFB25A026302E080E3217E7ADAC18686A4912CC7BD432FF05476820516182BEF3C321D84C22E8D238CD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Safety Glasses (priced EA)" GUID="{020432B4-96AC-48E3-9EAB-74CD4513771E}">.. <Properties>.. <Property Class="Text" GUID="{79966B3E-A965-4C09-B543-DD68E0084F78}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{020432B4-96AC-48E3-9EAB-74CD4513771E}</Property>.. <Property Class="Number" GUID="{09487022-AE0A-42B2-AC42-7B571A3DD064}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{DC829BEE-E736-414E-A3A2-E7048A806F8D}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Manual Qty" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False" Sa

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.5 Ceilings (Div\Acoustical Parts (Ma\is-8DG7D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	955
Entropy (8bit):	5.433715780763853
Encrypted:	false
SSDEEP:	24:2d2QdYWX22dx8f2WAdOcp+DSY1OcauPMYgAWarp9/CApWDJv:cBYWDkS/bSROh
MD5:	60EDE8112D719DD10EF2AFBE14A15EC0
SHA1:	5182978FD1A2526DCABAE66204571AF4C8635913
SHA-256:	E6D24565875BAB9A1B5FC6CB0EFF8A21711A37373321B55C5059AA74D4A5928C
SHA-512:	182F7C5A4763A930E3192F60D8FF7860A035B3FB453ECD5188A84183F813430B8A8594ABD028B7BB2924AB1824955E6611452BC98BD3CF9ED016C72E866E737A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Acoustical Parts (Manual Qty)" GUID="{9A2981E9-496A-4202-B8F8-58013359DAC5}">.. <Properties>.. <Property Class="Text" GUID="{DC28C426-E3F8-41DE-A766-FB618382CE8D}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{9A2981E9-496A-4202-B8F8-58013359DAC5}</Property>.. <Property Class="Number" GUID="{AA201390-DEA8-4818-B7B7-8A32D9852942}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Type" GUID="{87E5F1C8-E3C3-46C6-8337-1E804787003E}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{2C41B01D-8BCE-4BC9-819A-F5E60B4D49A0}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Acoustical Parts (Manual Qty)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.5 Ceilings (Div\Acoustical Tile (Are\Acoustical Tile (pri1\is-2810E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	16147
Entropy (8bit):	5.591471859332843
Encrypted:	false
SSDEEP:	384:WT5vwruajt7+fSPhVUD83BXcjBoqPhrraAcW2Tu+7jUeDhLLc+slL:WT5vwruajt7+fSP7UD83BGvVraAcxTub
MD5:	75381E0A2DB2A4E725CA82594BE7F100
SHA1:	73E96A1CADE8A751A58D34320D27A595A1ACCD68
SHA-256:	D9137BC3A5D505B0A03E87EB241256876951373E2BC650472F4DAD5854EE6B73
SHA-512:	61340DA8D03E1FE50C13D00AC3090FAC8B39267B6CD965785F4C593299A9E7B9037DA8522B96B12876B9EF392AC906C7A78BBDCA528FF3E04649C47DABDA8301
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Acoustical Tile (priced per SQ FT)" GUID="{FE84AB97-24C9-4DC3-9353-21F9C648EC59}">.. <Properties>.. <Property Class="Text" GUID="{A54963A9-E85A-4D8C-A4D0-1692C3A44D27}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{FE84AB97-24C9-4DC3-9353-21F9C648EC59}</Property>.. <Property Class="Number" GUID="{6806CF42-2FFC-4CE7-BBD3-F3DA227D6167}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{8EC5D0EA-2E55-4F1E-B493-6B14E5EFB5DD}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False" Sa

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.5 Ceilings (Div\Acoustical Tile (Are\Acoustical Tile (pri\is-3APDR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16131
Entropy (8bit):	5.591180920491997
Encrypted:	false
SSDEEP:	384:4fW/EShLHyuRKjKNFx6sXcGBVqzhy/8FGL2zpuHjU8DhWLEDZRzL:gWEShLHyuRKjKNFx64jszg8FGSFu4sW2
MD5:	FDD462B8E55AFC2369C78B231A28CAC3
SHA1:	D048D74A8A08F9B5EAAD51DBBDC5B2559D11B146
SHA-256:	7C266B1CC54548DA638977032211C12EE38E90A2C29E6E8A5C1189D027F7FF65
SHA-512:	EF84FA9A560FE139B5220935CE5A468DE2BF5FA950ED9EFFB6DA13CA86A328E1265F1B39EFC1241AD2B61CE62AA979B69BAE97ED92046A8C3043DCB36A01433C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Acoustical Tile (priced EA)" GUID="{0E5F5A0E-A9F6-4FBD-83E0-CF14BC96FBEE}">.. <Properties>.. <Property Class="Text" GUID="{55050125-C80C-4DAD-9863-7B3C3B7BF8E6}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{0E5F5A0E-A9F6-4FBD-83E0-CF14BC96FBEE}</Property>.. <Property Class="Number" GUID="{AA6121CE-EED2-4E3D-A4B4-25FBE26FD0C4}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{8AA2F007-2CE2-4F25-9272-2B1FDD841C36}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False" SameLine=

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.5 Ceilings (Div\Acoustical Tile (Are\Ceiling Grid (priced1\is-AI4NE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	16026
Entropy (8bit):	5.591194775400719
Encrypted:	false
SSDEEP:	384:t97uPGKGd2w/Jzr3TLbXc/BZqaBuyHOh2p5VjUfDhz1qGi9xL:t97kGKGd2w/Jzr3TLD+gryHO4p529z1O
MD5:	BE8B87CB3282658B39C53D3763FC32ED
SHA1:	971A43F67C65FBDDB4FCCD1FACF112639C906BE9
SHA-256:	D4B81377F6D086D61BBAD5D3761E2092F3E8F955AABD0D2EA5D131A9035BC3FD
SHA-512:	564E5A46700078801EF2E5764C271B13CCF6B757D21782300B0A8828D6A56599678711FE370ECA7318BB409663573E90CBBEB72DD0325C2E880EEED0EFC965CA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Ceiling Grid (priced per Box)" GUID="{4919A876-EF3E-47E2-A08B-52EB259B97A0}">.. <Properties>.. <Property Class="Text" GUID="{BF2308FF-B730-4BC2-8E20-5C3A6122805B}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{4919A876-EF3E-47E2-A08B-52EB259B97A0}</Property>.. <Property Class="Number" GUID="{6C331D3E-FEC4-4774-AA7C-3C40254FDB12}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{B719B488-42DB-4401-B794-75C517FCD30F}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Pitch" Order="1" ShowUnits="True&quo

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.5 Ceilings (Div\Acoustical Tile (Are\Ceiling Grid (priced\is-L5QII.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (396), with CRLF line terminators
Category:	dropped
Size (bytes):	16030
Entropy (8bit):	5.588376865258254
Encrypted:	false
SSDEEP:	384:nnQ/ZbTQqEZq0dno0eK3lMXcdBBqCPYBNSdz62z3MjUODh6qW+5L:nnQhbTQqEZq0dnLl3lYg4PB8dpz3Rm6w
MD5:	26A1DA0B6A7595288471D0B3458C1AEF
SHA1:	6DAA8BCABB35DB34D703820F482787EE308F197A
SHA-256:	D27A19AE170F1269581A60B55E43CC4A48142B117A5B7985E2465422BAEE0953
SHA-512:	A7E88242BE8CC29AFEA18B4A2007DE7D076FC7DDA0576E75553475D680BB333D706E880D40D14A51A6B60C73F84C3599239E4903E8CCA5CE323D4FF77535766F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Ceiling Grid (priced per SQ FT)" GUID="{0A8E2FD4-AA85-46D0-91D4-5A3424463131}">.. <Properties>.. <Property Class="Text" GUID="{D9AB166A-F08D-4FBB-B621-D11B261B9D41}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{0A8E2FD4-AA85-46D0-91D4-5A3424463131}</Property>.. <Property Class="Number" GUID="{67324027-5756-4102-B292-A2BA92A6141D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{FCAF5597-9994-4D37-8D2F-6241D90A1F07}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Pitch" Order="1" ShowUnits="True&q

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.5 Ceilings (Div\Acoustical Tile (Are\is-F3KHC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	959
Entropy (8bit):	5.428471780474511
Encrypted:	false
SSDEEP:	24:2d2I2Y7i0SX2wgf2WAdOc47i0Iq1OcLfgAWaxB/CApW8gv:c37ifDIh7idWdQ
MD5:	31BD67382D4F0D44963EEFA8740F7EAF
SHA1:	A6E93AB9443B5ABEF5227124DA191AED17E6468E
SHA-256:	4885CCFFAAA3CAE7A891BC5D22671410D559A533550FD56CE90EA3293EC205F5
SHA-512:	AD77F682D7983228FC9B91A9C350013E1BD48E93E9AF4FDB5A699BEDCD50F71FE3793E1F427A17F421B75E90A83ED4DE91D962E3D094EB5FC35B1BE6ACA238C9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Acoustical Tile (Area Takeoffs)" GUID="{69E1B298-1D77-4860-BEBB-6B299E4BA6D0}">.. <Properties>.. <Property Class="Text" GUID="{963A8C60-E021-48EF-B4A8-872818C9873F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{69E1B298-1D77-4860-BEBB-6B299E4BA6D0}</Property>.. <Property Class="Number" GUID="{EAA9760A-DC0F-4E0E-8EBF-C5E23ED3AAAA}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Type" GUID="{1C4A0482-F517-49DD-898E-D7F6C50F33BC}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{AC843B23-9D5C-4DA3-AEEB-27AA3B889CEC}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Acoustical Tile (Area Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.5 Ceilings (Div\Suspended Grid (Line\Ceiling Grid - Mains1\is-19G48.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15849
Entropy (8bit):	5.584025933127939
Encrypted:	false
SSDEEP:	384:r0BGVsi+AAgE76CS9DyGBXc/BFqeFA09rsi2EhHtjUk1DhsLWG3C0L:IBGVsi+LgE76CS9DyGBG8909rsVEdeku
MD5:	26279942E524EF4B2133CC8F4DB4FF81
SHA1:	481C9782F63A8DA15F153CED3A4B250EABCC57E2
SHA-256:	8EC6B4D244B489FEF849FB455A696BBD2607761F730BA95B58A76719CD97DCD3
SHA-512:	5E5C6B537ACA28D7E41C23A151C96B29F7D3DB263543650CDF04499DC120C08C046B27DEB0238822C8523D50033615559716E115D0892CE3F679DBFFE3AA113C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Ceiling Grid - Mains (priced EA)" GUID="{72D398B3-88C5-4077-8088-86767A9EDA77}">.. <Properties>.. <Property Class="Text" GUID="{CE9D3AA0-CD4E-4260-B7B5-0E9D494015C4}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{72D398B3-88C5-4077-8088-86767A9EDA77}</Property>.. <Property Class="Number" GUID="{715C497E-16EC-444A-8704-8D002FF23546}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{5FAD14D1-FE38-4D61-9CDD-E72381D05322}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Length" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False" Sa

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.5 Ceilings (Div\Suspended Grid (Line\Ceiling Grid - Mains\is-VACTO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15863
Entropy (8bit):	5.5858888831846025
Encrypted:	false
SSDEEP:	384:/+D8leLGAXTOsVFd8cyrSs8XcqBrqhk5EGh8W2YBsjUKDhuW3lsL:mD8leLGAXTOsVFd8cQSsIzuhrGh8xYBD
MD5:	2A88934D0F2CA68155FC31F876BEF96C
SHA1:	26D98DF5B3E883D0EC323DE240A410C283465AEA
SHA-256:	BCEC50BF564A54EA9FAD8C501FDAD197DBD2966CC9C2142594B2C694C47F41E2
SHA-512:	FAF0BAD33E0F5E8DAE416344C9047DA09090282EE459A37CF465DC529CC614D840251C6E576D70FD0D559837951D599BB67C1DFA06157DE2C116EDC3444901B1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Ceiling Grid - Mains (priced Linear FT)" GUID="{E2246755-4B99-4E53-A22E-40790BBCC257}">.. <Properties>.. <Property Class="Text" GUID="{06A179FE-D751-46C5-9D86-E91232AD9EF7}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{E2246755-4B99-4E53-A22E-40790BBCC257}</Property>.. <Property Class="Number" GUID="{2E1FD180-E12E-4512-A358-3F44C25E7C6E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{B2E79405-6859-4510-96CB-23B518BE0432}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Length" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False&q

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.5 Ceilings (Div\Suspended Grid (Line\Wall Angle (priced E\is-LQIB0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15830
Entropy (8bit):	5.586429091085345
Encrypted:	false
SSDEEP:	384:E4ekVLymatQJ2DszZptzd1LXcYBaEqK0R2Wi3y2a+kjU+yDhUBs92L:E4ekpymatQJEszZptzddRaLV2Wi3Fa+M
MD5:	3EFF23A482DE45FA313B9A175741D2D5
SHA1:	A8AAF04079CEB6E5DC33726CD0D921FED3D86691
SHA-256:	D31FED0BA6367C11F7B468B82B1B1C1BC2D129E505E8AF01C98585EEA3358659
SHA-512:	E82262F30E268B02B5A5F1ACE1CA5DACCC29A742FF04F42148E76C1AE367CECECF4DDA88C1B95F675D9626349EFBA95A0ED0BC739962E07C3DC7475D0F3BAB83
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Wall Angle (priced EA)" GUID="{5DB810BB-7739-49AA-8867-20B0D6C18E6F}">.. <Properties>.. <Property Class="Text" GUID="{DCEA9468-68E0-4833-BD86-28FC95602031}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{5DB810BB-7739-49AA-8867-20B0D6C18E6F}</Property>.. <Property Class="Number" GUID="{9369A701-12DD-4390-87EF-A9F4C1BFEF9D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{46C681A9-63B7-4BE9-8174-2A99AA585F3E}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Length" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False" SameLine=&qu

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.5 Ceilings (Div\Suspended Grid (Line\Wall Angle (priced L\is-EA0BV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15844
Entropy (8bit):	5.585396614749897
Encrypted:	false
SSDEEP:	384:4UH4ai9Kd3Hsl+CPjemYQxsXcaBRq/I0/8+e2m/f8MjU8DhJnWr+wL:4UH4p9Kd3Hsl+CPjemYQx4jor/8+Zm/c
MD5:	EF16440041107AC4225F59C3B6E78846
SHA1:	012ED61493912397A242ED20FF54A6FAD3B74C6E
SHA-256:	27311A5CD2920D2BA2650D3260F2FB74C116F4DCFA7332F965938AC4B7CD3231
SHA-512:	B103D2A74F8E292BC9AC45C98841898E12799161B74F126D08D0484C74E384E85BD81F8B8319C1755203C327DF7578384A513D195CD24C67921C3E868D2C74DB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Wall Angle (priced Linear FT)" GUID="{D9DE2378-A6FD-44F7-AC3D-D52B1BE74FA0}">.. <Properties>.. <Property Class="Text" GUID="{EE1BF296-5F01-48C9-9600-EB52B04CC48F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{D9DE2378-A6FD-44F7-AC3D-D52B1BE74FA0}</Property>.. <Property Class="Number" GUID="{DA73D086-9049-4D96-BA16-EF20C5FCE64F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{B0963CE4-653E-4B1D-A0D6-7C7E01368FC6}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Length" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False" SameL

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.5 Ceilings (Div\Suspended Grid (Line\is-VMJ34.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	977
Entropy (8bit):	5.453259983137661
Encrypted:	false
SSDEEP:	24:2d2KjuX2xJDef2WAdOcGCNpC1OcIM/fgAWa6mh/CApWAv:c2gu38p9N7m9X
MD5:	216473B1A958C73039A34AF82506BC8D
SHA1:	24B91B0B7D8682992B83F86DF677C1B98D14D650
SHA-256:	88DD3CC8FCCD5A11F6FD043585FADB039BD9C292D042B706B226A27415810C3A
SHA-512:	8E71D29E227346B3A6BAB380FFD5F4E3073C6CBABBD9B4B3536267C62B117A6339251988E292795F1E2B3C22408A010A8F3F8FB2A174152E006FF0C254EA2816
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Suspended Grid (Linear/Segment Takeoffs)" GUID="{5B5A77F2-9A88-41F9-8887-0BCC210CBE46}">.. <Properties>.. <Property Class="Text" GUID="{641373FE-232E-4BF6-8C6C-3497143E5ECC}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{5B5A77F2-9A88-41F9-8887-0BCC210CBE46}</Property>.. <Property Class="Number" GUID="{5E6F89A3-03D2-4444-82C0-018006B8DD87}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Type" GUID="{7647D0EC-EEC5-4225-831A-849DE99D42DA}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{0655389D-39FF-4D5C-87AA-D0F3BD66177C}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Suspended Grid (Linear/Segment Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.5 Ceilings (Div\is-5R4QQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	956
Entropy (8bit):	5.449271417003859
Encrypted:	false
SSDEEP:	24:2d2ub3X2RQRhbf2WAdOchLN1OccOBgAWaNB/CApWov:cHbmuReCc9N
MD5:	8E16AFDB4544ED5302B6FA382B2BD227
SHA1:	9059A605DB0717A679CDCE623FB4D53CFA5C21A4
SHA-256:	DCD5E415E8FDE37F2636153C7E3E94761155326CB5A663863B05BD0E44228C97
SHA-512:	FBE9133A04A0D4BA3FF065067FAE951376A86685A6DB620521F4FE036A2DD5D4F14C65C820BAA08064C1E161383E80E86299C596527987A7FB70442F33970749
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="09.5 Ceilings (Div 09.50.00)" GUID="{03714507-6EEB-4B0E-B314-72EB7B58D2F8}">.. <Properties>.. <Property Class="Text" GUID="{687A9EF8-EFB4-458A-B838-CC872151C83E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{03714507-6EEB-4B0E-B314-72EB7B58D2F8}</Property>.. <Property Class="Number" GUID="{7DC79B18-61D2-40B5-B7F6-05A23A0A9692}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">14</Property>.. <Property Class="Type" GUID="{38E37FD8-B2C2-4A23-95C0-0FB49DC8D341}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{B91EEE9A-8098-4FB5-948C-3EA3C8E76A0A}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">09.5 Ceilings (Div 09.50.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.6 Flooring (Div\Carpet Base (Linear%2F\Carpet Base (priced\is-VAETR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	15770
Entropy (8bit):	5.58924494155859
Encrypted:	false
SSDEEP:	384:DC96iMaot9smen484w6KgXXcBB+q9t6CZZm28KujUeDhMkK+VdL:mr3ot9smen484w6KgHEZ2CZZh8Kr29Ky
MD5:	C43AB0B0A82DF805730646F5281EC62B
SHA1:	7DBC0319CEB57B90BA7F4CD15D57AF33239250EA
SHA-256:	BD6A12789900B250149E8AFB957787728B5612FAE6FEEE9A3523620F35F84B28
SHA-512:	5F9E8370E1D56CA34FDAC60461BBB1D8809BC48D3890066981CB8C28A0A99247F934E1C227F619ECAF52C107C842372B18B5C6107EC3EE4B44C3CBBF57ACF820
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Carpet Base (priced Linear FT)" GUID="{359482AA-2327-4787-AB7B-40FFC71A278F}">.. <Properties>.. <Property Class="Text" GUID="{BC5EB096-CCFC-4FE0-8B6B-2F16D19EE5C4}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{359482AA-2327-4787-AB7B-40FFC71A278F}</Property>.. <Property Class="Number" GUID="{3CF46D71-DAC2-434A-AA5E-376B57F9F603}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{01DC55A5-7592-459F-B831-651F9719855F}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False" SameL

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.6 Flooring (Div\Carpet Base (Linear%2F\is-C88VE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	971
Entropy (8bit):	5.4365680783066805
Encrypted:	false
SSDEEP:	24:2d2zJoiX2PxWwf2WAdOcS5uxh1OcIMEV9gAWa7/CApWPv:csoiX4h5uxGNbVlU
MD5:	F14E85291FA0C5E5B72CC7A6FD10FC05
SHA1:	FBB8569FADED430C24C59BC87BE7C09F49A18F0D
SHA-256:	C3399989F2554FAFC40B2BA266355C691A281A49B9C22D5D407478906D22CD43
SHA-512:	66B2DE58DC02F2C770B24E519796D848250F920BA888CC361C0F195960266256BB03D8A9A00262DE402FFA4665D1696A4EBC8DC7FAA767200754F9941DFBFE89
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Carpet Base (Linear/Segment Takeoffs)" GUID="{0A98D7EF-734C-4F4A-B4F9-09E2FB45E87B}">.. <Properties>.. <Property Class="Text" GUID="{DECE82D0-9835-4D62-8098-38DD02FDF251}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{0A98D7EF-734C-4F4A-B4F9-09E2FB45E87B}</Property>.. <Property Class="Number" GUID="{514E9408-2DB0-487D-BADC-852E9123731D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Type" GUID="{C5795117-C6DD-4BED-9B3A-808E776F7F10}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{FF310FC6-A4CC-4AA4-B13A-B4064E2C2EE3}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Carpet Base (Linear/Segment Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.6 Flooring (Div\Flooring (Area Takeo\Carpet (priced SQ YD\is-5VP9S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	15517
Entropy (8bit):	5.589167451145198
Encrypted:	false
SSDEEP:	384:qBn+qtpq5OUWS6htC56XcJBDqsRQFk98/02f94jU1Dhj4ESH2dwL:qB+qtpq5OUWS6PC5ukWsn98/Hf9VTj4F
MD5:	8281F3114570B6D28104828A497BF876
SHA1:	BEF3ADFCE1D6BE880A0FE5D5623E2DED769D0FF4
SHA-256:	19A7C260C3232B56E4B88DF1D071BA46B78ED1E2DE6A836D686A1479D57D270E
SHA-512:	67D5ABF0FA39220EBADC19249029A03113AD3CC34691103947A3A2A22A6F0C9148A0C28B4F19647EA787D0E86B9B802C932618E4AD65FE8C1DE45E3BEEB7C310
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Carpet (priced SQ YD)" GUID="{86E4F443-6C2B-4AAB-8F9D-5084F41E89F4}">.. <Properties>.. <Property Class="Text" GUID="{55A6C7B4-EE59-4677-8590-C85DEDFACCD0}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{86E4F443-6C2B-4AAB-8F9D-5084F41E89F4}</Property>.. <Property Class="Number" GUID="{47571C94-34BC-4ED3-B703-FA707B163979}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{FAAE6888-FB64-4DB6-9DAC-5D42AFD7EDB8}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Waste %" Order="0" ShowUnits="False" SameLine="True" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False" SameLine=&q

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.6 Flooring (Div\Flooring (Area Takeo\Carpet Pad (priced p\is-KQVEQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	15802
Entropy (8bit):	5.590837002340236
Encrypted:	false
SSDEEP:	384:DhEhf9D+j7+1mqx+qdD1NoXcuBLfq5e2uDGY312G/xtjUaDhE4Lcx0L:D2J9DS7+1mqx+qdDT8X2cGY30G/xe6EW
MD5:	DA16B88A8DEAFA48C3D5281ECBA81520
SHA1:	540DBBFF219000E171078B747952EAD63D644392
SHA-256:	76F5B8B88AB6BF30A0C87F13F3AB32604D8AB921AD91CCA2C6984FE0AC166816
SHA-512:	1C20A0F29D14040F7C17B61831843B5E64D158CA0F9B11DB37E3DC8237349D3CDC7B151DD498E00D1B38605CFD897C6A2F30E2B78B545C2FAE8E1FE188468663
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Carpet Pad (priced per Roll)" GUID="{719F3E16-0AAD-4D64-A27E-DB098A46B868}">.. <Properties>.. <Property Class="Text" GUID="{76138F88-9C78-4A50-8D56-05139010C8BB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{719F3E16-0AAD-4D64-A27E-DB098A46B868}</Property>.. <Property Class="Number" GUID="{C8907E25-C738-42A5-853F-0A1BF73FE019}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">5</Property>.. <Property Class="Memo" GUID="{E2453B0D-47BB-40E4-B100-BEF572CE7307}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="False&q

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.6 Flooring (Div\Flooring (Area Takeo\Carpet Tile (priced1\is-SO7FC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15823
Entropy (8bit):	5.591935061602539
Encrypted:	false
SSDEEP:	384:pZgQ8xvKy50pPo36dzUXcQB4qp1DZWWu2YzijU2Dh56tPAL:pZgQ8xvKy50pPo36dzw9fnZWWJYzX+53
MD5:	BAD23C250A27C50C7B6D9CB1B9C460B2
SHA1:	63630CC927AA83A2CE0E2753F9074C905559695D
SHA-256:	A448FF07469F00B13C2BE280EA8010A979706BCC6210AC736EF1160B40C71B19
SHA-512:	712B3298935CBCE49DDE3337F8E09C646196488A324FDE7AB1D77B8BA12890148329148B19FDA526607CD9DE610E12137392F1329D2D083B005970BC557C6A44
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Carpet Tile (priced SQ FT)" GUID="{173B3000-BFDE-4CC0-A3B2-29E31B97E67C}">.. <Properties>.. <Property Class="Text" GUID="{1CB7DB76-07EB-4061-A8FF-8FC23BB5D8F2}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{173B3000-BFDE-4CC0-A3B2-29E31B97E67C}</Property>.. <Property Class="Number" GUID="{66F0EDA2-1FB7-4575-8FFC-7B4F56A37A6D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{53F817EF-473A-4EC6-96DD-4BD583543545}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False" SameLine=&

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.6 Flooring (Div\Flooring (Area Takeo\Carpet Tile (priced\is-I0M5M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	15817
Entropy (8bit):	5.592144374634882
Encrypted:	false
SSDEEP:	384:l2L4V16IOLaWXXlgaTXabCXcHB0qM61+OpE2gyzjU7DhSegfW/L:l5V16IOLaWXXlgaTXabmebZ+Op3gysRV
MD5:	3653EDBB52484F6AA75F8C2241BAF288
SHA1:	295FC843D0D81E28114532830D253287734B13D0
SHA-256:	C1CC84F34606E7C3191E9C3087379CA067C2B41A850EC725F1DECEBE46DD2FF3
SHA-512:	279BC89E0F34FBDA8CB7F96E6AE8F64FDD230963E914D0E99606C38FE20578169662338BA16FF2FB731C0FB141A9EE9FAAA649E441363AB50951915A808CD9A8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Carpet Tile (priced EA)" GUID="{175AB141-D34E-439F-A88B-0FFA9395B4C7}">.. <Properties>.. <Property Class="Text" GUID="{356F0654-8C94-479D-BCE4-674AC8FE748E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{175AB141-D34E-439F-A88B-0FFA9395B4C7}</Property>.. <Property Class="Number" GUID="{6B4923F8-61FA-4F62-A9CB-1AC08CC2B59E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{B36178F4-A64F-435A-BF21-488FA480CF0D}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Width" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Length" Order="1" ShowUnits="False" SameLine=&quo

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.6 Flooring (Div\Flooring (Area Takeo\Flooring (priced SQ\is-PK4K4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	15532
Entropy (8bit):	5.5881627610266715
Encrypted:	false
SSDEEP:	384:yToSwy3yX7q1Xn/LRf7zjK6Xc5BhqvSP5irf2tmzjUaDh8Fnok1L:A/t3yX7q1Xn/LRf7zjKuMYm5irutms6e
MD5:	A18EED9370987E9A5752DE5A575BDE0B
SHA1:	2593E84DD80B1BA385F2F8B4434E4613A6FEF5BB
SHA-256:	BA967E90775A5303C5E29CB6F76F46B7A4F183462679235FD59E35018026957D
SHA-512:	F187DCBB4D0DED84E77B736B8E13FD1E23B8672DF0D7D7FBCE1C49176024B96F3DDED00755E46373B7FCB0D4EA2B17643D05B638C495CBBC1539161C00D75538
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Flooring (priced SQ FT)" GUID="{1A1D958F-8A25-409D-B19D-592E5EFD3520}">.. <Properties>.. <Property Class="Text" GUID="{EDD27F66-E6B0-4704-BE76-6F5E2F3B83C5}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{1A1D958F-8A25-409D-B19D-592E5EFD3520}</Property>.. <Property Class="Number" GUID="{A24ADA79-1FBD-4298-9DA7-CFA32C39B0F2}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{95C5763B-5F9E-4885-8CFE-037B5423C044}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Waste %" Order="0" ShowUnits="False" SameLine="True" Tab=""/>.. <Item Name="Cost Each" Order="1" ShowUnits="False" SameLine=

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.6 Flooring (Div\Flooring (Area Takeo\Hardwood Flooring (p\is-CQVH4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (395), with CRLF line terminators
Category:	dropped
Size (bytes):	15868
Entropy (8bit):	5.5930989725212426
Encrypted:	false
SSDEEP:	384:l8tGbOEjIUylPEZ1PkNdmJXccBvqN1NdgO8U2WOHjUTDhppSAZv0L:l8tGbOEjIUsPEZ1PkNdm5tiJdx8nWO4+
MD5:	0AD936BD5FDF3EF874863978DB9B56A9
SHA1:	03714A387FB59264880DEC40789F2D090AB5C75C
SHA-256:	29D7235F912EF778DEAA34F7A14FB1D7C9762FFC417720C26451EFC5247148C5
SHA-512:	34226C7BCF5B575563D9A90B7B4FE7F83F51AD874827C59AA4360F4E44A1EAAD422DFBFC9C3F439A70A5E0D9193E7BCECCFA35CD948538F49A8C5B69F7C355F2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Hardwood Flooring (priced per Box)" GUID="{E475DE1D-1581-42F5-9478-D80241971A88}">.. <Properties>.. <Property Class="Text" GUID="{047C766E-C159-4E9E-B1AA-9C4D8734CDD8}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{E475DE1D-1581-42F5-9478-D80241971A88}</Property>.. <Property Class="Number" GUID="{C29EBC32-327E-40C0-BB3E-55CA4E1F10BF}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Memo" GUID="{A2E7486C-B1DA-42E6-9500-7BAEC28BF927}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Material Coverage" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Waste %" Order="1" ShowUnits="F

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.6 Flooring (Div\Flooring (Area Takeo\is-MIH14.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	945
Entropy (8bit):	5.433182888900878
Encrypted:	false
SSDEEP:	24:2d2pvZp2X26+p+f2WAdOcPZpQKkGRS1OcLTgAWanTh/CApWtv:cmZApcZUGRtq98
MD5:	55B010C13D77A5F0DA5FD586715B4EB5
SHA1:	2F6371807C1E33FE439D1A659181C9CAE9E5CD27
SHA-256:	A3E82874B327A94EF9EA3BC2193C526A33A442A5A252B97F57499E9D08914CCA
SHA-512:	256858C21F2BAC787B67F8B37BC0DE894FE84B332CD7763EF2CD952E07614D9A616E40C638D4AA5A46A2FB9EEE688734F926B83D6CEA77FDC5F031A80DCAFF26
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Flooring (Area Takeoffs)" GUID="{F32CC47E-0827-4485-BFFE-88536B75EDC9}">.. <Properties>.. <Property Class="Text" GUID="{C32181EE-24C0-4489-8F99-E2909725A915}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{F32CC47E-0827-4485-BFFE-88536B75EDC9}</Property>.. <Property Class="Number" GUID="{698E8E3F-0803-434A-9A81-E682568E0F97}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Type" GUID="{6919A476-6285-4CE6-880E-63838ED405D4}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{5E91A86D-50B1-4AC4-9029-DB18449BCA2C}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Flooring (Area Takeoffs)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Parts\Material Parts (Drag\09.6 Flooring (Div\is-O0TD0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1085
Entropy (8bit):	5.444266179956451
Encrypted:	false
SSDEEP:	24:2d2aFr+X20ks6f2WAdOc4uAK411Oc7GurH0CxDgAWaX/CApWu3v:cd+9uzRKzflED
MD5:	45E739571FB1557C5D6C87DD6BE2D86E
SHA1:	45BAFD4CE5918CFE3CD10063A21DFBDDD064C2EC
SHA-256:	B3F4692FEFC49B4B88D886D4383348852AAD6A6FB55223A7B39AEF81276A7530
SHA-512:	1598528126627667853389CF7F0716C42F653BC021C6E67AB60577722D3EA343ED183DA935E2AFDA759D174920FCA205AA2E2717CEA9C8DB5356EF8AEF978680
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="09.6 Flooring (Div 09.60.00)" GUID="{31EF1662-4E1C-49C4-AA73-D7E1BCF5DA0B}">.. <Properties>.. <Property Class="Text" GUID="{4B1C98AC-EE35-4A1A-B4D3-761980BB0AED}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{31EF1662-4E1C-49C4-AA73-D7E1BCF5DA0B}</Property>.. <Property Class="Number" GUID="{6C0898DF-1C9B-4969-B1DB-3209288F5E43}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">15</Property>.. <Property Class="Text" GUID="{D8036943-573E-4AF8-9995-76C2EDC905CC}" Name="Description" OrderIndex="11" DecimalPlaces="2"/>.. <Property Class="Type" GUID="{4A9222C2-96E1-4B52-8B50-E1871055AACF}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{CDCD55AC-8566-4453-8E85-1868AA409B0A}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" D

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\07.4 Siding (Div 07\Rock Veneer\is-37U6A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	19600
Entropy (8bit):	5.627007790782716
Encrypted:	false
SSDEEP:	384:hi1q6CMsUQa6feFhfmtPeQGILyCxCcVCNhF9l6dslaipjnEDUFBUC8haDuSrd+jw:qVCMsUQHeFhfmtPeQGILyC8gGz9l6KlD
MD5:	4744ADAC86977835F200FB1237DC1E81
SHA1:	40852E911067D1C0EABF193CB2EA0CF94762008A
SHA-256:	3DCDBB95FFF0B7E992BCB4D73A640896695C7D31154BF01648A8D55D7B2F0C54
SHA-512:	66561CE5B3D42EB931E3094FC605623B693E5209C0957B57E790FB902122B6AFA1633F3CB5CF50E3B70F96A4F1750504ACA979FFAC0D4207FFFD990A54BC3547
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Rock Veneer" GUID="{EE8C579F-0388-4DAA-B3F4-D238670FB08A}">.. <Properties>.. <Property Class="Text" GUID="{C6618328-A6DF-4B0E-8C6E-DDBB3F84F699}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{EE8C579F-0388-4DAA-B3F4-D238670FB08A}</Property>.. <Property Class="Number" GUID="{D9EC417B-F720-48D4-833E-E199E79FD935}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Image" GUID="{8B71CD80-64F8-41E4-8E9A-84E831DB614B}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="5" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZfmgZGRk

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\07.4 Siding (Div 07\Siding\is-FE5T0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	19590
Entropy (8bit):	5.627510149135326
Encrypted:	false
SSDEEP:	384:S+zVYGQmevZQ2TMCNJ9jk8Cc68wNHy4IJzQ5snCiVjnTDUivQCUsalu5b8DEXw:S+zCGQmevZQ2TMCNJ9jktPTHVIJztnhA
MD5:	DFE6076B6478DB208A1BF261AE0167AC
SHA1:	C2AD2C02152ACB3C161D4045182F4D3EE7C6BCDD
SHA-256:	1690D75ED951E6815856B8E312624D60904D076EC91A591159E603CE5A6D6636
SHA-512:	4C039CE09224BC8ADA5933FAAC25BB28DD01BED5613BB77CA457FBCF11D828A442B8804E2FF2ABD1707AD24E1A641AA04E90F2C79FC0A75E256B05ED6ADF4A82
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Siding" GUID="{7AA36D85-73FF-4BA8-8EC0-FDF2C549B9E6}">.. <Properties>.. <Property Class="Text" GUID="{049C2613-AB2C-49FE-ADAD-37B13A8D0AAA}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{7AA36D85-73FF-4BA8-8EC0-FDF2C549B9E6}</Property>.. <Property Class="Number" GUID="{0B0730B2-10C4-4402-BCB2-A1E866870B56}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Image" GUID="{256972D4-9E41-4078-B9D5-B3D1A6941DF9}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="5" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZfmgZGRk/////

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\07.4 Siding (Div 07\Stucco\is-EKSCK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	19590
Entropy (8bit):	5.627200387418245
Encrypted:	false
SSDEEP:	384:xgSaZdBgQNeayEJov9mlh32ICcbrNIvEQq+VswGi3jnNDUT061CL4Sa/unNfIWtJ:xgHdBgQNeayEJov9mlh32RqR7Qq+ywNF
MD5:	25B9540F5AA570A89E4AED9D0BCCAEE7
SHA1:	ADB0E2316A6F499B0038FAD5955F74DDDDFBF195
SHA-256:	5F52790F03DD6B3E7D4055B09337A2FAB1CD369A8DF8F9FB1629327A177919BF
SHA-512:	4E3DD8E7F6612AE63F83C44CD7776523DCCA3CADC6AFC673C577EFBF0B0260209337FCA0613CA0F09A9A2687D1901B143739580EC25055ABC73B11EB19E3F768
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Stucco" GUID="{47903CF6-C0BB-477B-81CD-167EEE550EC4}">.. <Properties>.. <Property Class="Text" GUID="{ED96C3B2-85B4-4A1E-B6FF-A304D3D8FA54}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{47903CF6-C0BB-477B-81CD-167EEE550EC4}</Property>.. <Property Class="Number" GUID="{7DFD888C-3FF2-478D-936C-69A927E99F0F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Image" GUID="{23E156CB-6E05-4164-8FD6-8043FA2F5DC8}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="5" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZfmgZGRk/////

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\07.4 Siding (Div 07\Trim\is-824I2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	20084
Entropy (8bit):	5.6483028602120795
Encrypted:	false
SSDEEP:	384:1Hg1v/j5QPednZ2bmmHKkiBXcmHqYqJdToed2/uAU1jUUDhWh5TggJOnmo7L:+1v/j5QPednZ2bmmHKkiBzKpJdTr8/Bm
MD5:	8EE7E5B412AABC0174ED0B63A75D202B
SHA1:	E6A43E5EC00F7FB444738527408C739DE27848F2
SHA-256:	19A859656CF74DF4E70F97C48AD0B1A8168794DFC06181A9291BCEAAB2D49124
SHA-512:	DFB52CE3308F163E228C6BC7883C15445976D7A7D80C07FE4268A92EB09F6B15266D463CD5B9C0DA2FA8AC2B4AFDC67B3509F468411AD239997E1EFDB06FF99A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Trim" GUID="{528D77D3-9FD6-42C2-BF93-58ECAD277EB0}">.. <Properties>.. <Property Class="Text" GUID="{606E2908-1F30-470C-8718-79B6E28D565F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{528D77D3-9FD6-42C2-BF93-58ECAD277EB0}</Property>.. <Property Class="Number" GUID="{E78B2C0D-E3D3-4F53-B9F9-C7B81C029336}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Image" GUID="{96E0FCAC-6616-4DE1-84EC-D7291DAD3E6C}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="6" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADCHgAAwh4AAAAAAAAAAAAAZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HZGR

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\08.0 Openings (Div\Door\is-99IKA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1314), with CRLF line terminators
Category:	dropped
Size (bytes):	20772
Entropy (8bit):	5.587498274803787
Encrypted:	false
SSDEEP:	384:52g1zBrb6f5oTQoYUMDDR0kBJ+7c5kGnc+RUdYwIPVqMMA+diKCCNhkhvPZ2WQz:52Srmf5ocoYUMDDR0kBJiw7OdZeMgaJV
MD5:	900CEE6D82D85DA9E94F7D4B86ED99FF
SHA1:	DB4E32B2E263733A2027D886DF2C2A24517DA139
SHA-256:	F6036A9E8E00F7A5D85E50CF6EA0576344F835D1215925A5FA1276F96C71AF12
SHA-512:	C62F4094B711523902B035D7EB73D2069424397067F358B66BAC217F64C928965F302BC36EEA50CD3CB980B2C0CF9F722A6FBD4BE210DE3F12E092FF2C727A7F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Door" GUID="{246AA16E-399C-44D9-A701-C3DFD6A50BDF}">.. <Properties>.. <Property Class="Text" GUID="{A87B8FFB-D289-4F09-AF98-AD5BF5F133D5}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{246AA16E-399C-44D9-A701-C3DFD6A50BDF}</Property>.. <Property Class="Number" GUID="{3CF19460-79C3-4EFE-932D-C20531C57118}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{CFC0AFD4-0A50-491C-AA09-E31152115B83}" Name="Form Layout" systemhidden="True" OrderIndex="8" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine="False" T

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\08.0 Openings (Div\Window\is-L51C8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1314), with CRLF line terminators
Category:	dropped
Size (bytes):	21022
Entropy (8bit):	5.587492067025518
Encrypted:	false
SSDEEP:	384:+r2a1OwXm5TDZgW4neR55CYRs7cSaGQ/D7+3UPw2MPAq9MAVdPW2KXCZh5zLnbZy:u2+Xm5TDCW4neR55CYRYjlQ7DI2yBXbY
MD5:	20329479DF1D6D14F824B0D7F60F1E34
SHA1:	BD47E4AD33D80166D4CBFEA80BF422A2359FC58C
SHA-256:	033830A1B01105C9AE53CFFEFC13CDCB03DFAC1972C0C98BC13168114C616420
SHA-512:	1E44CD4D3182545ED6656B9A406E470F987477F187E5A08E273EC579ED53331A0E4BF60F9A7D45011E97015F25547F8C5E17185DEF2B19F4B7A7E761FD062EAD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Window" GUID="{8359BC12-8321-4022-91DD-C91D2839A59C}">.. <Properties>.. <Property Class="Text" GUID="{3EAB6AD5-1BDB-47E6-B640-082C93373BED}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{8359BC12-8321-4022-91DD-C91D2839A59C}</Property>.. <Property Class="Number" GUID="{B242C8F8-2929-4036-ADA7-2C4B6806EB20}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{27BBE206-E083-4115-BF08-3E1B131ECA9E}" Name="Form Layout" systemhidden="True" OrderIndex="8" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine="False"

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\08.0 Openings (Div\is-SUC1I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	956
Entropy (8bit):	5.446508700731051
Encrypted:	false
SSDEEP:	24:2d2UoTcX2uUWf2WAdOcRCDB1OcHIOfcqgAWaN3/CApW4oBv:cOTc9DsCDmYfckyZ
MD5:	8A929E65435B9A9606BA9EB713AD4205
SHA1:	BA04FDDAD9A5ED5ADF0CE57599CFE2BF1267EF15
SHA-256:	66AD994E455BA2C5CBEB5A7C5A63306BC305CC093B8FE26AE70E29DA306FE691
SHA-512:	419A12F26BF7231D5BBBD683DC6D8E369F04A97FC491540D2F3E0B6A5E4239EF894A1B09294D1112E76D140C73485511DD23B34383672671C736264BC431D204
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="08.0 Openings (Div 08.00.00)" GUID="{5C4389AF-8958-4CA8-B352-00E2775D1A28}">.. <Properties>.. <Property Class="Text" GUID="{1F0643FE-C4C4-4C35-92C2-A4D31A9DF6D4}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{5C4389AF-8958-4CA8-B352-00E2775D1A28}</Property>.. <Property Class="Number" GUID="{68C72B1E-4776-454F-B0C2-F31AE19AB3E4}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">15</Property>.. <Property Class="Type" GUID="{3DEE121F-6845-4AAA-86C6-4AEB76AAAFBA}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{AD996490-5033-4052-B8CC-4BCE54D4B863}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">08.0 Openings (Div 08.00.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.2 Gypsum Board (\Corners\is-9TJTV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1314), with CRLF line terminators
Category:	dropped
Size (bytes):	20782
Entropy (8bit):	5.587877521279287
Encrypted:	false
SSDEEP:	384:m2F1h/gUPAMjxlc4sJGsUCn7cWuGuk+xUdwdPOqRMAIdmK1Chh63s7/k6K6Y:m2ldPAMjxlc4sJGsUC7bZNGxjbMVw36r
MD5:	27A199860DDE5C486620A33A2B7B775A
SHA1:	19DB0D7570A2CBB1C48A2000394682BF640DF02F
SHA-256:	C3BDAFD1EA0F01441F62DD36ED3D0391BAFCC756094342B2338CCD49F379ABBF
SHA-512:	B17C916C5984BD484F1902C2CCE4F382DCCB09617A4EB2FA421F0E4E0711E7012392457BFEBD7AAB7CF41413968234E73ECB06FDDA8E6647E83CA52267053351
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Corners" GUID="{970DF03E-B066-4BEA-9A04-8DBD6431EBB2}">.. <Properties>.. <Property Class="Text" GUID="{4E10157D-9973-48F7-B510-43F048949E8C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{970DF03E-B066-4BEA-9A04-8DBD6431EBB2}</Property>.. <Property Class="Number" GUID="{FB0FCFB7-89A7-4FAD-B758-28B3AB80813D}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{6D9B94EF-854B-4D7B-AA4A-B9EEDDFA80F5}" Name="Form Layout" systemhidden="True" OrderIndex="8" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine="False&quot

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.2 Gypsum Board (\Drywall Ceiling\is-GUM1B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	19871
Entropy (8bit):	5.62866421248968
Encrypted:	false
SSDEEP:	384:lNRdMaJQWe29Up6KqCp5HvoCXc34q+JA43G21x7jUbDhHI1PMzDxtD2L:nRdMaJQWe29Up6KqCptv5af0A43B1xEy
MD5:	78F7DD08B06304BBB53E7CFA7CF2298A
SHA1:	8DC1BDB8993B7C35CA1E984E02E1B77025BA29E1
SHA-256:	78413A823BAFF2C98337B5E3B9234C94C04DBAF6924ED2DFF15A7D0085A4BF05
SHA-512:	60C2364A8F4DDFE52FA1E36415EEA93313F437D6F41FFA6737B57CE72C67E30E75956816C2C39A51A88CB71A835575E857A432A1C5289C4702D797B5AA261A1C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Drywall Ceiling" GUID="{233EAD25-B816-494E-B6EC-18A3E6D92A6E}">.. <Properties>.. <Property Class="Text" GUID="{B336E68F-DDDB-4831-9035-6A3DC559DE7F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{233EAD25-B816-494E-B6EC-18A3E6D92A6E}</Property>.. <Property Class="Number" GUID="{BBADE897-54C4-44DE-BFFC-6E8098A977A6}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Image" GUID="{22A363EA-2953-4C92-BEE3-0DA58D539E17}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="6" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZfmg

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.2 Gypsum Board (\Exterior Walls\is-89U8C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	21429
Entropy (8bit):	5.656092913456265
Encrypted:	false
SSDEEP:	384:nsPZeczeylrMZT3virHruV7XcYCqOEzvQo2JPEPljUiNDhyZFC/91WQtZbxOL:nsPZeczeylrMZLvirLuVj5tNzvQzJPcO
MD5:	5FB0EC26D5085A0672A3C84B797CE465
SHA1:	CC37489F935D6BD51D3FBE9A1AB7D78343EAEF18
SHA-256:	248AA04168E8C435C85E5E37BDEF6FE1BC7C3A8BCA808A16005D501EF1132F70
SHA-512:	1C01E62F752BBC3D58A4B18447E808791979F75F335C4CEE26E769D12F3E095F3366D174984258A3F16B06A5F78D5A4F042EB31F5423B8CAA78153BC53D7BAB3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Exterior Walls" GUID="{5F7982DB-5DA4-4261-A020-F7B3C24D24AA}">.. <Properties>.. <Property Class="Text" GUID="{D3BF62FB-393A-4786-AF2C-762861579A21}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{5F7982DB-5DA4-4261-A020-F7B3C24D24AA}</Property>.. <Property Class="Number" GUID="{F7E409EE-99EE-4671-A95E-A9579E76A8E4}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Image" GUID="{17C85DCF-DDEC-4A68-9D2E-AB2B565B7F0A}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="6" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADCHgAAwh4AAAAAAAAAAAAAZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0Hm

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.2 Gypsum Board (\Interior Walls\is-PU3QQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1327), with CRLF line terminators
Category:	dropped
Size (bytes):	21442
Entropy (8bit):	5.65736712137624
Encrypted:	false
SSDEEP:	384:QtbEeZFhISaxeBVmsZ6x1yhQ9qXcolqa9nIY22sckjU4DhWh+zYJdbN0ZzvL:QtbEkFhISaxeBVmsZ6x1yO9e5cYnIYRA
MD5:	65CA5CCC3A17BE6546D5802677716AD7
SHA1:	4F3170D4410FA1949662B8F26AEC277B23500058
SHA-256:	45BF0CF82AB4F34FAC1C990B010C0512CFB15CA7B16C16DDD775AF3316371CEF
SHA-512:	743D41E444EB355FE43CF7D9FDD9D105FDFB09071903BB901B41EB1FFAD6D4578F721BC2F6B631C712D1FFE24E4693301600653B2856AE116971BC6774C88BF0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Interior Walls" GUID="{23D3154F-70E1-429B-8F0B-53850E646F1B}">.. <Properties>.. <Property Class="Text" GUID="{59C4E82F-3787-437A-BC10-BFBA4AA1835C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{23D3154F-70E1-429B-8F0B-53850E646F1B}</Property>.. <Property Class="Number" GUID="{7BCDC3CD-085C-4C13-817B-FD30B5CB45F6}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{9161FD34-CC55-4BD5-8F25-ECAAE4F0FF7B}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine="Fal

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.2 Gypsum Board (\is-31O75.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	964
Entropy (8bit):	5.436347560480145
Encrypted:	false
SSDEEP:	24:2d2NAJX2bsf2WAdOctEJLL21OcneXx8gAWa56/CApWBxv:ctJ7/ngAk
MD5:	FC0A49FF5BF0B5D92D9F3A2FC9291E1B
SHA1:	6ADC9740005D73D2C3556C58FBB4E11A8AB631EB
SHA-256:	208E67F6E8F9E6107F5A5582CAB06E76E2976074FAB1B71F0E8DC230D6ED3C8D
SHA-512:	3186497E3D6318BF50B4EB488587690B1840108FA0A4BB01309227D63F4776BED061A7221047BF02EB4331F91DC8D82EAC7741782290048E995CE312E5240C23
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="09.2 Gypsum Board (Div 09.20.00)" GUID="{45E6C8B4-712B-41A7-BDCC-AFBC23836F09}">.. <Properties>.. <Property Class="Text" GUID="{41B44705-D049-4F2A-911D-5D2705C6A082}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{45E6C8B4-712B-41A7-BDCC-AFBC23836F09}</Property>.. <Property Class="Number" GUID="{B95FD82D-5480-4946-BFA9-463A0D27C3B3}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">16</Property>.. <Property Class="Type" GUID="{CC616AC9-9DC6-4BEF-851D-624ED5495324}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{B1A80D40-3385-41B6-B22D-9FE5DB93C4A4}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">09.2 Gypsum Board (Div 09.20.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.3 Tiling (Div 09\Floor Drain\is-2D9AQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1314), with CRLF line terminators
Category:	dropped
Size (bytes):	20784
Entropy (8bit):	5.588414818167665
Encrypted:	false
SSDEEP:	384:p2x1ClpS7W2OwjGgyScOjvEd7c5dGbX+vURwxPEq4MA5dKKFCEbhRzZ+Van7cWZz:p22K7W2OwjGgyScOjvEBk4vSlFM/RAED
MD5:	0E13C7E2FC85CD47EFD00880957D4920
SHA1:	107DB04DE72C5595062CC48EA91B2E27A47A6F1E
SHA-256:	46D9C678DFDA6F2E5C7633FDE7D7009148A793F25D71A43497D92852564E1F5A
SHA-512:	D51AEAB3440643D253DF8BB0CD90CFCF9B0B78FE1826D9FC07B981B675639578F1E686D97673627B259B0357C590E97068CE9C5B35D2976DE8E6C00F5719F881
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Floor Drain" GUID="{417699A9-040E-473B-B875-9D5209F30FD0}">.. <Properties>.. <Property Class="Text" GUID="{91786D0B-1715-439B-9E98-FDC400C9E34E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{417699A9-040E-473B-B875-9D5209F30FD0}</Property>.. <Property Class="Number" GUID="{0A88D7B1-FC8D-4065-99F5-7CB708513CA3}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{695F1A38-AF4C-41F3-8C7F-D336DB2365C8}" Name="Form Layout" systemhidden="True" OrderIndex="8" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine="False&

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.3 Tiling (Div 09\Tile Backsplash\is-0192P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	20106
Entropy (8bit):	5.648721165851543
Encrypted:	false
SSDEEP:	384:YEJmjExXQheA+Pc6x3uq3GWXc4eqhDOcV4D2b0tkjUCDhJtlvdUDH58GGLL:94jElQheA+Pc6x3uq3Gix5dOcV4Kb0tk
MD5:	7593699647B7F769D6EEB2CBD2539C7D
SHA1:	05735962673BF1F29F5C7EB4A3FA04D4ADE8BC95
SHA-256:	03AB90169AC6FA8E97AE7FE63AD623F0347D200A5F52A5DA7FC5889F3FE8C342
SHA-512:	520DE83C2DD4EB7EA7AF0081F2F738A5B4A0B6D1CA4FFDAA24648C77CAA76BC6B93E581B18280DFA4430397CBF8B67B82072ED27DAFA79D036C969065AABC7EB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Tile Backsplash" GUID="{AD3FEDAA-1A61-4950-8636-6E1197F2AD5A}">.. <Properties>.. <Property Class="Text" GUID="{3102A2CB-F16E-4B87-A10F-C5619E5C3F85}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{AD3FEDAA-1A61-4950-8636-6E1197F2AD5A}</Property>.. <Property Class="Number" GUID="{B5262F4C-E3A7-4DC0-B476-1F75DFF5E7ED}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Image" GUID="{82654CF3-9F90-4F6E-AAED-EDCFCC0F88B0}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="6" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADCHgAAwh4AAAAAAAAAAAAAZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0H

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.3 Tiling (Div 09\Tile Floor\is-O5DLQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	19598
Entropy (8bit):	5.626418523530016
Encrypted:	false
SSDEEP:	384:tzuhfUTQyeeVRRelCDGhL0TzZCcE5RNuZ+FaSlssCUiujngDU+gfqC3LaYuSdf7o:tzuhfUTQyeeVRRelCDqL0Tzk95LZaSlE
MD5:	C5527B96A1EC4094C15B3FED7790AB4C
SHA1:	4DF2B3242446E4B322E1DECE22FD8B241C9F429D
SHA-256:	B3F3EA04006F162325FF9C99934C9863135C09C316D6A673D4B0F72A3E3B08A2
SHA-512:	25E2ADF154147ACDC13E6F41C351D65223C44924942666DAD7EDA799F8AC6ABCD1BE882A78DF4702A5516750F00B39F3F6E9C2A29EEA17843CF5F4F19AA392C8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Tile Floor" GUID="{11AAF104-2E21-4491-ABCF-1FF8B8F01DC0}">.. <Properties>.. <Property Class="Text" GUID="{A621ADE1-F161-4D0D-9428-6873F498F063}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{11AAF104-2E21-4491-ABCF-1FF8B8F01DC0}</Property>.. <Property Class="Number" GUID="{2063F515-EC17-4A8B-8058-247EB42E7D17}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Image" GUID="{28CD5E0D-D4D5-44E9-AA8A-0674AB510B0A}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="5" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZfmgZGRk/

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.3 Tiling (Div 09\Wall Tile\is-PU9T7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1327), with CRLF line terminators
Category:	dropped
Size (bytes):	21426
Entropy (8bit):	5.654902565086456
Encrypted:	false
SSDEEP:	384:cRjoBjdojieXni3wfocN04R2XcEzS0qlL1HfK2yaWjUxiDhNOM/AG5/KzSKWAL:cREBjdojieXni3wfoG04RCpz+N1Hf9yC
MD5:	EA7D138A0F4FC8A202A1E64671F766EC
SHA1:	E6CA0E56234E3182C06D7296DE84EEF25E69E580
SHA-256:	E88F241B59E1A721D504ACFCBA80F16E41D0CB52098E0A3BD831BABAFA1928B8
SHA-512:	0B78745B9A7BC139A11C2A553228130956992DB585E901A59A02BADB53331C4EEEB675B320AF976879EF732F4AAE8B92173E9B19B5792E1415272C4570E2C3EA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Wall Tile" GUID="{F37CDAB8-2827-49CF-BAF2-202E861F3D78}">.. <Properties>.. <Property Class="Text" GUID="{23275FB9-827F-4BD0-8CAB-8A85F28818A4}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{F37CDAB8-2827-49CF-BAF2-202E861F3D78}</Property>.. <Property Class="Number" GUID="{14CED149-0EA6-4EBD-9401-BC981684C766}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{F941140A-D044-4C1D-966E-0456C0FEFAD5}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine="False&qu

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.3 Tiling (Div 09\is-25M39.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	952
Entropy (8bit):	5.446830685838441
Encrypted:	false
SSDEEP:	24:2d2CUbX2x6f2WAdOcngunb1OcFr3zgAWa7+8/CApWTv:cFsqupug+4
MD5:	FF8BB0B679976DF2DB262AF3A6DEDC83
SHA1:	67744546E2389E9D92F2C1D69D262B58DC6BB2BA
SHA-256:	DB96289070DE9DB4273E28C85255B9E556FDB7F98BA930AC168D6CD45A1E856F
SHA-512:	F9707544F379580C866EB2D39684F5C3C91D8D3095F3659F66A20EE9949C7BFE3273A3EF370D5B92CE2516252809D9061E19DBD68C7D8FB1CBACBE4BA8993886
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="09.3 Tiling (Div 09.30.00)" GUID="{D7772501-5C4C-4CA1-89DE-8686703C290E}">.. <Properties>.. <Property Class="Text" GUID="{B29505D9-426D-4D83-85E6-6EC72B4EF154}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{D7772501-5C4C-4CA1-89DE-8686703C290E}</Property>.. <Property Class="Number" GUID="{73DAB033-6881-4B31-8589-95BF07BD7E0F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">17</Property>.. <Property Class="Type" GUID="{AF4C9851-1420-4D23-9FA8-0CDBED11178F}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{CB461763-E59C-4C18-B73D-AFDFB1A60C08}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">09.3 Tiling (Div 09.30.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.5 Ceilings (Div\Accoustical Ceiling\is-5HQ16.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	19618
Entropy (8bit):	5.62658921623835
Encrypted:	false
SSDEEP:	384:/wRmRQQeC40WZBbxGGvSvnpyCcv6NS6oxqgs5NiCjnKDUCpw2Cw2GaTuuazbWRIp:/wRmRQQeC40WZBb4GvSvnprGOjoxqh5u
MD5:	878938DF2353B0E4F987744D330E963F
SHA1:	BF09BC7CC5DB6A54DF0838A0317812B0793C6FB5
SHA-256:	45F2F7F97502D8C00A84BDD9B6476B92C89E3FCE847FB19D3C8367D4C8AEFE8F
SHA-512:	F19BBB708188B853AB0DA8F15C663021BB8E11CB614CD99F3FD67376B2CE97572FD3BA0A94CA7127D5C93A659419C783F214C0EFA5EC13113CC153D3FB53F258
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Accoustical Ceiling" GUID="{2D79AA57-0F5A-4110-A525-8033672B220B}">.. <Properties>.. <Property Class="Text" GUID="{89150BF5-09E9-4EA7-85AC-22F07A7B72CC}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{2D79AA57-0F5A-4110-A525-8033672B220B}</Property>.. <Property Class="Number" GUID="{90C629B1-BB3E-42D4-9EE5-6413DE799FE6}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Image" GUID="{41D13551-CA39-4DF5-B2F9-BF70CDFC9201}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="5" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmg

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.5 Ceilings (Div\Ceiling Grid\is-5N6KS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1328), with CRLF line terminators
Category:	dropped
Size (bytes):	20128
Entropy (8bit):	5.649859590157913
Encrypted:	false
SSDEEP:	384:nJszUf80kjPQveRRQKg+29ASzyfcaMaTHQV2KVje+bMU1hzO60jzRDAf8mUwfGWw:aAf80kjPQveRRQKg+29ASzqHnQEKNfdw
MD5:	279AA8A00F403C3469DDF232D330A62E
SHA1:	9033B5728B287F9755C64638636DB355C08117C9
SHA-256:	69EA7EE78AFD8AB86058805D04C99E7AE1710CCEA82430C55B803FA1D54602B2
SHA-512:	F3149BA32D9ABF65260C9CE0FA939DC35FEAF88BC599B80E0683472424E46C2D48101B69D8713D233963F147BD770B7FA4A692F0C9BC6BA9B4F55EFA06E6A0D2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Ceiling Grid" GUID="{D3694928-4C7B-4EAC-A066-987B4A717C4E}">.. <Properties>.. <Property Class="Text" GUID="{ECED1329-70EA-4FC9-A42D-D353621024CF}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{D3694928-4C7B-4EAC-A066-987B4A717C4E}</Property>.. <Property Class="Number" GUID="{3E4D22B8-2B43-4194-9A7F-BC1188F70363}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Memo" GUID="{9C96861D-0959-40C5-B7BA-43F1639ED0C9}" Name="Form Layout" systemhidden="True" OrderIndex="8" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine="False

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.5 Ceilings (Div\Ceiling Tile\is-IPRRH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1314), with CRLF line terminators
Category:	dropped
Size (bytes):	20898
Entropy (8bit):	5.5851839300981325
Encrypted:	false
SSDEEP:	384:viZBzd5+2z7GA1A6aDmeXcAOqhq1ilx2zynjUuDhR3ftC6+7dNIwiUhL:vGBzd5+2z7GA1A6aDmatJg1ilozyYGOh
MD5:	4153115AE0ADFDDF99AEE31AFD649F85
SHA1:	BE091A6FFE627DE5648C64637391AEF9033A71CD
SHA-256:	32EDB54B799D11599E26F9927DDBC326225048810DA94934323CF5B76C769681
SHA-512:	A29821B1960E8E980B92E28F84714A284E469BBD8ACC107979021232DE929AFBA0A97F188CC54D254D2587947990EA658F643DE12356E1EF1F771CACB15D1517
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Ceiling Tile" GUID="{21CC156D-C04B-411C-BC87-B5CF28A91460}">.. <Properties>.. <Property Class="Text" GUID="{367E89DE-6298-42E5-BE10-C95E27A6421D}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{21CC156D-C04B-411C-BC87-B5CF28A91460}</Property>.. <Property Class="Number" GUID="{8C36BD08-411F-4847-A51B-3AAC0FCF8F2F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{F9202052-1D6F-418C-8562-9FEEBF00D20D}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine="False

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.5 Ceilings (Div\Wall Angle\is-FPSI4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	20098
Entropy (8bit):	5.648874724130571
Encrypted:	false
SSDEEP:	384:SvtPJQNCekkqzVVI3Xs0q/XcY7qSzoC0VE2VM3jUfDhIdu85KLMAHqL:SvtPJQNCekkqzVVI3Xs0q/5eLC0V3VM1
MD5:	10C01E2603A4D2DF77B30E32771F3B0D
SHA1:	35F383FFEF3C6F4CB3AF4C863DD4B924D462886F
SHA-256:	1836C9A70E4C5BB362682E2A44C70F1640AC4744377B9BBC6AE0356243215DA2
SHA-512:	7B8B1F32847EDF367E2D7A039228F4D9CC12294C934AE91F92D657041310E2D2E41202E4FCF67EB464DEDED635CED3F8D0620E5AAF2F3BAA5F34ECB94B47BD04
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Wall Angle" GUID="{2A5C0641-A9B3-4460-9E59-36AEB9E2A292}">.. <Properties>.. <Property Class="Text" GUID="{9B794543-5AA5-4DDD-AE52-0F3083B262C4}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{2A5C0641-A9B3-4460-9E59-36AEB9E2A292}</Property>.. <Property Class="Number" GUID="{489FE012-6665-4CE2-8378-610BEAB6AB17}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Image" GUID="{145AA6F1-5A9B-4A4A-B6E7-39A163D6D564}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="6" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADCHgAAwh4AAAAAAAAAAAAAZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0Hm

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.5 Ceilings (Div\is-1VPBG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	956
Entropy (8bit):	5.440179726236092
Encrypted:	false
SSDEEP:	24:2d2oR7X2kJ9qf2WAdOcNRhm1OcY2gAWay6/CApWov:c5P+uON
MD5:	6258A38C625941B46A60590301EE5AE5
SHA1:	86B3497ABA1160333BA5597E51A27C5531DFDB32
SHA-256:	954034AE35FB7E8DDFB9D7CF382F271ADD427D459C9536F02E548F4937DD1ECC
SHA-512:	9FFAA33F17C3B42BDB3800091BC3E2F540A470A563573C38421F33EA0D253E6C85EEFAEC41DD0647465255BDD6077C74B97D631F8F28EF7453BFE30EB22C5CDF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="09.5 Ceilings (Div 09.50.00)" GUID="{3534891B-228C-4FCE-B195-C8B1E46F3B85}">.. <Properties>.. <Property Class="Text" GUID="{CA5F10FD-9DD5-4ACF-A117-027EAD58D9E4}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{3534891B-228C-4FCE-B195-C8B1E46F3B85}</Property>.. <Property Class="Number" GUID="{9D50508E-3D84-4D43-BD07-813C165D6534}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">18</Property>.. <Property Class="Type" GUID="{6371317C-4EC9-4B3D-9AB4-710787A9DD92}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{829E68E0-1CCF-43AE-BDC0-9A3D4C364BF3}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">09.5 Ceilings (Div 09.50.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.6 Flooring (Div\Carpet - SqYd\is-9JG8O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	19613
Entropy (8bit):	5.63025834468829
Encrypted:	false
SSDEEP:	384:usoVYqVw03QAeKabEofi7pq0LyvXct+quQddjKU2JzYTjULDhU2Tx/BGogwcL:usoVYqVw03QAeKabEofi7pq0LyvMZpdT
MD5:	D8675B7A145A55F0EECCE0BEF9BB4463
SHA1:	996B2A6465D7EF5FE2AB2A2104F84254FC4AE02B
SHA-256:	B658CBCA84E11677A5E59861783895E2836D0A48B14D283CA06145731B7AA095
SHA-512:	2D5E9E9635A4581D1F09F983271B3014F90AC6A4B06D0D614E99284F0F1466BE7DE65A4A6B4E7EBF16180F9504D81A805C7FF1F93CFAA251ED43EE4E97417538
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Carpet - SqYd" GUID="{B24F2067-52E6-4CAA-87E1-229C119FB290}">.. <Properties>.. <Property Class="Text" GUID="{C997CBD3-9644-40C4-B08F-D39338A90488}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{B24F2067-52E6-4CAA-87E1-229C119FB290}</Property>.. <Property Class="Number" GUID="{956E6FD5-178C-405A-9BC2-EF9CD9C9A300}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Image" GUID="{67626207-5303-49AA-9942-158A61CAE687}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="6" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZfmgZG

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.6 Flooring (Div\Carpet Base\is-E1BI0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	20100
Entropy (8bit):	5.647524902203632
Encrypted:	false
SSDEEP:	384:wPvMTFQSexIF+OTYh1IrBaXcjnqyzxSKlD2NnWjUTDhC+nr0eblMuHY2L:uvMTFQSexIF+OUh1IrBOWqoSKlKNnjZj
MD5:	07E51444BE3528EA129139963487C0D9
SHA1:	8D9FAE14DE9D0BC1996FC3A47F04B3D1D3ADA0AA
SHA-256:	B47A9EAF5C6DDBE16E63EE6DEB074663335CC2FD764CB93247C9DF0E7B30314C
SHA-512:	F514FAA77205EC91CEE4C3D3B3FBAE63D49175713C462C61CF66BAB401E446CEF2B94BA326B37C16142DF3DEF2CFC4CCF0AF95E122A5EB6463B96093C7200C2E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Carpet Base" GUID="{1A85D614-BCCE-4E4F-9810-9177DE2E0957}">.. <Properties>.. <Property Class="Text" GUID="{09B5C3F1-863A-42E8-8734-5D7E09EE67F2}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{1A85D614-BCCE-4E4F-9810-9177DE2E0957}</Property>.. <Property Class="Number" GUID="{A4D07999-12C5-4A96-B67B-57A196A68DE4}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Image" GUID="{9BD5A005-DDD9-4E42-9D76-337BE5F1D39D}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="6" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADCHgAAwh4AAAAAAAAAAAAAZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0H

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.6 Flooring (Div\Carpet Seams\is-1K91F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1328), with CRLF line terminators
Category:	dropped
Size (bytes):	20128
Entropy (8bit):	5.650479771938238
Encrypted:	false
SSDEEP:	384:y6HWIvhOAQhes8jMY8KgaHLIW7fcRwTHreGPOj6+ZMURhmCOG7jzQDAavOxOb5PN:y6HWIvhOAQhes8jMY8KgaHLIWLYGzPUY
MD5:	3201E37BABBD920B27E59594B93BA217
SHA1:	D0B4DCBACB365DA47BE2FB9CCE731F1101BFD2A2
SHA-256:	C95FDB1AA018A08122CAF69FEC1805FA03348A251CA1B6D2963BE1EAD4566F90
SHA-512:	EB7DCD003A773A9233303509E3F74CB1042527279A20DF02AC28C75E666A95B2C632C43C347C0A1DFE9A303FC5109923009C9674B4F85C4503ADBF80DAC7C2AF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Carpet Seams" GUID="{C9580B78-9A96-46F7-8559-4A3E265BA9DD}">.. <Properties>.. <Property Class="Text" GUID="{1DCD7AFC-1540-4CD0-8921-3D2941302DF0}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{C9580B78-9A96-46F7-8559-4A3E265BA9DD}</Property>.. <Property Class="Number" GUID="{9E334F35-6E29-4593-B5A9-CEF88A828552}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">5</Property>.. <Property Class="Memo" GUID="{BECCE9BA-5B4D-4E30-A4F8-D6E55BF4E7A7}" Name="Form Layout" systemhidden="True" OrderIndex="8" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine="False

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.6 Flooring (Div\Floor Vents\is-10DL2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1314), with CRLF line terminators
Category:	dropped
Size (bytes):	20801
Entropy (8bit):	5.588776855308249
Encrypted:	false
SSDEEP:	384:k2iy1DKc14zzsCMIPEbC/Tn77cn9vGaO+RUowCPsqPMA9dNK5CChdfGu11JUf:k2ixc14zzsCMIPEbC/TnvIOVpstlTsUD
MD5:	23B75FD1CFF4BD490A396F956F24FA71
SHA1:	0E5362B9569C96A4153ECEF8A11E26BA2D8813A4
SHA-256:	90940D6FF4B402071F7F4701B9FC3D014F77CF584257ED8FE551F24261E250AD
SHA-512:	BCB964A24ED5E409AB87468749679521E9A0C6B196B9F43C35764AAC7BB9E74EF37894C6E8F4355861526B49046C0D45E2ED1E7E1B393FC90BC3BE991CC7C6F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Floor Vents" GUID="{35AA183D-A5C8-48F7-8D51-6E6BCDFB5862}">.. <Properties>.. <Property Class="Text" GUID="{ECBEAB21-90FC-4A8E-96DA-A56EBEB6D7A5}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{35AA183D-A5C8-48F7-8D51-6E6BCDFB5862}</Property>.. <Property Class="Number" GUID="{D7F3C203-E2C0-4763-BBDE-6B7210A0EBE5}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">6</Property>.. <Property Class="Memo" GUID="{413023DF-FABD-4EA3-9DB7-E272601CE2AA}" Name="Form Layout" systemhidden="True" OrderIndex="8" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine="False&

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.6 Flooring (Div\Hardwood Flooring\is-CF2M8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	19614
Entropy (8bit):	5.627146645506194
Encrypted:	false
SSDEEP:	384:BmZ7RUQheTXCBlYLL4jYMJCcv1Nl++SwvCusY0iajnC6DU034CK7a0hu81Yw2Kk:B07RUQheTXCBlYLL4jYMUaPlzSwvCfYW
MD5:	3A53FBCB1B5445158ED8BC6873C59DB5
SHA1:	5A6403423A33222DADAE2D6C960585C5BC825076
SHA-256:	6C4222E38924A55880F9EBBF93BE4C74957C4E153319197B62EFFED9D7D203B4
SHA-512:	ADD0C8F4AB30E9F1E91FD1C76A1F3F91788009154E66B8C81D8ABF21DB9D4309AFE82DC9CDFD19F6501A5EC32BBB14BA3E4A78E513A33D3250490672A2609A2E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Hardwood Flooring" GUID="{F551E370-244F-41A9-9356-6DF9EB12204D}">.. <Properties>.. <Property Class="Text" GUID="{C13ED392-E08C-4616-A043-64BC9EAC391E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{F551E370-244F-41A9-9356-6DF9EB12204D}</Property>.. <Property Class="Number" GUID="{9FB4503F-0BFB-4579-832D-26098EE021C4}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Image" GUID="{46BDB6ED-B4F4-42A3-BF8F-00019958F21B}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="5" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZf

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.6 Flooring (Div\Laminate Flooring\is-VP9OC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	19614
Entropy (8bit):	5.627268954644092
Encrypted:	false
SSDEEP:	384:7fsjR+QnecLww7rPjqrr8dPhCctNNDSdVieNstziUjnzDUoMYCxLam/uFHtAzZ:7fER+Qne0ww7rPWrr8dPsYXQVieat2qa
MD5:	1FFA4780ED79059060C6E984B4CE0A40
SHA1:	7D5AC48A17D1AF12B2C40DDC56D09408DB07243C
SHA-256:	B4E3C9A0C8F89C2589452C83170BD080DE4CEF41057BA3010F5EB932D6D3B61C
SHA-512:	B988EA7468CC9D763ACE049A013822E0B59C9EFF3166157C6F5E76C46DACC5208B4CFF5217BB31306E50808A5DC7A7339867132E89387E1A9846162B94F23EEA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Laminate Flooring" GUID="{A9FAF630-6992-40DD-BC55-E826FEE33850}">.. <Properties>.. <Property Class="Text" GUID="{6E04ED5C-B21B-424E-A164-8D43BF0E499E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{A9FAF630-6992-40DD-BC55-E826FEE33850}</Property>.. <Property Class="Number" GUID="{AE37A199-A802-4E1F-8913-E5854A8C1A1F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Image" GUID="{0FE24AD0-DF7B-4B7B-8F4D-862FA61415D6}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="5" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZf

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.6 Flooring (Div\Vinyl Flooring\is-0LAG9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	19608
Entropy (8bit):	5.6280707222856945
Encrypted:	false
SSDEEP:	384:GcJpekQUerwlBMBi29RREBCcf+Ny9v0bCsobikBjn0DUKSB2CKDacuS9YH1P3S:nJpekQUerwlBMBi29RREMyyov0bboukS
MD5:	DFFA93ECF4E0A4CD9174BE47086ADAE4
SHA1:	0DB6F9DDE174AF4344DE2440253BB53358E118DA
SHA-256:	190954805BB7D5A0FFFE264F6DE9AFA92FF655D975EB81161E17836165109BED
SHA-512:	491023F3F0E54842057D6E7716BAC41DDEBCFE850CA456D0EC0335108AFD87738CEB3A5DC9DA615F2B30E18859C8751932A207494460F7AA8080FE7056514D7A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Vinyl Flooring" GUID="{84C93914-9685-4236-9B4F-3C7185126F6E}">.. <Properties>.. <Property Class="Text" GUID="{EB811855-A975-406C-92F4-F57B2E5EE52A}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{84C93914-9685-4236-9B4F-3C7185126F6E}</Property>.. <Property Class="Number" GUID="{E41B45F3-FF21-4DEA-B50F-613A5BBAFE54}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Image" GUID="{2D7740B6-15C5-4A6B-AD9A-0D8510BF627E}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="5" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZfmgZ

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.6 Flooring (Div\is-AKPDC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	956
Entropy (8bit):	5.445867445866999
Encrypted:	false
SSDEEP:	24:2d2aBPX2rHK5f2WAdOcxmgg1OcDHE88hgAWaefSKq/CApWu3v:cRPAqbsmuEfd6K+D
MD5:	6852159B0E991215E90624D520935864
SHA1:	B7E9BF2C51D028078B2DB872C33526E8A14404E6
SHA-256:	285029AB443EE14EEB03DD103CF03CC2B70D040026FA61F5AD059B42E6758A9F
SHA-512:	A91CBD98381625179FFC2F986E0A9746A9A7A71E79AA3C8981646DDD8993A7865AEF209BAFEA0EEB6BCE17529F2B4BDE51A9F6CC8320873CF4BDA618ED4389A4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="09.6 Flooring (Div 09.60.00)" GUID="{B7C0A9DE-D28C-4A52-BCB5-E4C20A062F9B}">.. <Properties>.. <Property Class="Text" GUID="{422E6AB1-7597-47F8-A5B3-ACEF9AF5B163}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{B7C0A9DE-D28C-4A52-BCB5-E4C20A062F9B}</Property>.. <Property Class="Number" GUID="{B6A01D8F-3019-4E08-85B9-3C16590EE58F}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">19</Property>.. <Property Class="Type" GUID="{0B6755EC-AB36-4258-B081-45C5705B19E5}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{B96A8E2D-C7D1-4AA7-AC70-A2DE8140CEDA}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">09.6 Flooring (Div 09.60.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.9 Painting (Div\Painted Ceiling\is-SSIM1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	19867
Entropy (8bit):	5.628916372494256
Encrypted:	false
SSDEEP:	384:nAMjPQ45eSE23dQDFd3J6lXcb+q28tgPN520M0jUHDhlszZMxn6EI8xTYL:nAMjPQ45eSE23dQDFd3J6+Z2KgPNQ0MC
MD5:	7FA3BDBE848B13CB3DEEA9CD8A217C5F
SHA1:	A505E3F6E0A6E7C3AE9294FDB9E22290562A4F11
SHA-256:	F867D61228A8CC4E84F8C210C12DBE203DB7CC585257FAB1D9059FD613AA58B9
SHA-512:	C9A1AC78FD93A07F86DC38552475D3CB3D8E80719842D189BAE155F775068D0049F9392C07DC5816C0B3F75715065E2A78466EDFC7DFF86337E0D8BEF5022CF8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Painted Ceiling" GUID="{87FC94C5-E4E9-48C2-B8A3-F53200BBF28D}">.. <Properties>.. <Property Class="Text" GUID="{114C0E41-7432-4FCF-B1BD-7B2F58AB49EC}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{87FC94C5-E4E9-48C2-B8A3-F53200BBF28D}</Property>.. <Property Class="Number" GUID="{88477B88-B0CE-44AC-9F98-D80E3D80E896}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Image" GUID="{BDC88E03-41E3-4976-A382-FC59E5713D16}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="6" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZfmg

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.9 Painting (Div\Painted Door\is-AFMAC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1314), with CRLF line terminators
Category:	dropped
Size (bytes):	20788
Entropy (8bit):	5.588179087911998
Encrypted:	false
SSDEEP:	384:Duuu42G1DpLrQ+X/NKUzEKky5mHN7cB0GL6+OULwOP8qYMADdoK8Cdh/t7Ghne8r:Duuu42kY+X/NKUzEKky5mHxcrp8YdsZa
MD5:	63F3D54F9497CC3D7AC2278F0235F95D
SHA1:	67644C790655BFA0B37886341F07287523EF77A5
SHA-256:	F3B6611730BCE478A2AC9D01F5B0CADE34B3A03A308503B2A6404F001D6876B7
SHA-512:	656F7023A3FC9E15DA2C574D31D2314217DFE43B34790A9D6154AE07E4FD4B6358ED4F5B80BF92FD4D05D0F98A06D185D4C94FDCCE8EA3548707CD808CADF26C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Painted Door" GUID="{66B6C2DD-CFBF-4A0E-B775-8C6D394E54E3}">.. <Properties>.. <Property Class="Text" GUID="{07F79AF0-A09F-4C36-8A76-AE894B0007F0}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{66B6C2DD-CFBF-4A0E-B775-8C6D394E54E3}</Property>.. <Property Class="Number" GUID="{FD075E0F-BDE7-447F-BC44-2329BB165857}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Memo" GUID="{F18047D0-9124-44E7-9FBF-5F4E5995A3E4}" Name="Form Layout" systemhidden="True" OrderIndex="8" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine="False

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.9 Painting (Div\Painted Exterior Wal\is-GMO98.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	21441
Entropy (8bit):	5.6556716277578785
Encrypted:	false
SSDEEP:	384:2TfA2xZCXe5DNQs6M2HKwd6Xc+FqVDbuWqM2wUpbjUMDhxR37K2V6avLtcSLL:YA2xZCXe5DNQs6M2HFduH8xbuWqfw8kW
MD5:	BB7CD5B18E7D1CFFA11645E65F5CDA6C
SHA1:	2309579776D3585CF0D14FF0E67877807B387655
SHA-256:	3588D85F49F85CF1C17F07D0701F516893A618C3D94D6C51B89F98523BB616D7
SHA-512:	7C074A7200BC6335300E3433C9E9C17A60A67BB78900D6BDF38974244E605639DE94D869AF325DF42B7441602DC20AD9EA74474E37687987D2ED771D625C2B8F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Painted Exterior Walls" GUID="{76F29BBB-9CDA-43B7-B577-68D70BF3E483}">.. <Properties>.. <Property Class="Text" GUID="{8952591E-92BF-4D46-BBE6-C3141407F26C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{76F29BBB-9CDA-43B7-B577-68D70BF3E483}</Property>.. <Property Class="Number" GUID="{CD450ADF-BD1F-486D-BB3A-F5F3495F30E9}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Image" GUID="{10D010DF-9F66-44F4-A760-8DD94CB534B1}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="6" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADCHgAAwh4AAAAAAAAAAAAAZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0Hm

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.9 Painting (Div\Painted Interior Wal\is-O0P20.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1327), with CRLF line terminators
Category:	dropped
Size (bytes):	21454
Entropy (8bit):	5.655386686361426
Encrypted:	false
SSDEEP:	384:ESjJ/HvdKeTWy/rTjuEcN4UXcBrbqEjBvk1l2zNr2jUODhZU8ZZGp+vmGL:EyJ/HvdKeTWy/rTjuEcN4wAr+mBvk1Ei
MD5:	2B6DD471EBA6B26882242EF195EDC4C7
SHA1:	802D47A9F3B3AB4474181C26C9700DF1830EBEBD
SHA-256:	2D128E8D464ADE711F53E4614A7A2ABBAC9585A60620147FB2958C2AB4344725
SHA-512:	856C9352BEFE961E2EDA53101F13ACA27A0C92A636E4CD8E632E024C612B05E601307B7E6BAFAA16604E66D3E7FC9F480CECD71619ABC5510AEBE1FEC92DD6A2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Painted Interior Walls" GUID="{1CB84254-C0A4-4DB9-8417-35C63B9117FA}">.. <Properties>.. <Property Class="Text" GUID="{72685E82-28C2-4713-90DF-171F09643A5C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{1CB84254-C0A4-4DB9-8417-35C63B9117FA}</Property>.. <Property Class="Number" GUID="{DA77B29C-EE15-43E1-BBEF-A6425BA106E7}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{69E7E330-E106-4267-B582-D6E54F5AE9C6}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine=&

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.9 Painting (Div\Painted Surface\is-UQNKT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	19610
Entropy (8bit):	5.628085576195365
Encrypted:	false
SSDEEP:	384:U/x9rjFQWekySked/hXzL7YCcDsNGtu0dkpCsSliwjnrDUKZ6QCnHaDurcZrFeFV:U/x93FQWekySked/hXzL7he0Yu0kpbSK
MD5:	15AFDDF76304A863B6C4E210EA55DF65
SHA1:	9961F0A9D5C6C9E619DB48D828AB56A71B495D7A
SHA-256:	A070D5B3DF7561619572D117A3636514334A1D3227827973FCB74E242B6F69DA
SHA-512:	7E61B192B844DA1E3AE873EEAFEE7524BF717E69B7F58B7C7AF4670AB600A3BAD69D49432F0BDC4CFC99EAD65D46BA7893F1CB055EDFD0F8AC1418E22DB4196E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Painted Surface" GUID="{16842C90-3ABB-40D6-8950-4712A8FB5033}">.. <Properties>.. <Property Class="Text" GUID="{94D48C03-F8D7-4C1C-8E21-F4CC6BCFA981}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{16842C90-3ABB-40D6-8950-4712A8FB5033}</Property>.. <Property Class="Number" GUID="{C8748273-A60C-4337-84B9-2AACF07AA6B1}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Image" GUID="{86CE31CE-B746-4083-8F1C-D0463CAEA967}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="5" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZfmg

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\09.9 Painting (Div\is-539A1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	956
Entropy (8bit):	5.445095998972816
Encrypted:	false
SSDEEP:	24:2d28JX2O6f2WAdOcBZwa61OcCMM5gAWa/q9/CApWgv:cHJNu02aVvpqRx
MD5:	4CB8AC98A88140A6F36C12EB79F4C45F
SHA1:	8DB1E1F38CBE28AC0A0C6518BE036B837D313C2D
SHA-256:	480D72AC78FBFE0B69B0FB2F01A714A20830C2CE9B8BDA2FA76B3B266C23936B
SHA-512:	4EB796189D2DA6BE6D8C89E52B7212579E26CB3A1B6086CFC745BCB6189722C6B4AAB69739200886C099A93B0F61DD102E54DB2017BFD2ACA503875BCBFD5E03
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="09.9 Painting (Div 09.90.00)" GUID="{15E72B70-1B5E-48C6-9261-073BB60A72D3}">.. <Properties>.. <Property Class="Text" GUID="{A455CD5F-6DE6-44BC-ACB1-AE050A5B8454}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{15E72B70-1B5E-48C6-9261-073BB60A72D3}</Property>.. <Property Class="Number" GUID="{B980E7D1-3D29-456D-8679-6BF7A545FD54}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">20</Property>.. <Property Class="Type" GUID="{D9EC5E4C-51FA-4F8D-8500-3B50E707CD73}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{E2B6E708-D127-4ACA-BF29-CECC0DDEAFF0}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">09.9 Painting (Div 09.90.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\10.0 Specialties (D\Fire Extinguisher\is-E8BB7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1314), with CRLF line terminators
Category:	dropped
Size (bytes):	20801
Entropy (8bit):	5.587077009183941
Encrypted:	false
SSDEEP:	384:Xb2+1yFSQ5FD2RLYmJS2LCTqGtf7c08GrM+wNUWwjPtqCMAWMdOKfCXhob9HeTFD:r25RPD2RLYmJS2LCTqGtjNznPbkyWA9k
MD5:	351E54B8845653406BD26296DD0F413E
SHA1:	BCA5AADA06D35621D927C3B303AF64F7DCB50682
SHA-256:	25F03692D7AFD4227DCBB0E9D0B1C03A29D9729B270FDE5F76F79FE93C9D31EC
SHA-512:	102D8B667DFE18338FC85AF60609B0EFE9FF79725E04F0FEFACC2A4EA6183202C6D32AD5DA015D5F74281E2899396A82586874F529668CD1CC17B7DC3F298478
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Fire Extinguisher" GUID="{B9160224-3B6F-413A-8952-771CD5933C19}">.. <Properties>.. <Property Class="Text" GUID="{DC563F98-C4EA-4CB1-825D-814502E2AF63}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{B9160224-3B6F-413A-8952-771CD5933C19}</Property>.. <Property Class="Number" GUID="{5B22F548-680D-430C-877C-0203CC59F934}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Memo" GUID="{C3896452-7DAE-451C-95DE-EA6695216901}" Name="Form Layout" systemhidden="True" OrderIndex="8" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine="

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\10.0 Specialties (D\is-I2U7O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.435741092970298
Encrypted:	false
SSDEEP:	24:2d2phPERCX2dHdD8f2WAdOcchPERKiy1OckZ2UdgAWa/K7/CApWgv:cIhPfQHdwthPeNwgKbf
MD5:	DE603CDC9A3DF6DB80DC8651B5C7410D
SHA1:	6645D57FDED66D773BBB86138C394B8B90AED2AB
SHA-256:	FEB788547DBCA5F2B84D5B8C44C4105D59AC2845A10005771D2795F3165563D1
SHA-512:	3F404913C8CB0BB74864E0290ABC2257B999BB07B996F46701C7F380E53F20FFB017DD98D13B94E0E068499E446A1B2E81BF9A2CD2C77423B69B4B6ACE55E999
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="10.0 Specialties (Div 10.00.00)" GUID="{2D106D8F-11A2-4FFC-B683-E1937998BFFB}">.. <Properties>.. <Property Class="Text" GUID="{2E719DF5-0D78-4699-B8AB-09C06931D915}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{2D106D8F-11A2-4FFC-B683-E1937998BFFB}</Property>.. <Property Class="Number" GUID="{947260A6-F572-4438-B840-BADA7606C0F5}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">21</Property>.. <Property Class="Type" GUID="{347ACF73-6AEF-4E4C-80A7-C95CD8282331}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{181E1213-086D-4DCF-9EA9-CD21DFC7B11B}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">10.0 Specialties (Div 10.00.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\22.0 Plumbing (Div\3%2F4%22 90 Copper Elbow\is-NNHJK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1314), with CRLF line terminators
Category:	dropped
Size (bytes):	21061
Entropy (8bit):	5.586418848375098
Encrypted:	false
SSDEEP:	384:Txh2j1720ijGDbqCO8s8B4Po7PI7cqVhGRTC+YUHwPPjqtMAAdZKUCQhf8zHnqOc:Txh20VjGDbqCO8s8B+o7PU3+9DQHGn0n
MD5:	B90ECB1903372A47C1851B79E3B36AEF
SHA1:	452740F71664EABB2D2DFA8F7160EC620FF32E63
SHA-256:	11019F7F4CFC083A319EB819648BCAAF2136A9F95F4C7B799244D06ED8371BD9
SHA-512:	C523CC4875CD458E751418B1B346669C1BEC5DF1AA9684BE756402D6F9E0D4BB412B80864C826CECD1FEBCAA20A07AA0A67A1CB3BB87C56A989A1E7A825403D4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="3/4" 90 Copper Elbow" GUID="{C4B7AB83-D706-43E0-92A4-322FA52E94DF}">.. <Properties>.. <Property Class="Text" GUID="{FE1D4A4D-DF94-4CCD-ACE4-4F70FA44B3A9}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{C4B7AB83-D706-43E0-92A4-322FA52E94DF}</Property>.. <Property Class="Number" GUID="{8FB0A7B0-D503-4ADC-87BC-EF7D472208FE}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{DDE4A014-74E1-48EC-8163-644B53E1900A}" Name="Form Layout" systemhidden="True" OrderIndex="8" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLin

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\22.0 Plumbing (Div\3%2F4%22 Copper Pipe\is-UHPK9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	20120
Entropy (8bit):	5.649298037068097
Encrypted:	false
SSDEEP:	384:fYRMCv/zQWesqNFTIzrHTqlXcYnqlgOjqdW2MfTjUBDh0NwWz+iSUYBmqZIL:QRMCv7QWesqNFTIzrHTqdxqlNjqdxMft
MD5:	58177A117C5BE3D59A2D343C0BF1BDFD
SHA1:	B310A087EF271A41EDE2CE39FA5184FD24414C17
SHA-256:	6247503A6FFDECF3AEAB9A6DAC486057B58A80D678730D300C600BA6D2A54FA8
SHA-512:	DF37A28F703A98620A44FC1F6C33E5C12918983645869A5F2ADB77DB972AD0189F2390B35FD33A55F180F0A7C90C92EE8F26CD8DF3670320AA91C85621B8C677
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="3/4" Copper Pipe" GUID="{AC0FF444-969A-4ABE-B2C1-36FEEE4F2DD3}">.. <Properties>.. <Property Class="Text" GUID="{722F4E42-B0B7-4794-A069-51728080B596}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{AC0FF444-969A-4ABE-B2C1-36FEEE4F2DD3}</Property>.. <Property Class="Number" GUID="{EC5636CA-4B5E-4C31-9B97-2A555B5AACA9}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Image" GUID="{2D0CD5E8-D277-40ED-B04E-97ABD1E2AF2B}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="6" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADCHgAAwh4AAAAAAAAAAAAAZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\22.0 Plumbing (Div\Drain Pipe\is-OVK8S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1328), with CRLF line terminators
Category:	dropped
Size (bytes):	20124
Entropy (8bit):	5.650242220322872
Encrypted:	false
SSDEEP:	384:h8+GW6+ekXQqecOub/dL1n3BOxcfcnNTHMxdJj/+tMMUFhxOSjz0DA9HPlFV6V9v:2+GW6+/XQqecOub/dL1n3BOx0C1Wd5WB
MD5:	3524323D2E46CE45D3E7E72C55799563
SHA1:	B92CE8C510E15878AB45109D3493FF4B458CF8C1
SHA-256:	76EF9AA986525DE1BE233FB70E435463234E48B26782FFCA10B4B2A6225A000F
SHA-512:	2B729CEC60CFE2A3D81508203D6CE5047994E36BE526D4EB071AB0D53540BEE8BAD28CADCBB3A01B8E18F66AFB95E57D70761342EC1D98D96AC16A6CD31E258F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Drain Pipe" GUID="{D2C667BA-6F54-41D4-85A9-02057BABC3BD}">.. <Properties>.. <Property Class="Text" GUID="{F545837A-15D6-4008-9DC7-5872EE2C6C29}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{D2C667BA-6F54-41D4-85A9-02057BABC3BD}</Property>.. <Property Class="Number" GUID="{E5549E68-F7DC-4A0C-8A41-F850717BEFED}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{B4A679EB-725C-4F2D-8E90-228B15E6260A}" Name="Form Layout" systemhidden="True" OrderIndex="8" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine="False&q

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\22.0 Plumbing (Div\Plumbing (priced by\is-EIU60.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	19778
Entropy (8bit):	5.632010486906917
Encrypted:	false
SSDEEP:	384:pG+8wZM0QEenVkvjm3m2KqqCcftNI16NXzsFxizjnuDUGILpC+Pa3u+uyAjP:pGVwS0QEenVkvjm3m2KqjG3S6NXgFA/7
MD5:	5EE9D3DDDFA7E51DDA10116BAE2D68D1
SHA1:	C7B87C24A30805DC0800C0821533E964F7938BFC
SHA-256:	37BBC1A7D590254EECD22385DC2E43220836B026EB1EC1BC8137CF203E1DFB12
SHA-512:	53C22E7179E885207A0EDFD7CB4D5548B7DF7C0D3F3CA97316D91EDF6F8482AE9F67252FD169854FBA59480AD977840F3E019F5108B6F19E56969FA6448D0E79
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Plumbing (priced by SqFt)" GUID="{2FBC8E18-10DF-4392-9073-9FD8481371AA}">.. <Properties>.. <Property Class="Text" GUID="{2112A4F3-61D2-4831-A2E4-F5CE97E58BBB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{2FBC8E18-10DF-4392-9073-9FD8481371AA}</Property>.. <Property Class="Number" GUID="{82F05BD8-B6D3-43CD-A7DE-475577F2EE5B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Image" GUID="{122C23E9-DBC6-411C-B333-7F4054F5774D}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="5" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZf

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\22.0 Plumbing (Div\is-BUHMO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	956
Entropy (8bit):	5.446928651503849
Encrypted:	false
SSDEEP:	24:2d2s4YX2sqf2WAdOct4+9IV1Oc9s4BgAWaw8B/CApWEv:cLV+g9IKj4m8dJ
MD5:	1DA8745DE1AB5973F279D2FE4E04C556
SHA1:	3B66A6C55D57616D37854F8A95313736AE28CB51
SHA-256:	98D6E833979052397E89B5CCD11A2D4395EEA3A39E097123DF36792077C3A2C8
SHA-512:	29497117B8B6DCDF1CF03E1405D7BC6EBAA84DCF9BE9CC17A475EF50840A5D0984F71A17B1143131FF6243B3908B1E01F05FED4A597E26A6D9304297287DB245
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="22.0 Plumbing (Div 22.00.00)" GUID="{210683D4-62DE-47F5-96D8-3472A3186CAE}">.. <Properties>.. <Property Class="Text" GUID="{ADB8F062-3091-4FC0-9A5D-7B0F1361EF8E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{210683D4-62DE-47F5-96D8-3472A3186CAE}</Property>.. <Property Class="Number" GUID="{1F78E187-F091-4AEA-A0CF-25E7EFB87F6A}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">22</Property>.. <Property Class="Type" GUID="{FEE99918-AC3B-4D8F-82FD-AE7B9985F8B2}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{2D716D52-248E-4320-B1A9-A9DE360D3216}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">22.0 Plumbing (Div 22.00.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\23.0 HVAC (Div 23.0\Ducting\is-D49NN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	20088
Entropy (8bit):	5.647422642628304
Encrypted:	false
SSDEEP:	384:3FoE5G2Qne1JYPW2VyA/uoWXc0dfqxFbT5Aa2EEQjUjDhWQlw6cmz22gwL:3uE5G2Qne1JYPW2VyA/uoiByTbT5eEEN
MD5:	CFAD09FB89FEE115FC4EBBF458872211
SHA1:	F24F02B30528F1C2642CC3C649E06002C18EF1E2
SHA-256:	65FBCCB4B13EE7272E402D8BE6F7AA31AC2D3FF02E5587DAE47050460058453C
SHA-512:	F6A32E005B7EA0560ABB405604E162CAF1E31E5F393B85C5C95A8E272CA1D8E72A5632A85696F9B6A1567D87A7A9F47BE7752150F3AA02252795AC68FAFE04ED
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Ducting" GUID="{B5CEEAFA-AC6E-4CB1-B876-C1600B75DDC0}">.. <Properties>.. <Property Class="Text" GUID="{B8AF5F2A-5724-40F3-976A-70C860DEBC9A}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{B5CEEAFA-AC6E-4CB1-B876-C1600B75DDC0}</Property>.. <Property Class="Number" GUID="{90B6EBA5-C3B9-4616-A6DB-DE15F031A915}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Image" GUID="{88EC9F12-22C5-451C-A8BF-CF29E20B984A}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="6" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADCHgAAwh4AAAAAAAAAAAAAZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0H

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\23.0 HVAC (Div 23.0\Flex Duct\is-84H8V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1328), with CRLF line terminators
Category:	dropped
Size (bytes):	20118
Entropy (8bit):	5.6502863376188595
Encrypted:	false
SSDEEP:	384:nYRYJA7jv2aQIeyOy4nWc9l28LFrfctqJTH+plfjY+GMUGhIOLBjz6DAwn5/jziV:nYRGAvv2aQIeyOyOWc9l28LF78iYlrFB
MD5:	354E2E44D4B1CD9D4089E56C2C6C1C14
SHA1:	D1342C7488F4F7C00D95130D949238EF03C44332
SHA-256:	F35F7314533BA6FC2B85B8042338EA0115B05FA24C80D8C33D152DCDC302073C
SHA-512:	8B8001B5437F4F5F0FC4152C7F2A958CE0F885CFEEDB5F73B6EAECCD60790812D2FBF5488DB7F72A34667F565CF31EEA93452A99AFBA279C368C58B610CE422A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Flex Duct" GUID="{4979BCF3-1B1A-47A8-8D0E-75F5B6460992}">.. <Properties>.. <Property Class="Text" GUID="{C1539DD8-756D-4793-BCD0-3E3C02690E15}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{4979BCF3-1B1A-47A8-8D0E-75F5B6460992}</Property>.. <Property Class="Number" GUID="{76329629-759E-4389-A07D-793277299C6C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{1494AD12-5DBA-4353-AF12-D6B0F348059F}" Name="Form Layout" systemhidden="True" OrderIndex="8" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine="False&qu

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\23.0 HVAC (Div 23.0\HVAC (priced by SqFt\is-54DHH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	19766
Entropy (8bit):	5.63269557265912
Encrypted:	false
SSDEEP:	384:iGUD8Jod4Qce4OmUnzM4V4k7KWfCcObhhN55C0M3LsXwiWjntDUuX9kCbbaMu2fk:iGuiod4Qce4OmUnIk4k7KWaP9LC0M3IL
MD5:	D6A959CDE0F0E9241312345F8B544772
SHA1:	2633D2B78CD2268B9C38E299037C36CCBAD8DBD2
SHA-256:	AF473241EB4AB204E7662F94641D4D58B186992BFFA723B0E2EC6107A2273D06
SHA-512:	4E067D2A230F3E5DF7A2014E06A871B3ADCB66027188740676EB1A0914D71D9506DA7AB00AB7A9B425CA5264A54DE02959FA49F9C6A217A64FAA0779F8BC497B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="HVAC (priced by SqFt)" GUID="{F2D06D89-D4BE-4177-83B3-583C59DD438A}">.. <Properties>.. <Property Class="Text" GUID="{5CEF9D95-2CA1-41F5-A384-7159282C0030}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{F2D06D89-D4BE-4177-83B3-583C59DD438A}</Property>.. <Property Class="Number" GUID="{B7F61436-38D2-4B29-89D8-085DE220A98B}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Image" GUID="{30E65B3E-B690-47E5-BB7B-4AAD4F2B0FFE}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="5" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZfmgZf

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\23.0 HVAC (Div 23.0\Register\is-GNJNH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1314), with CRLF line terminators
Category:	dropped
Size (bytes):	21021
Entropy (8bit):	5.587342537634036
Encrypted:	false
SSDEEP:	384:iR2X1G/Ue9ylUvUQBEasr++W7cJ/GB+9+hUUpwJP+q/MAvd6KZCWhXnrb5QWipR9:iR2SUe9ylUvUQBhsr++Kg+sPbtz11B0V
MD5:	6930DFF76E9E2E758A8E4F06E8D328DE
SHA1:	2F8F8D415C069F2B3197989CEE14C74F34A5CA17
SHA-256:	FE8E6D1D7E6C5CF2C95E140A5CF0FFABCE8F1B159F76D8027A81B18B5F956442
SHA-512:	EE22FEE8B7587358892170FDDCAE9B6B7F38F31088BF1573959591E125457C0883F3EB8F814861E7A5A424BDB2F6161CBF7EE8242422DF5D13B590E2A7F31AFA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Register" GUID="{CBBC2E3B-E0EF-46A8-BEDB-B4EAD6D7C9AC}">.. <Properties>.. <Property Class="Text" GUID="{F05CE4D4-CF99-42E4-B343-7C6E2BADA656}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{CBBC2E3B-E0EF-46A8-BEDB-B4EAD6D7C9AC}</Property>.. <Property Class="Number" GUID="{96D46BE5-C9F2-45CC-BEC3-0C8E233C03BC}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{B902F262-5425-4D0D-9AF0-E8B2E2421093}" Name="Form Layout" systemhidden="True" OrderIndex="8" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine="False&quo

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\23.0 HVAC (Div 23.0\is-GOF6T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	948
Entropy (8bit):	5.460572473282708
Encrypted:	false
SSDEEP:	24:2d2PePeFmTkrX2if2WAdOcbumT+vlb1Oc6n3hQkgAWaoB/CApWjeBv:cWe2FfrlLXvlgdQpdaeZ
MD5:	4930B43CD03EB7D60744F3993990467E
SHA1:	9F0E51BE658D97C31475E4613B856D0E53CC7704
SHA-256:	5AC0041EADE4C5F40904802D7E3DFB878C287EEEEF50D50E8B83890289A07B23
SHA-512:	0E477B6F0AC0121BD5FE7DD204547325566BA8F9AD49776B82900004E0CD137D66764A84198B14A0876171F995943D36885117CD22D142E6A659BEB7E7B9127C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="23.0 HVAC (Div 23.00.00)" GUID="{8461316D-735A-4290-8763-5DAC0CCC0577}">.. <Properties>.. <Property Class="Text" GUID="{25A68F5A-1873-4778-8F92-F129BEE242E6}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{8461316D-735A-4290-8763-5DAC0CCC0577}</Property>.. <Property Class="Number" GUID="{0B09556B-1B3E-4854-8A20-2D42C829295E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">23</Property>.. <Property Class="Type" GUID="{28421CA2-811D-4635-BD5F-9E458791E00B}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{12FC6E67-A5F5-4F5E-84C9-54264765CDA1}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">23.0 HVAC (Div 23.00.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\26.0 Electrical (Di\3%2F4%22 EMT Conduit\is-EB469.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	20122
Entropy (8bit):	5.650148364650023
Encrypted:	false
SSDEEP:	384:Sho6sQTeThaxVk+D/hD/MIXc4oqFvPg8lp2DlGjUNDh4kxjcX7jZsrL:Sho6sQTedaxVk+D/hDEcdvh48lgDlTbN
MD5:	5A6C2E6EC4FB875F8BFDF7F12CBE557D
SHA1:	40D78F56BB663A7D499278F3E1ED3E59003A1859
SHA-256:	72DD3C2FAB9BA3C0610E4843951A6AF432181D89091FBBE58161B79BFD7ED7CC
SHA-512:	CD2749630818FBC02B49B8A367A55F4138AC3DC9A3EA762C227939897ABFF9CF4A3022E9C57B69FD88C4EBC979F2AE108F3C148F9277473E1DBB05024A3FDC87
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="3/4" EMT Conduit" GUID="{5CE3B522-D924-43AD-A052-4E3088E1E46C}">.. <Properties>.. <Property Class="Text" GUID="{5599AB91-5ECA-4591-8A33-DC2D8746DB41}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{5CE3B522-D924-43AD-A052-4E3088E1E46C}</Property>.. <Property Class="Number" GUID="{0DC52A53-248F-4842-8ADE-715C51354D78}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Image" GUID="{2AEB5FFA-65A9-4FEA-B70D-85DD72F8E1C6}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="6" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADCHgAAwh4AAAAAAAAAAAAAZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\26.0 Electrical (Di\Electrical (priced b\is-LA0V2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	19784
Entropy (8bit):	5.630707418377465
Encrypted:	false
SSDEEP:	384:kLGvbnQJfQwefKFQSeIVsI5l1Ccm+NuDKz1ZHHns7TiDjnwDU2ZWyCd19a0ur7hG:kLGTnQ1QwefKFQSeIVsil4LyBPHHs7Wf
MD5:	26A3952AB7B612FF96186459788B601A
SHA1:	1F278A86BF3BEAC1891ADF3C5ACCDFF582C1793C
SHA-256:	F9F104216239D2063EDD37B2F00CE08F1F83E0B472CB38E661DB95A3073B8C60
SHA-512:	B0CDD6C213936C9E4B2079C9A0D35BF2B7B5FEF2FEEA493F860D2FD9305D45E83505AC1A8EEDA9AEE4FC45AC4C935B4F9FE0E4AFCD9C267D3A6DE113FD99A34E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Electrical (priced by SqFt)" GUID="{68D0F0AB-01B0-4D6C-B4D6-879C779EC714}">.. <Properties>.. <Property Class="Text" GUID="{5499107B-BF16-41C8-ABBD-2815F499AB14}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{68D0F0AB-01B0-4D6C-B4D6-879C779EC714}</Property>.. <Property Class="Number" GUID="{819CB81B-1BAE-4AD6-B62F-4271AA57B948}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Image" GUID="{BFF47B4C-F172-402E-A659-2BA76A65F9F0}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="5" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmg

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\26.0 Electrical (Di\GFCI Duplex Outlet\is-N5T27.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1314), with CRLF line terminators
Category:	dropped
Size (bytes):	20802
Entropy (8bit):	5.5891486584685675
Encrypted:	false
SSDEEP:	384:Gr2C1JpqQ6Mh3/rQHaW0+0k2xO7cjXGFW+4UtwAP9qWMARd+KvC/h9j2Q0hXP8z6:Gr264Q6Mh3/rEaW0+0k2xyuW5WmUWHtn
MD5:	AC779B33207A7D8F696574B363B5B65F
SHA1:	B0D232DB955170049480B0B72472E2F1D6F490B9
SHA-256:	305080C2671B1A2AC860CF30223223F998E44699FDEAA7D27A275B9D62F4462D
SHA-512:	E6839F7175446A0479EF06AE03EAEE57E8CAA3806DBB1DD4D75BBD1BA62D3B6DDE29861860FAB1DD60A3E9FB991759E4011E3C13429C712D697AD26AD63DA4EE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="GFCI Duplex Outlet" GUID="{02E1CA73-D54A-48CD-889E-05322F45B7BA}">.. <Properties>.. <Property Class="Text" GUID="{7C9866E3-7D30-4631-B12B-E16956E05FB4}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{02E1CA73-D54A-48CD-889E-05322F45B7BA}</Property>.. <Property Class="Number" GUID="{95171160-D66E-4092-B890-0384A9783B34}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{C8A7C0B9-1FB0-4AE5-85E2-0850F08CA74B}" Name="Form Layout" systemhidden="True" OrderIndex="8" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine=&quot

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\26.0 Electrical (Di\Romex Wire\is-37EM7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1328), with CRLF line terminators
Category:	dropped
Size (bytes):	20126
Entropy (8bit):	5.650950360940201
Encrypted:	false
SSDEEP:	384:hmW1M9LUOPQxeaOrF1K5M+yUgt8fc34THZwAZPejW+CMUfh0OOjzFDAgSIlfytDy:YW12LUOPQxeaOrvK5M+yUgtU2+JZPk35
MD5:	7AAE2147C3E376F8622E17EA2604ECCB
SHA1:	AFE016ECAD4AFE543F61992C019EAD4DB3960DBE
SHA-256:	6C10AD756FBFE8C18A8D7C85A6E71C13770FF8A0B93E267E9DF9B4B734AA52EE
SHA-512:	541F394D7077193834BCEB8629619322AD4C708DF8609EAADCD99B9CDE2FA3D6C872DB5D9BC80C635AB9410420EB0EA7D7AF69F89B1F68A0B39B9A3827CA6064
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Romex Wire" GUID="{2E9381CB-6B78-4B5B-AFB6-0740DD49227F}">.. <Properties>.. <Property Class="Text" GUID="{76282223-E54A-45D3-A0AF-0476A6E4B91E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{2E9381CB-6B78-4B5B-AFB6-0740DD49227F}</Property>.. <Property Class="Number" GUID="{416786A0-1F28-49B3-8AED-182FCDDBD460}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Memo" GUID="{CE0C31A9-58B0-4BC3-85EC-A3892E64BC9A}" Name="Form Layout" systemhidden="True" OrderIndex="8" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine="False&q

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\26.0 Electrical (Di\is-NTMTP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	960
Entropy (8bit):	5.429206781584425
Encrypted:	false
SSDEEP:	24:2d25oaX2EkD8f2WAdOcRNe81OcfSMKCbgAWa65tQWb9/CApW6v:cJav50NmdMPSPnRD
MD5:	1EBEE8AC113ADAA8DAE0B8278D2AA840
SHA1:	5624CD986AACE1870EED799D993E3FD1E75E4285
SHA-256:	0371E9A5E165AB1EAB403D7F9BDDB05D99BD41F5A54A20D32B6F89ED3EC1501A
SHA-512:	1B7FA9615499DBAE11D6C64C6C870E357705072DAD5B65ADA35CB986A00AB3466DFEB6F1ABB97EBCF8A9979663BB4DF9594D7DB4AFC8DC307AF379DEF1AD57BF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="26.0 Electrical (Div 26.00.00)" GUID="{2CD65DFF-B13C-4A24-91B2-10F9F928D8D8}">.. <Properties>.. <Property Class="Text" GUID="{60FB009E-124C-4413-AE6B-5F8BF8386E57}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{2CD65DFF-B13C-4A24-91B2-10F9F928D8D8}</Property>.. <Property Class="Number" GUID="{5B00A50F-DCA9-4AC7-BA76-BCD550ACC0AB}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">24</Property>.. <Property Class="Type" GUID="{A8AD46A2-672C-4D3B-9F3A-A2AEF8AB7DDE}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{0E5C44D8-5C34-4AFF-AA55-2215353C5C80}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">26.0 Electrical (Div 26.00.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\32.1 Paving and Bas\Curb and Gutter\is-USPOB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	20116
Entropy (8bit):	5.647960704381134
Encrypted:	false
SSDEEP:	384:Ag2gNQresxGbo0xSndeK5Xch8ZqTdgytfGP2MyejUUDhk+OYddPIwLOKltoL:Ag2gNQresxGbo0xSndjpM8guytfG+Myr
MD5:	797532ECBCBDFA2930F7015C98386A0A
SHA1:	1A69836C2C9B2238893A0C286ED7DE7A2A07589A
SHA-256:	20474C6CAEDA53F0904E1A3DAD3212651428D53AED108EE72632E11F49B3F984
SHA-512:	C37E416A329CD3A2299450CEE8763EDB3DC9948B56827775B040A8A5E25B9C3AD9F0E865050CD22A821AD75B01FA1668971BC8C2A11EBED22BEE3049E2FAF979
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Curb and Gutter" GUID="{61D2DE21-7FB0-4057-9188-C6F0B6EBF56A}">.. <Properties>.. <Property Class="Text" GUID="{EAB11F76-419C-44E8-8975-2C6D43DDAD0F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{61D2DE21-7FB0-4057-9188-C6F0B6EBF56A}</Property>.. <Property Class="Number" GUID="{FBBB9A61-2567-425D-884B-6E4B556B1B82}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Image" GUID="{FB7B4256-867A-4D06-8BC3-E10F453D5127}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="6" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADCHgAAwh4AAAAAAAAAAAAAZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0H

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\32.1 Paving and Bas\Heavy Duty Asphalt\is-A29NN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	19624
Entropy (8bit):	5.628937556628746
Encrypted:	false
SSDEEP:	384:md0w3NYlQteAIVoX9quGi1pXcguZqZD9Vpw2NWfjUS6Dh6nsFtW0/EaUtL:me+NsQteAIVoX9quGi1Z1JB9Vp7NWAhA
MD5:	BD2335FF8F798DEB9BF6219651EEC135
SHA1:	DDEE655D6D9870B1F26D080CB93A6A1C3A97ABF4
SHA-256:	EE9851B5D562E36FAFC79CC8275D039C30230179F088368FF5B18E25F6ADEE54
SHA-512:	D7FFB50F211D3C6A3B33B22D1BA70213AE34DB4E3554CFF9598D6B3E814D7C411D876E1662DD64B028DC5AEC87C2DF79EE25A31A3473491D08FB12DECF4F0EA8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Heavy Duty Asphalt" GUID="{2C4477A9-F7B9-499E-A194-679C701379B1}">.. <Properties>.. <Property Class="Text" GUID="{6903FA0F-3F01-456E-A7F6-E8E7E2DF24AD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{2C4477A9-F7B9-499E-A194-679C701379B1}</Property>.. <Property Class="Number" GUID="{CF970717-AC60-495E-9721-0FAEDA6EDB13}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Image" GUID="{946673DA-C569-495E-89FD-EDEE0601DD0F}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="6" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZ

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\32.1 Paving and Bas\Light Duty Asphalt\is-851KQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	19624
Entropy (8bit):	5.6270530994522785
Encrypted:	false
SSDEEP:	384:bGPBpQkTeWznMbmiW8jB4imXcarxqq/DYKMk2euXjUSrDh0kE2MlWOtTt4q0H4L:bGPBpQkTeWznMbmiW8jB4iyrrxl7YKMG
MD5:	28D64B6E35EA4F48B3B78396C93B1B16
SHA1:	8D870FF9673648CE48D169B73BCF9CFE6086BC67
SHA-256:	D544D70B855FA63D005ABCA509D7DB760025336927AA528D286912341E45483C
SHA-512:	FFDBA0ABD9F1C5DE9A8C99CED91E3E259657243A8376C747FB2F207344EE5EB6A56ADED52F92BBA018069A7C605C9F442DB1525579AE6329050A33D7B3CE6B06
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Light Duty Asphalt" GUID="{BAFDAE2F-74BD-4415-BA1A-AFA542DEF859}">.. <Properties>.. <Property Class="Text" GUID="{82548AA4-06DB-40C9-8A28-B81270CEB5F1}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{BAFDAE2F-74BD-4415-BA1A-AFA542DEF859}</Property>.. <Property Class="Number" GUID="{BC3123CB-ECB4-472D-BCCB-BF59B88CE192}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Image" GUID="{744E3501-BBD0-4CF7-93BB-2158ABDFBF28}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="6" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZ

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\32.1 Paving and Bas\Manhole Cover\is-9V97G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1314), with CRLF line terminators
Category:	dropped
Size (bytes):	20798
Entropy (8bit):	5.5882838066187075
Encrypted:	false
SSDEEP:	384:Q2z1Jp5wQ1dd6oM4W2oL8d7cCHGX0+nYUDvwuP5qhn2MAQd5KfCPho+TG2SmN:Q2d5wQ1dd6oM4W2oL8BnmN04QoEwaJoG
MD5:	5A91C6478F0B9E2C21D92F106C192A34
SHA1:	D4E0F063AE000D632946109FD712285934559352
SHA-256:	70692DCE13B6837179365CB7F8E1794F28B83497C7BCA30D291057E8DB61D314
SHA-512:	4BFF7F731A72CB3640E7B88AD1F45CD7AEA221357A5109B14E9705A0C49D64E900F2418B1A9F584EAB846688959F31E9553516BAF965A4413A328DC13E5E317A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Manhole Cover" GUID="{64869BD5-3E6B-4D54-89F9-ECFD161FAAFF}">.. <Properties>.. <Property Class="Text" GUID="{441C3A52-AF36-4328-B176-6F37F6EDE71F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{64869BD5-3E6B-4D54-89F9-ECFD161FAAFF}</Property>.. <Property Class="Number" GUID="{DEEE1B21-0357-4311-A27E-7CEF4BFA2185}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Memo" GUID="{94D67975-7365-46C1-9E0E-A6EE37D7C464}" Name="Form Layout" systemhidden="True" OrderIndex="8" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine="Fals

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\32.1 Paving and Bas\Standing Curb\is-HA7B6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1328), with CRLF line terminators
Category:	dropped
Size (bytes):	20138
Entropy (8bit):	5.649496154059297
Encrypted:	false
SSDEEP:	384:vfmNXZY0Qne81CsFhBtTS1E5Ddfc7eTHABMSjH+NMUBhROdjzIDArw+zXoatra:v+NXZY0Qne88sFhBtTS1WDd6gCMAeTDR
MD5:	FBD9106AB5CDD0F7C8FB5B2796AEE061
SHA1:	F6E906F4EB1F0FADD1FF99CDF16074556B82BFA7
SHA-256:	92721A753DBFFEFF229BF91472AA55753F7731DEA251B85B86A879D721A54D55
SHA-512:	29FAA9B09BE1AC877E8D13A5F1137567D847EF48E8AF2C5B595B2499DE5A51B39AEEC51D61839C7BD681D2AC6822A84D21ED7CDCA21C67B9DE0155B29A8CF356
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Standing Curb" GUID="{539D71C7-7BA9-4AE0-AD78-E78AA3924D80}">.. <Properties>.. <Property Class="Text" GUID="{83178473-1111-45EB-AFAD-4E2B277B9C3A}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{539D71C7-7BA9-4AE0-AD78-E78AA3924D80}</Property>.. <Property Class="Number" GUID="{7F75127A-7A8D-4BA4-9A6A-786FE54CD9A0}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Memo" GUID="{FFEFAE6D-E9D6-41DD-B3B4-5F92DCEC961E}" Name="Form Layout" systemhidden="True" OrderIndex="8" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine="Fals

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\32.1 Paving and Bas\is-QA8FH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	972
Entropy (8bit):	5.434034065074782
Encrypted:	false
SSDEEP:	24:2d2tmX2Jf2WAdOcYwsB91Oc0PWt+HgAWaE+g/CApWtEv:cAmITwuSVn1oQG
MD5:	985A53E9DC926F3E9A4DB7CE470922E9
SHA1:	0D0EB2AC3EAC09ED6E17E4BCA19089DC3168F24E
SHA-256:	28973DFF83B7F43A90FF405C71BAC6981B43F703569BAF03B632BB50433AD7AB
SHA-512:	A80158EFEEA0FD19B769635906169FB03CB5EA067AF3012769669E7BE28B71ADC45F37890787BE1F6A40A62557A1B5EB0ADAF32A68C77FD7D8B23223DAC95A43
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="32.1 Paving and Bases (Div 32.10.00)" GUID="{B4829A43-69BA-4D72-AA18-ED9C172D620D}">.. <Properties>.. <Property Class="Text" GUID="{A7A391C7-89EF-4AF6-B37C-BBDF5309415E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{B4829A43-69BA-4D72-AA18-ED9C172D620D}</Property>.. <Property Class="Number" GUID="{EC6A8A1F-03B2-483B-83F5-D1A4D1366120}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">25</Property>.. <Property Class="Type" GUID="{7DC378E1-08D9-4827-8EB2-2C2D9049D089}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{DF6736D5-63DB-4B1C-8FBF-D47DCD643F1E}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">32.1 Paving and Bases (Div 32.10.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\32.9 Landscaping an\1-1%2F2%22 Sched 40 Main\is-S11H9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1328), with CRLF line terminators
Category:	dropped
Size (bytes):	20180
Entropy (8bit):	5.652744705146861
Encrypted:	false
SSDEEP:	384:EMT7+e8T/DFQ+egcAlRZB946LTKHfcUgTHfqDYjxM+2MURh4OU1jzdDAsFLFxjj2:EMT7+e8jDFQ+egcsRZB946LTK/xWiDae
MD5:	C56E9A7092E62E0113DEE5EE9F03CE8C
SHA1:	D0FAB65A7AB1C07D638C79B8D38E4F8ECD597450
SHA-256:	2FE7BE46AAA467792B9291DE1E0B9E4DA3645080DB41F10D409B8910466DDCE6
SHA-512:	06224B3036E66074AC91B0518936D6EA81E17E3C2693281A69228B4F2D138E4559ACC0751BBE89652BA4AC84E328DF56BE5C6B0AAE57BABFACFCCC80FCE83866
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="1-1/2" Sched 40 Main Line" GUID="{D4CF2EFA-047B-4268-987B-F0C9E4D4E543}">.. <Properties>.. <Property Class="Text" GUID="{1543A5E0-486B-46E4-863E-97D263BBE584}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{D4CF2EFA-047B-4268-987B-F0C9E4D4E543}</Property>.. <Property Class="Number" GUID="{7CAA4287-909A-4CB4-B3F7-A918D3150B15}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Memo" GUID="{06BCBA65-3DB9-44A1-BF3B-3906603B538B}" Name="Form Layout" systemhidden="True" OrderIndex="8" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" Sa

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\32.9 Landscaping an\2%22 Sched 40 Main Lin\is-DEN4T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	20146
Entropy (8bit):	5.649153161567871
Encrypted:	false
SSDEEP:	384:rRUc1xjQLe5dmKAKCVLarnB0XcXsqCz0d7aJ23Q2jUfDhwll43sUEzxBOXL:rRUc1xjQLe7mKAKCVLarnBQqjq0deA36
MD5:	889954BE7C8046B4ECEF012EAAC71BFC
SHA1:	B27356DB3A758FE7E650888671C43780CC1D6751
SHA-256:	080E0B88837E09EE9EEA022631CB4D25DFA8D2F6DE1240FFDBBA5A5F69AB0D32
SHA-512:	CA34582689B7649ABB1EFF9D7FA2B2045AF53D17B4AD319895DC9F26904EEB25C69A7091BAFC34B4E519A50F257050522CEF34C781B85455766506754977FB80
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="2" Sched 40 Main Line" GUID="{43C343BA-22F4-43E2-AB75-6873ACD34A30}">.. <Properties>.. <Property Class="Text" GUID="{B663F1D7-9DA6-4533-A178-CEF8D1797E60}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{43C343BA-22F4-43E2-AB75-6873ACD34A30}</Property>.. <Property Class="Number" GUID="{B1621F7A-5D81-4D33-AD6E-3EEE2DE8A46C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Image" GUID="{5F95B69D-4BC8-45A4-9179-613F1BB4A502}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="6" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADCHgAAwh4AAAAAAAAAAAAAZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkZGRkZGRkZGRkZGRkmV0HmV0HmV0HZGRkZGRkZGRkmV0HmV0HmV0HmV0HmV0HmV0HmV0HmV0Hm

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\32.9 Landscaping an\5 gallon shrub\is-GNL98.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4487
Entropy (8bit):	5.40358565641213
Encrypted:	false
SSDEEP:	48:cYrQeyJ9jDonKgwfdfValEfkD0HagAF+WngHHDmYVJzgnxku5SVpYsh:pQRJ9nCUIM5zgxkOGpDh
MD5:	2598698BE82D04C4388E659625654A74
SHA1:	573E72172CE57C7F3253AE301A1341611262F534
SHA-256:	F72FA6234F9AF897BE5C1F7E44B0D9704F167F5887EE08F927C9BDFC9DA463E0
SHA-512:	47EF7DF7B9939A17BBD8EC626B1FC98FE1713D9CBA1B662833FB8A046C94CB69FE95ADFD7FF5DEDD68534249B216B7AA491E0572380F1D1D0CBEE465619C3718
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="5 gallon shrub" GUID="{F9199CF5-A2DA-432E-9038-11961CEA9976}">.. <Properties>.. <Property Class="Text" GUID="{5DF6BD89-8AEC-468F-A7E0-C485CCBE684A}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{F9199CF5-A2DA-432E-9038-11961CEA9976}</Property>.. <Property Class="Number" GUID="{4CAE41B8-888C-4861-BA70-66066F97CB75}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">5</Property>.. <Property Class="Memo" GUID="{963CD7D1-AF68-4F5C-8939-98F8D87DBA8B}" Name="Form Layout" systemhidden="True" OrderIndex="17" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLine="Fa

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\32.9 Landscaping an\Mulch\is-M5EA8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	19606
Entropy (8bit):	5.628720641066757
Encrypted:	false
SSDEEP:	384:tVYL2FQKeGqAiA69THZ6gXcRtq+COVK32JjgjUXDhj6pWqmXgHiU/L:tVYL2FQKeGqAiA69THZ6EEUbOVKmJjtG
MD5:	6BDB0DE0ACF45A7C72EF2D86F28F18F6
SHA1:	0A0E52AEDC67414C77E9F943D1BBA1A53625AAB6
SHA-256:	4CD405156E65334168D7991727901A0C5032A49C576C1E7815F7D9642A7B1B3C
SHA-512:	A762028884B8FB26412C102C9D9AA125C453DC553F8FF02FC3C4723BA20B6CAB54F1573893B137C68900985CDDE911D78C3DEF3966ACB608259DF67D98D88038
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Mulch" GUID="{86CE52CB-63FF-460F-89A0-8631181BC728}">.. <Properties>.. <Property Class="Text" GUID="{F64B7777-EC4E-4F3A-8947-405BB46CAFCF}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{86CE52CB-63FF-460F-89A0-8631181BC728}</Property>.. <Property Class="Number" GUID="{90DD305E-4C53-4A2A-A473-FC90DED59081}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Image" GUID="{77BAFA7E-FC54-471A-9843-1A945C59C489}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="6" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZfmgZGRk//////

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\32.9 Landscaping an\Rock\is-S2V7D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	19604
Entropy (8bit):	5.627262391926424
Encrypted:	false
SSDEEP:	384:hXRYw/Q4eWo+bRa02wdpdXcE7qKwZ2nv21owjUwDhbvHDC5AcVqDPL:xRYw/Q4eWo+bRa02wdpFZeVZ2ne1o9YF
MD5:	CF36AA60014E3226CCE5A0034837A31C
SHA1:	C2BE622F1CEB54E918D39B5C307F6AD31AD87ACB
SHA-256:	7F4EEBC219CB022370BA176C0C89CA00B45C7BF3E81097AC54A5C1C4DD2BDA8D
SHA-512:	9E71282BE45164D7D938E5701A3F1871FEBDFFB5B9938FC676C132A6846218FF9064F6CED0933973C815F300C04BA15869C1A7C03EBDDF98A41DC9CAC77C7D28
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Rock" GUID="{F4C30DA7-8867-4D29-93E5-7791C9AFAB15}">.. <Properties>.. <Property Class="Text" GUID="{A2C4BA35-64D4-4252-AAE2-2034A2DEC780}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{F4C30DA7-8867-4D29-93E5-7791C9AFAB15}</Property>.. <Property Class="Number" GUID="{E71347B5-C9BB-4E07-9E5C-F05CA79834B5}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Image" GUID="{1CE3472D-82C8-445E-B428-73FC215DE687}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="6" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZfmgZGRk///////

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\32.9 Landscaping an\Sod\is-VHUIH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1313), with CRLF line terminators
Category:	dropped
Size (bytes):	19602
Entropy (8bit):	5.627968000067486
Encrypted:	false
SSDEEP:	384:ELSUF7F2QOe++OaREjFrSz8M4XcNoqlRwAP126EXijUWDhE5gj+roM/FlQZe0teQ:qpFR2QOe++OaREjFrSz8MMcvvwAP06EM
MD5:	914A3B72A05C3597B1ADE71B3D1365BC
SHA1:	2F3AF888AF7BDE8F0D42E39E3F794E6EE54C9C99
SHA-256:	29B3DD5AF847B413F991550F457EBFC2F24FAC129A81DA6A550842E2241D755F
SHA-512:	F634F576C8E0D4D96A5CDB4A7CEBEAA24C0A8611BEBB3800B0ADE52FED40F85BF1E40D96F2688E3390C7023D2EB4EE309E9F079668B79D78E379E781C18AC422
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Sod" GUID="{CDFCBA3B-808D-4012-8CEE-36E69D756557}">.. <Properties>.. <Property Class="Text" GUID="{7DCE3AB0-7AEE-4570-AC7F-B23B25497F66}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{CDFCBA3B-808D-4012-8CEE-36E69D756557}</Property>.. <Property Class="Number" GUID="{A4963C8E-3A36-452D-8490-99409631ABA7}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Image" GUID="{037DCCAC-6B93-430A-8EB4-17F480475811}" Name="Icon" inheritaction="Inherit Result" locked="True" OrderIndex="6" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADAHgAAwB4AAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////////////////ZGRkZGRkZGRkZGRkZGRkZGRk////////////////////////////////////////ZGRkZfmgZfmgZfmgZfmgZGRk////////

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\Sample Takeoff Tools\32.9 Landscaping an\is-FLUSQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	988
Entropy (8bit):	5.448578299421288
Encrypted:	false
SSDEEP:	24:2d2//iX2ORf2WAdOciqbcm1Ocp0ngAWaFc8/CApWVRKv:cX9DoIR/ccf
MD5:	B5AD90A2F272976D8F09D6D4C688646E
SHA1:	C87E8AD85B5B4414F1DA6857614ACE733F12DEAD
SHA-256:	FD0F47B7414EFFC9B988554A0F242616A632E1E1DCDF098536D8C5B11D11F801
SHA-512:	34910326057D8944D9F4B71294512871A60153E2F193EEA0BD7C1117507C9045C3FD0251F0F29658EC9A68617BDC04A316C9819151BBE61CC6262727D6895AF0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="32.9 Landscaping and Planting (Div 32.90.00)" GUID="{3F3FC189-4F5F-43D2-8926-34FA560E06FB}">.. <Properties>.. <Property Class="Text" GUID="{335655B5-CC78-4974-B0DF-9EF2F5BEA23F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{3F3FC189-4F5F-43D2-8926-34FA560E06FB}</Property>.. <Property Class="Number" GUID="{02752316-BB55-43AF-9A24-BC04B95A170C}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">26</Property>.. <Property Class="Type" GUID="{F85AFC61-6972-4227-92B0-BDA2C5BADB9A}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{EC029B65-EB22-41FE-A611-8EADC9996662}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">32.9 Landscaping and Planting (Div 32.90.00)</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\Templates\is-6T4E4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (705), with CRLF line terminators
Category:	dropped
Size (bytes):	2918
Entropy (8bit):	5.078870891384604
Encrypted:	false
SSDEEP:	48:cViskd2uf0MdOSaN2iddu0MdOSaNnG0cwR0MdOSaNsKdww0MdOSaNf:kiTd2uf0MdOEiddu0MdOZLcwR0MdOmKc
MD5:	F4DF75F06D6C36AF6378EE6AEB442810
SHA1:	B6096E93FE8D3CC8D592B4FDE81942EAA3CFE6D6
SHA-256:	3FF537A4049AB87581FFCB4812C306336A7F165E48DF55756D1A41C1F3BC40B5
SHA-512:	0615F0BE874F989101BABFD53611178B158D16EFC69934090726371A68032EF3591C3BE2F8CD7B0576461A921014D2CBBF33C1EEAAFAAA03F4607DB3F80BC801
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Templates" GUID="{A50BC811-5344-451B-B46C-D28EBD99E4D6}">.. <Properties>.. <Property Class="Text" GUID="{60AC0FA8-7EDA-4CE3-8B78-D909BC182EE8}" Name="Name" inheritaction="" inherited="False" input="True" inputorder="0" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" InputFormSameLine="0" Adjust="" InputFormTab="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" Expression="0">Templates</Property>.. <Property Class="Type" GUID="{01F2417E-B4D2-4111-B747-2DB1C54FDCA9}" Name="Type" inheritaction="" inherited="False" input="False" inputorder="0" locked="False" hidden=

C:\Program Files (x86)\PlanSwift11\Data\Storages\Local\is-HDQMP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (4639), with CRLF line terminators
Category:	dropped
Size (bytes):	7771
Entropy (8bit):	6.092611430532759
Encrypted:	false
SSDEEP:	192:7sOC9pjcaOvQiD3D748zQZjxuPXU8jYYFu6WVJlX:71uRcxvQibn7QNKXJMYF/WV3X
MD5:	3BD820177C3DD7BCC4E033679B87675A
SHA1:	3FBF80725BBD0B4D71E0A723DCD02D92BD34D6CF
SHA-256:	EC923FC29E4FDCC023CDD68DECEEFC6B0BEC4A1E16717448E972F003BB8C7213
SHA-512:	FBA8D03583DB8E8B822EA58B802E4963C9C263231F66389CCA46741049D98F161A8D1D033AA616954746FE3082E66D8181565C314221014296DD82548FE3E357
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Local" GUID="{BE391900-7103-4C73-B646-785AECA47C01}">.. <Properties>.. <Property Class="Text" GUID="{E735FFCF-65CB-4F58-B9C7-80C80FB46A41}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">Local</Property>.. <Property Class="Type" GUID="{8E2148FE-80FF-4D67-84E7-425515B33EC1}" Name="Type" OrderIndex="1" DecimalPlaces="">Storage</Property>.. <Property Class="Image" GUID="{4440A7B2-C94E-42CE-A140-8C5D41A4A8A9}" Name="Icon" OrderIndex="2" DecimalPlaces="" Transparent="True" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAALGOfPtRkwAAACBjSFJNAACHDwAAjA8AAP1SAACBQAAAfXkAAOmLAAA85QAAGcxzPIV3AAAKOWlDQ1BQaG90b3Nob3AgSUNDIHByb2ZpbGUAAEjHnZZ3VFTXFofPvXd6oc0wAlKG3rvAANJ7k15FYZgZYCgDDjM0sSGiAhFFRJoiSFDEgNFQJFZEsRAUVLAHJAgoMRhFVCxvRtaLrqy89/Ly++Osb+2z97n77L3PWhcAkqcvl5cGSwGQyhPwgzyc6RGRUXTsAIABHmCAKQBMVka6X7B7CBDJy82FniFyA

C:\Program Files (x86)\PlanSwift11\Data\Storages\is-D6C7V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	897
Entropy (8bit):	5.414171058388281
Encrypted:	false
SSDEEP:	24:2d2T9jsXWPsIgtr1Ociqf2WAdOcF9jzwL0/CApW/v:c8smNCOEog
MD5:	91C839E37FBA7DE7D0972BB1278CF80B
SHA1:	9C6A64813D3D6F47087F8A4B4B4B8F7D3833A068
SHA-256:	AA834631CF8D703FD4AE4B5D12A638E67CEA227A22F70137FE6478B808F72EF1
SHA-512:	BDB82A2D22284700333EBF801149D8B098BA2553B5242A2233A16B9BE083427A4CA50B6533D904507C1FF3072328CBE64607848365B6E71B50E10DB11E3DC17B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Storages" GUID="{9BA7F720-F353-4B99-A561-4ABD81C0DA1A}">.. <Properties>.. <Property Class="Type" GUID="{80053946-1A01-47F4-B5E2-FE3F81B62BCC}" Name="Type" OrderIndex="0" DecimalPlaces="">Folder</Property>.. <Property Class="Number" GUID="{F17E65C7-742C-4C29-8F0F-21376BC325BC}" Name="OrderIndex" systemhidden="True" OrderIndex="2" DecimalPlaces="">2</Property>.. <Property Class="Text" GUID="{9C2DE04E-9C1F-44E5-9B00-C55B8FAB43C1}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{9BA7F720-F353-4B99-A561-4ABD81C0DA1A}</Property>.. <Property Class="Text" GUID="{4BBCE1A5-70AD-483E-B42E-D6537E1A5D9B}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="4" DecimalPlaces="">Storages</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Textures\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3081
Entropy (8bit):	5.054813969580891
Encrypted:	false
SSDEEP:	96:kAZnqd2uI0MdOMG2bdw20MdOMbzbd/uz0MdOM8bcwk0MdOMG3:PvdOH4dO1dO4dO/3
MD5:	5BB93E3827ABF0438F97F1B95F144DB3
SHA1:	F069B5FDCA54121CA2A7A636B7D052123A1E4F43
SHA-256:	71D9569E2E63953812CCCC792B590F3743845C0838DB16B0DD494D4375601B0C
SHA-512:	00C3A90BEA8F946875168B6BF058C1B9C38C7036EFA65A16D2C2F193D027EB0F64EBFCF327051ED81B545866BDDED3F8093EA51603EF67A81204969635812F83
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Textures" GUID="{6075900F-15C0-42BE-B9FA-5BECC9B11E05}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Textures</Property>.. <Property Class="Number" GUID="{EBAD0F2B-3A15-4371-BF8D-6E1A82583086}" Name="OrderIndex" inheritaction="" calculatebefore="0" inherited="False" input="False

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Brick\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3112
Entropy (8bit):	5.092911354486029
Encrypted:	false
SSDEEP:	96:ksoKqd2uI0MdOMhuOZbd/u20MdOMxQbdwz0MdOM0bcwk0MdOMw:7dOcdOCdOqdOR
MD5:	5328460F8AE6AE0A262B87ED7EFF9B49
SHA1:	32D963E06D3084A019E33B856197CEEA4EA63FA5
SHA-256:	B7C6CB2B371CCA0244C5DFF0021BC406B4E759C41AABFB8EBF3C2B00635D28B5
SHA-512:	1D576284C5445C009D018746761E676197231BEF0587B0D06BD2E196954F56E23DA175C7D756BDC65F3D58A507DAB2F27AE931C0330F7871408BE7BB596E2BE0
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Brick" GUID="{AF51748B-406C-447F-9865-6E6BD3E79191}">.. <Properties>.. <Property Class="Text" GUID="{DF49B24C-F05B-485A-880E-93F3D67B0540}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Brick</Property>.. <Property Class="Type" GUID="{C3E8B75B-9C57-4A61-8E6A-C5F2622EC7B4}" Name="Type" inheritaction="" calculatebefore="0" inheri

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Brick\brick005\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (15876), with CRLF line terminators
Category:	dropped
Size (bytes):	20503
Entropy (8bit):	5.964385666139946
Encrypted:	false
SSDEEP:	384:SdOFdOVdO7nQT3x5/Aj+/SR4udsXkzs4pTozmgueyq+Y6U8ggrm4DWPzFdOSdOsp:DOei/6+qR4f4NoFgq+vdFrm4DWPzODRy
MD5:	01DF098A0922B0456CFA17C18B7ED99D
SHA1:	FF99B1A1BCD75F9955D0DB81038178BCC10349B0
SHA-256:	3DCDB1124CC228018F302D1C99188EAF6C1B0ABA0525F8D66521A897B267546F
SHA-512:	5790577FC2364D2BCA2238EB407ECAF185FA943749C51E1B96DC4A70719BBE82857E2A9413FF0C0FE43D388276E04FA30E160BDAD80A687D0FED2B0D36476ED9
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="brick005" GUID="{51068FF7-E115-48C9-933C-6DF2C456D6A0}">.. <Properties>.. <Property Class="Text" GUID="{CB68A3C7-96EB-42C0-9B39-ACE74E8A18FD}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">brick005</Property>.. <Property Class="Type" GUID="{2D2ACE9B-0DD1-47D1-B8A5-9DA03205C568}" Name="Type" inheritaction="" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Brick\brick005\is-07CAG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (15876), with CRLF line terminators
Category:	dropped
Size (bytes):	20503
Entropy (8bit):	5.964385666139946
Encrypted:	false
SSDEEP:	384:SdOFdOVdO7nQT3x5/Aj+/SR4udsXkzs4pTozmgueyq+Y6U8ggrm4DWPzFdOSdOsp:DOei/6+qR4f4NoFgq+vdFrm4DWPzODRy
MD5:	01DF098A0922B0456CFA17C18B7ED99D
SHA1:	FF99B1A1BCD75F9955D0DB81038178BCC10349B0
SHA-256:	3DCDB1124CC228018F302D1C99188EAF6C1B0ABA0525F8D66521A897B267546F
SHA-512:	5790577FC2364D2BCA2238EB407ECAF185FA943749C51E1B96DC4A70719BBE82857E2A9413FF0C0FE43D388276E04FA30E160BDAD80A687D0FED2B0D36476ED9
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="brick005" GUID="{51068FF7-E115-48C9-933C-6DF2C456D6A0}">.. <Properties>.. <Property Class="Text" GUID="{CB68A3C7-96EB-42C0-9B39-ACE74E8A18FD}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">brick005</Property>.. <Property Class="Type" GUID="{2D2ACE9B-0DD1-47D1-B8A5-9DA03205C568}" Name="Type" inheritaction="" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Brick\brick011\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (6328), with CRLF line terminators
Category:	dropped
Size (bytes):	10955
Entropy (8bit):	5.884205021990456
Encrypted:	false
SSDEEP:	192:YdOfndO6dOdDNnwa9ZOCrM8F2NV8xcxY21ydO5dOQRdOadOU:YdOfndO6dOTn79Z+84V8k4dO5dOOdOax
MD5:	5C5716A2539825359E1D198CE68974A6
SHA1:	3BFDE2ABE6A11583CFB109A286CA6F9F366128D4
SHA-256:	93F8B00B62407382CAA9E8BDA7A12A13A9B96A1DD46B3C6E936C09D6BFE7255F
SHA-512:	F4D4F219559307675FAF7D84CFE72BC4152DBDBFE914571D863460486E5CC997820CB302F5908ED5923A7AAEEBCD29EDC0CEAE2ACFB3CE28FFFEABC87602E694
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="brick011" GUID="{A36E51F5-E042-4D77-B621-7504FC2E922B}">.. <Properties>.. <Property Class="Text" GUID="{A274CC47-3782-4FCA-87E3-FE14866E1E61}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">brick011</Property>.. <Property Class="Type" GUID="{778E4A1B-7F94-4DF9-9B87-47BCCD02D676}" Name="Type" inheritaction="" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Brick\brick011\is-RMC3E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (6328), with CRLF line terminators
Category:	dropped
Size (bytes):	10955
Entropy (8bit):	5.884205021990456
Encrypted:	false
SSDEEP:	192:YdOfndO6dOdDNnwa9ZOCrM8F2NV8xcxY21ydO5dOQRdOadOU:YdOfndO6dOTn79Z+84V8k4dO5dOOdOax
MD5:	5C5716A2539825359E1D198CE68974A6
SHA1:	3BFDE2ABE6A11583CFB109A286CA6F9F366128D4
SHA-256:	93F8B00B62407382CAA9E8BDA7A12A13A9B96A1DD46B3C6E936C09D6BFE7255F
SHA-512:	F4D4F219559307675FAF7D84CFE72BC4152DBDBFE914571D863460486E5CC997820CB302F5908ED5923A7AAEEBCD29EDC0CEAE2ACFB3CE28FFFEABC87602E694
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="brick011" GUID="{A36E51F5-E042-4D77-B621-7504FC2E922B}">.. <Properties>.. <Property Class="Text" GUID="{A274CC47-3782-4FCA-87E3-FE14866E1E61}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">brick011</Property>.. <Property Class="Type" GUID="{778E4A1B-7F94-4DF9-9B87-47BCCD02D676}" Name="Type" inheritaction="" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Brick\brick013\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (3856), with CRLF line terminators
Category:	dropped
Size (bytes):	8482
Entropy (8bit):	5.724002103104754
Encrypted:	false
SSDEEP:	192:aDwdOzWdO/GdOXDNnw+Mqf07jkdOAdO0dOTdOC:HdOzWdO+dOBn9Mqf1dOAdO0dOTdOC
MD5:	63DF33973CF5E0522B75BC36828A6153
SHA1:	68CF8A519191D3817C0DAD2EB53DDA11CF9492ED
SHA-256:	248D63058629B778A8B6D84CFABBE667EC1362872C3887EB57141488B515A2B7
SHA-512:	13BA31F5F0FFBA1EE9F19C57D70BDF609466E9CEF313701B4727C580F77C08497AAAB4FF0369A4A9BD5BDBB8ABB83C31BFDC6AD08F423607951197AF6D68334D
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="brick013" GUID="{0B47B5B0-0416-40AC-B274-2D32CE7A8608}">.. <Properties>.. <Property Class="Text" GUID="{340BDD4A-8D64-42BF-A24D-412CDECF06D6}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">brick013</Property>.. <Property Class="Type" GUID="{D05CD7ED-2D4B-432E-A622-E10A55C660DF}" Name="Type" inheritaction="" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Brick\brick013\is-TM94B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (3856), with CRLF line terminators
Category:	dropped
Size (bytes):	8482
Entropy (8bit):	5.724002103104754
Encrypted:	false
SSDEEP:	192:aDwdOzWdO/GdOXDNnw+Mqf07jkdOAdO0dOTdOC:HdOzWdO+dOBn9Mqf1dOAdO0dOTdOC
MD5:	63DF33973CF5E0522B75BC36828A6153
SHA1:	68CF8A519191D3817C0DAD2EB53DDA11CF9492ED
SHA-256:	248D63058629B778A8B6D84CFABBE667EC1362872C3887EB57141488B515A2B7
SHA-512:	13BA31F5F0FFBA1EE9F19C57D70BDF609466E9CEF313701B4727C580F77C08497AAAB4FF0369A4A9BD5BDBB8ABB83C31BFDC6AD08F423607951197AF6D68334D
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="brick013" GUID="{0B47B5B0-0416-40AC-B274-2D32CE7A8608}">.. <Properties>.. <Property Class="Text" GUID="{340BDD4A-8D64-42BF-A24D-412CDECF06D6}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">brick013</Property>.. <Property Class="Type" GUID="{D05CD7ED-2D4B-432E-A622-E10A55C660DF}" Name="Type" inheritaction="" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Brick\brick015\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (5216), with CRLF line terminators
Category:	dropped
Size (bytes):	9842
Entropy (8bit):	5.826441063768094
Encrypted:	false
SSDEEP:	192:WdOfVwdOJgpdOXDNnwQ3yeUa2R6nBwOEx/v6lSfadO1dOXUdOQdOo:WdONwdOJmdOBnX3ArR6BwOblSfadO1dx
MD5:	18B5A424C5691D52404054F0F1FAFFF4
SHA1:	49C145305A6AA8829CA423EB2C1B1BA2C4B476BD
SHA-256:	E64B7C87802D88FC9B9DD133830C32005399DF0E3DBB67BB2F640A0FA12808DD
SHA-512:	67B5D3239264A107549745D3F28923B61EF42CD5F6FB1F8EA80528A28E2BA5D9E7121151D17E5CAB93CDC642E97E087E1AB5655C3BAC2F47A327FF29B4F1EB67
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="brick015" GUID="{9859CFE9-45D3-4476-97F0-0AB627D346F1}">.. <Properties>.. <Property Class="Text" GUID="{AF24DD4B-5012-45A3-B828-3C80876DD9E7}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">brick015</Property>.. <Property Class="Type" GUID="{C2289E9C-4362-4A4E-A1A7-A6477C4C5757}" Name="Type" inheritaction="" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Brick\brick015\is-9AOU6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (5216), with CRLF line terminators
Category:	dropped
Size (bytes):	9842
Entropy (8bit):	5.826441063768094
Encrypted:	false
SSDEEP:	192:WdOfVwdOJgpdOXDNnwQ3yeUa2R6nBwOEx/v6lSfadO1dOXUdOQdOo:WdONwdOJmdOBnX3ArR6BwOblSfadO1dx
MD5:	18B5A424C5691D52404054F0F1FAFFF4
SHA1:	49C145305A6AA8829CA423EB2C1B1BA2C4B476BD
SHA-256:	E64B7C87802D88FC9B9DD133830C32005399DF0E3DBB67BB2F640A0FA12808DD
SHA-512:	67B5D3239264A107549745D3F28923B61EF42CD5F6FB1F8EA80528A28E2BA5D9E7121151D17E5CAB93CDC642E97E087E1AB5655C3BAC2F47A327FF29B4F1EB67
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="brick015" GUID="{9859CFE9-45D3-4476-97F0-0AB627D346F1}">.. <Properties>.. <Property Class="Text" GUID="{AF24DD4B-5012-45A3-B828-3C80876DD9E7}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">brick015</Property>.. <Property Class="Type" GUID="{C2289E9C-4362-4A4E-A1A7-A6477C4C5757}" Name="Type" inheritaction="" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Brick\brick021\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (4148), with CRLF line terminators
Category:	dropped
Size (bytes):	8774
Entropy (8bit):	5.751196952206478
Encrypted:	false
SSDEEP:	192:LdO0dOxdOCDNnwhGq0wc1tr/pWdONdOCVdOMdOU:LdO0dOxdOsnnYdONdOYdOMdOU
MD5:	79CA8617071354186F35A3D7F985CFC4
SHA1:	3D7BA511D6E6E15CB436F5D7203FA1BCE2C03AB1
SHA-256:	45DE35C2F8F7B39DEF00BD8179CD8364ADEFF4B61CC0278939C1B2B02B6F7B5D
SHA-512:	8E1616E8FCE8C9EFE84CE60E131B7CA47FDFABF94B6014DE24C83CFDCE1B4DAFB68361F4AF4A3BC71C909AAC14E9F61D805A3DDBEBE60D8226BE3D09A3418D9F
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="brick021" GUID="{6A80804E-7171-49DC-AB85-4E963F573CDD}">.. <Properties>.. <Property Class="Text" GUID="{37490C59-813E-416E-B48F-114702777A7A}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">brick021</Property>.. <Property Class="Type" GUID="{B7A04CE5-9EE5-4911-A0AB-7086860D90B0}" Name="Type" inheritaction="" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Brick\brick021\is-JN99M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (4148), with CRLF line terminators
Category:	dropped
Size (bytes):	8774
Entropy (8bit):	5.751196952206478
Encrypted:	false
SSDEEP:	192:LdO0dOxdOCDNnwhGq0wc1tr/pWdONdOCVdOMdOU:LdO0dOxdOsnnYdONdOYdOMdOU
MD5:	79CA8617071354186F35A3D7F985CFC4
SHA1:	3D7BA511D6E6E15CB436F5D7203FA1BCE2C03AB1
SHA-256:	45DE35C2F8F7B39DEF00BD8179CD8364ADEFF4B61CC0278939C1B2B02B6F7B5D
SHA-512:	8E1616E8FCE8C9EFE84CE60E131B7CA47FDFABF94B6014DE24C83CFDCE1B4DAFB68361F4AF4A3BC71C909AAC14E9F61D805A3DDBEBE60D8226BE3D09A3418D9F
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="brick021" GUID="{6A80804E-7171-49DC-AB85-4E963F573CDD}">.. <Properties>.. <Property Class="Text" GUID="{37490C59-813E-416E-B48F-114702777A7A}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">brick021</Property>.. <Property Class="Type" GUID="{B7A04CE5-9EE5-4911-A0AB-7086860D90B0}" Name="Type" inheritaction="" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Brick\is-TP30I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3112
Entropy (8bit):	5.092911354486029
Encrypted:	false
SSDEEP:	96:ksoKqd2uI0MdOMhuOZbd/u20MdOMxQbdwz0MdOM0bcwk0MdOMw:7dOcdOCdOqdOR
MD5:	5328460F8AE6AE0A262B87ED7EFF9B49
SHA1:	32D963E06D3084A019E33B856197CEEA4EA63FA5
SHA-256:	B7C6CB2B371CCA0244C5DFF0021BC406B4E759C41AABFB8EBF3C2B00635D28B5
SHA-512:	1D576284C5445C009D018746761E676197231BEF0587B0D06BD2E196954F56E23DA175C7D756BDC65F3D58A507DAB2F27AE931C0330F7871408BE7BB596E2BE0
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Brick" GUID="{AF51748B-406C-447F-9865-6E6BD3E79191}">.. <Properties>.. <Property Class="Text" GUID="{DF49B24C-F05B-485A-880E-93F3D67B0540}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Brick</Property>.. <Property Class="Type" GUID="{C3E8B75B-9C57-4A61-8E6A-C5F2622EC7B4}" Name="Type" inheritaction="" calculatebefore="0" inheri

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3100
Entropy (8bit):	5.06164784892641
Encrypted:	false
SSDEEP:	96:kr79nqd2uI0MdOMePbdw20MdOMUiAbd/uz0MdOM13bcwy0MdOMq7r:sHdOHdOgdOIodOlv
MD5:	9A09CAA92ED35E2145E3C9FF51F29754
SHA1:	0FE41FFB0970FA1CF33D05394E11CF537F76E424
SHA-256:	735B99762FE98D758A3234B8E9EACA3F3FAE82EFD5AEEE105D188A77EB9010EC
SHA-512:	0BDD1138520D91D123FB8BFA58E29B020435E3069F58B0F2B96072051CFFCEB9A57CDAEC94F7D5BA83AA9FA50F7B72356A228A01AB71785468E924A27E49E1AF
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="_Default Textures" GUID="{AD60D09D-F15B-440A-9986-A3937A8B074D}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Default Textures</Property>.. <Property Class="Number" GUID="{F17C3E44-B5EB-4C00-B3DD-55654D673EE9}" Name="OrderIndex" inheritaction="" calculatebefore="0" inherited=

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Flooring\Carpet\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3116
Entropy (8bit):	5.086842577234903
Encrypted:	false
SSDEEP:	96:kiySqd2uI0MdOMxbd/u20MdOMcbdwz0MdOM//bcwk0MdOM4:NdO2dOcdOtdOV
MD5:	DBD3B7B6DF9B6E1BDA2FA2255877A6BA
SHA1:	52FEA216E7DD414C04CDFE754A473A4D7FF416A1
SHA-256:	A0B511610E9C152FF540C18B2926A1F3C99B3926FCE027D0CF8561225CBCF5A9
SHA-512:	263D23DD7BD167977087742D80E414038355C48591775798C5BBAB315ACF398977A19ED25831C34537C5802F5356AA0791A51C77E2A06ADBB759F0304C8C57D9
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Carpet" GUID="{2F6CA0CF-A261-4186-8232-ED609495E22D}">.. <Properties>.. <Property Class="Text" GUID="{7DDA0A51-67E7-4ABD-A421-AF6881AF82C3}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Carpet</Property>.. <Property Class="Type" GUID="{A7279B9B-9FC5-4010-828D-E1DFA8133090}" Name="Type" inheritaction="" calculatebefore="0" in

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Flooring\Carpet\is-6USLQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3116
Entropy (8bit):	5.086842577234903
Encrypted:	false
SSDEEP:	96:kiySqd2uI0MdOMxbd/u20MdOMcbdwz0MdOM//bcwk0MdOM4:NdO2dOcdOtdOV
MD5:	DBD3B7B6DF9B6E1BDA2FA2255877A6BA
SHA1:	52FEA216E7DD414C04CDFE754A473A4D7FF416A1
SHA-256:	A0B511610E9C152FF540C18B2926A1F3C99B3926FCE027D0CF8561225CBCF5A9
SHA-512:	263D23DD7BD167977087742D80E414038355C48591775798C5BBAB315ACF398977A19ED25831C34537C5802F5356AA0791A51C77E2A06ADBB759F0304C8C57D9
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Carpet" GUID="{2F6CA0CF-A261-4186-8232-ED609495E22D}">.. <Properties>.. <Property Class="Text" GUID="{7DDA0A51-67E7-4ABD-A421-AF6881AF82C3}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Carpet</Property>.. <Property Class="Type" GUID="{A7279B9B-9FC5-4010-828D-E1DFA8133090}" Name="Type" inheritaction="" calculatebefore="0" in

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Flooring\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3120
Entropy (8bit):	5.085049204736958
Encrypted:	false
SSDEEP:	96:kA/hqd2uI0MdOMsbd/u20MdOM/bdwz0MdOMbbcwk0MdOMQYh:tdO3dO1dOVdOGh
MD5:	8A0217BE475634C9E729D5D09E511C12
SHA1:	CE320680FC9F8E3E5D12D560D1B27343BDD5475F
SHA-256:	117B80C26978EE9CD09F347A2766F88FE5FD6F0E123DA3A378F2C0B490456361
SHA-512:	53ACF439BDE5A53808004BE4E4EAED59B38806B0910648DE64058D6CF3E134B71C2EFA685DED2BB309FA7CE3F91113C21425AA822A8C9F6B2012BE63005DA1BF
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Flooring" GUID="{7E85F959-28F7-4A86-B123-88E3EB173E77}">.. <Properties>.. <Property Class="Text" GUID="{C392E1A3-473D-492C-9C9D-A061B70DC202}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Flooring</Property>.. <Property Class="Type" GUID="{BF668227-4EAA-4096-801F-0703ABCDF0BB}" Name="Type" inheritaction="" calculatebefore="0

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Flooring\is-869MA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3120
Entropy (8bit):	5.085049204736958
Encrypted:	false
SSDEEP:	96:kA/hqd2uI0MdOMsbd/u20MdOM/bdwz0MdOMbbcwk0MdOMQYh:tdO3dO1dOVdOGh
MD5:	8A0217BE475634C9E729D5D09E511C12
SHA1:	CE320680FC9F8E3E5D12D560D1B27343BDD5475F
SHA-256:	117B80C26978EE9CD09F347A2766F88FE5FD6F0E123DA3A378F2C0B490456361
SHA-512:	53ACF439BDE5A53808004BE4E4EAED59B38806B0910648DE64058D6CF3E134B71C2EFA685DED2BB309FA7CE3F91113C21425AA822A8C9F6B2012BE63005DA1BF
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Flooring" GUID="{7E85F959-28F7-4A86-B123-88E3EB173E77}">.. <Properties>.. <Property Class="Text" GUID="{C392E1A3-473D-492C-9C9D-A061B70DC202}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Flooring</Property>.. <Property Class="Type" GUID="{BF668227-4EAA-4096-801F-0703ABCDF0BB}" Name="Type" inheritaction="" calculatebefore="0

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Flooring\wood002\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3118
Entropy (8bit):	5.088450938974685
Encrypted:	false
SSDEEP:	96:ktrbd2uI0MdOMqXbd/ul0MdOM7bcw20MdOMibdwz0MdOM5:9dON2dOTdO2dOm
MD5:	58683BFFFBA6B1359F4DD9424C672A62
SHA1:	B3E1ABB36211666C7C72332665525762D71BE601
SHA-256:	726833947162A1146C93EB49A5D5F2EB72D4105F16D63195E75CAE2A349C2FDA
SHA-512:	D8999D45497C94FA5CD56A3213CD203245A110C22596B6FDF77183B7B8AD698E61E4115F3E042215ECF79EA105D0D005D03ABBDCB3E0AB20DF776260689396B8
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="wood002" GUID="{9E3956F4-E191-44B4-BE58-D25B1EDBDFEC}">.. <Properties>.. <Property Class="Text" GUID="{4A47E637-9D10-4BC2-B252-FDBD11D5CF6E}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">wood002</Property>.. <Property Class="Type" GUID="{D229E95B-5FCE-439E-B988-FF2A52AC214E}" Name="Type" inheritaction="" calculatebefore="0" i

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Flooring\wood002\is-G5OKH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3118
Entropy (8bit):	5.088450938974685
Encrypted:	false
SSDEEP:	96:ktrbd2uI0MdOMqXbd/ul0MdOM7bcw20MdOMibdwz0MdOM5:9dON2dOTdO2dOm
MD5:	58683BFFFBA6B1359F4DD9424C672A62
SHA1:	B3E1ABB36211666C7C72332665525762D71BE601
SHA-256:	726833947162A1146C93EB49A5D5F2EB72D4105F16D63195E75CAE2A349C2FDA
SHA-512:	D8999D45497C94FA5CD56A3213CD203245A110C22596B6FDF77183B7B8AD698E61E4115F3E042215ECF79EA105D0D005D03ABBDCB3E0AB20DF776260689396B8
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="wood002" GUID="{9E3956F4-E191-44B4-BE58-D25B1EDBDFEC}">.. <Properties>.. <Property Class="Text" GUID="{4A47E637-9D10-4BC2-B252-FDBD11D5CF6E}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">wood002</Property>.. <Property Class="Type" GUID="{D229E95B-5FCE-439E-B988-FF2A52AC214E}" Name="Type" inheritaction="" calculatebefore="0" i

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Flooring\wood007\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (4788), with CRLF line terminators
Category:	dropped
Size (bytes):	9411
Entropy (8bit):	5.806311603244036
Encrypted:	false
SSDEEP:	192:5RdOa2dOQdOTdOEdO+dOfdOZDNnwcJBoZUgvF5wrQMNV/ned:bdOa2dOQdOTdOEdO+dOfdOvnpgvcHV/a
MD5:	759365A954DE3B80FD64EDF34BEA473E
SHA1:	F40AB2B2D0AA9CF148F6B16C59BA98EACAB54552
SHA-256:	64A0E7DD03BF786F45EA1D53839FB9BB72DEFF03414F6A1FEBD84606AB88B2D5
SHA-512:	516B7ADE37BB0E36EB13A500A3CE7DD316088063E570BD04DCABD70CD6474F4E827F82E3E6D75EA6ECAB38C23CEB2517324B6DF84AE361839E47A9F0D95B1D9E
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="wood007" GUID="{0475E41C-AA3A-482A-AA8C-BC3A5D078546}">.. <Properties>.. <Property Class="Text" GUID="{4A47E637-9D10-4BC2-B252-FDBD11D5CF6E}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">wood007</Property>.. <Property Class="Type" GUID="{D229E95B-5FCE-439E-B988-FF2A52AC214E}" Name="Type" inheritaction="" calculatebefore="0" i

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Flooring\wood007\is-TCTKC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (4788), with CRLF line terminators
Category:	dropped
Size (bytes):	9411
Entropy (8bit):	5.806311603244036
Encrypted:	false
SSDEEP:	192:5RdOa2dOQdOTdOEdO+dOfdOZDNnwcJBoZUgvF5wrQMNV/ned:bdOa2dOQdOTdOEdO+dOfdOvnpgvcHV/a
MD5:	759365A954DE3B80FD64EDF34BEA473E
SHA1:	F40AB2B2D0AA9CF148F6B16C59BA98EACAB54552
SHA-256:	64A0E7DD03BF786F45EA1D53839FB9BB72DEFF03414F6A1FEBD84606AB88B2D5
SHA-512:	516B7ADE37BB0E36EB13A500A3CE7DD316088063E570BD04DCABD70CD6474F4E827F82E3E6D75EA6ECAB38C23CEB2517324B6DF84AE361839E47A9F0D95B1D9E
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="wood007" GUID="{0475E41C-AA3A-482A-AA8C-BC3A5D078546}">.. <Properties>.. <Property Class="Text" GUID="{4A47E637-9D10-4BC2-B252-FDBD11D5CF6E}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">wood007</Property>.. <Property Class="Type" GUID="{D229E95B-5FCE-439E-B988-FF2A52AC214E}" Name="Type" inheritaction="" calculatebefore="0" i

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Flooring\wood018\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (4352), with CRLF line terminators
Category:	dropped
Size (bytes):	8975
Entropy (8bit):	5.775891788422153
Encrypted:	false
SSDEEP:	192:t5dO+2dOQdO4dODwdO+dOfdO2DNnwNTSVpa4IYMgBo6jVJvt5S:HdO+2dOQdO4dO0dO+dOfdOgn6TSHabYq
MD5:	1449F3735295196C8830DEE8BC15E7C6
SHA1:	7AC63E4B5D052AD177D6AFD480BC778D88F4B52A
SHA-256:	4C672AB520B17AA1B5826A8EB9A4C4CF97F5481982FF170EE057ECAF5A82DBD1
SHA-512:	4C3F3075FED196BBA2F393C99756FD280CF4D191448310C613CAE59A581206F6EFA1B9483FAD729B301FC3D6DBD3C77F256D6880B2A330851A7A55213AB8550C
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="wood018" GUID="{2E34D38C-8ACE-4B54-9DB2-F884DF53A232}">.. <Properties>.. <Property Class="Text" GUID="{4A47E637-9D10-4BC2-B252-FDBD11D5CF6E}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">wood018</Property>.. <Property Class="Type" GUID="{D229E95B-5FCE-439E-B988-FF2A52AC214E}" Name="Type" inheritaction="" calculatebefore="0" i

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Flooring\wood018\is-UMSIQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (4352), with CRLF line terminators
Category:	dropped
Size (bytes):	8975
Entropy (8bit):	5.775891788422153
Encrypted:	false
SSDEEP:	192:t5dO+2dOQdO4dODwdO+dOfdO2DNnwNTSVpa4IYMgBo6jVJvt5S:HdO+2dOQdO4dO0dO+dOfdOgn6TSHabYq
MD5:	1449F3735295196C8830DEE8BC15E7C6
SHA1:	7AC63E4B5D052AD177D6AFD480BC778D88F4B52A
SHA-256:	4C672AB520B17AA1B5826A8EB9A4C4CF97F5481982FF170EE057ECAF5A82DBD1
SHA-512:	4C3F3075FED196BBA2F393C99756FD280CF4D191448310C613CAE59A581206F6EFA1B9483FAD729B301FC3D6DBD3C77F256D6880B2A330851A7A55213AB8550C
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="wood018" GUID="{2E34D38C-8ACE-4B54-9DB2-F884DF53A232}">.. <Properties>.. <Property Class="Text" GUID="{4A47E637-9D10-4BC2-B252-FDBD11D5CF6E}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">wood018</Property>.. <Property Class="Type" GUID="{D229E95B-5FCE-439E-B988-FF2A52AC214E}" Name="Type" inheritaction="" calculatebefore="0" i

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Ground\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3116
Entropy (8bit):	5.090666724810172
Encrypted:	false
SSDEEP:	96:ke2elqd2uI0MdOMS5bd/u20MdOMBbdwz0MdOMqbcwk0MdOMf:/lrdOVjdOfdOcdOS
MD5:	6FD1D16056A5F92D81BEAA34BA68D165
SHA1:	9527E96E36DC34D48806EBDE197A5EE6B06F7B68
SHA-256:	9CCEA1C57A9171096BB7ED59CB269829C042C3881709E638FADB90A5F47F53D4
SHA-512:	222B10AD9142746D29F20DA23CDC987AEE7B0C2A1DAEC9A29B9F7C4CE392A09026C08E9EE3D1D851DF7F3145D290916DD3F551F88E32900EEA583A9E8690CB79
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Ground" GUID="{0C1739DD-133D-4D45-BA4F-B98D8C07B141}">.. <Properties>.. <Property Class="Text" GUID="{B30B6727-D4BA-4D9A-B2A1-34D400D924DA}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Ground</Property>.. <Property Class="Type" GUID="{0289A78F-2B46-498F-B85A-83C60D4199F8}" Name="Type" inheritaction="" calculatebefore="0" in

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Ground\is-QET76.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3116
Entropy (8bit):	5.090666724810172
Encrypted:	false
SSDEEP:	96:ke2elqd2uI0MdOMS5bd/u20MdOMBbdwz0MdOMqbcwk0MdOMf:/lrdOVjdOfdOcdOS
MD5:	6FD1D16056A5F92D81BEAA34BA68D165
SHA1:	9527E96E36DC34D48806EBDE197A5EE6B06F7B68
SHA-256:	9CCEA1C57A9171096BB7ED59CB269829C042C3881709E638FADB90A5F47F53D4
SHA-512:	222B10AD9142746D29F20DA23CDC987AEE7B0C2A1DAEC9A29B9F7C4CE392A09026C08E9EE3D1D851DF7F3145D290916DD3F551F88E32900EEA583A9E8690CB79
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Ground" GUID="{0C1739DD-133D-4D45-BA4F-B98D8C07B141}">.. <Properties>.. <Property Class="Text" GUID="{B30B6727-D4BA-4D9A-B2A1-34D400D924DA}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Ground</Property>.. <Property Class="Type" GUID="{0289A78F-2B46-498F-B85A-83C60D4199F8}" Name="Type" inheritaction="" calculatebefore="0" in

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Ground\natfl064\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (11016), with CRLF line terminators
Category:	dropped
Size (bytes):	15643
Entropy (8bit):	5.919666034258919
Encrypted:	false
SSDEEP:	384:BdOd2dOQdOBdOVdOldOcdO3n2XmdOH1FbCt/mdpY1mAB/:SltSeuBgmA1d++zA9
MD5:	996934150BE1CA05F27AF8176BE7AE83
SHA1:	B1D0A0D545BEDECB4B0F854220290976AE9BA92E
SHA-256:	DCF0E9810CC2247776E729B9AC6A1F3AA5B01CC447345FBB4C1F03E1BF2A8462
SHA-512:	77644305A2EF9D92CC84A5008C23DEED7D01C49323FA003C8CF85A10A4FCFC1DDAEC7637A734C4B13E121227863C6303874C9565567C2B540445DA15DEBB34D9
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="natfl064" GUID="{1D1D9A5E-77F7-4462-9A65-2AB874341356}">.. <Properties>.. <Property Class="Text" GUID="{4A47E637-9D10-4BC2-B252-FDBD11D5CF6E}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">natfl064</Property>.. <Property Class="Type" GUID="{D229E95B-5FCE-439E-B988-FF2A52AC214E}" Name="Type" inheritaction="" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Ground\natfl064\is-LA5QB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (11016), with CRLF line terminators
Category:	dropped
Size (bytes):	15643
Entropy (8bit):	5.919666034258919
Encrypted:	false
SSDEEP:	384:BdOd2dOQdOBdOVdOldOcdO3n2XmdOH1FbCt/mdpY1mAB/:SltSeuBgmA1d++zA9
MD5:	996934150BE1CA05F27AF8176BE7AE83
SHA1:	B1D0A0D545BEDECB4B0F854220290976AE9BA92E
SHA-256:	DCF0E9810CC2247776E729B9AC6A1F3AA5B01CC447345FBB4C1F03E1BF2A8462
SHA-512:	77644305A2EF9D92CC84A5008C23DEED7D01C49323FA003C8CF85A10A4FCFC1DDAEC7637A734C4B13E121227863C6303874C9565567C2B540445DA15DEBB34D9
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="natfl064" GUID="{1D1D9A5E-77F7-4462-9A65-2AB874341356}">.. <Properties>.. <Property Class="Text" GUID="{4A47E637-9D10-4BC2-B252-FDBD11D5CF6E}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">natfl064</Property>.. <Property Class="Type" GUID="{D229E95B-5FCE-439E-B988-FF2A52AC214E}" Name="Type" inheritaction="" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Ground\natfl217\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (19360), with CRLF line terminators
Category:	dropped
Size (bytes):	23987
Entropy (8bit):	6.035158496905324
Encrypted:	false
SSDEEP:	384:xdOF2dOQdOGdOxdONdOUdOtn8WP+GOwieJ7Ctsso3bfWkxmet7C1QjRkn6Yhalzb:CdtPC2ZGW9iehCtBufWkxmCC1Qj4azcA
MD5:	009E71DC3D002C109428C509F47CDD62
SHA1:	D1784563945B62937D5010CF85E0EEE74418A9D2
SHA-256:	FC92891F85362E1006B729394C0C1FC38E340B3D80FC4DC3780027D912833211
SHA-512:	A9374633058B6D4CB06CBF058721D1C35592F1F3B368F45904515A0028F0617BEFD62D00CB2D6C69089747239585F53D06BAE3BE42F00AC22A883BF560657ECA
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="natfl217" GUID="{53D80280-17D9-49BE-9CDE-9E4F63A5BB0E}">.. <Properties>.. <Property Class="Text" GUID="{4A47E637-9D10-4BC2-B252-FDBD11D5CF6E}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">natfl217</Property>.. <Property Class="Type" GUID="{D229E95B-5FCE-439E-B988-FF2A52AC214E}" Name="Type" inheritaction="" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\Ground\natfl217\is-INJSB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (19360), with CRLF line terminators
Category:	dropped
Size (bytes):	23987
Entropy (8bit):	6.035158496905324
Encrypted:	false
SSDEEP:	384:xdOF2dOQdOGdOxdONdOUdOtn8WP+GOwieJ7Ctsso3bfWkxmet7C1QjRkn6Yhalzb:CdtPC2ZGW9iehCtBufWkxmCC1Qj4azcA
MD5:	009E71DC3D002C109428C509F47CDD62
SHA1:	D1784563945B62937D5010CF85E0EEE74418A9D2
SHA-256:	FC92891F85362E1006B729394C0C1FC38E340B3D80FC4DC3780027D912833211
SHA-512:	A9374633058B6D4CB06CBF058721D1C35592F1F3B368F45904515A0028F0617BEFD62D00CB2D6C69089747239585F53D06BAE3BE42F00AC22A883BF560657ECA
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="natfl217" GUID="{53D80280-17D9-49BE-9CDE-9E4F63A5BB0E}">.. <Properties>.. <Property Class="Text" GUID="{4A47E637-9D10-4BC2-B252-FDBD11D5CF6E}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">natfl217</Property>.. <Property Class="Type" GUID="{D229E95B-5FCE-439E-B988-FF2A52AC214E}" Name="Type" inheritaction="" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\Textures\_Default Textures\is-GHPR1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3100
Entropy (8bit):	5.06164784892641
Encrypted:	false
SSDEEP:	96:kr79nqd2uI0MdOMePbdw20MdOMUiAbd/uz0MdOM13bcwy0MdOMq7r:sHdOHdOgdOIodOlv
MD5:	9A09CAA92ED35E2145E3C9FF51F29754
SHA1:	0FE41FFB0970FA1CF33D05394E11CF537F76E424
SHA-256:	735B99762FE98D758A3234B8E9EACA3F3FAE82EFD5AEEE105D188A77EB9010EC
SHA-512:	0BDD1138520D91D123FB8BFA58E29B020435E3069F58B0F2B96072051CFFCEB9A57CDAEC94F7D5BA83AA9FA50F7B72356A228A01AB71785468E924A27E49E1AF
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="_Default Textures" GUID="{AD60D09D-F15B-440A-9986-A3937A8B074D}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Default Textures</Property>.. <Property Class="Number" GUID="{F17C3E44-B5EB-4C00-B3DD-55654D673EE9}" Name="OrderIndex" inheritaction="" calculatebefore="0" inherited=

C:\Program Files (x86)\PlanSwift11\Data\Textures\is-MIJLC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3081
Entropy (8bit):	5.054813969580891
Encrypted:	false
SSDEEP:	96:kAZnqd2uI0MdOMG2bdw20MdOMbzbd/uz0MdOM8bcwk0MdOMG3:PvdOH4dO1dO4dO/3
MD5:	5BB93E3827ABF0438F97F1B95F144DB3
SHA1:	F069B5FDCA54121CA2A7A636B7D052123A1E4F43
SHA-256:	71D9569E2E63953812CCCC792B590F3743845C0838DB16B0DD494D4375601B0C
SHA-512:	00C3A90BEA8F946875168B6BF058C1B9C38C7036EFA65A16D2C2F193D027EB0F64EBFCF327051ED81B545866BDDED3F8093EA51603EF67A81204969635812F83
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Textures" GUID="{6075900F-15C0-42BE-B9FA-5BECC9B11E05}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Textures</Property>.. <Property Class="Number" GUID="{EBAD0F2B-3A15-4371-BF8D-6E1A82583086}" Name="OrderIndex" inheritaction="" calculatebefore="0" inherited="False" input="False

C:\Program Files (x86)\PlanSwift11\Data\Types\Area Dropdown\Area Cubic Yards\is-I6SCO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1591), with CRLF line terminators
Category:	dropped
Size (bytes):	5891
Entropy (8bit):	5.827549234495651
Encrypted:	false
SSDEEP:	96:Nk9hazlUZFdD2Ji1TNRDlIXRtzlUe9fgxP77DvtKgBR+:N8ulCW8RDloLzaMQjlKgC
MD5:	9D45BC46E5D15678BB0BEB0A77286181
SHA1:	F29A509CDF7CB9B5E362E906A0AA193D20D486B8
SHA-256:	F2A4CCDD778A552FF80413CAE0D5BB9B802574468D06F6B6816E512979811CB1
SHA-512:	0E5FA0BC07BA5565D4C8B5D0753CB5C76BCEFE1288D6EA4845213CE7E769F0D5118FA331A39A24F89A9EF1CA6C122D125495F961405F78F1A96D17ED911D47A3
Malicious:	false
Preview:	<?xml version="1.0" encoding="windows-1252"?>..<Item Class="Item" Name="Area Cubic Yards" GUID="{0BE07CE7-620E-422A-856F-D962102124D0}">.. <Properties>.. <Property Class="Type" GUID="{589D127A-84B6-4516-B388-CA439AB77288}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Area</Property>.. <Property Class="Text" GUID="{D2B566B0-0607-473C-8BB1-DD4263C99ADD}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="">Area Cubic Yards</Property>.. <Property Class="Number" GUID="{05CB49B7-549A-48A0-9663-9B93BCF966ED}" Name="Cost Each" group="Estimating" OrderIndex="3" DecimalPlaces="" List="cmbList" PluginToExecute="cmbList">[Price Per CU YD]</Property>.. <Property Class="Number" GUID="{974B2299-0ED0-4DAF-9854-948707917418}" Name="Qty" inputunits="CU YD" group="Estimating" OrderIndex="4" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Volume]</Property>.. <Property Class="Number" GUID="{D9C99EE8-04D4-4D90-

C:\Program Files (x86)\PlanSwift11\Data\Types\Area Dropdown\Price Per SQ FT\is-CU8MU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (2069), with CRLF line terminators
Category:	dropped
Size (bytes):	6605
Entropy (8bit):	5.474064095118042
Encrypted:	false
SSDEEP:	192:4U+dOckdOsdODOydO18dO65JJoOddO0dOM6:45dO3dOsdO6ydOOdO2LddO0dO/
MD5:	2E103B4A9052D9957E6759BC46B084C7
SHA1:	8F608C1A8B962C7FA2F53C104B78D2FEDEB0E16F
SHA-256:	270479E23D11A6487527E0DD98B3C9FD7710D442719E1247CD4F1D847340FB65
SHA-512:	2592F616EA59DC7A067CD7F7982A627927A5C51BE70CFA54DB974D08C65CE39BFBD9FB63053D2C40A0FA7873F79B25E28FD78896E6751C8473EBA61BCE3CFDE0
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Price Per SQ FT" GUID="{3D20352B-37EF-4465-95F3-D25857A02A35}">.. <Properties>.. <Property Class="Type" GUID="{9078E83A-E70B-4EDE-949C-A1ABA97802AD}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="1" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ToolHint="">Area</Property>.. <Property Class="Text" GUID="{EFC9CE83-ABDC-4CF3-A610-7EFED01A4D73}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="Fa

C:\Program Files (x86)\PlanSwift11\Data\Types\Area Dropdown\Roof Area\is-11TF3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1395), with CRLF line terminators
Category:	dropped
Size (bytes):	3008
Entropy (8bit):	5.972431177819371
Encrypted:	false
SSDEEP:	48:cgRmYgrorgtTE4hxnl16jiJJV8jJDUbgy2/bF4fbRRwYFyZNQbYF/:hQ7jVX66vQJDEgyubF4fbAZOY
MD5:	BCF7673FC799E440A721187DF241D77A
SHA1:	539097446FFAE60912AD684BC2C6F90C3E1681B8
SHA-256:	51AFA80E0487839DB0CAAA53A286CCEB8D3725AFA52899273F999BB67EB8E3F5
SHA-512:	5F754EEB6B542B8907E453453D67C957027B3B2343BC4C794D8ADA8A4841B79C67A33DBEDB387A82DB258AF5E62563D5A42D16526BDF035CBD3779AD9FA650CA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Roof Area" GUID="{5BD3EEA6-7AEF-4143-B0C2-513B6E2DE114}">.. <Properties>.. <Property Class="Type" GUID="{A7C0F077-C391-405F-8DAC-BD40F9F8808F}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Area</Property>.. <Property Class="Text" GUID="{CFEB23FA-0BCE-475C-AABB-02FCC061E316}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Roof Area</Property>.. <Property Class="Image" GUID="{1E172C81-C9F8-4B2B-9A52-11FA2CAD956C}" Name="Icon" inheritaction="Inherit Result" OrderIndex="4" DecimalPlaces="2" Transparent="True" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAAAlwSFlzAAAK9gAACvYBwq9wAwAAAuNJREFUOE+lkn8s1HEYx89K2tI0/ZFzml0yv9351U03u2VD/mjFrpBcxaHdnA79kCIc4ZpbcobT6RAhJz9G87PJj9HINY5T4zaTOxwhju/3tKcvK6PNrPXZnn8+z/N+vZ8

C:\Program Files (x86)\PlanSwift11\Data\Types\Area Dropdown\is-66P8C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (740), with CRLF line terminators
Category:	dropped
Size (bytes):	3058
Entropy (8bit):	5.086067232735185
Encrypted:	false
SSDEEP:	48:cV92uSV8Sbd/uI0MdOSaNLkqv8Sqd2u20MdOSaNLkqoz3xB+8Sbdwz0MdOSaNLkx:kMuSRbd/uI0MdOfqd2u20MdOYjUbdwzD
MD5:	DEF97D3407EF7B7F51A43D259D0E7504
SHA1:	1D99FB5B92A1E9DF97EA87815269C0406C1CC08F
SHA-256:	1001760071E099F56FF2E2E56DEA84064F77DD31AF2F75E4E387F306CD5936F6
SHA-512:	7F4D8ABEEA02FEB7D501420F8E7985B1E21048846A8A2E2B7EFFC7FC1A046AC2469F12E00369DADCDB6852EE7594EB7E607AF02B14889191402256CCA5CCBD13
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Area Dropdown" GUID="{6A8BC7BA-8766-43A9-8290-5ED307A063EC}">.. <Properties>.. <Property Class="Type" GUID="{9405A620-FBD6-49A4-8C77-1E5DBB7214FE}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ToolHint="">Folder</Property>.. <Property Class="Text" GUID="{F1D11849-BE42-4A73-BA40-A87822F7ADF4}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="

C:\Program Files (x86)\PlanSwift11\Data\Types\Count Dropdown\All New Shapes\is-6D653.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, Non-ISO extended-ASCII text, with very long lines (730), with CRLF line terminators
Category:	dropped
Size (bytes):	47896
Entropy (8bit):	5.307974712357812
Encrypted:	false
SSDEEP:	384:s3OUbVfZF99Je8O5j1+WeNSPwCPVJrcsJdWBu9UmYcfsTUT:dobF99JeTj1Xe8PEcV
MD5:	BD5BE3EE5564B5CDB58B91BF2B2F10A6
SHA1:	0D659833666109283F5D39DDF1121A73AABF9305
SHA-256:	F5D390EE7C7A3B3C8DC29384C94AD0CFCFFF69A54AB535EFB0FA5363791F081F
SHA-512:	D2559919EAF5C3B9487DF28B9635499D9D77A0CE234A36EE29784E985D3E504E4BF5DBEE1B73101791D325E92F03AE8B16B7E7AA2E2E6DF8B67D1A2644C777BF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Count" Name="All New Shapes" GUID="{67BB5420-0090-4DBF-A2F6-ED3BD0502155}">.. <Properties>.. <Property Class="Number" GUID="{F602EF9F-D0E1-43AC-9E32-E344474B211A}" Name="Qty" inputunits="EA" group="Estimating" OrderIndex="0" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Takeoff]</Property>.. <Property Class="Text" GUID="" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{67BB5420-0090-4DBF-A2F6-ED3BD0502155}</Property>.. <Property Class="Text" GUID="{C13DF108-DFBA-4DFC-B670-4E722832342B}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Type" GUID="{3CF0C1F2-0022-4E4B-9203-1A24A3BD5E7E}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Count</Property>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item"

C:\Program Files (x86)\PlanSwift11\Data\Types\Count Dropdown\Arrow Shapes\is-5A73J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, Non-ISO extended-ASCII text, with very long lines (730), with CRLF line terminators
Category:	dropped
Size (bytes):	47374
Entropy (8bit):	5.300229446370814
Encrypted:	false
SSDEEP:	384:sEAijYfTF9dvBOnuGeWVmw9OTrfgJYts5wxm4nUiGs:3AijUF9tGuGeWVmc5iD
MD5:	A534596B2729EAF62854214DB8F19666
SHA1:	9DE99C606AEE72132E9A46F9B24F126FBE69D7B4
SHA-256:	57316FD66B3823B2C1432B832E896AC2E136CE071484E2EF031A571A8C292F20
SHA-512:	C6B8ECB4CE3478C715BB561E6191A005BAF6C13661AC4842A9F8E03BB4E08640C997513DD3BC6E6759DCB578C34C74FC14E22A543BE0667993913A4B1ED002E3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Count" Name="Arrow Shapes" GUID="{2EFD80F1-4EE7-4846-91DE-6C8E1A4D700E}">.. <Properties>.. <Property Class="Number" GUID="{09044B8E-6E71-420C-86D1-E6326E5D844C}" Name="Qty" inputunits="EA" group="Estimating" OrderIndex="0" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Takeoff]</Property>.. <Property Class="Text" GUID="" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{2EFD80F1-4EE7-4846-91DE-6C8E1A4D700E}</Property>.. <Property Class="Text" GUID="{4F6290BA-E3C9-4D40-8801-92ADE9123558}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Type" GUID="{0BB19889-DD22-4A2B-80C0-0A67DB4B2C4E}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Count</Property>.. <Property Class="Text" GUID="{E01C40FE-EF64-4F82-B005-996814CDADA5}" Name="Item #" group="Item" OrderIndex="3"

C:\Program Files (x86)\PlanSwift11\Data\Types\Count Dropdown\Check and X Mark Sha\is-CEPDC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, Non-ISO extended-ASCII text, with very long lines (730), with CRLF line terminators
Category:	dropped
Size (bytes):	47398
Entropy (8bit):	5.300347712646291
Encrypted:	false
SSDEEP:	384:sFqfZF9MjOBuAseZJINiHrxIJxxF2A/mq7LZp:VF92AseZJgBnT
MD5:	40D8E190440DEC180EC3B83AD1A8FA06
SHA1:	B407CC6AE4CB8104F93AC2A904202C7449C42F69
SHA-256:	E44670C485BD046FF902A4F53B7C0EE78436285359E361249DFF2FF9BA0A381A
SHA-512:	FA9B4DE13F687080A0A397900557D126AD51A537B5CC7EBC9205AF307DEA0B5E7D9225100CFB1D278D9EAE588DF5DABCB23618E6B5A5B4869009363E480FE35B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Count" Name="Check and X Mark Shapes" GUID="{DBAF7BC3-8E13-4679-A82F-9CD8B011000E}">.. <Properties>.. <Property Class="Number" GUID="{A4C44D5A-4338-4FD3-AC68-E9243B861D5F}" Name="Qty" inputunits="EA" group="Estimating" OrderIndex="0" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Takeoff]</Property>.. <Property Class="Text" GUID="" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{DBAF7BC3-8E13-4679-A82F-9CD8B011000E}</Property>.. <Property Class="Text" GUID="{82F73C80-5A1D-45C6-B0A3-0C733702408C}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Type" GUID="{5F34BA8D-0525-406C-951E-99B851AF6A6C}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Count</Property>.. <Property Class="Text" GUID="{17230FED-1A88-4E11-8A83-91294249CEC8}" Name="Item #" group="Item" Ord

C:\Program Files (x86)\PlanSwift11\Data\Types\Count Dropdown\Circle\is-200KK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1515
Entropy (8bit):	5.463924264750148
Encrypted:	false
SSDEEP:	24:2dFDqnXWy7JgAWvuU/CApWxOK1OcG8C9f2WAdOc3HIU3qcPD5anKMEYWtnIgYv:cwdoZKOFr/4TaUD5anKMEYWtIgC
MD5:	93C4561AB3090C22AE6B4CEF3FED7A2B
SHA1:	BCA8C6D654E4F8A57A702AC90D0BC3D60A6EA5DD
SHA-256:	D9556C11BC236C7880B23D552251F93C7F589A7740192939DBAD0C382116D027
SHA-512:	0C436C01163D8F0EFE714DBDCC59A23E78FDA2EEA4BA4B9623619ED5821D35778AEFAD27457E92D8B29CEAC168B6008B4F8D250BA97614E08C91B9F438EB378E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Circle" GUID="{E487E4EF-0FDE-4070-8625-1661F0083B5E}">.. <Properties>.. <Property Class="Type" GUID="{B90C4014-968E-4DF2-BF8C-7F44B087579C}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Count</Property>.. <Property Class="Text" GUID="{D634436F-146F-482E-A8C4-4C00ECE16455}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="">Circle</Property>.. <Property Class="Number" GUID="{67089B24-B381-43EF-9FDB-E26B6C239BF1}" Name="OrderIndex" systemhidden="True" OrderIndex="5" DecimalPlaces="">2</Property>.. <Property Class="Text" GUID="{191AEB2C-522D-40C4-A828-B8D5F06D8760}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="7" DecimalPlaces="">{E487E4EF-0FDE-4070-8625-1661F0083B5E}</Property>.. <Property Class="Memo" GUID="{F18E6692-DB7A-4498-9BAD-F14C3030EEF9}" Name="Form Layout" systemhidden="True" OrderIndex="

C:\Program Files (x86)\PlanSwift11\Data\Types\Count Dropdown\Diamond\is-CO780.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1114), with CRLF line terminators
Category:	dropped
Size (bytes):	2266
Entropy (8bit):	5.912422480034057
Encrypted:	false
SSDEEP:	48:cv+doZZ3tTge4hnn5b7yq/gg8PUOUCadIF4q/kyutxKrk:k+do/dUtn59/cUC94EkvxKrk
MD5:	5732996DC1502B9E232DE7AFB548D37F
SHA1:	28E94512CE91E7C7D236349A7AAE765F71F8F324
SHA-256:	49335576FB55DD8C7401F020E57970A414862CB02895D828ED82550938FD37F2
SHA-512:	574A26F804172849362666D3527783D410CED93FC027689AB71F3E1D4F36DEA715B003048A8992B0FC86A5138571B0D2267ECDDC96FA35DAE336FA36658C7201
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Diamond" GUID="{2B5F882D-1BCA-4848-A022-6B2F32DF84C9}">.. <Properties>.. <Property Class="Type" GUID="{B90C4014-968E-4DF2-BF8C-7F44B087579C}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Count</Property>.. <Property Class="Text" GUID="{D634436F-146F-482E-A8C4-4C00ECE16455}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="">Diamond</Property>.. <Property Class="Image" GUID="{6E86729A-3AD2-4B9C-84F8-ACE79C863485}" Name="Icon" inheritaction="Inherit Result" OrderIndex="5" DecimalPlaces="" Transparent="True" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAAAlwSFlzAAAuIgAALiIBquLdkgAAAhJJREFUOE+Nkk9IVFEYxQ+EC5ukWgXVTERJtIiIaJGVktuIohDDbCPW0KAlIgRmKjpEBLWQIBpsBv/Q/xKpDEkiSt6ohA6DzaiMlaKjBhG0CGxz+r53GcuZJ7g4775773d+37n3P

C:\Program Files (x86)\PlanSwift11\Data\Types\Count Dropdown\Door and Window Shap\is-3ISL4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, Non-ISO extended-ASCII text, with very long lines (730), with CRLF line terminators
Category:	dropped
Size (bytes):	47436
Entropy (8bit):	5.300996405793621
Encrypted:	false
SSDEEP:	384:s5+f3F9+OQgesuP3SkLr0MJx2ySelPm0qSSj0+S:KeF9sgesq/7SBS
MD5:	5C18D3FD5E14B552901BE8E26312068C
SHA1:	131BED1D9659EE81CA3F74516BF0A8785CE3F10E
SHA-256:	DBD535FA6479F1A1905DD43E8E3AD44FD32FB0290F0B59DA0767D4A3FD28C0B0
SHA-512:	FDA3CE184327451E10A9D1D17144B6DCF0AAC9A2F179658118B915B213F418F2FAAEA0BCCA2E657789357CB10116AC6F5B2E88A60A58E6627B822F8DEDFA70DB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Count" Name="Door and Window Shapes" GUID="{C920C103-0E6A-4951-8598-18074E61E8FE}">.. <Properties>.. <Property Class="Number" GUID="{74C9DE80-BD61-4F22-942A-1BEF7AF89C3D}" Name="Qty" inputunits="EA" group="Estimating" OrderIndex="0" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Takeoff]</Property>.. <Property Class="Text" GUID="" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{C920C103-0E6A-4951-8598-18074E61E8FE}</Property>.. <Property Class="Text" GUID="{C16206F9-4970-4CBF-A0DD-DDFB5EBAF954}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Type" GUID="{4537FC7C-4908-4E50-A2F6-31A9C339E299}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Count</Property>.. <Property Class="Text" GUID="{ECCE719F-AD66-4E08-960E-28A0FA6DEE6B}" Name="Item #" group="Item" Orde

C:\Program Files (x86)\PlanSwift11\Data\Types\Count Dropdown\Geometric Shapes\is-VKLK4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, Non-ISO extended-ASCII text, with very long lines (730), with CRLF line terminators
Category:	dropped
Size (bytes):	47450
Entropy (8bit):	5.299921867681454
Encrypted:	false
SSDEEP:	384:saqfvF9eOD7eZvdVMdI+rcmJdlgc4A1m9fiWT0/:uF9/7eZvdVOIfif
MD5:	3C25775C712BE08E6293AEF9CCD82BC0
SHA1:	64673152B05A52B629E1DA03287847A3EC099872
SHA-256:	388E7910E9108A4744613923EAD228CB7252595C06042B78D07337EBC97F2F9F
SHA-512:	A7D6937C486232905E3337752BFABBDBCA3B29DE43F9EAB5BF5C9066707E740959811EC242CA68BAD9D3933A62C84128F0C14C4A75FE4235BD5703BCDB77D79B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Count" Name="Geometric Shapes" GUID="{1AAE04D0-3045-4513-9586-42644D29F955}">.. <Properties>.. <Property Class="Number" GUID="{6C2988B2-323D-4997-85E8-A6A6B59B59D5}" Name="Qty" inputunits="EA" group="Estimating" OrderIndex="0" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Takeoff]</Property>.. <Property Class="Text" GUID="" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{1AAE04D0-3045-4513-9586-42644D29F955}</Property>.. <Property Class="Text" GUID="{13D037A5-FFE1-4F1C-B1BE-F9819E8102E4}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Type" GUID="{6E08DDD6-A664-4C9D-928B-029B49E3B00B}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Count</Property>.. <Property Class="Text" GUID="{99F7E062-2096-41FC-B5BD-37FB8C4A6EF8}" Name="Item #" group="Item" OrderIndex

C:\Program Files (x86)\PlanSwift11\Data\Types\Count Dropdown\Labeled Count\is-SH018.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4041
Entropy (8bit):	5.522588638965133
Encrypted:	false
SSDEEP:	96:Jix5l9Dsm94z8OfSfcqbYf0WbOukrWjchOI:JySIgkcqbG0yzMWohr
MD5:	CDB27056869138D392A4E8DE85FECE34
SHA1:	D0F3BD27A934F2E071FAA9FC5971904FB95796FE
SHA-256:	E9A665511B4637C31BF533466EF2FF90C4D783D2169A86578DF6C065F031BB6A
SHA-512:	CB282A11524AE92A62C8DB0615C564D60DA2730C5A455013D0C6587FDFEF67934C6568628C45A6412F8281B9791401D72F2CF07A43AFC792C873131BE72FC49E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Labeled Count" GUID="{FFC90A28-C06E-450D-88F9-878765604322}">.. <Properties>.. <Property Class="Text" GUID="{FF687F2A-C45B-4ADC-B5DD-15C5D6876A38}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Labeled Count</Property>.. <Property Class="Type" GUID="{86BEF146-CD86-47C2-B5EC-D2D16E19C2C4}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Count</Property>.. <Property Class="Color" GUID="{D78FD078-1C6F-4B2C-B4A0-4286BD1906BA}" Name="Color" inheritaction="Flatten" input="True" group="Item" OrderIndex="3" DecimalPlaces="2">[!RandomColor]</Property>.. <Property Class="Number" GUID="{CB454781-1351-495A-824B-7A92AFAEA85C}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">0</Property>.. <Property Class="Text" GUID="{625AA7C9-EA4E-44D6-92CE-27FFCAFD3B4D}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden=

C:\Program Files (x86)\PlanSwift11\Data\Types\Count Dropdown\Plus\is-3PVU7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1250), with CRLF line terminators
Category:	dropped
Size (bytes):	2393
Entropy (8bit):	5.970598485866519
Encrypted:	false
SSDEEP:	48:c1JdoZ2m8tTge4hFGrrRMo0t/chDACDPdiIF4x//yutxKry:adognUtFwMrcRTn41/vxKry
MD5:	3B65A0E02C9CA1A3A9940FA1AF66B3F7
SHA1:	B58EC7172B29B4560E0E42777FFBC93B68D0BF7A
SHA-256:	33917B1B90EE10995A81961F20E09D40CA9B922ADD946AA22697B8883CC6ED70
SHA-512:	7C93CEC9900D603D0A1A0DB4819C586429FFA1036B94AD716F6368C3C172ABCFA5EA2947C96D584E94D36C2F773C3B51A07426DAF53D702C412E404EACDFA46C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Plus" GUID="{CD599080-D963-4E26-BAC2-D7D3C961AC43}">.. <Properties>.. <Property Class="Type" GUID="{B90C4014-968E-4DF2-BF8C-7F44B087579C}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Count</Property>.. <Property Class="Text" GUID="{D634436F-146F-482E-A8C4-4C00ECE16455}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="">Plus</Property>.. <Property Class="Image" GUID="{FE50EB7E-B9DF-4640-8723-122D71596509}" Name="Icon" inheritaction="Inherit Result" OrderIndex="5" DecimalPlaces="" Transparent="True" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAAAlwSFlzAAAuIgAALiIBquLdkgAAAnhJREFUOE99U1tIVFEUXYmJqKNTk5qVpR+lvfsLIwiKHvQTEVF/QVBBFFFWWoiEiYmIaFQGRUGWmUzTICImlvagsnxlJSLRR0joRzFTzqORYbf2Ob0MacNi7pyz1jr7rrMvTh4Fjh/5g4P

C:\Program Files (x86)\PlanSwift11\Data\Types\Count Dropdown\Scaled Count\is-LJ2NA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1206), with CRLF line terminators
Category:	dropped
Size (bytes):	3220
Entropy (8bit):	5.900038325130212
Encrypted:	false
SSDEEP:	48:cQFmiePoBtTge4hCrxHVxsBdQ95YVx4UbofatTpD5anKMEYWYaLVXMCgl5C:Lmi3bUtCzI4UoCtT78cSC
MD5:	33EA5B5C0C19B447D9862BA8B7D5DEA4
SHA1:	5C6A43901B153A2448DA5798440C7EB74979139F
SHA-256:	3D53064DB02CFF52FAEB67EB0E52A90A1CB01C2F1C3BF83F88FA5D3DA874FEC5
SHA-512:	132E88452BB2240CF283DB5752915C1FA01CFB0148F2B6C86B23939B5B6B7B0A1281FC0BBB94A8B147B430358158419CD5789E94540A84FA79BEFE6D7D2EADE8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Scaled Count" GUID="{4E78C0EB-2549-4743-B5A7-714161312FC0}">.. <Properties>.. <Property Class="Type" GUID="{6E280D0E-8FFD-41A6-9AC0-1C1D0B298F27}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Count</Property>.. <Property Class="Text" GUID="{BFAA8F12-F233-4CF3-A6A7-3E8D4B900E75}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="">Scaled Count</Property>.. <Property Class="Image" GUID="{0205CEA9-0634-4582-8BCE-116C545B10AB}" Name="Icon" inheritaction="Inherit Result" OrderIndex="5" DecimalPlaces="" Transparent="True" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAAAlwSFlzAAAuIgAALiIBquLdkgAAAldJREFUOE9dk09IVGEUxQ/SIPLWki5UxH844kpGQdGFi0hEZTCXtmjhymVIq4EIFxWVtZH+UFJNSJSSiJZJ/40ISVAkq12kI+mMksY4ozOnc5+jzrT48e533z3nfvd

C:\Program Files (x86)\PlanSwift11\Data\Types\Count Dropdown\Square\is-0T8U1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1110), with CRLF line terminators
Category:	dropped
Size (bytes):	2259
Entropy (8bit):	5.909228340020149
Encrypted:	false
SSDEEP:	48:cF5ArdoZGXtTge4hzVoI2C4eFUO+aLAlZbkJIF4n/R52PtxKr9:brdo09UtzB2AUODEbF4/WxKr9
MD5:	33F86BFC9B22828BF326C1B56D52EFF2
SHA1:	C3FD436CBC299B763A30695337EC0C1963B9B581
SHA-256:	717AC1AE7D04138DDFE0A877685D1EEEFE201408E842CA6FA15F5F1A8F79D62A
SHA-512:	57E6176B61CFA5AB293E2BEE2829FEAC8C0C7D391025E2A9F561C61057B4A5F1701073F43B9E1607DFBDABF6C2B355C74C9614E0D8F62A417D8F5D0D6704ACBC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Square" GUID="{2A5A3685-2B70-417D-A397-EF313D526DE1}">.. <Properties>.. <Property Class="Type" GUID="{B90C4014-968E-4DF2-BF8C-7F44B087579C}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Count</Property>.. <Property Class="Text" GUID="{D634436F-146F-482E-A8C4-4C00ECE16455}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="">Square</Property>.. <Property Class="Image" GUID="{3E134242-670F-4762-BB33-7AAD66ED4A0E}" Name="Icon" inheritaction="Inherit Result" OrderIndex="5" DecimalPlaces="" Transparent="True" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAAAlwSFlzAAAuIgAALiIBquLdkgAAAg9JREFUOE+dkl1ojmEYx//lSMvBkgNJkhw4eLNysElirZEcSJKEA7HZ2uzDTD7ykY98hKIdkK81M8OsWTOzMbPeZ++8liRJkiQHcuBIktTPfd23531fZQ4c/Huu53n+/9913dfzCPh

C:\Program Files (x86)\PlanSwift11\Data\Types\Count Dropdown\Star Shapes1\is-B19DT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, Non-ISO extended-ASCII text, with very long lines (730), with CRLF line terminators
Category:	dropped
Size (bytes):	47359
Entropy (8bit):	5.29908336681748
Encrypted:	false
SSDEEP:	384:szfkF9lOxo8eCpyowd3ikVrbGyJIvGYvm8bnnH:ZF9Io8eCp/w2
MD5:	C7DBAFCFF50C6D6AC2502B4D553A6696
SHA1:	9E35E3D8EF56361259BD7D5DFB485508D7E40317
SHA-256:	FDF842939C80992637A04DAB2961740F760389B3B67A65E873F51C53EC725C8A
SHA-512:	4B4F9DC159BF1A213223418ACC1A50A8A6336646FB9BC375132C26F63C34DEE4E23AFBA586A66D8F6562ED864D1E2E2881E8A861D6180A24D6C401F0F93B89D0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Count" Name="Star Shapes" GUID="{DFF844E7-B1EF-43FB-AE25-E8648CB83E68}">.. <Properties>.. <Property Class="Number" GUID="{28C51922-6374-43BC-B73A-1F7D51D10FF1}" Name="Qty" inputunits="EA" group="Estimating" OrderIndex="0" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Takeoff]</Property>.. <Property Class="Text" GUID="" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{DFF844E7-B1EF-43FB-AE25-E8648CB83E68}</Property>.. <Property Class="Text" GUID="{2FCB2565-D5AA-442C-AECF-8A4FA1694013}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Type" GUID="{FF52100C-D517-48A5-90A6-905B35946609}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Count</Property>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" Ord

C:\Program Files (x86)\PlanSwift11\Data\Types\Count Dropdown\Tag and Other Shapes\is-90R4H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, Non-ISO extended-ASCII text, with very long lines (730), with CRLF line terminators
Category:	dropped
Size (bytes):	47386
Entropy (8bit):	5.300385641094239
Encrypted:	false
SSDEEP:	384:sbfVF9C8On7eyDtrueG3rTdJ+/QEtmWPZV5vS:uF9C17ektTPL5q
MD5:	7B13F5A0E889486B8E4219C0BC9EF0EA
SHA1:	56EA4F2E014FF5862FEDC4C2A34A1CF6B005C771
SHA-256:	B6A1114894DF47EA884774E32D9C0268BE331EDB45691EB20CD710C93BC43632
SHA-512:	31589681A51E73A1677A21DE239651E1A871FD3043DA75BE3DD5F00633ABFCB6674015ACF120F605F5FAC5D7DA10B5EAC0E61BAE01746F3108D431F4B81E8D5A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Count" Name="Tag and Other Shapes" GUID="{468268AA-EE21-4BEC-8B1E-7251B28725A7}">.. <Properties>.. <Property Class="Number" GUID="{2E41173B-12F0-4484-ACC3-69C95D0BB5F7}" Name="Qty" inputunits="EA" group="Estimating" OrderIndex="0" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Takeoff]</Property>.. <Property Class="Text" GUID="" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{468268AA-EE21-4BEC-8B1E-7251B28725A7}</Property>.. <Property Class="Text" GUID="{76600E8A-9E8A-4A29-9F81-9366893FB087}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Type" GUID="{A14E4E06-0766-42A5-BE10-2834A05A6856}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Count</Property>.. <Property Class="Text" GUID="{B495E59D-0EF4-4BE8-A75A-8BD0FCE43987}" Name="Item #" group="Item" OrderI

C:\Program Files (x86)\PlanSwift11\Data\Types\Count Dropdown\Triangle\is-277PT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1030), with CRLF line terminators
Category:	dropped
Size (bytes):	2739
Entropy (8bit):	5.897158210826277
Encrypted:	false
SSDEEP:	48:cGJdoZYKtTge4h3sChlgJdideF4E/HcVTpD5anKMEYWsgDyuteri:rdoXUtVfgrX468T78qveri
MD5:	709EAB39E097C86150EAEBCFE1A00035
SHA1:	02D70C4EEAC3DFD4BC0CA4C0458299790E08A7EA
SHA-256:	4F872DCE4DCF5CF5665F104D24DB7A8A4D4B5512AC7458F19F406715BD0E5DFF
SHA-512:	6CBF23062807E95439FE6684F46FADFF148F059F276D71B8C1556949192AEA551B12300A105EC679AD69ECCFC629C107293ED4419087100453D6B062D130C840
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Triangle" GUID="{9CA0FBF3-A41E-4C0E-B631-E507567D44E3}">.. <Properties>.. <Property Class="Type" GUID="{B90C4014-968E-4DF2-BF8C-7F44B087579C}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Count</Property>.. <Property Class="Text" GUID="{D634436F-146F-482E-A8C4-4C00ECE16455}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="">Triangle</Property>.. <Property Class="Image" GUID="{9FD67680-B035-447C-B7B8-58203CB29A37}" Name="Icon" inheritaction="Inherit Result" OrderIndex="5" DecimalPlaces="" Transparent="True" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAAAlwSFlzAAAuIgAALiIBquLdkgAAAdJJREFUOE+l009IFFEcB/Dvus3Mzqy7oBEaBWFUCEtEIWwHDyp0iI7eIixQOliBUIqYhiwSEpFa/lliEQ9RSyxREhFRe4jwEB6kIDx1CulSeOpQ4dfvc5+66SRBX/iwA/O+7/3

C:\Program Files (x86)\PlanSwift11\Data\Types\Count Dropdown\is-UB127.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (740), with CRLF line terminators
Category:	dropped
Size (bytes):	3060
Entropy (8bit):	5.088545216064171
Encrypted:	false
SSDEEP:	48:cVtkZ8Sbd/uI0MdOSaNLkqdn8Sqd2u20MdOSaNLkqW8Sbdwz0MdOSaNLkqxa8Sb1:ktktbd/uI0MdONqd2u20MdOEbdwz0MdF
MD5:	553964B0BF9CE05D1504818E8C7D6275
SHA1:	0BC54CB3678EFEFE72C5E8005A407FE8B09482E4
SHA-256:	91A98CEE60C654FD46A885F03765F3AE4F194F44D13C5BFDF54CDDAB6FDD677F
SHA-512:	E51F3D4E7F127F8808292512BE66161286A66EDFB3119B179D1EC11D9631240DBA5ABA66E8E59A6F678CCB9FFCDBA0A18A3482CD8FDEA7B4F141C406EACE311A
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Count Dropdown" GUID="{103001B1-DAFF-4521-94CE-286B34933D1F}">.. <Properties>.. <Property Class="Type" GUID="{5404A29F-DEE9-420C-8A87-8CA167AD69C8}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ToolHint="">Folder</Property>.. <Property Class="Text" GUID="{6212907B-A646-4486-85BC-E9094E8828CB}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited=

C:\Program Files (x86)\PlanSwift11\Data\Types\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (2176), with CRLF line terminators
Category:	dropped
Size (bytes):	10681
Entropy (8bit):	5.679506150695012
Encrypted:	false
SSDEEP:	192:6EdOJdO2dOd3dOgQUdO2dOjdOf9tvgdOQLZdOAjv7alM:6EdOJdO2dO9dOSdO2dOjdOfPvgdOQ1dp
MD5:	72DA233782A11433AD18E5512222F6ED
SHA1:	3B73BE73FCC418BBC1D4D066D1622E3522A53439
SHA-256:	BED1DFB591C4984F482A6EE1D9E57D17AA4481B5D1B9441C924673CDA047062E
SHA-512:	F02722907104A93775FCE29E75DAE4671926770B49ED05812AB8BC32AB3F92919B86ED4F8D75F412C95E96640C50937C00305CB1493A95343BF42900DDFDC1B0
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Types" GUID="{62F848BC-F4D7-48DC-8CAC-4C6573328BBE}">.. <Properties>.. <Property Class="Text" GUID="{297C9F20-3128-4F55-B11C-3D953C3868F6}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Types</Property>.. <Property Class="Type" GUID="{2812BC3B-CC85-4C05-91F2-FB3FC7B257C8}" Name="Type" inheritaction="" calculatebefore="0" inheri

C:\Program Files (x86)\PlanSwift11\Data\Types\Linear Dropdown\Linear Cubic Yards\is-O5N4B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1587), with CRLF line terminators
Category:	dropped
Size (bytes):	6216
Entropy (8bit):	5.78457680284903
Encrypted:	false
SSDEEP:	96:JTFv2ydWE+qgspudPC7tqfWtYcNODucyH:ZrbdrtqfgP8D9+
MD5:	3C829FD1A2893D2C901175CF3AF9458A
SHA1:	C74A053C69D34436A53366D32E470C452FA123D6
SHA-256:	A2B48AB64464146D6A4A6B610B3332EA8C2A5062982A3D7C22F97DF8037D5514
SHA-512:	764E7536F62CE7FBCCA79388F1B516AC165255222C98087F87905C073392FACD932ECFDF00F043081B364654620BAFAB593D01AB127CB872A5BB5DFB5EACF162
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Linear Cubic Yards" GUID="{E322A445-133C-4820-A3B6-26DC17B7333A}">.. <Properties>.. <Property Class="Type" GUID="{34EC42B8-31D3-43C8-91D9-1A00C435403D}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Linear</Property>.. <Property Class="Text" GUID="{67889109-4B24-4D33-813A-6B242912B982}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="2" DecimalPlaces="">Linear Cubic Yards</Property>.. <Property Class="Number" GUID="{3DDB0D96-E136-4B69-B999-FDA0E329B12C}" Name="Qty" units="CU YD" inputunits="CU YD" group="Estimating" OrderIndex="4" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Volume]</Property>.. <Property Class="Number" GUID="{F62040C5-8F4E-41B6-A066-464832B52DD2}" Name="Wall Height (FT)" input="True" units="FT" inputunits="FT" group="Estimating" OrderIndex="6" DecimalPlaces="" List="cmbList" PluginToExecute="cmbList">9</Property>.. <Proper

C:\Program Files (x86)\PlanSwift11\Data\Types\Linear Dropdown\Wall Area\is-HMKBM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (630), with CRLF line terminators
Category:	dropped
Size (bytes):	5140
Entropy (8bit):	5.593646938664995
Encrypted:	false
SSDEEP:	96:LXPXjmQDMQqoquvFLp0PvlxtmQeTTyauqRJnL24x:DKytl8rmQIygJnL2G
MD5:	5420CA1520256265C610D711FE6EDB35
SHA1:	13CDF4C2C2A23343470FCAE056F2D9AAB537464E
SHA-256:	35E6E449DF86B7617F7FA739EADDDA894A5EF54D9807B84289959F748031A196
SHA-512:	C30A8BF9853CADAF47159E09F423C68D30533A10876C3DE0C1D087718688483AE6FDC2F6AFCACC87BA1891ED2EBB4E0069FCDE1EAADE64B7561C00B1C17B3766
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Wall Area" GUID="{16780DB6-18F3-4A9B-84EE-0514F65984A8}">.. <Properties>.. <Property Class="Number" GUID="{97FDD428-1CB2-4B0F-8FCA-BA1238D6BA66}" Name="Qty" units="SQ FT" inputunits="SQ FT" group="Estimating" OrderIndex="0" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Takeoff]</Property>.. <Property Class="Number" GUID="{56D75413-BE7A-46E2-A694-4246EA896036}" Name="Wall Height" input="True" units="[Scale Units]" inputunits="[Scale Units]" group="Estimating" OrderIndex="7" DecimalPlaces="" SimpleList="8..9..10" List="cmbList" PluginToExecute="cmbList">8</Property>.. <Property Class="Number" GUID="{2DC70E83-89FC-44A1-AC1C-1B8AB26C93ED}" Name="# of Wall Sides" input="True" group="Estimating" OrderIndex="9" DecimalPlaces="" SimpleList="1..2" List="cmbList" PluginToExecute="cmbList">1</Property>.. <Property Class="Number" GUID="{E8D2183E-B6CA-4FC4-963E-FD462E3D501C}" Name="Wall Width" input="True" u

C:\Program Files (x86)\PlanSwift11\Data\Types\Linear Dropdown\is-CUJPU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (740), with CRLF line terminators
Category:	dropped
Size (bytes):	3062
Entropy (8bit):	5.083676815564194
Encrypted:	false
SSDEEP:	48:cVJhV8Sbd/uI0MdOSaNLkq98Sqd2u20MdOSaNLkqaa8Sbdwz0MdOSaNLkq38Sbcj:kJhRbd/uI0MdOJqd2u20MdODbdwz0Mdn
MD5:	DD06320A89537756DB9107D60EDF1699
SHA1:	1F89D2EFCB106CE663D3BC5B1E44CC06BCDCD172
SHA-256:	2D0A60CA5FAAED070196EB5103272EE3F26454C79F9183F16A7B14354DDC5B7E
SHA-512:	16D63C80181CD1599A908DA1176F34FB4BAEC37D04D9C42A913DE3D4D5918E1DE9B5CC29CF2DE4C8380A3A0C47DA1E77EF596E37376CEF186E50210099E047EF
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Linear Dropdown" GUID="{4810C190-E255-46E2-851D-B07D8744DCE4}">.. <Properties>.. <Property Class="Type" GUID="{C4C78CF5-9402-4CFD-8340-C1666E205EE2}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ToolHint="">Folder</Property>.. <Property Class="Text" GUID="{CBAE0BFF-E869-4E12-88A4-461DD6B0845E}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited

C:\Program Files (x86)\PlanSwift11\Data\Types\Revision Clouds\Revision Cloud\is-36MAH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1871
Entropy (8bit):	5.516227458777874
Encrypted:	false
SSDEEP:	24:2dFDyj8+X2yjSvApWMi8gAWLipf1Octy9f2WAdOcu8fseabqcaDon7WGjwVugJbs:cwj8+NsP/D8ff/Don7WowggJb+RR7CI
MD5:	85456BF5F14670C92D3AEC5FB6AEB6A9
SHA1:	65078F7232D74E7D8C160C97C903169F184E3B31
SHA-256:	B7501E001C3FA46C55B152E82771C9467A105022E36D9F0F54AC7B48BD4BF621
SHA-512:	5D6DC46F4C693F335734A09F3AB827944546756F5953C9CEEDFFFF54B7289F07887BFC8D3FFE4FA2165C579D78A63644D872EB93144332982CFF60303B503DDC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Revision Cloud" GUID="{F47CD493-7A0E-4A85-B683-4E4A80D8B4DD}">.. <Properties>.. <Property Class="Text" GUID="{8D5A4842-EF24-40FB-86CE-E88CBF21FD9E}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Revision Cloud</Property>.. <Property Class="Type" GUID="{C3FCD68B-59DD-42BC-B3A5-F237C463DADC}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">RevisionCloud</Property>.. <Property Class="Number" GUID="{B5E14359-EBF4-4BDC-8762-D00674173328}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">0</Property>.. <Property Class="Text" GUID="{A2C4E887-FD86-42F8-9754-42A148415B40}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{F47CD493-7A0E-4A85-B683-4E4A80D8B4DD}</Property>.. <Property Class="Memo" GUID="{C49C590D-612E-4A43-99F2-F6BE00772BCA}" Name="Form Layout" systemhidden="Tru

C:\Program Files (x86)\PlanSwift11\Data\Types\Revision Clouds\is-C9DGK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	889
Entropy (8bit):	5.3866415965227565
Encrypted:	false
SSDEEP:	24:2d2yoZByZ45XYZR1Oc+R/CApWOixgAWUFX32f2WAdOcC4Pv:cfHGwWzcFX36XG
MD5:	C4EB1931D0D3D46F07E47B8C987D4ADE
SHA1:	548AB1044ACFF0E72029E663FF3765E223B01232
SHA-256:	E504B9F547BAA531B960E8EEA73CDF8AEA6C24A29112B745E1EF9BFDA93FFD6B
SHA-512:	B956C8C88E5BD566F7C37520D9016E5F68DA25E79A2A81A81D8C08A98C108D0DAF9478758AEBC205568E18471289CE5B48178C4BF083127466E89C361E0CE679
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Revision Clouds" GUID="{841D360C-A261-4693-BF30-FCB4E0B351CB}">.. <Properties>.. <Property Class="Number" GUID="{707FA0B8-F3FC-4EE7-96A8-F9D8736BC361}" Name="OrderIndex" systemhidden="True" OrderIndex="2" DecimalPlaces="2">8</Property>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Revision Clouds</Property>.. <Property Class="Type" GUID="{A8A04C86-DD97-4088-B094-1038320E59D2}" Name="Type" group="Item" OrderIndex="4" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{627940C2-37B7-47B5-9973-7994E33EDA52}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="8" DecimalPlaces="2">{841D360C-A261-4693-BF30-FCB4E0B351CB}</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Types\Rubber Stamps\Approved\is-S4TOD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	5.456362060886776
Encrypted:	false
SSDEEP:	24:2dFDX07X2EBvApWcIHZllgAW6J1Oct3Ef2WAdOc00Qy0soC6Vk88HbybGk3HD8Hp:cR07pZPu2c90QpHCRHbGIHEubUGz7
MD5:	0AA7465C51F389885A830A62EB968825
SHA1:	0B1BC865072ECD5CB26AED4C6F46CB107FD76E19
SHA-256:	7390EA8BDDBEBE363926329DF12429DD149BFB7208DB0F4B515BDD76039175FA
SHA-512:	4DCEE3FD248E0F0B9D967121221E88ABD9397E6C660CA6817D248C625CBAFF831C4E249918963D6E40233462ED12334BDC3FE92DD6A1C2A023B33E2C62A45958
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Approved" GUID="{553E7BBC-754D-46FA-8A5A-082047FE4C11}">.. <Properties>.. <Property Class="Text" GUID="{94B13EED-7E5C-424B-AF07-DE52FF6463BC}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Approved</Property>.. <Property Class="Type" GUID="{056D76D1-44E3-40FD-9DE7-486F1EE85D3F}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">RubberStamp</Property>.. <Property Class="Number" GUID="{2AD5F0A1-5FF1-450D-B12A-CE5993B07C22}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">0</Property>.. <Property Class="Text" GUID="{B8DC0A98-FED8-4E77-B329-AB5C6E47ABF4}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{553E7BBC-754D-46FA-8A5A-082047FE4C11}</Property>.. <Property Class="Color" GUID="{82BBBD79-FB8B-4CBF-B5E6-AF63CFD54A02}" Name="Stamp Color" input="True" group="Rubber Sta

C:\Program Files (x86)\PlanSwift11\Data\Types\Rubber Stamps\As-Builts\is-E66J7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1552
Entropy (8bit):	5.430889500294759
Encrypted:	false
SSDEEP:	24:2dFDAI/xX24FvApWGZLgAWX1OciRHL6f2WAdOcv/SHoP46Vk884/Gk3HD8uMVkEv:cR/xUluc/SH64R45If
MD5:	EA14B4659E97D397AEA16250850D3B2B
SHA1:	6F36757BEB1C4B353139A0177D712F69D9F0207F
SHA-256:	33CE882AD783A97E8B4B2978F866533D43909C2D3BBE0638EFF8D87EBC8F2AC5
SHA-512:	ED911712DEB6CD5C25D6D1D82A187DEB14E2FF8FCEC508DBA01CF2BF325045486E1E7B3F1D088914EF6279C421664419329CF9B5CD6DB5271B54A86C90CEB903
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="As-Builts" GUID="{2D9CD355-72A9-497F-B0D3-53D9A0D49311}">.. <Properties>.. <Property Class="Text" GUID="{B4D2C6BF-71AE-4145-8042-9D24F4A07348}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">As-Builts</Property>.. <Property Class="Type" GUID="{BBE830DD-7996-453C-A619-7FD1B30BC50A}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">RubberStamp</Property>.. <Property Class="Number" GUID="{FC44DA43-748D-4B9A-9759-69C817B0CF8A}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">1</Property>.. <Property Class="Text" GUID="{9CDFFC0E-4552-4B23-91DA-A177F3D39BDD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{2D9CD355-72A9-497F-B0D3-53D9A0D49311}</Property>.. <Property Class="Color" GUID="{7EFC181A-753A-440F-9F87-1B59608CF502}" Name="Stamp Color" input="True" group="Rubber S

C:\Program Files (x86)\PlanSwift11\Data\Types\Rubber Stamps\Bid Set\is-E466I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1550
Entropy (8bit):	5.433667876907128
Encrypted:	false
SSDEEP:	24:2dFDRAhqGrX2gvApWh5pNAhgAWzT1Oc646rf2WAdOcDhqPyR3xoVk888BtfGk3Ht:c8hL7NApjBByhguxL8BtZIfM
MD5:	182142E53631099FDDBB29B77D7541F5
SHA1:	14115F9085E05CB6B2006A5CEA2928B5315DC4E4
SHA-256:	E76D7893E3A309B95F9B5EE073B1C9FA4201A403454FFDE0106E20263648FB38
SHA-512:	DBFE04BBDB283FFD10B07B58FEE6944025E7308DFE2D3D1A7DAFCB0540FAAEB46CDE020D2DF7560FCA815485547DD9D2F1452926954DDAB499687B49E6048976
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Bid Set" GUID="{8FE0708A-989B-474B-8570-56D0E535101D}">.. <Properties>.. <Property Class="Text" GUID="{F117D219-50C3-4465-BFE6-C545FAE323DF}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Bid Set</Property>.. <Property Class="Type" GUID="{F1A2D29A-0E5A-4E14-B38C-96C341554427}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">RubberStamp</Property>.. <Property Class="Number" GUID="{CFDFABCE-1293-4197-ACA8-D760AA2DF54E}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">2</Property>.. <Property Class="Text" GUID="{FC915138-D4C3-4E1E-BFB1-8BCDED8BFEBD}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{8FE0708A-989B-474B-8570-56D0E535101D}</Property>.. <Property Class="Color" GUID="{877F5DC6-070D-4D8C-8319-5C54BB9C8615}" Name="Stamp Color" input="True" group="Rubber Stamp

C:\Program Files (x86)\PlanSwift11\Data\Types\Rubber Stamps\Canceled\is-V5D9G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	5.436554512254909
Encrypted:	false
SSDEEP:	24:2dFDOpX2LyvApWDIP3gDgAWwe41OcMfwLLhf2WAdOc1p+SG3FVkpv:cEpL0gLLzIjG3a
MD5:	E26906065764AC079C0CE2CAF17FA13C
SHA1:	259997D55D91525302754E4E80CB527B046D06E7
SHA-256:	C8C7FFB14F0283E414EB58F51BC5055A8741135B23BCE220AECDFF99DCF96EB6
SHA-512:	C872299382C4B617CB0F49F46223C712E6ACDD22B4EF4E6947E49A7A01FCF0846808DE8F1DDAC3E210EB468A2562C8933CECEF51CDB605C5B7D91ABC9E2777A3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Canceled" GUID="{D85284FB-D97D-4A20-8036-389A76684965}">.. <Properties>.. <Property Class="Text" GUID="{26F06F77-6694-4055-8086-AC0575B1C75E}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Canceled</Property>.. <Property Class="Type" GUID="{3D81448D-0737-4F5E-837C-5B84BA023E94}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">RubberStamp</Property>.. <Property Class="Number" GUID="{02A94BA2-49AD-42CB-A056-6548177D1E43}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">3</Property>.. <Property Class="Text" GUID="{6AAEC0AF-2E5A-4E9F-B701-FA9252EB4D7D}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{D85284FB-D97D-4A20-8036-389A76684965}</Property>.. <Property Class="Text" GUID="{EB5C2849-8F64-4AAA-8758-A2E197FC0FF3}" Name="Primary Label" input="True" group="Rubber St

C:\Program Files (x86)\PlanSwift11\Data\Types\Rubber Stamps\City Approved\is-QE63F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	5.451444693602326
Encrypted:	false
SSDEEP:	24:2dFDvX2n9vApW+pa9gAW9B1OckOAif2WAdOcjr8PzVk88fG1Gk3HD8jyPp6VkMv:cNGdhHmK8Af6I0pm
MD5:	6B3D73D6A32F6C31B7B34E18DE156EE4
SHA1:	C7982127ECBD7493406F3A9EA51B101A415D62A9
SHA-256:	3F64492B5591EF897496C5CC01A6D7C782917DFFF2C382B4C2852740801569EA
SHA-512:	7D6AC0709C6EE80B39DDE77A36BC919E048284F3F491520875872EF79A9DC1CF7B54CEE60959DF899CAFC8A468AAB0ECB5888392443351AA6029A2E6DA9AF98B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="City Approved" GUID="{A6F25AC9-9BC3-4C57-8E66-633AEE54E770}">.. <Properties>.. <Property Class="Text" GUID="{1247E55C-5083-442E-8F39-99AB8295A430}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">City Approved</Property>.. <Property Class="Type" GUID="{3672C63E-FE16-4036-A2A8-8DCC57B434A8}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">RubberStamp</Property>.. <Property Class="Number" GUID="{181959ED-4A4A-493E-A3BD-67BBF1868B89}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">4</Property>.. <Property Class="Text" GUID="{347366C2-4E7F-4057-9F45-2BE040A13901}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{A6F25AC9-9BC3-4C57-8E66-633AEE54E770}</Property>.. <Property Class="Color" GUID="{FEBA1CC9-2219-4E05-909C-A7E41D894343}" Name="Stamp Color" input="True" group="

C:\Program Files (x86)\PlanSwift11\Data\Types\Rubber Stamps\Confidential\is-LQKTF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	5.452067759146775
Encrypted:	false
SSDEEP:	24:2dFDdttX2t/9vApW6HgRedogAWNx1OcOPdof2WAdOcpWY/DVk8894jGk3HD8t8Z5:cXTc//ReF2g7Yg94NIer
MD5:	EC22D1EFE28E828BCEB7FB3E12679CA5
SHA1:	B6DA31CC2FB48C62BF31D4C4583E72225C194B44
SHA-256:	58447CCB4EFB4A7BEC706091A97B77996B36B8CEE05E34AA8678B4D7139461B1
SHA-512:	285F1AFFCB9502ED10E2E105983A6CFC2E5789F54AFBACF33B6C2C35C1E3E7EF3A44E103F14816AB376A456B35B6C6D67B8DF5BB95FBC178B5CE865131C6BD02
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Confidential" GUID="{7783F663-B060-4EB2-8C38-13893781E236}">.. <Properties>.. <Property Class="Text" GUID="{D45C228C-018F-4979-9D60-E3DDE05F6E90}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Confidential</Property>.. <Property Class="Type" GUID="{35EFFD78-3FC1-42DB-94DA-F388FE38275B}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">RubberStamp</Property>.. <Property Class="Number" GUID="{E6275B62-40B6-41CC-8AA4-5104E4B2BF7D}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">5</Property>.. <Property Class="Text" GUID="{7AB6BE96-896F-4CA6-870A-D74D45D3A76E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{7783F663-B060-4EB2-8C38-13893781E236}</Property>.. <Property Class="Color" GUID="{26336491-E40B-4952-A611-AEFE9B865A81}" Name="Stamp Color" input="True" group="Ru

C:\Program Files (x86)\PlanSwift11\Data\Types\Rubber Stamps\Construction Set\is-CS4OQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1767
Entropy (8bit):	5.440721058122813
Encrypted:	false
SSDEEP:	24:2dFDqyCX2rvApWp/BgAWnw91OcLof2WAdOccJpqfVk88I8mGk3HD8IDLfbkLK4jy:cYiSt1pZI80IIery
MD5:	63954397B23E74A6C5FBFF2EAC10E51A
SHA1:	08F72F70E285F3DD06A2FA5DD53E066BC121B680
SHA-256:	3B0D5AC14A0CDAA68AB2342B689FBC1027462FE7A69F37D0AD82AE43D7293C06
SHA-512:	C8266166F66E734A02D7A32259D516F946D010E2F3F0756D95DF1B7DC7E747EA27CB2FF096E0FC7F9B90A18EB8FFFBD1F43173CEFF6AA779F5D32FAE78F21F03
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Construction Set" GUID="{6654C607-C076-4AC5-8927-7803FA555452}">.. <Properties>.. <Property Class="Text" GUID="{46E21D16-DBF9-4EE7-B76A-AF1CB6E93276}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Construction Set</Property>.. <Property Class="Type" GUID="{D204A896-8983-4DD9-B04B-B136259FB772}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">RubberStamp</Property>.. <Property Class="Number" GUID="{F1C966A0-BAB6-4AFD-96DE-3D81ED192B60}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">6</Property>.. <Property Class="Text" GUID="{5D86D36B-6048-4190-9488-F033CC03A1F3}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{6654C607-C076-4AC5-8927-7803FA555452}</Property>.. <Property Class="Color" GUID="{FF446BB3-91D7-46ED-93A7-11D548BBDCBD}" Name="Stamp Color" input="True" g

C:\Program Files (x86)\PlanSwift11\Data\Types\Rubber Stamps\Draft\is-PKOVN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	5.443720334146051
Encrypted:	false
SSDEEP:	24:2dFDOu23JX2SRBvApWvDn4gAWzh1OcYu8d4f2WAdOcS2qmI3UVk88gak+Gk3HD8J:cgR3JtLEPdwAqfgakMIJ
MD5:	0963111048EDBE1945CA0FA3A11B058C
SHA1:	353B79D95ACC0A448B26907F930F40BC2A523D4C
SHA-256:	94DEFF6C481A535A4EAB41004428E9F3E78B676D90B76997341F1980564836AB
SHA-512:	A2FCC50FAA5E40CCEFEC4D3D2E2541C291E1EBAE971B78DD39A88DAEBE18DE79B8F1B282A6E9545757C487DD8A5FB263318412BDB2A4EDA9FAAD2598F6B6678E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Draft" GUID="{9AE15646-118F-42C9-894F-BFC38E62ED43}">.. <Properties>.. <Property Class="Text" GUID="{76399D76-BE73-4108-B7B6-23B4ABF500D2}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Draft</Property>.. <Property Class="Type" GUID="{37991FB9-7F56-4D49-8550-084E9EA14109}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">RubberStamp</Property>.. <Property Class="Number" GUID="{9EB8C0B8-8407-4FB7-A676-5B9C83215065}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">7</Property>.. <Property Class="Text" GUID="{4487FAB7-234F-4C88-9624-E78B315887D3}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{9AE15646-118F-42C9-894F-BFC38E62ED43}</Property>.. <Property Class="Color" GUID="{B515D24E-F500-40D1-83EB-49DE4467045C}" Name="Stamp Color" input="True" group="Rubber Stamp Set

C:\Program Files (x86)\PlanSwift11\Data\Types\Rubber Stamps\Field Set\is-0BUPJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.439551046519856
Encrypted:	false
SSDEEP:	24:2dFDV9nRHysniX2YojsvApWYR56qgAW4ck1OcllzB6f2WAdOc/lpFVk88qvk9GkF:cr9iPn0YSrOqvkDIEeg
MD5:	A43821A722B4A90BB92B4999385E2416
SHA1:	FA0B47B2F46AD8DE805EED51861B1323C7E31541
SHA-256:	4EA213BD67347641A86363B75917DB0F531C7AA3D8F3B9A00AAC480035A1E8E7
SHA-512:	FC96981BFB9C776FA60894A3199FE89D8B91A807E9295232BD350931F74E3E2C8581C26E6F167007BA375B68FBEC33A66CE4BCDC55A5C6E9A3A52D3509AB6F4D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Field Set" GUID="{85AD2AB3-5163-4F4E-8A85-855BD081AEE0}">.. <Properties>.. <Property Class="Text" GUID="{63F6E7F9-8BB0-48E8-ADCD-17C5D0E7128E}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Field Set</Property>.. <Property Class="Type" GUID="{3CF7E4F8-3506-4EA6-9F2B-39138E139B79}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">RubberStamp</Property>.. <Property Class="Number" GUID="{8739C68C-12A5-40E1-90A1-9F6ED3EF7005}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">8</Property>.. <Property Class="Text" GUID="{2F15679E-61F4-445D-8DCA-A93840A27FA4}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{85AD2AB3-5163-4F4E-8A85-855BD081AEE0}</Property>.. <Property Class="Color" GUID="{FBB1A38D-F4AF-4D66-B38E-5DED0EBE274A}" Name="Stamp Color" input="True" group="Rubber S

C:\Program Files (x86)\PlanSwift11\Data\Types\Rubber Stamps\Final\is-GB7F4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1544
Entropy (8bit):	5.4325966521311955
Encrypted:	false
SSDEEP:	24:2dFDaPmX26LL9vApWbMHpfgAWzG1OcePmuBf2WAdOc4MBVk88CejJMGk3HD8cR+w:cX1LL6ADTzM6C8II5w
MD5:	634A387DC3F80B6B705444CB65AD6CFF
SHA1:	E7F543B76A44112FA5D6817F223F7C09B2DBDAC5
SHA-256:	4F3F92D731DED7EF65AE68F72FF437E54DB738A539EEB6CE12D59DF46A9D8A23
SHA-512:	F3D0D0F030752DCD1511E5C1B178C776E19240E4A321FA66555FB29D32545C87F76315E1D11BFD5C76A9E0EA75B07816660F276FA30CC19F901870BBE0910917
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Final" GUID="{8384495F-D39F-44D2-905D-7129F35A0DAC}">.. <Properties>.. <Property Class="Text" GUID="{01D88223-3DAE-4AE6-A268-1CD449AE2440}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Final</Property>.. <Property Class="Type" GUID="{62B64E13-5B52-4343-A133-5BA034029CF1}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">RubberStamp</Property>.. <Property Class="Number" GUID="{E34273CB-FA95-4C26-AE82-1D444B8D3077}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">9</Property>.. <Property Class="Text" GUID="{BFF19111-E917-4C24-83AF-3757E57E597C}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{8384495F-D39F-44D2-905D-7129F35A0DAC}</Property>.. <Property Class="Color" GUID="{AFD3037D-F2D8-463B-BA36-FA7FA70613A3}" Name="Stamp Color" input="True" group="Rubber Stamp Set

C:\Program Files (x86)\PlanSwift11\Data\Types\Rubber Stamps\Not Approved\is-BSL00.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1108
Entropy (8bit):	5.449308262233834
Encrypted:	false
SSDEEP:	24:2dFD6oXrX250vApWE1er9gAWWh1OcX+eBff2WAdOcKo2oLNVkXUv:cDmers4ic2
MD5:	4553750BA745AA66D87D9F62DAB46ED4
SHA1:	8FB2FE1836C661AA32E672A25D47F482F60314D0
SHA-256:	C581D8F8998FE342E34242830BA17F88980474F200A55A449FD4A7B57244BB3B
SHA-512:	052AD27A346C95C846F93C643CA0CBC2FDDE5C02FA0B5D32F9E877A107371A9FD7C7EA5E45C69C202E924BAF0CC654EB69F6B4994C1CB119C1F45C64B1D9D8C5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Not Approved" GUID="{A12D4CA7-04DF-4F9B-A315-15F68C80F8EA}">.. <Properties>.. <Property Class="Text" GUID="{CE47C6FE-6B70-4081-8DE1-1833C6D3971F}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Not Approved</Property>.. <Property Class="Type" GUID="{AF9CDF12-5029-4B9B-B278-049B2CB6F8D0}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">RubberStamp</Property>.. <Property Class="Number" GUID="{96B27F1F-DC78-4E87-BE53-962202A15A88}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">10</Property>.. <Property Class="Text" GUID="{C8697D49-6510-4FFE-BF8A-2064D822D085}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{A12D4CA7-04DF-4F9B-A315-15F68C80F8EA}</Property>.. <Property Class="Text" GUID="{DFEE9A2C-64D9-4373-911B-17366C43F9CB}" Name="Primary Label" input="True" group="

C:\Program Files (x86)\PlanSwift11\Data\Types\Rubber Stamps\Not for Construction\is-BABEN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1586
Entropy (8bit):	5.446979361971704
Encrypted:	false
SSDEEP:	24:2dFDQX2NfvApWoi1PfgAWQNVh1Oc/Rouf2WAdOceRHBVk8841bGk3HD8u4UVklv:ceE7GpilE4XIff
MD5:	6887D804E399729766F00A044D069DC0
SHA1:	9328EBFDFD480B0C555FFDDE7C31A5AA53B2D5F2
SHA-256:	EA21204D31CABE2B9559AD950A265B6856BD33959B10FA91321038942E66E9A7
SHA-512:	1CF843FE3B2F9AD3AEAF5B7CA2CE84D4DC26377BB1F14D87472F55FB3BEC11A6A8752C53A9A31C015001612976AA62DECBF0DD513304D9232C3398AB176D7826
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Not for Construction" GUID="{F521DA88-FBCE-42A4-B33D-9D98CFB67E9E}">.. <Properties>.. <Property Class="Text" GUID="{F983FED4-60BF-478C-A7D1-1A2A8AAA7D74}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Not for Construction</Property>.. <Property Class="Type" GUID="{9488EDDF-154F-4798-B74D-DD55B99F8C63}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">RubberStamp</Property>.. <Property Class="Number" GUID="{C4D3683C-7685-4746-975C-77E5A41EEB13}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">11</Property>.. <Property Class="Text" GUID="{316B8BEF-24DA-4E09-A9F0-D1C649E60785}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{F521DA88-FBCE-42A4-B33D-9D98CFB67E9E}</Property>.. <Property Class="Color" GUID="{611F4385-4E97-4776-B634-84AD5FD1AC9B}" Name="Stamp Color" input

C:\Program Files (x86)\PlanSwift11\Data\Types\Rubber Stamps\Pending\is-621RH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	5.445136611051208
Encrypted:	false
SSDEEP:	24:2dFDTiIlX2PNvApWWuIwgAW+S1OcYUyiK8f2WAdOcPVIVYPiVk88zJAIGk3HD8zs:c1GEotiFg6YxzJAiIzJHakQ
MD5:	63800D83106AD3C0F3C23324C4FC6FC4
SHA1:	CD5FBAA819D96313A5B9972234536BA0B27BFD4C
SHA-256:	AABB8FD088F73D880E2A74D3CCA0650857BDA3F987F9A09A8278D00E5AC4FD7A
SHA-512:	CA29D49F0DCB1B330B51141D27CA605318802C0167AEE03F7BA950D820F8B98F1D479EC9AEF5BAAE02E70951B384D0CADED05830C29D507038F681F62A2065A4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Pending" GUID="{9BBA66A5-428C-4BA9-9750-B510BE783076}">.. <Properties>.. <Property Class="Text" GUID="{495C971B-6AC3-41C4-9942-A434A24F8A07}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Pending</Property>.. <Property Class="Type" GUID="{3D8773AA-6A77-41E9-B209-2A6E472D6348}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">RubberStamp</Property>.. <Property Class="Number" GUID="{EAF96DF7-2C91-4647-AC59-96138B4F7BAA}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">12</Property>.. <Property Class="Text" GUID="{E0CDF857-B502-48E9-8ED9-63D375947244}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{9BBA66A5-428C-4BA9-9750-B510BE783076}</Property>.. <Property Class="Color" GUID="{E8D53094-9C5C-4844-82BB-13EF8E65C4A8}" Name="Stamp Color" input="True" group="Rubber Stam

C:\Program Files (x86)\PlanSwift11\Data\Types\Rubber Stamps\Preliminary\is-T3OBT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1565
Entropy (8bit):	5.447504882658735
Encrypted:	false
SSDEEP:	24:2dFDwtwX2bbvApWgVZYS1gAWcH1OcLN0f2WAdOc+trJUL9Vk88D69mGk3HD8/Sev:ckwO40S1s8s5rJULGD6mIp
MD5:	768443E00619372FEF3EA6F0B5252398
SHA1:	FB10A805C2F3AE83859C0BF8C9ACFD1844F104F6
SHA-256:	D9B318DF92AFF4ECC84A40540117BB07242D1EC14108EF6ADEB00B48277CFFE0
SHA-512:	27139E24A2C65665995ACEF9C2302E35D5B2FC0889773FE4019A5CFB7F518F0DBCFC7350A259637F38271FCF3D878926BD41714138162C136500AFF37BBA5E1D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Preliminary" GUID="{EE291A4A-ABB7-4B35-99D0-9611E6813045}">.. <Properties>.. <Property Class="Text" GUID="{16202B7F-A6EE-41AA-98A4-B857009A36BA}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Preliminary</Property>.. <Property Class="Type" GUID="{6B6227A2-FCBE-4ACA-8F99-E7037E4CF44D}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">RubberStamp</Property>.. <Property Class="Number" GUID="{92F356BC-1A2F-489A-8B1D-F1C683330DE2}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">13</Property>.. <Property Class="Text" GUID="{71D1416A-B165-4D7D-8976-618F18F44B7D}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{EE291A4A-ABB7-4B35-99D0-9611E6813045}</Property>.. <Property Class="Color" GUID="{4E233240-C161-47F5-B133-08EE3872BF60}" Name="Stamp Color" input="True" group="Rub

C:\Program Files (x86)\PlanSwift11\Data\Types\Rubber Stamps\Priority\is-1SHET.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	5.427684214268058
Encrypted:	false
SSDEEP:	24:2dFDkIadX26QkCxehvApWkZCYgAWxB1OcZ+66f2WAdOcfaf4WmMgVk0v:ci1QxeBm2tuJDhE
MD5:	8E54C11DF4AD0DDCAA42C9848275EE13
SHA1:	DE3CEE3DDB0A214148AF421907981A0590B66010
SHA-256:	68574D926A166FA3139578785EADD9970A754A9E2E9EB1515A1C71A0F1DBA4EA
SHA-512:	37A603E444F72BE2C5BE9DDA40ABB49F4704B155986346A96BB2CC556943E28B01BECD4651D2397F9A8EA8B859CBC59A11725E988301EFD96058A7600C0E97E2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Priority" GUID="{21168322-5AF8-4578-895C-AED325953DC8}">.. <Properties>.. <Property Class="Text" GUID="{0B5BAE58-4D12-45B5-88F2-5D2A2F6DB862}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Priority</Property>.. <Property Class="Type" GUID="{BD106EBA-490D-401A-98C9-26D7AF8E7B39}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">RubberStamp</Property>.. <Property Class="Number" GUID="{C4AF6A66-1C38-4C20-9768-F19223CF988D}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">16</Property>.. <Property Class="Text" GUID="{0DD9B3A0-EC50-4883-BF05-19B16808FBA2}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{21168322-5AF8-4578-895C-AED325953DC8}</Property>.. <Property Class="Text" GUID="{B54B8EB1-3D40-4326-82E3-D1CDA804518D}" Name="Primary Label" input="True" group="Rubber S

C:\Program Files (x86)\PlanSwift11\Data\Types\Rubber Stamps\Received\is-V31K7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1542
Entropy (8bit):	5.440527188221831
Encrypted:	false
SSDEEP:	24:2dFDNaZgZ5X2ELh6vApWjO8QkUgAWIB1OcyW8f2WAdOcRZgZD+yPlVk88CYVs8GJ:cpbxJ1mHFwdPXId
MD5:	BBDEEDEF4875B4A36364E5C7AAA4E2C2
SHA1:	CA73B103EB5A4EF8DEDB945DABF9A5C2F9F9B60D
SHA-256:	8FDCB4BDB79053AF1D422C27BD8BA76B2394D4088E2CC2E89AA526C233D0843B
SHA-512:	F8A9627BB6FDC45BA7FFF08AEF02C4B853362C8BAABEA14DB032F5AFF8FC00C0BFA06844FB5A4A7351F42F079C966E91860915737C6A4002B545CC3660EA379C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Received" GUID="{510BEB16-266C-4795-8E01-90BE214FCB22}">.. <Properties>.. <Property Class="Text" GUID="{EB091575-367F-48F4-8BEA-8478FF85AB9D}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Received</Property>.. <Property Class="Type" GUID="{3642778B-DD61-4ED8-9352-C8FA92EFBF6B}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">RubberStamp</Property>.. <Property Class="Number" GUID="{6C2EAE95-ED4F-4BD8-B5A8-DBCB5BCD545C}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">14</Property>.. <Property Class="Text" GUID="{B06A42AE-E88E-44BA-8FB3-987D7A0E7191}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{510BEB16-266C-4795-8E01-90BE214FCB22}</Property>.. <Property Class="Color" GUID="{8FD1A46A-042F-4F95-81C1-60DB06F9A90D}" Name="Stamp Color" input="True" group="Rubber St

C:\Program Files (x86)\PlanSwift11\Data\Types\Rubber Stamps\Revised\is-OMNU2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1547
Entropy (8bit):	5.447981220725868
Encrypted:	false
SSDEEP:	24:2dFDyZX2z5vApWk/BgAWFhe1OcthGg8Jbf2WAdOcppJVk88R4Gk3HD8JlR8Vkqv:cwZC8kpdRSwRyIFS
MD5:	35B4B93C65C0FD515FA401FD8F3832CE
SHA1:	B5AB0FCEECB93DE5E6AC75F151DD6CBDE0B6C623
SHA-256:	95D5E2190FEF59D2C000FD06493FC6910F0511911488F6D7CE94421A80B13D25
SHA-512:	2B158A7289D25AB67FB567CBBE2431AE72C53925D63FBF2CBFC25AEED7BA536E9A841D40D380E311DEED689D14DB9BAB06915A00F737EC803546E111839C2A3F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Revised" GUID="{E72D8C2E-53F5-476A-87EB-C0835CBFF979}">.. <Properties>.. <Property Class="Text" GUID="{E1BEEFC2-2191-42D8-8208-B1CF297E93F1}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Revised</Property>.. <Property Class="Type" GUID="{37B286D7-B03F-458F-9227-4A96C776D58D}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">RubberStamp</Property>.. <Property Class="Number" GUID="{F7A493C5-64F3-4630-8B13-896FDBE3D556}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">15</Property>.. <Property Class="Text" GUID="{C463AADE-3F93-4BEB-AEC4-1EE113B76057}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{E72D8C2E-53F5-476A-87EB-C0835CBFF979}</Property>.. <Property Class="Color" GUID="{FE4A0715-7F09-48C3-A96C-8E06C3EE92A1}" Name="Stamp Color" input="True" group="Rubber Stam

C:\Program Files (x86)\PlanSwift11\Data\Types\Rubber Stamps\Update\is-7GARI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1548
Entropy (8bit):	5.439019882375304
Encrypted:	false
SSDEEP:	24:2dFDDa7dCX2ZvApWNxE6gAWzj2E1Oc3PhDbf2WAdOc7dJDEKw6Vk88ud5Gk3HD8X:c+07P2HiRQHDGRuBIytO
MD5:	81C7A489B2566923D3A340A51E8A120A
SHA1:	143A19DAEB7F2180E3E7D7E1E12B0E6BC2785576
SHA-256:	FF57FE0B1AE779AA669050B64CC0A93F55F2539133C7B88C3B4C9350708232F0
SHA-512:	11954F144463FE70D94DF7C022ED8F19AE6B8332CAD040B2A6FA8616BBD70192106A1E8F42F9DC688357D3AF69BA57C17A13631C4E338000A0EA1E2BD010E1F3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Update" GUID="{F776ECB7-A5DE-4F97-958A-53A3D90D59CE}">.. <Properties>.. <Property Class="Text" GUID="{734BD83C-D232-4B1F-A178-5AA51911A642}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Update</Property>.. <Property Class="Type" GUID="{55396D7F-B9BC-4F34-8AE4-1D05A88C3CED}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">RubberStamp</Property>.. <Property Class="Number" GUID="{B640BA78-ADC7-4A01-B657-1D9EEDA77859}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">17</Property>.. <Property Class="Text" GUID="{4F09CD32-4E37-498E-9098-3A927002B897}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{F776ECB7-A5DE-4F97-958A-53A3D90D59CE}</Property>.. <Property Class="Color" GUID="{746398C4-6E60-4FBB-8A77-D3F00BD86454}" Name="Stamp Color" input="True" group="Rubber Stamp

C:\Program Files (x86)\PlanSwift11\Data\Types\Rubber Stamps\is-FV1I9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	925
Entropy (8bit):	5.42483554273017
Encrypted:	false
SSDEEP:	24:2d2rlgv5kXsCf1Oc5yvB/CApW/5/gAWU6m9f2WAdOcH5Kv:cQgvq5kLjm/wK
MD5:	B631A0DACD62F274D2ED656C27291436
SHA1:	1C6E44E5B67B0D86F731A07AC48E6F4E0AE39B0C
SHA-256:	DFC4A27659C16D09C600E81F9CB1B02F3FEA4E406BACE24DC5244F490F5197F7
SHA-512:	09D57B5C2D7601798B6AB3048C7A3849B5BBB42A48AD31A6C55D3585021A28E1A751B18F777FEE023C2C5F62DEB800A1785739D9FF11D8DCE2FBB0167AF3229B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Rubber Stamps" GUID="{617C082E-1071-4941-B90E-9132AF14ACAD}">.. <Properties>.. <Property Class="Number" GUID="{2CC55AFB-6F0C-40A3-B82A-F2B6E0E94CA7}" Name="OrderIndex" systemhidden="True" OrderIndex="2" DecimalPlaces="2">6.5</Property>.. <Property Class="Text" GUID="{827D42BE-41E8-43A7-B9E4-7EB8194CB6DC}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Rubber Stamps</Property>.. <Property Class="Type" GUID="{C783A2C6-8977-47F6-BBDB-11BB0BC428AB}" Name="Type" group="Item" OrderIndex="4" DecimalPlaces="2">Folder</Property>.. <Property Class="Text" GUID="{0D878B97-E79C-482C-82CC-6F203AF7E1A0}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="8" DecimalPlaces="2">{617C082E-1071-4941-B90E-9132AF14ACAD}</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Types\Scripted Tools\Items\Beam Material\is-QVU9U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2718
Entropy (8bit):	5.451613018440595
Encrypted:	false
SSDEEP:	48:cR4z7Tf+zc6SBEXYvPLXCYvlq+tYvxLVRrNYvenL8YvML21GXYve:W4TOhSml2IfrNLnL89ZXH
MD5:	C3568DF0B52A749AFA7325E17349E1CA
SHA1:	1D1BB1A82F8CF13D198142A81BFEA7F6CC3DC2F4
SHA-256:	A28849D200778C3D0D9A0B382AD6B51BD6714BF036F968F4BE16B1BA305D75DF
SHA-512:	F1AD8A25734CC7351EEB4F7EEDA7361D0D3E6E8969141395E4A573975ABD9725AA06BB33C8D2AFB6EA8579C0CE0033B6C0B6E27CB6887133FD432FBC37B9993B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Beam Material" GUID="{15A09F8B-E35E-4204-8E2E-6DF672C5A679}">.. <Properties>.. <Property Class="Text" GUID="{7A8FFF51-2CBA-432A-99A7-17C8926F0166}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{15A09F8B-E35E-4204-8E2E-6DF672C5A679}</Property>.. <Property Class="Number" GUID="{DF8DC193-A0CA-4C9E-8971-3B196C46877A}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">10</Property>.. <Property Class="Text" GUID="{1ADAC6CD-76BB-4483-B369-1B0F45F38E75}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Beam Material</Property>.. <Property Class="Type" GUID="{6F268FD2-6811-4D4A-94B9-F1514BB4FD75}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Material</Property>.. <Property Class="Number" GUID="{BFC2F84F-3659-4458-B256-AFDA36AB0C63}" Name="Cost Each" units="[!C

C:\Program Files (x86)\PlanSwift11\Data\Types\Scripted Tools\Items\Beam Tool\is-EV99S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1554), with CRLF line terminators
Category:	dropped
Size (bytes):	13381
Entropy (8bit):	5.671836001058868
Encrypted:	false
SSDEEP:	192:Wkcp2lrNJp8eVfK0Qv6Px0Rc9PH6uHEdtN/w2PTb8hi8x818MTfvHTJ48w8j:Vrh1FKVSPCRc95Edj/7bP9L
MD5:	1D7367BA536BE63073EE6DD95E7D0B5E
SHA1:	09A966F6C691F1184AA2F16DDF5580616DF68F2F
SHA-256:	8C0A3F02568CE7FE7F6F88BA70FCCC3D9103B4469B6854B56ABCBF702B8791B7
SHA-512:	451C23F7DE8214B13972FB9A04D8102181145E09C151E3BE6F29E6D172B32417C2B10E15F8EA23FDF5E37209DA371675048F3802385939B667B45175939E4708
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Beam Tool" GUID="{F758B921-ADC0-4216-B801-EE20782A5C61}">.. <Properties>.. <Property Class="Number" GUID="{9C9D6821-17CC-4EB9-8469-75033E984BF8}" Name="Qty" inputunits="[Scale Units]" group="Estimating" OrderIndex="0" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Total Beam Length]</Property>.. <Property Class="Number" GUID="{F032958D-FE5B-42EB-96C9-FE21AAC1A148}" Name="Cost Each" locked="True" units="[!CU]" inputunits="[!CU]" group="Estimating" OrderIndex="23" DecimalPlaces="2" List="cmbList"/>.. <Property Class="Number" GUID="{2DE0705E-A9EC-4930-837D-1A56908DF367}" Name="Cost Total" inheritaction="Inherit Formula" locked="True" units="[!CU]" inputunits="[!CU]" group="Estimating" OrderIndex="26" DecimalPlaces="2" List="cmbList">[Qty] * [Cost Each]</Property>.. <Property Class="Number" GUID="{10CA2E81-B326-4633-9223-4815CD93B71C}" Name="Markup Each" inheritaction="Inherit Formula" locked="True"

C:\Program Files (x86)\PlanSwift11\Data\Types\Scripted Tools\Items\Grid Tool\is-1QJIQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (930), with CRLF line terminators
Category:	dropped
Size (bytes):	8697
Entropy (8bit):	5.580621882209414
Encrypted:	false
SSDEEP:	96:Ckjl5TuMLGxp41yTUmDNyQ1MICaqIkcikZkXMc4S4lyTIFrNLqP89cfr4jlf:CURLGL4nmDNyfq7C4lsIrNm8Kf4lf
MD5:	1BFCABBA23C4CCAF22ABA2802924DCFF
SHA1:	3C2984331CC66F6ADB313516C0A2A789C703451F
SHA-256:	0015C6DC4E544BDC7F89810936D07223696DF8402C307D53C5DE3576A3D770B8
SHA-512:	C19CA1290FA6C2B322816C780021EBB669FC972EFC310EBCAFD8B5D9BDD43AC9295EE8CB3F7BCE3923813DD778C6F7F06EE1935FF3BB33E59DDCB54771B04EC2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Grid Tool" GUID="{F9E4EC56-C778-489D-B740-90352208DC28}">.. <Properties>.. <Property Class="Type" GUID="{52A75DB8-EB3A-4565-99E0-02E5D69EF369}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Area</Property>.. <Property Class="Text" GUID="{1F8247E1-1055-4F37-B5F5-B73F6349364E}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="2" DecimalPlaces="">Grid Tool</Property>.. <Property Class="Number" GUID="{1AE9038D-8E32-4ACC-BCBB-B661201424D7}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="">1</Property>.. <Property Class="Text" GUID="{2892AAD6-E82A-481A-8C99-5A95E738238B}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="5" DecimalPlaces="">{F9E4EC56-C778-489D-B740-90352208DC28}</Property>.. <Property Class="Image" GUID="{58AF33FC-FADF-497F-AC2C-325158F979BD}" Name="Icon" inheritaction="Inherit Result" Or

C:\Program Files (x86)\PlanSwift11\Data\Types\Scripted Tools\Items\Joist Segment\is-ULCRS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (319), with CRLF line terminators
Category:	dropped
Size (bytes):	2957
Entropy (8bit):	5.485709487240856
Encrypted:	false
SSDEEP:	48:cnrhAtp2CJ5ShZgohsBHYvPLCCYvlqmtYvxLbcrNYveNyI8YvMLtTQOTYUTAUUN6:KAxJ5ShZgosBHSvl+IvcrNLNyI89hTFD
MD5:	0D10440E3648D3B53A1A8A6254CAFA53
SHA1:	6E0F1435C64D00AC7AC13FA689CD13F60E4B5561
SHA-256:	B6CA0ABE520F9DEA1FB591869656B774FD95CD33A2398E97E1F45833038C41F6
SHA-512:	861DA07A3AF4F7F64E9E46E756E9AB87046DEE7A6674DE40417EE1F9C4D03962226A2007CA0FADFCA3CA013D65EB03A80817597F24396A68F3B69E3274F927C2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Joist Segment" GUID="{987A5564-1DF5-4457-A59C-D29A42EF1566}">.. <Properties>.. <Property Class="Text" GUID="{72C504E8-942B-4581-ADF1-9874EF0DA1F5}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">Joist Segment</Property>.. <Property Class="Type" GUID="{D6BE61D5-EF61-4EE0-968F-63833392B6D7}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Segment</Property>.. <Property Class="Number" GUID="{05C4A9C4-DF82-4805-9ED4-DC5BAB0D487E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">3</Property>.. <Property Class="Text" GUID="{E65EDC5B-5876-453E-ACBE-D479808DC113}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="5" DecimalPlaces="2">{987A5564-1DF5-4457-A59C-D29A42EF1566}</Property>.. <Property Class="Number" GUID="{329E4A87-0134-469A-85D1-CE6DC46C1606}" Name="Cost Total" inheritacti

C:\Program Files (x86)\PlanSwift11\Data\Types\Scripted Tools\Items\Joist Tool\is-CS36J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (994), with CRLF line terminators
Category:	dropped
Size (bytes):	14847
Entropy (8bit):	5.443734522373619
Encrypted:	false
SSDEEP:	192:ZMWRrNJ86iGRZZdPiXoexSCiojeT3X+pmXlw:vrrliGpdPmxx2Q
MD5:	7B7E81CC0F74CA8C015C6073BE49029D
SHA1:	A583F993DB8141867DAC9B53F270CA4A3C8CE27E
SHA-256:	F4CA50C8FE1B62F857B1F4E4C2022B69325C6B5FAA29A63BF9F0E71B9967527B
SHA-512:	2990DA4D25D7D7EB79426A32D2D83DA41D1754116F3FE9AA08913BDB372D93364FBFFC54B04A50D7EB463C06D892C680F0CC36EB719A09F88DE23C806A4B9FE0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Joist Tool" GUID="{558E2DC0-617F-4ACF-93A2-0097EFB4C5C5}">.. <Properties>.. <Property Class="Number" GUID="{AC12FA6D-FA59-434F-85B1-3A5D314D8E51}" Name="Qty" units="SQ [Scale Units]" inputunits="SQ [Scale Units]" group="Estimating" OrderIndex="0" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Takeoff]</Property>.. <Property Class="Number" GUID="{5E01844C-4EAB-4442-B395-23BCCC49D52E}" Name="Cost Each" units="[!CU]" inputunits="[!CU]" group="Estimating" OrderIndex="23" DecimalPlaces="2" List="cmbList"/>.. <Property Class="Number" GUID="{A89E7AF5-B937-47AD-8867-D90207EE6C9A}" Name="Cost Total" inheritaction="Inherit Formula" locked="True" units="[!CU]" inputunits="[!CU]" group="Estimating" OrderIndex="26" DecimalPlaces="2" List="cmbList">[Qty] * [Cost Each]</Property>.. <Property Class="Number" GUID="{87860F82-2815-497F-A4E0-90E52C71D950}" Name="Markup Each" inheritaction="Inherit Formula" locked="T

C:\Program Files (x86)\PlanSwift11\Data\Types\Scripted Tools\Items\Joist material\is-RDFDP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2471
Entropy (8bit):	5.439221615712065
Encrypted:	false
SSDEEP:	48:cN/4eJRUMmYvPLlcCYvlqvtYvxLcsrNYveQ8YvML8:4/bJRUMmSXl1I4srNLQ89g
MD5:	95DED93D808759E6E483A07C0F58693E
SHA1:	8905EB1AB386A0C8744DE5E8B0423698E22D61A8
SHA-256:	4F8DF2A75F5BB4CF54601DDEF359373B54C89EC12E4674E0FBA114228E4B1E6E
SHA-512:	072C0803C2BB27336CC6BB391C66D7FC18E923A63D116A8162F1AC5E4A703F2884D3230F76C70AD09EC7C5577E6E6419216CBA9937F3BAFCA754A894C8132612
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Joist Material" GUID="{94C049B7-8457-4E67-A68E-EFD0689B607B}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Joist Material</Property>.. <Property Class="Type" GUID="{BA535F6D-CD7E-4040-BFE4-E18922BEF04B}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Material</Property>.. <Property Class="Text" GUID="{506CA5B7-4B46-49A6-BCED-5EC768E4DE24}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{94C049B7-8457-4E67-A68E-EFD0689B607B}</Property>.. <Property Class="Number" GUID="{195182C1-A0DA-4E38-A564-17E984F8FC3B}" Name="OrderIndex" systemhidden="True" OrderIndex="6" DecimalPlaces="2">9</Property>.. <Property Class="Number" GUID="{F284DA97-D092-4537-8BBA-7DD5DB6AEA61}" Name="Cost Each" units="[!CU]" inputunits="[!CU]" group="Estimat

C:\Program Files (x86)\PlanSwift11\Data\Types\Scripted Tools\Items\is-FASI0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (780), with CRLF line terminators
Category:	dropped
Size (bytes):	3999
Entropy (8bit):	5.123615351500156
Encrypted:	false
SSDEEP:	96:kWd3bd/uI0MdOMKCqd2u20MdOMHbdwz0MdOMhbcwk0MdOMblbdwh0MdOMxK:5dOtSdOrdOndODdO/
MD5:	9BE27D70EEFB1099E69327008569BAAC
SHA1:	5C4AB7E136512A35D92AC88BC27E72DD1EE47765
SHA-256:	5B9D672D5861C9E8E3AE1BCEBCAE222BC9B9E596214985D4920ACF719FBAB636
SHA-512:	678539E8E71D28609C2E957034381298AA63D87426CE4051A004261D148BF74A0CC3C3207FC2A89F1857D5BEC6C0B9E0A57373088CFF986854DF5B67779E4FFB
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Items" GUID="{6581CD95-6CF0-4B16-8816-98181B0BB165}">.. <Properties>.. <Property Class="Type" GUID="{F0A8CAC5-1007-4E0B-98BE-49CF952EBFA8}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Folder</Property>.. <Property Class="Text" GUID="{013DCEA6-811D-487F-B4BF-F98736325D9E}" Name="Name" inheritaction="Ignore" calculatebefore="0" i

C:\Program Files (x86)\PlanSwift11\Data\Types\Scripted Tools\Sections\Beam Section\is-5NDHB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1349), with CRLF line terminators
Category:	dropped
Size (bytes):	22534
Entropy (8bit):	5.00447302523774
Encrypted:	false
SSDEEP:	192:tTBMYZMdi5Eaqp6wDdIDnnHmNFo2CKF67y6cLfd9GXOaJffm7bvfbkLIJO4YV6TP:/84NTTHmz0fJc+87bvfbkEJO4cr2
MD5:	42E6E5E02C792E9A94494A7E706CF8B1
SHA1:	9097B1EF36102CAE0A018DF4557BBD248474CAB4
SHA-256:	AC05408EB4CC5C4CA2BEF183EF1F542DF82BCAD916F9DC502E16BDF9FA3D492A
SHA-512:	9A81B5CE63B17DF1F900529F1615EF3F3EBF4C1E5951D8361D2990C5918581FD642FE1860F5CF44CFE637A18EA62A5A56A6A32D58D6C7101965B2F7AB18DE4F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Beam Section" GUID="{0BF050FF-62FC-43AB-B8EC-D2FFA24CC11A}">.. <Properties>.. <Property Class="Type" GUID="{53A513E0-BD0C-4BA1-9303-B818E31EADA9}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="2">Segment Section</Property>.. <Property Class="Text" GUID="{A0C9F6E4-404B-4ACB-AA27-D987A8F46F5C}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="2" DecimalPlaces="2">Beam Section</Property>.. <Property Class="Text" GUID="{4D13B273-DA3F-4B25-A85E-BFAEE4BB3473}" Name="Cost Type" inheritaction="Inherit Formula" group="Item" OrderIndex="7" DecimalPlaces="2" SimpleList="Material..Labor..Equipment..Subcontract..Other" List="cmbList">Material</Property>.. <Property Class="Number" GUID="{9AFCB9B6-A9B1-4621-AE20-4188748FC4F4}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">0</Property>.. <Property Class="Text" GUID="{70828E2C-D795-4934-87BB-8F381DE9

C:\Program Files (x86)\PlanSwift11\Data\Types\Scripted Tools\Sections\Grid Section\is-8NS4L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (775), with CRLF line terminators
Category:	dropped
Size (bytes):	11528
Entropy (8bit):	5.249061743636126
Encrypted:	false
SSDEEP:	192:M256bbYbQ2SzkbCbTHLPUtdleKd45juosB4F4fosr4F4u3p9zdZCxFuLqbIubyJn:MDNbn9uBmmrmp9zdZCxFunxce
MD5:	B5EF1F334834D4F54761B34FF375CABD
SHA1:	2AF6B1372EF069A13CDD6E3551059DAA931B3DA4
SHA-256:	4154CBC2E8C11CC435922958AAB5277CC24F5BF1DDAA1C632E709A9DC37B4972
SHA-512:	F206F5EEA95A7341DEA39F9BE1F736A8FB80DFA40CD1C73CC7584988CBDA578F86D78FFBE3190C660373C5D6F84098CB8539A401B6CDF4A4100DC280EEDE0370
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Grid Section" GUID="{43714BAA-0C7A-4CA0-9DB6-6179353568BC}">.. <Properties>.. <Property Class="Type" GUID="{B1658354-3FC8-4B1F-85C5-572585DD19C5}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="2">Area Section</Property>.. <Property Class="Text" GUID="{3204A5C1-19F9-44A8-A6BA-EACC6AB0474A}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="2" DecimalPlaces="2">Grid Section</Property>.. <Property Class="Number" GUID="{F1CDDA94-97DD-4089-BF77-752A4D9A6D08}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">1</Property>.. <Property Class="Text" GUID="{B8A6509D-27ED-412E-B797-044CE7E7D6F2}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{43714BAA-0C7A-4CA0-9DB6-6179353568BC}</Property>.. <Property Class="Image" GUID="{76E47584-0CBF-4039-993D-5AB89D702D9D}" Name="Icon" inheritaction="

C:\Program Files (x86)\PlanSwift11\Data\Types\Scripted Tools\Sections\Joist Line\is-FJB5D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (317), with CRLF line terminators
Category:	dropped
Size (bytes):	2472
Entropy (8bit):	5.568365229378764
Encrypted:	false
SSDEEP:	48:cA5fg++TYU7FVJVpfkqTEuEbcdaW8l4xD5anK3jA:vTsDFVKqI0aWS4zs
MD5:	EFD4906FC88A42C732CBBB59EF9182B8
SHA1:	4B7375B9A0B34ACD0D1F48603A2A8ED1687C4031
SHA-256:	494CFCBCD6BDD4949306B55EA45D48E08A61F406D05BCC740F5D8AED403F23A6
SHA-512:	FB3EF9924DD19F92DE995F632CBA142E7984B5B31991F521B4849C3323CB3D2FE9D6643ED5F087393011B490E20AF1CF2F5B2A927A91D99387C5FB871D89211A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Joist Line" GUID="{689EA943-8C55-43EA-BE51-C0A460E92065}">.. <Properties>.. <Property Class="Text" GUID="{869EEC2D-6DB8-4670-8DD0-3B2E1F678B2E}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">Joist Line</Property>.. <Property Class="Type" GUID="{0B943881-96E1-4715-81AB-EAE9E6C0E85E}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Segment Section</Property>.. <Property Class="Script" GUID="{37915CBA-E966-4DFF-BEFD-4B13111B95D6}" Name="Add Double Joist" inheritaction="Inherit Formula" group="Method" OrderIndex="3" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList" ParseFormula="False" ScriptType="Method" ScriptLanguage="Pascal" Parameters="">AItem := ItemGUID;..PItem := ParentItem(AItem);..Area := GetResultAsString(AItem,'Section Link','');..lst := TStringList.Create;..lst.Text := GetResultAsString(Area,'Jois

C:\Program Files (x86)\PlanSwift11\Data\Types\Scripted Tools\Sections\Joist Section\is-J2SAH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (863), with CRLF line terminators
Category:	dropped
Size (bytes):	46281
Entropy (8bit):	4.213314571683559
Encrypted:	false
SSDEEP:	384:TNCIPCwHgLzwYD/5EXuJm1rPIMHxIsD4c8x1bG2RS0JwbGucHMZeIQzwcDqlZc5S:FPqsD4SQJwbGuc6Awe564xSmnVZsp7kK
MD5:	73C2C3AFA9AC458678679DFFF0B49429
SHA1:	9C6F3767FDBE2B5A2602562CCA8CAE126630DFEE
SHA-256:	C84D8488EA3A1567FEEC91B607D714B2F46EF9176F9619A2CB32A2E2C43D1DCB
SHA-512:	467A8CFC320EFEA22E33257A96DFBD7464901EA69A1D3C854F0B684D3C282A110205A7AE9FE38C37EFC3EFC0D65010EAB26FD8269CF2C366AD324FF65682FA7A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Joist Section" GUID="{B8E7E6B0-78D9-483C-8770-93AB055A22E9}">.. <Properties>.. <Property Class="Type" GUID="{08DA3A45-4832-42DF-9920-C6D3BAA56D2E}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="2">Area Section</Property>.. <Property Class="Text" GUID="{A4A80401-7262-40D6-8F9D-FCA4CCDE3BFF}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="2" DecimalPlaces="2">Joist Section</Property>.. <Property Class="Number" GUID="{F45188CD-44D6-4FCC-BD49-FEB10ECF95B1}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">2</Property>.. <Property Class="Image" GUID="{13C19ECB-134A-45CF-A65E-B072A76C2194}" Name="Icon" inheritaction="Inherit Result" OrderIndex="4" DecimalPlaces="2" Transparent="True" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAA

C:\Program Files (x86)\PlanSwift11\Data\Types\Scripted Tools\Sections\is-L5AHB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (780), with CRLF line terminators
Category:	dropped
Size (bytes):	4005
Entropy (8bit):	5.123040673555473
Encrypted:	false
SSDEEP:	96:k4Vbd/uI0MdOMIqd2u20MdOM0bdwz0MdOMZobcwk0MdOMCbdwh0MdOMxK:TdOddO8dOgdOWdO/
MD5:	77EBD55BF928CD559727A0D3B115756E
SHA1:	4C7E07AFB2BDB53CBF6561D227FDEC2483070DE9
SHA-256:	A0E0C8071A40C38C03C096D7E7A89F0C1AC87F9227469BB9CC10B452AE6FCBDD
SHA-512:	169445403B4915774177A0352AAD677CF4E6A7DED854C22876FD697DFF7920C356D52E09929BB27461234BA378455C605C231BA2CD8DB29020AAEF724896EC41
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Sections" GUID="{1733D4C8-927A-4C89-B841-06CE4D95753C}">.. <Properties>.. <Property Class="Type" GUID="{1DECF470-2955-45D4-A79A-BDFBBE56C6B1}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Folder</Property>.. <Property Class="Text" GUID="{BA6FAA16-9F58-4FD0-B92F-010082C27600}" Name="Name" inheritaction="Ignore" calculatebefore="0

C:\Program Files (x86)\PlanSwift11\Data\Types\Scripted Tools\is-EO2C8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (780), with CRLF line terminators
Category:	dropped
Size (bytes):	4017
Entropy (8bit):	5.124331001470186
Encrypted:	false
SSDEEP:	96:kqj3bd/uI0MdOM4qd2u20MdOMUbdwz0MdOM4bcwk0MdOMJTbdwh0MdOMxK:fdOBdO8dOydOsUdO/
MD5:	7158A6F689CE1C253BD0E967039876C2
SHA1:	D8C98FDB2F32EC0091A8F287A50BEFFA21B366A7
SHA-256:	A01EE8AF231F11AF09E416EC6D5BA0FFBE64C7DB912EA36D2018E2087CFA2AAB
SHA-512:	2FD8E06B8B351415DD5B971F284F7B16ED2B733428B7C3497DBCE85B7C7C48DA424E1E18D1F3C0782B4C16167FDAABA674876560BC9033A2DB8425C0FE553DA8
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Scripted Tools" GUID="{44349D86-06AE-4103-A48A-651D97A0FADF}">.. <Properties>.. <Property Class="Type" GUID="{2FA0BB45-6A55-4FE2-92BA-6CE950B921A1}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Folder</Property>.. <Property Class="Text" GUID="{39352DE6-80B5-454F-93A3-3EA511E72F1D}" Name="Name" inheritaction="Ignore" calculatebef

C:\Program Files (x86)\PlanSwift11\Data\Types\Segment Dropdown\Hip-Valley Tool\is-PTB90.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (415), with CRLF line terminators
Category:	dropped
Size (bytes):	14715
Entropy (8bit):	5.548884692192599
Encrypted:	false
SSDEEP:	192:JdhZphVWsnATQGjv7avla+Vbpxr3XnelQ3aVITlGNMbQTpemIklj:JdhNouATzjv7avQ4bpxrHXHbeemIklj
MD5:	31769E6791ED0FDE6C9F3DB5D44F066E
SHA1:	5BC7B02A95D590FDE8EA53BDF1BA28CF6F404641
SHA-256:	3112058084F6EBAEE8EBED2BA5E2F94AD2B5C4E758FB2FF55C59A16070AC0FD0
SHA-512:	401E64061A5CAD00F754CC292DBCFEB0759609F3264F85BB66B3A7234F77E0F5DEDC283C4D264D5654D4502191CF9E934FB37251A1DE90900B1441DA7E94D8DA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Segment" Name="Hip-Valley Tool" GUID="{68CA95B2-3074-41F6-83D8-AC6A6AD862EA}">.. <Properties>.. <Property Class="Text" GUID="{1221B2F0-361E-4AD5-9DEB-B1C68B45CB76}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{68CA95B2-3074-41F6-83D8-AC6A6AD862EA}</Property>.. <Property Class="Number" GUID="{D17BAED1-87DA-4C3A-907B-24B03DA26293}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">5</Property>.. <Property Class="Memo" GUID="{BDCF8E5B-352D-4B83-8D11-651A386DA34E}" Name="Form Layout" systemhidden="True" OrderIndex="16" DecimalPlaces="2"><?xml version="1.0" encoding="windows-1252"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Description" Order="1" ShowUnits="False" SameLi

C:\Program Files (x86)\PlanSwift11\Data\Types\Segment Dropdown\Segment Cubic Yards\is-AFKU5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1586), with CRLF line terminators
Category:	dropped
Size (bytes):	6220
Entropy (8bit):	5.793513558838186
Encrypted:	false
SSDEEP:	96:ijF4Dt9BzzZC3jRd9TprPj7tqr3XlIsT+qWDyH:SihvzzZC3ZZtqrHA+
MD5:	BE93CC79E1B5DD21C001E3E834904653
SHA1:	9A7EBEE0013153334A228E15D6FBE20361F36E94
SHA-256:	12360F973FBEDA9375DF40C4427DC6A8512EC3E6C06E43EC9964B9D984266B2E
SHA-512:	15CC14FB58D9B98C9B06EF56A58C25311866E02D3D7A5D886FB9EDA196F2EF9B86D92951D4F81330847A7425A4555B4D4CE079E4AEE7CC6CDB420B6388E15A62
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Segment Cubic Yards" GUID="{DDF235F3-A740-4A29-B74D-5801C3E4F132}">.. <Properties>.. <Property Class="Type" GUID="{34EC42B8-31D3-43C8-91D9-1A00C435403D}" Name="Type" group="Item" OrderIndex="0" DecimalPlaces="">Segment</Property>.. <Property Class="Text" GUID="{67889109-4B24-4D33-813A-6B242912B982}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="2" DecimalPlaces="">Segment Cubic Yards</Property>.. <Property Class="Image" GUID="{252043D4-DF2A-4197-A474-67A5DD051263}" Name="Icon" inheritaction="Inherit Result" OrderIndex="4" DecimalPlaces="" Transparent="True" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAAAlwSFlzAAAOpgAADqYBh9ypbwAAA3NJREFUOE+d021Mk1cUB/Bnxs03hAdanqoFFVAR2AARaSlQWopWIBBLwWFTZS2ltYhtJ4VSW1tQG6y82CINLaJR2YIbdSFjW3ALM2yik5gYzAw

C:\Program Files (x86)\PlanSwift11\Data\Types\Segment Dropdown\Segment Wall Area\is-3O3L7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (630), with CRLF line terminators
Category:	dropped
Size (bytes):	5160
Entropy (8bit):	5.5933751249206
Encrypted:	false
SSDEEP:	96:zdJKmKxtmQeTTyGGBRJndvyZ5hjhfM9FXquK84x:bCrmQIyGGnJndvWzc5G
MD5:	28706C7FA7D61411000AB74F1B033BFF
SHA1:	F040589146A9D64EBB0FB0A8C8645DB07D65F021
SHA-256:	4B68D1C76B3C7776866FA4B7185450CD8264CDF41DB0071E0C368AF406AC81B1
SHA-512:	D1AE41A168A25DD78BA079D0625AAEEF36A8157819EC5A8BD25DD245FBABEE3C55A959463689A54890BD55CC5C26D14480C132B0B1F5931FD85663BC648AA346
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="Segment Wall Area" GUID="{C1607B51-1480-456B-82CC-38E3ED0A7D36}">.. <Properties>.. <Property Class="Text" GUID="{903FF017-9AEC-4A0F-87B7-1FEEB3F13B8D}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{C1607B51-1480-456B-82CC-38E3ED0A7D36}</Property>.. <Property Class="Number" GUID="{E52CA8BC-95EE-4EA5-8161-0FA9ACB88164}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">5</Property>.. <Property Class="Image" GUID="{B7EAF5A4-E170-4E47-B8E4-B61EA509E751}" Name="Icon" inheritaction="Inherit Result" OrderIndex="6" DecimalPlaces="" Transparent="True" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAAAlwSFlzAAAuIgAALiIBquLdkgAAAKVJREFUOE9j+P//PwMlGKzZQpLtPzkYpBduwPXdC//umVX/tzbA6AfIsBcXtv3AJwZSg2LAssa0vx2xDn+LX

C:\Program Files (x86)\PlanSwift11\Data\Types\Segment Dropdown\Wall Area\is-1ODAO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (630), with CRLF line terminators
Category:	dropped
Size (bytes):	5091
Entropy (8bit):	5.569753428858903
Encrypted:	false
SSDEEP:	96:9PvyldKmKxtPINTfk5hjhfM9FXquzGBRJnC84x:5vWCrWTfkzctGnJnXG
MD5:	A13018D6F44E45C576A80824A0CBEFD9
SHA1:	6EABFFDE16C6D4927EC557861F554E7CD2271891
SHA-256:	F2321AA875E8DE8CA818EB02FAA177AD87A2AC95FFDA65C4DF71FCDA43E7AA09
SHA-512:	DD0BBCF5350A32AC175B8D821EC63C7E901003257D8F6636BEFBD23C35F1E433B59BC28878A864ACBA6FA3A5109A7BFE4955DBF18489E4577B0BF45A8E187F8F
Malicious:	false
Preview:	<?xml version="1.0" encoding="windows-1252"?>..<Item Class="Item" Name="Segment Wall Area" GUID="{C1607B51-1480-456B-82CC-38E3ED0A7D36}">.. <Properties>.. <Property Class="Number" GUID="{79829141-01CF-48EE-948B-65BE920DB655}" Name="Qty" units="SQ FT" inputunits="SQ FT" group="Estimating" OrderIndex="0" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Takeoff]</Property>.. <Property Class="Text" GUID="" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{C1607B51-1480-456B-82CC-38E3ED0A7D36}</Property>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="2" DecimalPlaces="">Segment Wall Area</Property>.. <Property Class="Type" GUID="{E6358506-0616-4A63-B323-7EC48264CDC2}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Segment</Property>.. <Property Class="Number" GUID="{E52CA8BC-95EE-4EA5-8161-0FA9ACB88164}" Name="OrderIndex"

C:\Program Files (x86)\PlanSwift11\Data\Types\Segment Dropdown\is-5OOAD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (740), with CRLF line terminators
Category:	dropped
Size (bytes):	3064
Entropy (8bit):	5.085586197878515
Encrypted:	false
SSDEEP:	48:cVTUhV8Sbd/uI0MdOSaNLkq98Sqd2u20MdOSaNLkqoa8Sbdwz0MdOSaNLkqS78Sx:kTUhRbd/uI0MdOJqd2u20MdOFbdwz0MZ
MD5:	844095EF33F10658DF1DC741B4141F9B
SHA1:	03B3077B4BB016EE380E81454FF19BA1D9E44E5E
SHA-256:	5091C576B9A57489EB4756CDBF8C4D99C68BF53FCFF86464E85821BEE38521D9
SHA-512:	AE3E8CD4FA33E8E4380A98F7D70C57A0978624361D033420D2251DF203FB358CEE9A6EFFE890F75D82DF4C75AA8D85385BD651D9D6E21CDC8BADE33985C1B881
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="Segment Dropdown" GUID="{8B020240-7642-43A2-8A5A-42CA65B5044C}">.. <Properties>.. <Property Class="Type" GUID="{C4C78CF5-9402-4CFD-8340-C1666E205EE2}" Name="Type" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="False" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ToolHint="">Folder</Property>.. <Property Class="Text" GUID="{CBAE0BFF-E869-4E12-88A4-461DD6B0845E}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\Types\Sticky Tabs\URGENT1\is-81MS3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2805
Entropy (8bit):	5.492375282315782
Encrypted:	false
SSDEEP:	48:c86ehdXcxjS9FZI5/Don3YcgBKCRkaRgJv0pBd8:VThdcxj6TI5oGrpBq
MD5:	052517469C3B3ACEED92F4C1C67D7858
SHA1:	EB0670F9C6A65D51B662FC6794170134F8DEB7FA
SHA-256:	34005364AF8F2E19BC0B42649095E6A744CA4E261D9277B8EEE85D7EADE53744
SHA-512:	31F61C7DE91727B36FC1E3F5A0C6F871AB0362E6CDA4C5D906784D809309E3EA569D92FFB70546FD694789D40C64C28704FA089C2D8827B69BCE9E8701BDC7E9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="URGENT" GUID="{6815E2F2-49E0-4052-A51D-83A4A3B8EE57}">.. <Properties>.. <Property Class="Text" GUID="{F24BFB65-E363-4AE8-A3F9-244C3564D7CB}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">URGENT</Property>.. <Property Class="Type" GUID="{95DF5632-016A-40F4-8EA0-4029FAAF8562}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">StickyTab</Property>.. <Property Class="Number" GUID="{7C86EF2F-80D9-4E9D-8A20-09DE77BE205C}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">1</Property>.. <Property Class="Text" GUID="{9D61E6FB-8810-4526-B9EB-97A3E54776C5}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{6815E2F2-49E0-4052-A51D-83A4A3B8EE57}</Property>.. <Property Class="Color" GUID="{C49C12AD-041A-4118-99BE-0ABD4368FF47}" Name="Label Color" input="True" group="Sticky Tab Setti

C:\Program Files (x86)\PlanSwift11\Data\Types\Sticky Tabs\URGENT2\is-B8K83.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2584
Entropy (8bit):	5.481716223490695
Encrypted:	false
SSDEEP:	48:cflXszXj23V0/Don3YcgBKCRkaRgJh/l6:ClXszX6WoGaN6
MD5:	AAA9B8588B0A6C01AC0786D7586D1C30
SHA1:	3818BD22C5566CBADE1A59D6A3DFB1EE657B4A01
SHA-256:	47960517C28B3D57950DE742E977BBE48F6FE71930F92A924B81E0A8919134B4
SHA-512:	5C901DFC6B23D11E568F019171F8631F527AE74A4F692EE91E1A18FF641B4B45F30633D3946265ADEA7C5DF5DFE8AE4ED04B794DC4650F118112CA5C7C97DCA1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="URGENT" GUID="{2D5510A2-622E-49B1-B058-A9143C6D6979}">.. <Properties>.. <Property Class="Text" GUID="{D551F646-5CCD-49D7-80DB-F3C1B09273A2}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">URGENT</Property>.. <Property Class="Type" GUID="{8F8BF081-9B59-4F17-A33C-BFA234BCDCFC}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">StickyTab</Property>.. <Property Class="Number" GUID="{37761E95-C90E-4BA9-9CBB-621E5D33760D}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">2</Property>.. <Property Class="Text" GUID="{A7FE98FF-4CB9-4514-8F07-B389D618A54B}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{2D5510A2-622E-49B1-B058-A9143C6D6979}</Property>.. <Property Class="Memo" GUID="{767DB3DA-6691-4905-B5B4-9323A9DCBFA0}" Name="Form Layout" systemhidden="True" OrderIndex="13" D

C:\Program Files (x86)\PlanSwift11\Data\Types\Sticky Tabs\URGENT3\is-1VARD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2450
Entropy (8bit):	5.508137127340864
Encrypted:	false
SSDEEP:	48:cjb4TEECLxGo1T+/Don3YcgBck5gJVDplxr:CbsEhLEo1T+o9rDpvr
MD5:	BACC66FD5D9729E781103C33AF216065
SHA1:	ACD5FD3D5D9371E098F1342DA65E8BCE98F94983
SHA-256:	5D485147766C4AD4678945EB7F26E9127D7D0BD5AF6184E40B3CF0A61DBDB2A7
SHA-512:	41A28A7C3DA0D39E7BCBE4CAE30829B2642482D4420980EC19582F83A67D768CF1A004C7A2E2EFBF82746F9ACEB9CB2E13DF45E5F6CD5996F6458348A4DDD296
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="URGENT" GUID="{027D1A0A-B6DF-4C34-BEB0-0AE350A867F4}">.. <Properties>.. <Property Class="Text" GUID="{434763ED-A314-44D8-A763-57D5736D4707}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">URGENT</Property>.. <Property Class="Type" GUID="{14B03A31-85BD-4145-9899-53EF5A195B76}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">StickyTab</Property>.. <Property Class="Number" GUID="{9B9DE986-7BEC-4D13-8B2F-FCF5A264EA95}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">3</Property>.. <Property Class="Text" GUID="{19780C12-79EC-48E5-828C-2329A2A6B7AA}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{027D1A0A-B6DF-4C34-BEB0-0AE350A867F4}</Property>.. <Property Class="Memo" GUID="{75218C2D-B9E6-4147-8721-3F07A7F86856}" Name="Form Layout" systemhidden="True" OrderIndex="13" D

C:\Program Files (x86)\PlanSwift11\Data\Types\Sticky Tabs\URGENT4\is-3KMG9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2671
Entropy (8bit):	5.50751208787593
Encrypted:	false
SSDEEP:	24:2dFDSBXTX2q5vApWZjegAWwbCI1OckOFAf2WAdOcUmqcaDonAqG7VKgQufkknauI:coGsdrp/Don3YcgBck5gJHzxocIru9
MD5:	92A14ED42B8F4AC01A7E53530ECD5835
SHA1:	A9FB5BAF9CDAA17B5054A3CCC128C819923849DE
SHA-256:	2629EF1A56A9002BB702D0E7ECDC9608AA57CCF5268DF5A63DDE4B552F21D2FA
SHA-512:	22C59AA0E96A4D827411385EB196C712320EBBBF2C335A71038ACA684BBA528B99D195A136AEE36D9EFA2D0A07191C44E3B8306025040C7A55BFA476A6EF338D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="URGENT" GUID="{C72B1506-CD3B-4608-9ADF-73676354F048}">.. <Properties>.. <Property Class="Text" GUID="{9886F474-4C66-4CE2-8F20-AFDC64DBCD09}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">URGENT</Property>.. <Property Class="Type" GUID="{7252C85C-4A7F-493A-887C-88026A337F19}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">StickyTab</Property>.. <Property Class="Number" GUID="{295294C1-42A9-451B-BCE8-916E07A0928C}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">4</Property>.. <Property Class="Text" GUID="{D07AF324-A36F-4CAE-8651-FE0920DB2B18}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{C72B1506-CD3B-4608-9ADF-73676354F048}</Property>.. <Property Class="Memo" GUID="{1AEBCF01-8D87-45EE-9D0A-D19395EDA8F8}" Name="Form Layout" systemhidden="True" OrderIndex="13" D

C:\Program Files (x86)\PlanSwift11\Data\Types\Sticky Tabs\URGENT\is-1VJCH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	5.493290471410131
Encrypted:	false
SSDEEP:	24:2dFDSUuX2ZvApWZjNeyCgAWw+d1OctN6f2WAdOcAfQqcaDonAqG7VKgQufkknaug:cIWehTguL/Don3YcgBck5go+
MD5:	FA95025581D33422A132B161F3EE2325
SHA1:	D1B3EB37403B155AD4CA3AF842512240A3665768
SHA-256:	5A690C3DFDD72C957DC9194B29394B55375D324D3E9E38FD2B08A77FCC284B36
SHA-512:	7E9DE4B8E47D29FD72845375F01CB9AA33150F9286F0FC216C87721467D966AE49605C6BA67E2662A0B3DB7B1661E923977680E8D9A6CEB018008E5BF5EE64CA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="URGENT" GUID="{338C94C7-5C02-4E5B-89D8-74D7494F4DB7}">.. <Properties>.. <Property Class="Text" GUID="{1C1ADC85-2B3C-437D-95C8-0EE177AC6B3A}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">URGENT</Property>.. <Property Class="Type" GUID="{111F0CD4-89E0-486A-A470-8B31EED6774C}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">StickyTab</Property>.. <Property Class="Number" GUID="{54F920C2-C49E-458A-9D59-E3F0929A9FBB}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">0</Property>.. <Property Class="Text" GUID="{1579A192-E820-4CE3-AE31-8880C58E7701}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{338C94C7-5C02-4E5B-89D8-74D7494F4DB7}</Property>.. <Property Class="Memo" GUID="{719242E9-3DCE-4312-8B56-475306CEF516}" Name="Form Layout" systemhidden="True" OrderIndex="13" D

C:\Program Files (x86)\PlanSwift11\Data\Types\Sticky Tabs\is-SI61L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	919
Entropy (8bit):	5.411490965212231
Encrypted:	false
SSDEEP:	24:2d2rfsX/I661OcFPy6N7yf2WAdOcdzdju/CApWqzBgAWXv:ccfsA6VEN7W25jqi
MD5:	466C5CFB0095E3D94D8CACA6CE4E905F
SHA1:	04DBDF4E86F429F94EEA70B740F06FD5DC5BECFE
SHA-256:	E61A3F64A4986E904BB23801FC9A4AE600394BBB00F5D0947048BF97E40D89BC
SHA-512:	5F9F45C2460F8E4E2B859B4D1B6744659C10564934C58E734D49F8CACC61730C99D57F3527414C48755E0EB776E256C00072909EF4711464FD587798CFC0E56C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="Sticky Tabs" GUID="{E319C649-4A2A-4DC4-BAD5-C4A882DFD16A}">.. <Properties>.. <Property Class="Number" GUID="{8BA75D34-0AED-4B8B-84A5-019A867F63ED}" Name="OrderIndex" systemhidden="True" OrderIndex="2" DecimalPlaces="2">9</Property>.. <Property Class="Text" GUID="{83F17F17-552C-4614-AFAE-C1FFF4A6FBA5}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="8" DecimalPlaces="2">{E319C649-4A2A-4DC4-BAD5-C4A882DFD16A}</Property>.. <Property Class="Text" GUID="{342B0AC0-365B-4029-996C-BC96541C56A5}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Sticky Tabs</Property>.. <Property Class="Type" GUID="{DA5D826C-3594-4EAB-8BC6-CCC5680F1351}" Name="Type" group="Item" OrderIndex="4" DecimalPlaces="2">Folder</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\Types\is-2UHHJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (2176), with CRLF line terminators
Category:	dropped
Size (bytes):	10681
Entropy (8bit):	5.679506150695012
Encrypted:	false
SSDEEP:	192:6EdOJdO2dOd3dOgQUdO2dOjdOf9tvgdOQLZdOAjv7alM:6EdOJdO2dO9dOSdO2dOjdOfPvgdOQ1dp
MD5:	72DA233782A11433AD18E5512222F6ED
SHA1:	3B73BE73FCC418BBC1D4D066D1622E3522A53439
SHA-256:	BED1DFB591C4984F482A6EE1D9E57D17AA4481B5D1B9441C924673CDA047062E
SHA-512:	F02722907104A93775FCE29E75DAE4671926770B49ED05812AB8BC32AB3F92919B86ED4F8D75F412C95E96640C50937C00305CB1493A95343BF42900DDFDC1B0
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="Types" GUID="{62F848BC-F4D7-48DC-8CAC-4C6573328BBE}">.. <Properties>.. <Property Class="Text" GUID="{297C9F20-3128-4F55-B11C-3D953C3868F6}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">Types</Property>.. <Property Class="Type" GUID="{2812BC3B-CC85-4C05-91F2-FB3FC7B257C8}" Name="Type" inheritaction="" calculatebefore="0" inheri

C:\Program Files (x86)\PlanSwift11\Data\_Types\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (2208), with CRLF line terminators
Category:	dropped
Size (bytes):	5308
Entropy (8bit):	5.211631425427944
Encrypted:	false
SSDEEP:	96:k0Kk6qd2uI0MdOMxLbd/ul0MdOMLibd/u24MdOM0YFW+eOcIWbdwz0MdOMBbcwkQ:ZkdOe6dObdOuW+BcadOfdOx
MD5:	430A2CA6DAA0C740D0BCBCF671F9E561
SHA1:	F52E258088584637787AA40DBAC7692FA7483636
SHA-256:	22AC449C39D0C3E2668841B552757EBFCDE76930A4A39B261FD4AF4EB6D84930
SHA-512:	C291FE541AF104A8611174A170717B9C15C9AFBF36693D5E0C54A2ACAEE4A9D08871B499E303815CE2F242C61F39951783A1220CDA793369A7E9CD950226E6E0
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Types" GUID="{01B29FFC-E81D-4701-B19D-11C87B97175D}">.. <Properties>.. <Property Class="Text" GUID="{C33D5B04-C01D-4930-88D3-562905A3D3CE}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Types</Property>.. <Property Class="Type" GUID="{036C68FC-5BEF-4D6F-82C9-889B99EDB749}" Name="Type" inheritaction="" calculatebefore="0" inhe

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1688), with CRLF line terminators
Category:	dropped
Size (bytes):	6136
Entropy (8bit):	5.414134921177981
Encrypted:	false
SSDEEP:	96:kPV1obcwI0MdO84bdwl0MdOKqd2u20MdOpBkAbd2uz0MdOz6bd/uk4MdOyLh7I0g:ujhdO8NdOqdOfJdOzgdOyLh2y74dOxdE
MD5:	49DAC5E6C1594879178701832666E644
SHA1:	147FEB42566C67D858CBECA6EB0C91FBEB15E5E7
SHA-256:	A718B1D776CB32B45574BF73293CF4510AE57AA668BE7591A79BF8EA29E1BBE8
SHA-512:	4DF2A69FBE8B98239B37CDD7E83E798804644F5E01591CFDA595CC66EFB9AFEEFCAD2C5E27E8720A32E297AB02C511D916C30D3F062FE737CF54947FBF809083
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="_All" GUID="{A343E721-1948-452D-9C02-CFB512B26FC1}">.. <Properties>.. <Property Class="Text" GUID="{02F528BD-A772-413E-BEA9-AC07D92A0749}" Name="GUID" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="True" systemhidden="True" required="False" units="" inputunits="" group="" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0">{A343E721-1948-452D-9C02-CFB512B26FC1}</Property>.. <Property Class="Number" GUID="{AE1A70B3-36BC-4F7A-AB51-184F00160D5D}" Name="OrderIndex" inheritaction="" calculatebefore="0" inhe

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Attachment\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1036), with CRLF line terminators
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	5.929835466157317
Encrypted:	false
SSDEEP:	24:2dFDmYgX2RvApWh/W1Oc1fcgAWR6GL8f2WAdOcgYLswtYUQWWI5wGEBxONNOQ2/M:cICJpGLkUtYUYLBANftbM6A3uq9CC+
MD5:	2DA655B7CAFF67245F6549403E31ED55
SHA1:	F46153C294AFEA3251AC4F21AAC26EC20E6B9D54
SHA-256:	AC3A1EA1E7B91C335DAAF755F9644DE0FD1D742261CCA4043644145E1D58845B
SHA-512:	1A88CD39E26DCB66CB6821FE30A6FBE5780A573E956A5F5C0DDF456D18D82A046238A0D2D801917D3FA8A6AB204A0CEFF933C2918F9ED1BBE523B6EE37306805
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Attachment" GUID="{574B2962-49FA-4791-B4DD-40F08C0DD2F7}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Attachment</Property>.. <Property Class="Number" GUID="{7C97528E-5BCC-48A6-B57A-020369B16927}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">15</Property>.. <Property Class="Type" GUID="{3B6472D3-56CD-467B-BF5F-6017B79AEC0D}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">All</Property>.. <Property Class="Text" GUID="{029AB85A-0391-41D2-A7B8-FC42DD596F2D}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{574B2962-49FA-4791-B4DD-40F08C0DD2F7}</Property>.. <Property Class="Image" GUID="{CA91D1A5-EEF0-4620-A05B-5AF98F54B976}" Name="Icon" inheritaction="Inherit Formula" group="Item" OrderIndex="4" DecimalPlaces=""

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Attachment\is-CFGNA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1036), with CRLF line terminators
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	5.929835466157317
Encrypted:	false
SSDEEP:	24:2dFDmYgX2RvApWh/W1Oc1fcgAWR6GL8f2WAdOcgYLswtYUQWWI5wGEBxONNOQ2/M:cICJpGLkUtYUYLBANftbM6A3uq9CC+
MD5:	2DA655B7CAFF67245F6549403E31ED55
SHA1:	F46153C294AFEA3251AC4F21AAC26EC20E6B9D54
SHA-256:	AC3A1EA1E7B91C335DAAF755F9644DE0FD1D742261CCA4043644145E1D58845B
SHA-512:	1A88CD39E26DCB66CB6821FE30A6FBE5780A573E956A5F5C0DDF456D18D82A046238A0D2D801917D3FA8A6AB204A0CEFF933C2918F9ED1BBE523B6EE37306805
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Attachment" GUID="{574B2962-49FA-4791-B4DD-40F08C0DD2F7}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Attachment</Property>.. <Property Class="Number" GUID="{7C97528E-5BCC-48A6-B57A-020369B16927}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">15</Property>.. <Property Class="Type" GUID="{3B6472D3-56CD-467B-BF5F-6017B79AEC0D}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">All</Property>.. <Property Class="Text" GUID="{029AB85A-0391-41D2-A7B8-FC42DD596F2D}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{574B2962-49FA-4791-B4DD-40F08C0DD2F7}</Property>.. <Property Class="Image" GUID="{CA91D1A5-EEF0-4620-A05B-5AF98F54B976}" Name="Icon" inheritaction="Inherit Formula" group="Item" OrderIndex="4" DecimalPlaces=""

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Bookmark\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1298), with CRLF line terminators
Category:	dropped
Size (bytes):	2476
Entropy (8bit):	5.03617368654224
Encrypted:	false
SSDEEP:	48:ckxvTJ6tTU52d3TpTpRs5pFRs5pTpTp0pcpJWpJWpJWpDE7g+kBYtAwMi:PxvTSg52dJs7sNccWgg1aARi
MD5:	CF600FAB47EB3311CAE400D977BED275
SHA1:	BA07C8BB0D8D5BC7CEDDFE3A3C678EC86D9EBE69
SHA-256:	5FDE9F6E70A5328D9BC7B3B509EEF07C59E2EAF8641CDDE3F2CC451B7900479C
SHA-512:	F3AB9D41ECFEAF972D6BC0AA906D1185C083B28FA4BAF5397C916FB7AD40584299AF40B4B82C036D32411453488795CA3E23292553CD6B1F26A0205833FF15E0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Bookmark" GUID="{768A7FF8-0B3C-49BB-A60B-49DE563A6D41}">.. <Properties>.. <Property Class="Text" GUID="{E32B84D9-0489-41A9-A317-33EB2B8CF4DB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="">{768A7FF8-0B3C-49BB-A60B-49DE563A6D41}</Property>.. <Property Class="Image" GUID="{713B3E5C-0325-4659-8F5C-B5D123C47450}" Name="Icon" inheritaction="Inherit Result" OrderIndex="1" DecimalPlaces="" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAADwAAABAAAAABABgAAAAAAAADAAATCwAAEwsAAAAAAAAAAAAA/wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD/AAAA/wD/NC4aNC4aNC4aNC4aNC4aNC4aNC4aNC4aNC4aNC4aNC4aNC4a/wD//wD/AAAA/wD/jZeE////////////////////////GBoc////////////NC4a/wD//wD/AAAA/wD/jZeE////////////////////////GBoc////////////NC4a/wD//wD/AAAA/wD/jZeE////////////////////aHSC////aHSC////////NC4a/wD//wD/AAAA/wD/jZeE////////////GBocGBoc////GBoc//

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Bookmark\is-73NVF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1298), with CRLF line terminators
Category:	dropped
Size (bytes):	2476
Entropy (8bit):	5.03617368654224
Encrypted:	false
SSDEEP:	48:ckxvTJ6tTU52d3TpTpRs5pFRs5pTpTp0pcpJWpJWpJWpDE7g+kBYtAwMi:PxvTSg52dJs7sNccWgg1aARi
MD5:	CF600FAB47EB3311CAE400D977BED275
SHA1:	BA07C8BB0D8D5BC7CEDDFE3A3C678EC86D9EBE69
SHA-256:	5FDE9F6E70A5328D9BC7B3B509EEF07C59E2EAF8641CDDE3F2CC451B7900479C
SHA-512:	F3AB9D41ECFEAF972D6BC0AA906D1185C083B28FA4BAF5397C916FB7AD40584299AF40B4B82C036D32411453488795CA3E23292553CD6B1F26A0205833FF15E0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Bookmark" GUID="{768A7FF8-0B3C-49BB-A60B-49DE563A6D41}">.. <Properties>.. <Property Class="Text" GUID="{E32B84D9-0489-41A9-A317-33EB2B8CF4DB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="">{768A7FF8-0B3C-49BB-A60B-49DE563A6D41}</Property>.. <Property Class="Image" GUID="{713B3E5C-0325-4659-8F5C-B5D123C47450}" Name="Icon" inheritaction="Inherit Result" OrderIndex="1" DecimalPlaces="" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAADwAAABAAAAABABgAAAAAAAADAAATCwAAEwsAAAAAAAAAAAAA/wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD/AAAA/wD/NC4aNC4aNC4aNC4aNC4aNC4aNC4aNC4aNC4aNC4aNC4aNC4a/wD//wD/AAAA/wD/jZeE////////////////////////GBoc////////////NC4a/wD//wD/AAAA/wD/jZeE////////////////////////GBoc////////////NC4a/wD//wD/AAAA/wD/jZeE////////////////////aHSC////aHSC////////NC4a/wD//wD/AAAA/wD/jZeE////////////GBocGBoc////GBoc//

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Development\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1827), with CRLF line terminators
Category:	dropped
Size (bytes):	6074
Entropy (8bit):	5.469081562731594
Encrypted:	false
SSDEEP:	96:kb/zqd2uUDMdOMRbd/ulDMdOMQfbd/uChMdOu0T+Ug8TPTfREKbdw7DMdOMJjIbs:UqdOidOhMdO9lTdOIqdOSGdOm
MD5:	4AA9304AB0065D13FDED7839B7B06D48
SHA1:	A3F1ACC98ED4DD17CD835E1BAD9CE36C136FCCFA
SHA-256:	56F251816D0F4C2783061C4CC981F30376ECA50206B2CE42107D62A5F8EEBCCB
SHA-512:	134EE75CD04C1676779B8CFF71E95A29224AA9E2FBE2CE4313FF63AAB0DF8BE5390247B6495E12A2C57C1D893EC54E89C32E7A6A4D97418DA437B9E1F2C3F662
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Development" GUID="{3CD9E917-2DAC-42E7-9BDD-227224F5B739}">.. <Properties>.. <Property Class="Text" GUID="{3A559676-C3E4-4AAC-B719-68A2C4FFDC19}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Development</Property>.. <Property Class="Type" GUID="{DCBB8CD9-5420-4C97-BF85-F47A1EFE04B8}" Nam

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Development\_Help\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1885), with CRLF line terminators
Category:	dropped
Size (bytes):	6001
Entropy (8bit):	5.371701462628064
Encrypted:	false
SSDEEP:	96:k1YGqd2uI0MdOMk5bd/ul0MdOM4fbd/u24MdOu0X1dqJFzTdKgsgbdwz0MdOMHbh:WfdOUdOtNdOk0gsDdO9dOwdO3
MD5:	5BF7D6BFE757C72EB2121CE9DA903EAA
SHA1:	E78F1F11F70C3C437645EBE24CCC109E6838CD9C
SHA-256:	6C6C9E2A3C559668EBDE5BB3BC38C76541A180E741C39E9CBB5F19047F655B05
SHA-512:	644E9704F7211EA86560302892FDA6B4115FA5610A9AA9397B5904F3DDDA157E9233708B52BFCC75A35DAA7E77DA5FF27421E1F1D056948C954EFB2EB3F13390
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Help" GUID="{BE2E7970-B7F6-4633-8373-7730B1CDCDC8}">.. <Properties>.. <Property Class="Text" GUID="{21EA72A7-931F-448D-AD29-CD5787302AE3}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Help</Property>.. <Property Class="Type" GUID="{F9D976BB-0211-4979-8D69-BB5EE356F1B5}" Name="Type" inheritaction="" calculatebefore="0" inheri

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Development\_Help\_Event\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1117), with CRLF line terminators
Category:	dropped
Size (bytes):	5300
Entropy (8bit):	5.2220575982128326
Encrypted:	false
SSDEEP:	96:k7ndqd2uI0MdOMi6Zbd/ul0MdOMmfbd/u24MdOu0awfzbdwz0MdOM08bcwk0MdOX:mTdO1dO7NdOcdOjRdOIdOSa
MD5:	9CC173569335C91D67AAD89C03AEB092
SHA1:	8CCC8D563D26AE6BAB4FF4A6BE9518AA48981AFD
SHA-256:	83768CA4941AA64D33061A88AB5AA99483FB828AE156B183F3EAA6331F59A5C1
SHA-512:	BDA6BF71BF962FE4EAAF018BB30B466FA1809634AC1151BCBF964FB4C78A31A127FC4D969BBC6E4BA64FA662346415508C9D411EA5B9B643D25CB50A2D014686
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Event" GUID="{0F42EE24-96EB-4040-87D6-D13C3E60E3F4}">.. <Properties>.. <Property Class="Text" GUID="{81A5E7D9-A183-4A47-AAA0-8FDC0800CBD4}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Event</Property>.. <Property Class="Type" GUID="{9397BB84-F097-46CD-816C-FC558FBB79F0}" Name="Type" inheritaction="" calculatebefore="0" inhe

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Development\_Help\_Event\is-P30V2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1117), with CRLF line terminators
Category:	dropped
Size (bytes):	5300
Entropy (8bit):	5.2220575982128326
Encrypted:	false
SSDEEP:	96:k7ndqd2uI0MdOMi6Zbd/ul0MdOMmfbd/u24MdOu0awfzbdwz0MdOM08bcwk0MdOX:mTdO1dO7NdOcdOjRdOIdOSa
MD5:	9CC173569335C91D67AAD89C03AEB092
SHA1:	8CCC8D563D26AE6BAB4FF4A6BE9518AA48981AFD
SHA-256:	83768CA4941AA64D33061A88AB5AA99483FB828AE156B183F3EAA6331F59A5C1
SHA-512:	BDA6BF71BF962FE4EAAF018BB30B466FA1809634AC1151BCBF964FB4C78A31A127FC4D969BBC6E4BA64FA662346415508C9D411EA5B9B643D25CB50A2D014686
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Event" GUID="{0F42EE24-96EB-4040-87D6-D13C3E60E3F4}">.. <Properties>.. <Property Class="Text" GUID="{81A5E7D9-A183-4A47-AAA0-8FDC0800CBD4}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Event</Property>.. <Property Class="Type" GUID="{9397BB84-F097-46CD-816C-FC558FBB79F0}" Name="Type" inheritaction="" calculatebefore="0" inhe

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Development\_Help\_Function\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1117), with CRLF line terminators
Category:	dropped
Size (bytes):	5306
Entropy (8bit):	5.207062872786725
Encrypted:	false
SSDEEP:	96:kK3dqd2uI0MdOMi6Zbd/ul0MdOMmfbd/u24MdOu0agbdwz0MdOMT8bcwk0MdOMZP:FDdOndO7NdOudOERdOHdOSa
MD5:	857A5C82213BFC8229053A83A571C803
SHA1:	5A19E3C96CCB138E22E1A2A28C4BA677D42A7809
SHA-256:	BEE70EC1A338C59FE1D534D88320C82D8191ECF6F38D0D47FF861EC27998DED5
SHA-512:	2D1F2F33761F52EBF343CBA8CF9A84BB0B1BC5DE8EC939B6E48125CA520BF61F80022B52373EC68771069DEF0333CED05FC4D20BC883C87BCC94889ACA03E24B
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Function" GUID="{ECF6A18A-6230-4BA6-A778-906DF118E719}">.. <Properties>.. <Property Class="Text" GUID="{81A5E7D9-A183-4A47-AAA0-8FDC0800CBD4}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Function</Property>.. <Property Class="Type" GUID="{9397BB84-F097-46CD-816C-FC558FBB79F0}" Name="Type" inheritaction="" calculatebefore="0

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Development\_Help\_Function\is-M07T6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1117), with CRLF line terminators
Category:	dropped
Size (bytes):	5306
Entropy (8bit):	5.207062872786725
Encrypted:	false
SSDEEP:	96:kK3dqd2uI0MdOMi6Zbd/ul0MdOMmfbd/u24MdOu0agbdwz0MdOMT8bcwk0MdOMZP:FDdOndO7NdOudOERdOHdOSa
MD5:	857A5C82213BFC8229053A83A571C803
SHA1:	5A19E3C96CCB138E22E1A2A28C4BA677D42A7809
SHA-256:	BEE70EC1A338C59FE1D534D88320C82D8191ECF6F38D0D47FF861EC27998DED5
SHA-512:	2D1F2F33761F52EBF343CBA8CF9A84BB0B1BC5DE8EC939B6E48125CA520BF61F80022B52373EC68771069DEF0333CED05FC4D20BC883C87BCC94889ACA03E24B
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Function" GUID="{ECF6A18A-6230-4BA6-A778-906DF118E719}">.. <Properties>.. <Property Class="Text" GUID="{81A5E7D9-A183-4A47-AAA0-8FDC0800CBD4}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Function</Property>.. <Property Class="Type" GUID="{9397BB84-F097-46CD-816C-FC558FBB79F0}" Name="Type" inheritaction="" calculatebefore="0

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Development\_Help\_Object\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1661), with CRLF line terminators
Category:	dropped
Size (bytes):	5911
Entropy (8bit):	5.2161807390619614
Encrypted:	false
SSDEEP:	96:kvdqd2uI0MdOMPl6Zbd/ul0MdOMmfbd/u24MdOu0MMYWregMtlr0NUr7MObdwz0P:kdO0HdO7NdOg6dOlRdOKdOSD
MD5:	1C67A2ED45AFE22BFC0AE2BD29DDB4D7
SHA1:	D14DCD4E22B7B2D136869E155D0A83EC51964FEF
SHA-256:	20AB4E2C5D0B41E65A1CEC0D13632F8CC809A3E1BADAB095CF61696C3E9401F3
SHA-512:	FE994AA9036EA21E170EC35FAF7DFDE79AF0210F593F5A4F55E6C0297B8E3226FC91C8DF7ADF2F0270965864F3B345D1041560895CB759478D45EB538FAA97BE
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Object" GUID="{214FEBEE-8065-47BC-A70A-FD342F24F819}">.. <Properties>.. <Property Class="Text" GUID="{81A5E7D9-A183-4A47-AAA0-8FDC0800CBD4}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Object</Property>.. <Property Class="Type" GUID="{9397BB84-F097-46CD-816C-FC558FBB79F0}" Name="Type" inheritaction="" calculatebefore="0" in

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Development\_Help\_Object\is-EOR43.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1661), with CRLF line terminators
Category:	dropped
Size (bytes):	5911
Entropy (8bit):	5.2161807390619614
Encrypted:	false
SSDEEP:	96:kvdqd2uI0MdOMPl6Zbd/ul0MdOMmfbd/u24MdOu0MMYWregMtlr0NUr7MObdwz0P:kdO0HdO7NdOg6dOlRdOKdOSD
MD5:	1C67A2ED45AFE22BFC0AE2BD29DDB4D7
SHA1:	D14DCD4E22B7B2D136869E155D0A83EC51964FEF
SHA-256:	20AB4E2C5D0B41E65A1CEC0D13632F8CC809A3E1BADAB095CF61696C3E9401F3
SHA-512:	FE994AA9036EA21E170EC35FAF7DFDE79AF0210F593F5A4F55E6C0297B8E3226FC91C8DF7ADF2F0270965864F3B345D1041560895CB759478D45EB538FAA97BE
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Object" GUID="{214FEBEE-8065-47BC-A70A-FD342F24F819}">.. <Properties>.. <Property Class="Text" GUID="{81A5E7D9-A183-4A47-AAA0-8FDC0800CBD4}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Object</Property>.. <Property Class="Type" GUID="{9397BB84-F097-46CD-816C-FC558FBB79F0}" Name="Type" inheritaction="" calculatebefore="0" in

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Development\_Help\_Procedure\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1117), with CRLF line terminators
Category:	dropped
Size (bytes):	5439
Entropy (8bit):	5.236536914002131
Encrypted:	false
SSDEEP:	96:kFqidqd2uI0MdOMH6Zbd/ul0MdOMmfbd/u24MdOu0awY7czbdwz0MdOM0w8bcwkX:KdOgdO7NdO6dOCRdOwPdOZC
MD5:	75876ECAA02DC16F5C155B0BAE845F9C
SHA1:	29EE72B2A7F71B627B3BFD111602B1E9F31CF8FB
SHA-256:	0BE35FBDFEC800B537B67DCD06C1276243A770BC04DA8EDF2EB8AE6498CF5927
SHA-512:	DC8F5041ECE0499FF584359A8D114C3E0B771BDAEE02CB7A08554CC656892B751B6DDF0F5370A61B2FE956F48AB2F8227A5A774EF3FD138109EDF9180C96D501
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Procedure" GUID="{9C2AD77D-AD29-4981-BC65-4D22B4B77093}">.. <Properties>.. <Property Class="Text" GUID="{81A5E7D9-A183-4A47-AAA0-8FDC0800CBD4}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Procedure</Property>.. <Property Class="Type" GUID="{9397BB84-F097-46CD-816C-FC558FBB79F0}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Development\_Help\_Procedure\is-OCLNU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1117), with CRLF line terminators
Category:	dropped
Size (bytes):	5439
Entropy (8bit):	5.236536914002131
Encrypted:	false
SSDEEP:	96:kFqidqd2uI0MdOMH6Zbd/ul0MdOMmfbd/u24MdOu0awY7czbdwz0MdOM0w8bcwkX:KdOgdO7NdO6dOCRdOwPdOZC
MD5:	75876ECAA02DC16F5C155B0BAE845F9C
SHA1:	29EE72B2A7F71B627B3BFD111602B1E9F31CF8FB
SHA-256:	0BE35FBDFEC800B537B67DCD06C1276243A770BC04DA8EDF2EB8AE6498CF5927
SHA-512:	DC8F5041ECE0499FF584359A8D114C3E0B771BDAEE02CB7A08554CC656892B751B6DDF0F5370A61B2FE956F48AB2F8227A5A774EF3FD138109EDF9180C96D501
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Procedure" GUID="{9C2AD77D-AD29-4981-BC65-4D22B4B77093}">.. <Properties>.. <Property Class="Text" GUID="{81A5E7D9-A183-4A47-AAA0-8FDC0800CBD4}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Procedure</Property>.. <Property Class="Type" GUID="{9397BB84-F097-46CD-816C-FC558FBB79F0}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Development\_Help\_Property\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1117), with CRLF line terminators
Category:	dropped
Size (bytes):	4223
Entropy (8bit):	5.183893030281566
Encrypted:	false
SSDEEP:	96:kPPWbqd2uI0MdOMX0bd/ul0MdOM5fbd/u24MdOu0aTPbdwz0MdOM6tbcwk0MdOMZ:gOddOSdOINdO/dOSdOQ
MD5:	45805622A342AEF0393FA86C29A6DAB6
SHA1:	400EB4037229D66415685D3E80033C7D36D2FBDC
SHA-256:	1FC7FFD55BBB8F6F7FFEA57DE249E1CC9C70D11CAF008AAEDE04862468F7A717
SHA-512:	86764D1F6220346FEF0C83D9AE2B34907E8695763030F0A7F295E8CF511DC26451EF54244DF1300713C4FA72CC834CCE449608E1A69BCA6E368ABDDECA9F3956
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Property" GUID="{E7570F6E-5DDF-44F7-8CFD-FA87AC50457F}">.. <Properties>.. <Property Class="Text" GUID="{2ECC4B29-7BD6-4C88-BC6A-E48C71B594C4}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Property</Property>.. <Property Class="Type" GUID="{39ED69D7-E55F-48CD-A067-6D503584EDDE}" Name="Type" inheritaction="" calculatebefore="0

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Development\_Help\_Property\is-D57HA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1117), with CRLF line terminators
Category:	dropped
Size (bytes):	4223
Entropy (8bit):	5.183893030281566
Encrypted:	false
SSDEEP:	96:kPPWbqd2uI0MdOMX0bd/ul0MdOM5fbd/u24MdOu0aTPbdwz0MdOM6tbcwk0MdOMZ:gOddOSdOINdO/dOSdOQ
MD5:	45805622A342AEF0393FA86C29A6DAB6
SHA1:	400EB4037229D66415685D3E80033C7D36D2FBDC
SHA-256:	1FC7FFD55BBB8F6F7FFEA57DE249E1CC9C70D11CAF008AAEDE04862468F7A717
SHA-512:	86764D1F6220346FEF0C83D9AE2B34907E8695763030F0A7F295E8CF511DC26451EF54244DF1300713C4FA72CC834CCE449608E1A69BCA6E368ABDDECA9F3956
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Property" GUID="{E7570F6E-5DDF-44F7-8CFD-FA87AC50457F}">.. <Properties>.. <Property Class="Text" GUID="{2ECC4B29-7BD6-4C88-BC6A-E48C71B594C4}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Property</Property>.. <Property Class="Type" GUID="{39ED69D7-E55F-48CD-A067-6D503584EDDE}" Name="Type" inheritaction="" calculatebefore="0

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Development\_Help\_ShowMeHow\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1913), with CRLF line terminators
Category:	dropped
Size (bytes):	4983
Entropy (8bit):	5.515763322874586
Encrypted:	false
SSDEEP:	96:kzGenqd2uI0MdOMombbdwl0MdOM0Zbd/u20MdOMQzbcwz0MdOMFGxfjfbd/uk4MP:gG0dO7RdODDdOtpdOUGNj3dO9q7/gIR
MD5:	E7CA2D591A87C8790B1F2179AAFE6B17
SHA1:	852D915C69885D5FDA5ACB79E925CF393EC121CB
SHA-256:	C5C3D4D62409FB41199F79E24A18306A69B1567A712D98CC6C7933FC112B1DE8
SHA-512:	0A657E461AE56DE2E58B2DDD4CE7E36F45B62D68BABA4350D93883F024E742859F7AE48E6E374379C6A45D87D355CD3BB51AFCA34A5BE45A995949523DEE9BBD
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_ShowMeHow" GUID="{96C461B8-CA2A-41C7-9DD1-E2D6FB3C2E04}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_ShowMeHow</Property>.. <Property Class="Number" GUID="{08A1E97D-3C21-47E6-BA91-8B6AADDC2277}" Name="OrderIndex" inheritaction="" calculatebefore="0" inherited="False" input="F

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Development\_Help\_ShowMeHow\is-J97VF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1913), with CRLF line terminators
Category:	dropped
Size (bytes):	4983
Entropy (8bit):	5.515763322874586
Encrypted:	false
SSDEEP:	96:kzGenqd2uI0MdOMombbdwl0MdOM0Zbd/u20MdOMQzbcwz0MdOMFGxfjfbd/uk4MP:gG0dO7RdODDdOtpdOUGNj3dO9q7/gIR
MD5:	E7CA2D591A87C8790B1F2179AAFE6B17
SHA1:	852D915C69885D5FDA5ACB79E925CF393EC121CB
SHA-256:	C5C3D4D62409FB41199F79E24A18306A69B1567A712D98CC6C7933FC112B1DE8
SHA-512:	0A657E461AE56DE2E58B2DDD4CE7E36F45B62D68BABA4350D93883F024E742859F7AE48E6E374379C6A45D87D355CD3BB51AFCA34A5BE45A995949523DEE9BBD
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_ShowMeHow" GUID="{96C461B8-CA2A-41C7-9DD1-E2D6FB3C2E04}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_ShowMeHow</Property>.. <Property Class="Number" GUID="{08A1E97D-3C21-47E6-BA91-8B6AADDC2277}" Name="OrderIndex" inheritaction="" calculatebefore="0" inherited="False" input="F

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Development\_Help\_Topic\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1885), with CRLF line terminators
Category:	dropped
Size (bytes):	5951
Entropy (8bit):	5.434899678132244
Encrypted:	false
SSDEEP:	96:k8Cqd2uI0MdOMOibd/ul0MdOM4/5fbd/u24MdOu0X1dIaD/dlOjTbdwz0MdOMBbE:adOZdOXNdOGaD/HdObdO/dOD
MD5:	3EF47E3FBCA18FD5208BB82E544904B0
SHA1:	3E5344ED98631A107EDF5D8817C33547C0B19696
SHA-256:	7E3A89DE90770FF273831D8B6E4D9694CA13DAA1CAA9CE074C45144791FB9231
SHA-512:	BDF84597C0640B41298E411FC6B554895C92D734FFF2CB257F15F26204EAC5C25608BD39924AC152CBDFECF9FA1149D0ED0A093870E546023F40DDCEFCFA16EF
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Topic" GUID="{101C6AD4-36C7-486E-B363-BAF5001C59C1}">.. <Properties>.. <Property Class="Text" GUID="{AEE54AA0-ABEB-44DC-BE6A-4C291A537304}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Topic</Property>.. <Property Class="Type" GUID="{3B270C92-7790-4BA2-A8A9-EA5689D3A448}" Name="Type" inheritaction="" calculatebefore="0" inhe

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Development\_Help\_Topic\is-K2NIH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1885), with CRLF line terminators
Category:	dropped
Size (bytes):	5951
Entropy (8bit):	5.434899678132244
Encrypted:	false
SSDEEP:	96:k8Cqd2uI0MdOMOibd/ul0MdOM4/5fbd/u24MdOu0X1dIaD/dlOjTbdwz0MdOMBbE:adOZdOXNdOGaD/HdObdO/dOD
MD5:	3EF47E3FBCA18FD5208BB82E544904B0
SHA1:	3E5344ED98631A107EDF5D8817C33547C0B19696
SHA-256:	7E3A89DE90770FF273831D8B6E4D9694CA13DAA1CAA9CE074C45144791FB9231
SHA-512:	BDF84597C0640B41298E411FC6B554895C92D734FFF2CB257F15F26204EAC5C25608BD39924AC152CBDFECF9FA1149D0ED0A093870E546023F40DDCEFCFA16EF
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Topic" GUID="{101C6AD4-36C7-486E-B363-BAF5001C59C1}">.. <Properties>.. <Property Class="Text" GUID="{AEE54AA0-ABEB-44DC-BE6A-4C291A537304}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Topic</Property>.. <Property Class="Type" GUID="{3B270C92-7790-4BA2-A8A9-EA5689D3A448}" Name="Type" inheritaction="" calculatebefore="0" inhe

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Development\_Help\is-M77J9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1885), with CRLF line terminators
Category:	dropped
Size (bytes):	6001
Entropy (8bit):	5.371701462628064
Encrypted:	false
SSDEEP:	96:k1YGqd2uI0MdOMk5bd/ul0MdOM4fbd/u24MdOu0X1dqJFzTdKgsgbdwz0MdOMHbh:WfdOUdOtNdOk0gsDdO9dOwdO3
MD5:	5BF7D6BFE757C72EB2121CE9DA903EAA
SHA1:	E78F1F11F70C3C437645EBE24CCC109E6838CD9C
SHA-256:	6C6C9E2A3C559668EBDE5BB3BC38C76541A180E741C39E9CBB5F19047F655B05
SHA-512:	644E9704F7211EA86560302892FDA6B4115FA5610A9AA9397B5904F3DDDA157E9233708B52BFCC75A35DAA7E77DA5FF27421E1F1D056948C954EFB2EB3F13390
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Help" GUID="{BE2E7970-B7F6-4633-8373-7730B1CDCDC8}">.. <Properties>.. <Property Class="Text" GUID="{21EA72A7-931F-448D-AD29-CD5787302AE3}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Help</Property>.. <Property Class="Type" GUID="{F9D976BB-0211-4979-8D69-BB5EE356F1B5}" Name="Type" inheritaction="" calculatebefore="0" inheri

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Development\_Script Library\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1457), with CRLF line terminators
Category:	dropped
Size (bytes):	5306
Entropy (8bit):	5.340811499486416
Encrypted:	false
SSDEEP:	96:kXeqd2uI0MdOMpbd/ul0MdOMeZfbd/u24MdOu0TR2U6uHFbd/uz4MdOuYbdwk0M+:fdOHdODZNdO9R2YHcdONdOyBdOF
MD5:	9CE627FA713AEFC9A786F9F86A3D9F72
SHA1:	DEE99E039FD8930BC2CAEFA7AEC3F123E58D4357
SHA-256:	46DE5AEBF8F79E01CBDD4E59C95154A88C892CBD75A0515C964099D0DE943F6E
SHA-512:	104DB5C3F74141D0E7C9F5896D85F6DD70962B8F9263721C58A91F85C48C5BA13CC3DB139139789F975502B5A5F11BD85305EDB96919D0EEFC03DEF9BF6304C3
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Script Library" GUID="{AED1B8D1-531F-4197-94E0-3CFA8FEC1AF1}">.. <Properties>.. <Property Class="Text" GUID="{92918C8F-F400-4289-BE91-80C5C2D906C8}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Script Library</Property>.. <Property Class="Type" GUID="{992AFA85-D072-41F4-87A9-F67EC4A6135C}" Name="Type" inheritaction="" calcul

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Development\_Script Library\is-0HGF1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1457), with CRLF line terminators
Category:	dropped
Size (bytes):	5306
Entropy (8bit):	5.340811499486416
Encrypted:	false
SSDEEP:	96:kXeqd2uI0MdOMpbd/ul0MdOMeZfbd/u24MdOu0TR2U6uHFbd/uz4MdOuYbdwk0M+:fdOHdODZNdO9R2YHcdONdOyBdOF
MD5:	9CE627FA713AEFC9A786F9F86A3D9F72
SHA1:	DEE99E039FD8930BC2CAEFA7AEC3F123E58D4357
SHA-256:	46DE5AEBF8F79E01CBDD4E59C95154A88C892CBD75A0515C964099D0DE943F6E
SHA-512:	104DB5C3F74141D0E7C9F5896D85F6DD70962B8F9263721C58A91F85C48C5BA13CC3DB139139789F975502B5A5F11BD85305EDB96919D0EEFC03DEF9BF6304C3
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Script Library" GUID="{AED1B8D1-531F-4197-94E0-3CFA8FEC1AF1}">.. <Properties>.. <Property Class="Text" GUID="{92918C8F-F400-4289-BE91-80C5C2D906C8}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Script Library</Property>.. <Property Class="Type" GUID="{992AFA85-D072-41F4-87A9-F67EC4A6135C}" Name="Type" inheritaction="" calcul

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Development\is-FCHSI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1827), with CRLF line terminators
Category:	dropped
Size (bytes):	6074
Entropy (8bit):	5.469081562731594
Encrypted:	false
SSDEEP:	96:kb/zqd2uUDMdOMRbd/ulDMdOMQfbd/uChMdOu0T+Ug8TPTfREKbdw7DMdOMJjIbs:UqdOidOhMdO9lTdOIqdOSGdOm
MD5:	4AA9304AB0065D13FDED7839B7B06D48
SHA1:	A3F1ACC98ED4DD17CD835E1BAD9CE36C136FCCFA
SHA-256:	56F251816D0F4C2783061C4CC981F30376ECA50206B2CE42107D62A5F8EEBCCB
SHA-512:	134EE75CD04C1676779B8CFF71E95A29224AA9E2FBE2CE4313FF63AAB0DF8BE5390247B6495E12A2C57C1D893EC54E89C32E7A6A4D97418DA437B9E1F2C3F662
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Development" GUID="{3CD9E917-2DAC-42E7-9BDD-227224F5B739}">.. <Properties>.. <Property Class="Text" GUID="{3A559676-C3E4-4AAC-B719-68A2C4FFDC19}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Development</Property>.. <Property Class="Type" GUID="{DCBB8CD9-5420-4C97-BF85-F47A1EFE04B8}" Nam

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Estimating Layout\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1010), with CRLF line terminators
Category:	dropped
Size (bytes):	2182
Entropy (8bit):	5.827285571199936
Encrypted:	false
SSDEEP:	48:cJL0A7NbLPtTb4humez4gXRJNWpeWfLQWYowMi:QL00lLlgPeE2RXWfUWFRi
MD5:	CCF05693C672EDD120D2AA2CA4584E37
SHA1:	DB84376E82441D0A929FFFBEEB3A5561C937A64C
SHA-256:	3A8087DB8E9427A527AC8F8C88F2DA48E25548C09BB9DD9AA83047D554E47822
SHA-512:	911B281CFBD13C8EBA1FC8ABC2DD30A81E8B244DB1BD45739A7DFB8A0A31F7C5687CCAD6F00302CFA43C815301FBDEBD38BBDF4D78104033F329795E106FD9E1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Estimating Layout" GUID="{35545E11-084B-4C1D-AC22-6CE2E13CB89D}">.. <Properties>.. <Property Class="Text" GUID="{30EAED6C-B7DF-4778-B20E-CB2833C70794}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Estimating Layout</Property>.. <Property Class="Type" GUID="{2F94AB4A-D17A-473C-A39C-8E2691F61983}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2"/>.. <Property Class="Image" GUID="{5D3D0683-08EB-499C-8408-98AFD0E8DCD2}" Name="Icon" inheritaction="Inherit Result" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList" Transparent="False" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAAAlwSFlzAAALDAAACwwBP0AiyAAAAZpJREFUOE+l010oQ2EYB/CzC3Lj80JpuWFumAtqWrKlXCofaT4ibka+1liEdqHcEFptNixS

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Estimating Layout\is-5DBFR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1010), with CRLF line terminators
Category:	dropped
Size (bytes):	2182
Entropy (8bit):	5.827285571199936
Encrypted:	false
SSDEEP:	48:cJL0A7NbLPtTb4humez4gXRJNWpeWfLQWYowMi:QL00lLlgPeE2RXWfUWFRi
MD5:	CCF05693C672EDD120D2AA2CA4584E37
SHA1:	DB84376E82441D0A929FFFBEEB3A5561C937A64C
SHA-256:	3A8087DB8E9427A527AC8F8C88F2DA48E25548C09BB9DD9AA83047D554E47822
SHA-512:	911B281CFBD13C8EBA1FC8ABC2DD30A81E8B244DB1BD45739A7DFB8A0A31F7C5687CCAD6F00302CFA43C815301FBDEBD38BBDF4D78104033F329795E106FD9E1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Estimating Layout" GUID="{35545E11-084B-4C1D-AC22-6CE2E13CB89D}">.. <Properties>.. <Property Class="Text" GUID="{30EAED6C-B7DF-4778-B20E-CB2833C70794}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Estimating Layout</Property>.. <Property Class="Type" GUID="{2F94AB4A-D17A-473C-A39C-8E2691F61983}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2"/>.. <Property Class="Image" GUID="{5D3D0683-08EB-499C-8408-98AFD0E8DCD2}" Name="Icon" inheritaction="Inherit Result" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList" Transparent="False" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAAAlwSFlzAAALDAAACwwBP0AiyAAAAZpJREFUOE+l010oQ2EYB/CzC3Lj80JpuWFumAtqWrKlXCofaT4ibka+1liEdqHcEFptNixS

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Folder\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1298), with CRLF line terminators
Category:	dropped
Size (bytes):	2952
Entropy (8bit):	5.540911033348138
Encrypted:	false
SSDEEP:	48:c1AbItTU51dJQi6uPPPPPPtQmsYCRwYtAwMpBmn8CyM5YUMsCai:aAbqg51d6i6MsYjaAR6D5wai
MD5:	289ED9F5C4A2E6F2223724953B27DCAB
SHA1:	2E03578CA999798D2AFD10512D6732ED8E796724
SHA-256:	262EAAC8C723CC88CE450160A1DB7F320284009AC6B95C67F30FB90DD661310C
SHA-512:	B989560BE999E4302484C7D1AD6B53B89CA16894641A9BE08E542719540DCAD4E448B7FBEA37D56E487906FFEAB06B00272F4125BD024EB26BEBBD083A223E17
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="_Folder" GUID="{5F0DCB51-1F46-4E21-8BD6-F12692D603B7}">.. <Properties>.. <Property Class="Text" GUID="{14CF212F-96D5-4C59-8147-53A46E29A318}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="">{5F0DCB51-1F46-4E21-8BD6-F12692D603B7}</Property>.. <Property Class="Image" GUID="{350ECE71-00A7-4B97-A3D7-87412BF88B4A}" Name="Icon" inheritaction="Inherit Result" OrderIndex="1" DecimalPlaces="" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAAATCwAAEwsAAAAAAAAAAAAA/wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD/f39/ampqampqampqampqampqampqampqampqampqampqampqf39//wD//wD/HYK1G4GzGH6wFnyuE3mrEHaoDXOlC3GjCG6gBmyeBGqcAmiaAWeZSkpKf39/Ioe6Z8z/IIW4mf//b9T/b9T/b9T/b9T/b9T/b9T/b9T/b9T/O6DTmf//AWeZa2trJYq9Z8z/J4y/mf//e+D/e+D/e+D/e+D/e+D/e+

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Folder\is-JCJF3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1298), with CRLF line terminators
Category:	dropped
Size (bytes):	2952
Entropy (8bit):	5.540911033348138
Encrypted:	false
SSDEEP:	48:c1AbItTU51dJQi6uPPPPPPtQmsYCRwYtAwMpBmn8CyM5YUMsCai:aAbqg51d6i6MsYjaAR6D5wai
MD5:	289ED9F5C4A2E6F2223724953B27DCAB
SHA1:	2E03578CA999798D2AFD10512D6732ED8E796724
SHA-256:	262EAAC8C723CC88CE450160A1DB7F320284009AC6B95C67F30FB90DD661310C
SHA-512:	B989560BE999E4302484C7D1AD6B53B89CA16894641A9BE08E542719540DCAD4E448B7FBEA37D56E487906FFEAB06B00272F4125BD024EB26BEBBD083A223E17
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="_Folder" GUID="{5F0DCB51-1F46-4E21-8BD6-F12692D603B7}">.. <Properties>.. <Property Class="Text" GUID="{14CF212F-96D5-4C59-8147-53A46E29A318}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="">{5F0DCB51-1F46-4E21-8BD6-F12692D603B7}</Property>.. <Property Class="Image" GUID="{350ECE71-00A7-4B97-A3D7-87412BF88B4A}" Name="Icon" inheritaction="Inherit Result" OrderIndex="1" DecimalPlaces="" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAAATCwAAEwsAAAAAAAAAAAAA/wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD/f39/ampqampqampqampqampqampqampqampqampqampqampqf39//wD//wD/HYK1G4GzGH6wFnyuE3mrEHaoDXOlC3GjCG6gBmyeBGqcAmiaAWeZSkpKf39/Ioe6Z8z/IIW4mf//b9T/b9T/b9T/b9T/b9T/b9T/b9T/b9T/O6DTmf//AWeZa2trJYq9Z8z/J4y/mf//e+D/e+D/e+D/e+D/e+D/e+

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Hatch Pattern\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (4608), with CRLF line terminators
Category:	dropped
Size (bytes):	7890
Entropy (8bit):	5.852938408169932
Encrypted:	false
SSDEEP:	192:HKdO8dOvHdOxC9pjcaOvQiD3D7489QadObPdO0:qdO8dOvdOxuRcxvQibn1TdODdO0
MD5:	205255806E9CD4B10B71568EE9026A5C
SHA1:	C4B4EE46F5B85A7BA5D2C18B3B057318D3CCCAD7
SHA-256:	2695A206FCB5BA0490BE331B600D14AA973DDF8FB1DC00A8A0B58DC1242C3A75
SHA-512:	917EFC1BA69CB26B4217DD68DFBEDDD14C4BDF76937FD0EAA3D9D3366F9ADD8FCFE351C29B6FFA527E523A8D2D7817BA5BB2C0480187187268F8FC55ED3CF5C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Hatch Pattern" GUID="{442A4A2A-86D9-40AB-9722-17CE2403C0CE}">.. <Properties>.. <Property Class="Text" GUID="{06D99D55-C2D5-40DD-9B7F-A35522012F18}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Hatch Pattern</Property>.. <Property Class="Type" GUID="{1250F174-E227-4BE4-BD00-153A7BCED39B}"

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Hatch Pattern\is-LG7JJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (4608), with CRLF line terminators
Category:	dropped
Size (bytes):	7890
Entropy (8bit):	5.852938408169932
Encrypted:	false
SSDEEP:	192:HKdO8dOvHdOxC9pjcaOvQiD3D7489QadObPdO0:qdO8dOvdOxuRcxvQibn1TdODdO0
MD5:	205255806E9CD4B10B71568EE9026A5C
SHA1:	C4B4EE46F5B85A7BA5D2C18B3B057318D3CCCAD7
SHA-256:	2695A206FCB5BA0490BE331B600D14AA973DDF8FB1DC00A8A0B58DC1242C3A75
SHA-512:	917EFC1BA69CB26B4217DD68DFBEDDD14C4BDF76937FD0EAA3D9D3366F9ADD8FCFE351C29B6FFA527E523A8D2D7817BA5BB2C0480187187268F8FC55ED3CF5C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Hatch Pattern" GUID="{442A4A2A-86D9-40AB-9722-17CE2403C0CE}">.. <Properties>.. <Property Class="Text" GUID="{06D99D55-C2D5-40DD-9B7F-A35522012F18}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Hatch Pattern</Property>.. <Property Class="Type" GUID="{1250F174-E227-4BE4-BD00-153A7BCED39B}"

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1867), with CRLF line terminators
Category:	dropped
Size (bytes):	4989
Entropy (8bit):	5.264635064266197
Encrypted:	false
SSDEEP:	96:kk1ByQqd2uI0MdOMebd2ul0MdOM1bcw20MdOMRwfbddz0MdOM0X1dPDesybdwk0t:TyWdOhdOldOLzdOfDodOP
MD5:	945E8122B55613177A5B9A300CA4328C
SHA1:	AF4E5344FB8539E23BF3B9BB74627E53D1CC8D15
SHA-256:	84D199E2E01B0E0F0DEE8FE1108587AC7AF34237F521A3137DFCD5EC124E6526
SHA-512:	E209A4EBC298B51561F009A1072DF93027EA6E5F3FAE68798438BB81CE4F0F978946C1E26373FD2FF4A187552E3506AB6A1D24488B0D6304AE01FD018FB9E300
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Image File" GUID="{07F11ECD-1839-4F8B-A7F0-446F2D2B3A04}">.. <Properties>.. <Property Class="Text" GUID="{501DD7A3-93DA-4A66-B6EE-39C14E14C4EC}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Image File</Property>.. <Property Class="Type" GUID="{780C92F3-D68A-48F1-8B19-85F17FF6F689}" Name="Type" inheritaction="" calculatebefor

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_BMP\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3114
Entropy (8bit):	5.104545803814427
Encrypted:	false
SSDEEP:	96:kt1Mqd2uI0MdOM+Gbd/ul0MdOMEObnbdw20MdOM0/bcwk0MdOMN:kydObjdOyLdOodOw
MD5:	3EECE30555F5621911041809A593C04A
SHA1:	E4D546F4757600F93A69F34E2EC797A533211E56
SHA-256:	0ABB8CE7C8D4EA396E269C65A279B10FE3FF95F024D1BB0CC60FB258BA550216
SHA-512:	43C7710C75491445EE6E3E76609B88AAD9EBA2AED9A5ABA694E429CE565175CC5F186BAE6CD42BDF128F51BDBE7146F8F75C16634DF569A80943CD6116DE158E
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_BMP" GUID="{3ABBA6BF-9A8D-4F13-A79C-359A283666BE}">.. <Properties>.. <Property Class="Text" GUID="{06DD57C2-CA14-4D61-B395-143F7E855C9A}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_BMP</Property>.. <Property Class="Type" GUID="{9EBC1A84-9024-457D-9970-C210447550A8}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_BMP\is-LN60C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3114
Entropy (8bit):	5.104545803814427
Encrypted:	false
SSDEEP:	96:kt1Mqd2uI0MdOM+Gbd/ul0MdOMEObnbdw20MdOM0/bcwk0MdOMN:kydObjdOyLdOodOw
MD5:	3EECE30555F5621911041809A593C04A
SHA1:	E4D546F4757600F93A69F34E2EC797A533211E56
SHA-256:	0ABB8CE7C8D4EA396E269C65A279B10FE3FF95F024D1BB0CC60FB258BA550216
SHA-512:	43C7710C75491445EE6E3E76609B88AAD9EBA2AED9A5ABA694E429CE565175CC5F186BAE6CD42BDF128F51BDBE7146F8F75C16634DF569A80943CD6116DE158E
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_BMP" GUID="{3ABBA6BF-9A8D-4F13-A79C-359A283666BE}">.. <Properties>.. <Property Class="Text" GUID="{06DD57C2-CA14-4D61-B395-143F7E855C9A}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_BMP</Property>.. <Property Class="Type" GUID="{9EBC1A84-9024-457D-9970-C210447550A8}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_CAD\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3114
Entropy (8bit):	5.097944940739092
Encrypted:	false
SSDEEP:	96:kSRVlqd2uI0MdOMbbd/ul0MdOMJbdw20MdOM7bcwk0MdOMzJ:f5dOLdOSdOBdOo
MD5:	69294F03652759E2C72F5668FCF19C03
SHA1:	71408347AF2F52A535BA5BB49E1C6372524420DB
SHA-256:	6DB14CF20A51E1FDB4D10164FE3EC3E3CB84E616F25729602A461D3CA087AFBD
SHA-512:	5DCAD38F178ED59F8FDAECE34F5A92AC88F658601EFF6A7225DD61094249660A62DEDB081F3D9D6FDD9940B812BF0E1F2C80CD5FF63744C2637704D234C43623
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_CAD" GUID="{CBF6656B-FAC0-4245-8777-2A35A9D83623}">.. <Properties>.. <Property Class="Text" GUID="{A5496618-52C1-4162-B985-CBE5281581AE}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_CAD</Property>.. <Property Class="Type" GUID="{D1C5301D-58EA-430E-9F56-1F5CFD77E4D4}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_CAD\_DWF\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	5.100970938818192
Encrypted:	false
SSDEEP:	96:kjwnqd2uI0MdOMQbd/ul0MdOMwpbdw20MdOMOzbcwk0MdOMB7:NdO4dO1NdOjidOc
MD5:	06284E3FC386AB5B21593D1741A61A3E
SHA1:	21D601A32BD56886E1D9AE2425FB2D61E458E5C9
SHA-256:	FD1AF4273A7C37960A95753118DBEFD1A144F19E3B28A7F53018DA8A4601BBB1
SHA-512:	51F5A732EC12FEFA976760304B3B53D886FE119565383BAF52CF58C5D2143281CA788BD4F99E8F1D1AEC193719D218DC0C1B0B1AEFE20390A0DBAAE73EA45A7A
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_DWF" GUID="{57268B2E-CDFF-4F86-AB3F-5770CEE9D918}">.. <Properties>.. <Property Class="Text" GUID="{28DF136E-590E-4699-B323-CD4ABBC537E6}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_DWF</Property>.. <Property Class="Type" GUID="{E4A5B345-FD79-4D85-BC0E-217A322B0B0F}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_CAD\_DWF\is-91GN1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	5.100970938818192
Encrypted:	false
SSDEEP:	96:kjwnqd2uI0MdOMQbd/ul0MdOMwpbdw20MdOMOzbcwk0MdOMB7:NdO4dO1NdOjidOc
MD5:	06284E3FC386AB5B21593D1741A61A3E
SHA1:	21D601A32BD56886E1D9AE2425FB2D61E458E5C9
SHA-256:	FD1AF4273A7C37960A95753118DBEFD1A144F19E3B28A7F53018DA8A4601BBB1
SHA-512:	51F5A732EC12FEFA976760304B3B53D886FE119565383BAF52CF58C5D2143281CA788BD4F99E8F1D1AEC193719D218DC0C1B0B1AEFE20390A0DBAAE73EA45A7A
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_DWF" GUID="{57268B2E-CDFF-4F86-AB3F-5770CEE9D918}">.. <Properties>.. <Property Class="Text" GUID="{28DF136E-590E-4699-B323-CD4ABBC537E6}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_DWF</Property>.. <Property Class="Type" GUID="{E4A5B345-FD79-4D85-BC0E-217A322B0B0F}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_CAD\_DWG\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	5.093735666628429
Encrypted:	false
SSDEEP:	96:kRKlqd2uI0MdOMqbd/ul0MdOMOTjbdw20MdOMnbcwk0MdOM/:MudO2dO7TXdOBdOG
MD5:	3ACF29D75ECCB18E851C4A090E2A28BE
SHA1:	1E8EFC07921F36EFA00A255F1CCD43D7A7AF6E4B
SHA-256:	28D4B241D2F2B55AB8E152F27CEE88EAA5A443376A6A267BF26C9938AB07F2CA
SHA-512:	B5C77EE405C0881205DE47C5B8D8C3EB39FDE9B183E1EE1E4F0F126E965CDBFA13D658793E21DCD3024942E4C3F415804CF6C722C01150DA96B93649B40DCA9C
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_DWG" GUID="{01FD8F34-38CB-44A0-8F3A-F99F8D452500}">.. <Properties>.. <Property Class="Text" GUID="{820C8138-C63E-4DD7-A68D-30819ADA1297}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_DWG</Property>.. <Property Class="Type" GUID="{10600C3A-62CF-4110-A749-242BD093E48D}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_CAD\_DWG\is-77CJJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	5.093735666628429
Encrypted:	false
SSDEEP:	96:kRKlqd2uI0MdOMqbd/ul0MdOMOTjbdw20MdOMnbcwk0MdOM/:MudO2dO7TXdOBdOG
MD5:	3ACF29D75ECCB18E851C4A090E2A28BE
SHA1:	1E8EFC07921F36EFA00A255F1CCD43D7A7AF6E4B
SHA-256:	28D4B241D2F2B55AB8E152F27CEE88EAA5A443376A6A267BF26C9938AB07F2CA
SHA-512:	B5C77EE405C0881205DE47C5B8D8C3EB39FDE9B183E1EE1E4F0F126E965CDBFA13D658793E21DCD3024942E4C3F415804CF6C722C01150DA96B93649B40DCA9C
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_DWG" GUID="{01FD8F34-38CB-44A0-8F3A-F99F8D452500}">.. <Properties>.. <Property Class="Text" GUID="{820C8138-C63E-4DD7-A68D-30819ADA1297}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_DWG</Property>.. <Property Class="Type" GUID="{10600C3A-62CF-4110-A749-242BD093E48D}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_CAD\_DXF\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	5.100769385036818
Encrypted:	false
SSDEEP:	96:knUBqd2uI0MdOMh+bd/ul0MdOM0Wbdw20MdOMkYbcwk0MdOMOE:JdO8dOjYdORNdOK
MD5:	4D96E2831E41E747BCC19ABC8C808BCA
SHA1:	6BBD40601FCA5C6FC9601B5D841452F49663CD98
SHA-256:	85AAC42271382E69037E5821C86C92FB2C2B177B1917CA15F8D8B4A7C4616906
SHA-512:	FCB0C330DA5EC50D9F9F91B9915D031387BB7171E8A62082C7F2A828FCBECFC8153631ABDE0ED2FC9119D9A86798632ADFC75BE5AEDDE288055C1B3146C24C0B
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_DXF" GUID="{878F27B7-396D-4C34-BD9F-94420AECA141}">.. <Properties>.. <Property Class="Text" GUID="{205E745B-043D-4612-B6BD-8A6B09A1234C}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_DXF</Property>.. <Property Class="Type" GUID="{13F575D0-4DA3-407D-9CFA-277AB3D4EB18}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_CAD\_DXF\is-8KGCL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	5.100769385036818
Encrypted:	false
SSDEEP:	96:knUBqd2uI0MdOMh+bd/ul0MdOM0Wbdw20MdOMkYbcwk0MdOMOE:JdO8dOjYdORNdOK
MD5:	4D96E2831E41E747BCC19ABC8C808BCA
SHA1:	6BBD40601FCA5C6FC9601B5D841452F49663CD98
SHA-256:	85AAC42271382E69037E5821C86C92FB2C2B177B1917CA15F8D8B4A7C4616906
SHA-512:	FCB0C330DA5EC50D9F9F91B9915D031387BB7171E8A62082C7F2A828FCBECFC8153631ABDE0ED2FC9119D9A86798632ADFC75BE5AEDDE288055C1B3146C24C0B
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_DXF" GUID="{878F27B7-396D-4C34-BD9F-94420AECA141}">.. <Properties>.. <Property Class="Text" GUID="{205E745B-043D-4612-B6BD-8A6B09A1234C}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_DXF</Property>.. <Property Class="Type" GUID="{13F575D0-4DA3-407D-9CFA-277AB3D4EB18}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_CAD\is-KJ08P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3114
Entropy (8bit):	5.097944940739092
Encrypted:	false
SSDEEP:	96:kSRVlqd2uI0MdOMbbd/ul0MdOMJbdw20MdOM7bcwk0MdOMzJ:f5dOLdOSdOBdOo
MD5:	69294F03652759E2C72F5668FCF19C03
SHA1:	71408347AF2F52A535BA5BB49E1C6372524420DB
SHA-256:	6DB14CF20A51E1FDB4D10164FE3EC3E3CB84E616F25729602A461D3CA087AFBD
SHA-512:	5DCAD38F178ED59F8FDAECE34F5A92AC88F658601EFF6A7225DD61094249660A62DEDB081F3D9D6FDD9940B812BF0E1F2C80CD5FF63744C2637704D234C43623
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_CAD" GUID="{CBF6656B-FAC0-4245-8777-2A35A9D83623}">.. <Properties>.. <Property Class="Text" GUID="{A5496618-52C1-4162-B985-CBE5281581AE}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_CAD</Property>.. <Property Class="Type" GUID="{D1C5301D-58EA-430E-9F56-1F5CFD77E4D4}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_EMF\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3114
Entropy (8bit):	5.094775070544828
Encrypted:	false
SSDEEP:	96:kL8qd2uI0MdOMhbd/ul0MdOMM+bdw20MdOMGbcwk0MdOM8:zdOZdONwdOodOd
MD5:	A7820738A1F4282EBE318206BF05A0AB
SHA1:	C6A0F7ADC7C2629FCCFE8CD1CFB1BBE1267F47FA
SHA-256:	7D8658BB8759534732CAB71EE013C62E06A47A4C00D3BC05118441D0A6EAA13A
SHA-512:	C088FCFFD0E4E0E8095672DDBADAB70B1F4A04514664E07D3C36A9FF0374B87147CD8313B251748886BF3841ACBE28189630F73E4F7E39709D10847C24827E78
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_EMF" GUID="{8962FC74-8694-4B49-A21C-F0F92FB2F71A}">.. <Properties>.. <Property Class="Text" GUID="{E7130BDA-EA5A-4C63-A6A1-B5ACA2264DEB}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_EMF</Property>.. <Property Class="Type" GUID="{2E1C53DC-3DA9-4FEF-A474-5615523BFE80}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_EMF\is-AN4T9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3114
Entropy (8bit):	5.094775070544828
Encrypted:	false
SSDEEP:	96:kL8qd2uI0MdOMhbd/ul0MdOMM+bdw20MdOMGbcwk0MdOM8:zdOZdONwdOodOd
MD5:	A7820738A1F4282EBE318206BF05A0AB
SHA1:	C6A0F7ADC7C2629FCCFE8CD1CFB1BBE1267F47FA
SHA-256:	7D8658BB8759534732CAB71EE013C62E06A47A4C00D3BC05118441D0A6EAA13A
SHA-512:	C088FCFFD0E4E0E8095672DDBADAB70B1F4A04514664E07D3C36A9FF0374B87147CD8313B251748886BF3841ACBE28189630F73E4F7E39709D10847C24827E78
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_EMF" GUID="{8962FC74-8694-4B49-A21C-F0F92FB2F71A}">.. <Properties>.. <Property Class="Text" GUID="{E7130BDA-EA5A-4C63-A6A1-B5ACA2264DEB}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_EMF</Property>.. <Property Class="Type" GUID="{2E1C53DC-3DA9-4FEF-A474-5615523BFE80}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_JPG\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3114
Entropy (8bit):	5.0959509095595426
Encrypted:	false
SSDEEP:	96:kblqd2uI0MdOM8bd/ul0MdOMXtKbdw20MdOMHbcwk0MdOMJx:SdOMdO0tcdO5dOS
MD5:	ED0B2084F239F6DDCD80D65EFFF93E23
SHA1:	0E40849BE9F566FD988E411C87597316B2D6B04A
SHA-256:	67D0D08CBE2B9A9680D1CB68A75B7D171D75FCE648F3815EC9BAB600D2F78369
SHA-512:	E1A9F3BFD334B43780E2A1339169102697BF78EED392CAA36AC8B10E94EA3CA3BF91FEE4B6C4D81E74D827624B5DA172C7E474149CEC6D5DB5BF11FE96239284
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_JPG" GUID="{A306F0BC-D28E-4DB3-A1A8-6C1D6DA499EC}">.. <Properties>.. <Property Class="Text" GUID="{F42811F6-037D-4668-ABD1-8E2CB3076C0E}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_JPG</Property>.. <Property Class="Type" GUID="{12071643-B6FC-4E20-BFB9-633FACC155D9}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_JPG\is-54RGK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3114
Entropy (8bit):	5.0959509095595426
Encrypted:	false
SSDEEP:	96:kblqd2uI0MdOM8bd/ul0MdOMXtKbdw20MdOMHbcwk0MdOMJx:SdOMdO0tcdO5dOS
MD5:	ED0B2084F239F6DDCD80D65EFFF93E23
SHA1:	0E40849BE9F566FD988E411C87597316B2D6B04A
SHA-256:	67D0D08CBE2B9A9680D1CB68A75B7D171D75FCE648F3815EC9BAB600D2F78369
SHA-512:	E1A9F3BFD334B43780E2A1339169102697BF78EED392CAA36AC8B10E94EA3CA3BF91FEE4B6C4D81E74D827624B5DA172C7E474149CEC6D5DB5BF11FE96239284
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_JPG" GUID="{A306F0BC-D28E-4DB3-A1A8-6C1D6DA499EC}">.. <Properties>.. <Property Class="Text" GUID="{F42811F6-037D-4668-ABD1-8E2CB3076C0E}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_JPG</Property>.. <Property Class="Type" GUID="{12071643-B6FC-4E20-BFB9-633FACC155D9}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_OSE\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3114
Entropy (8bit):	5.098760726354233
Encrypted:	false
SSDEEP:	96:kOKqd2uI0MdOM9W8wbd/ul0MdOMXebdw20MdOM9hMbcwk0MdOMm:MdOGW8JdO0QdO4hhdOr
MD5:	4A0D36CB7B754E32701D4CBE9B33E924
SHA1:	435FB28A731C719AE44B198215116E7E00AD431F
SHA-256:	2AC87D29EC20E2CA666812872C6E36413F28BAF5D6DAD7BE0666FB9939C61F38
SHA-512:	FBDCE101C1A5353BE625D7F60613DD489A40C37F1944329FA8949B100A8D55EAF78188C1C4016954A99F588B09D7FA61CEE2518AFA6469BC9A6B513477C6BCD7
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_OSE" GUID="{4030A38F-97D7-4251-901E-5E79E3BAA1C9}">.. <Properties>.. <Property Class="Text" GUID="{18C8F925-47AE-4E5D-B9C9-763689AD1334}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_OSE</Property>.. <Property Class="Type" GUID="{0B968E6F-44F2-4843-A9C9-2AE718B1238E}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_OSE\is-DK4II.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3114
Entropy (8bit):	5.098760726354233
Encrypted:	false
SSDEEP:	96:kOKqd2uI0MdOM9W8wbd/ul0MdOMXebdw20MdOM9hMbcwk0MdOMm:MdOGW8JdO0QdO4hhdOr
MD5:	4A0D36CB7B754E32701D4CBE9B33E924
SHA1:	435FB28A731C719AE44B198215116E7E00AD431F
SHA-256:	2AC87D29EC20E2CA666812872C6E36413F28BAF5D6DAD7BE0666FB9939C61F38
SHA-512:	FBDCE101C1A5353BE625D7F60613DD489A40C37F1944329FA8949B100A8D55EAF78188C1C4016954A99F588B09D7FA61CEE2518AFA6469BC9A6B513477C6BCD7
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_OSE" GUID="{4030A38F-97D7-4251-901E-5E79E3BAA1C9}">.. <Properties>.. <Property Class="Text" GUID="{18C8F925-47AE-4E5D-B9C9-763689AD1334}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_OSE</Property>.. <Property Class="Type" GUID="{0B968E6F-44F2-4843-A9C9-2AE718B1238E}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_PDF\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3114
Entropy (8bit):	5.097179590363271
Encrypted:	false
SSDEEP:	96:k4vqd2uI0MdOMxbd/ul0MdOMMbdw20MdOMyYbcwk0MdOMwI:vdOtdOpdO5dOq
MD5:	D60FB77979DAF5A0746C81F728D6800F
SHA1:	229A2CBBCD90020E68A77183662F9EB3D4CE2DE8
SHA-256:	2D55377F80E1E137B7C194FC07C804C1336CAFB10774A644DA90CCF6BA59F6DA
SHA-512:	BCA17D60A5E02EE71E84FF0F42CA535506B027076094D1E07C3A6044DC2B1EA9D0B68D8DA5CF054629DACE84C4984C57C82721A43608D520C8448E26A350AA6E
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_PDF" GUID="{321B2B5E-A315-4165-9680-C7FC500998B4}">.. <Properties>.. <Property Class="Text" GUID="{5ABDFE29-3CF0-4D74-BCCC-CECD42C737E0}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_PDF</Property>.. <Property Class="Type" GUID="{846DE942-22E4-4D55-B4A7-DC6309657FA3}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_PDF\is-QVI2G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3114
Entropy (8bit):	5.097179590363271
Encrypted:	false
SSDEEP:	96:k4vqd2uI0MdOMxbd/ul0MdOMMbdw20MdOMyYbcwk0MdOMwI:vdOtdOpdO5dOq
MD5:	D60FB77979DAF5A0746C81F728D6800F
SHA1:	229A2CBBCD90020E68A77183662F9EB3D4CE2DE8
SHA-256:	2D55377F80E1E137B7C194FC07C804C1336CAFB10774A644DA90CCF6BA59F6DA
SHA-512:	BCA17D60A5E02EE71E84FF0F42CA535506B027076094D1E07C3A6044DC2B1EA9D0B68D8DA5CF054629DACE84C4984C57C82721A43608D520C8448E26A350AA6E
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_PDF" GUID="{321B2B5E-A315-4165-9680-C7FC500998B4}">.. <Properties>.. <Property Class="Text" GUID="{5ABDFE29-3CF0-4D74-BCCC-CECD42C737E0}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_PDF</Property>.. <Property Class="Type" GUID="{846DE942-22E4-4D55-B4A7-DC6309657FA3}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_PLN\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3114
Entropy (8bit):	5.093391629630755
Encrypted:	false
SSDEEP:	96:kIO2qd2uI0MdOM/hbd/ul0MdOMTbdw20MdOMVobcwk0MdOM8G:godOC8dOQdOMdOLG
MD5:	B8BA7F40304D27165E08E4BA33B8BD1A
SHA1:	41AB2F933C76F1428CAA9545FF4F3EB5CCE88E79
SHA-256:	80846C172CE7E0A673DE050C0B508831D77E45DE86E11F9F3BB8D84AE176F2CF
SHA-512:	7E10EC181B0DFD696815F33DD6B9C1CEAF8CC94CC8A7F5A19DF2383E44767377A50FEA28383F6D3435673397400434CA4F622B553DBA5D8F5D9C44A92EE02E5D
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_PLN" GUID="{BB86FB81-2712-42D0-8D81-83DF3E7F82D5}">.. <Properties>.. <Property Class="Text" GUID="{BABC70B8-1937-4791-B881-8982602E2F4E}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_PLN</Property>.. <Property Class="Type" GUID="{458506DA-50C8-49BC-A09E-080EC774AF8A}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_PLN\is-N1UHC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3114
Entropy (8bit):	5.093391629630755
Encrypted:	false
SSDEEP:	96:kIO2qd2uI0MdOM/hbd/ul0MdOMTbdw20MdOMVobcwk0MdOM8G:godOC8dOQdOMdOLG
MD5:	B8BA7F40304D27165E08E4BA33B8BD1A
SHA1:	41AB2F933C76F1428CAA9545FF4F3EB5CCE88E79
SHA-256:	80846C172CE7E0A673DE050C0B508831D77E45DE86E11F9F3BB8D84AE176F2CF
SHA-512:	7E10EC181B0DFD696815F33DD6B9C1CEAF8CC94CC8A7F5A19DF2383E44767377A50FEA28383F6D3435673397400434CA4F622B553DBA5D8F5D9C44A92EE02E5D
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_PLN" GUID="{BB86FB81-2712-42D0-8D81-83DF3E7F82D5}">.. <Properties>.. <Property Class="Text" GUID="{BABC70B8-1937-4791-B881-8982602E2F4E}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_PLN</Property>.. <Property Class="Type" GUID="{458506DA-50C8-49BC-A09E-080EC774AF8A}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_PLT\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3114
Entropy (8bit):	5.097986186596333
Encrypted:	false
SSDEEP:	96:k2/qd2uI0MdOMopbd/ul0MdOMXwbdw20MdOMVxbcwk0MdOM7:ldOadO0ydOcUdOm
MD5:	0956C99A486742CE4270A87FF57462E4
SHA1:	2599515F6457C975327C88E38905123828FD10D6
SHA-256:	98490871CBCDC36D95316DEDD1C0111614978C2BAF38F9F3393B298B5582D1CF
SHA-512:	2DE246CB04B39BD9907A7345C1744C774422C8B56D650C1DCFE57AD87B55D7E81460A38639F0C9E5E59BBCDAB25E9E82FD30E11C9D5D42B79AA945301D878762
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_PLT" GUID="{AFCB0859-0961-474D-9F80-E50297453F76}">.. <Properties>.. <Property Class="Text" GUID="{A46E722C-1E72-4824-A4BC-8B26D489FFA1}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_PLT</Property>.. <Property Class="Type" GUID="{EC74D546-203C-46C3-A851-1293D03A5648}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_PLT\is-U3HO3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3114
Entropy (8bit):	5.097986186596333
Encrypted:	false
SSDEEP:	96:k2/qd2uI0MdOMopbd/ul0MdOMXwbdw20MdOMVxbcwk0MdOM7:ldOadO0ydOcUdOm
MD5:	0956C99A486742CE4270A87FF57462E4
SHA1:	2599515F6457C975327C88E38905123828FD10D6
SHA-256:	98490871CBCDC36D95316DEDD1C0111614978C2BAF38F9F3393B298B5582D1CF
SHA-512:	2DE246CB04B39BD9907A7345C1744C774422C8B56D650C1DCFE57AD87B55D7E81460A38639F0C9E5E59BBCDAB25E9E82FD30E11C9D5D42B79AA945301D878762
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_PLT" GUID="{AFCB0859-0961-474D-9F80-E50297453F76}">.. <Properties>.. <Property Class="Text" GUID="{A46E722C-1E72-4824-A4BC-8B26D489FFA1}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_PLT</Property>.. <Property Class="Type" GUID="{EC74D546-203C-46C3-A851-1293D03A5648}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_PNG\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	817
Entropy (8bit):	5.340689038926212
Encrypted:	false
SSDEEP:	24:2dFDj5opX2Rf2WAdOcG5oA+j8gAWINRvApW0qxH1Ocov:c4YI9t
MD5:	ED257CF65EE799F5FB3B148FB4AA7EDE
SHA1:	7A1ED2BC5625C8B0351A41CABC69CA52D521F7F9
SHA-256:	6BD2A8ACE08D880F7FCDB955824F0B378DED87BB680002B45644E4336136B0C6
SHA-512:	7CEC10082AAAA088B25ADB0EFF0EDFBFBC98879C08D446A58DFAADF7EB9DAB296A5D73A57520D05D902D7EEBCC46A6494DBF4FD22EC36AA782DF8B8D21B005BE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_PNG" GUID="{21A4CDC7-48A9-42C0-88C7-5D4A91340E97}">.. <Properties>.. <Property Class="Text" GUID="" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{21A4CDC7-48A9-42C0-88C7-5D4A91340E97}</Property>.. <Property Class="Type" GUID="{5F86110B-3C0F-4C61-BD89-16E3D1C18C64}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Image File</Property>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="2" DecimalPlaces="2">_PNG</Property>.. <Property Class="Number" GUID="{CF585700-63E6-43D0-80D6-56057B26064E}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">3</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_PNG\is-RS26V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	817
Entropy (8bit):	5.340689038926212
Encrypted:	false
SSDEEP:	24:2dFDj5opX2Rf2WAdOcG5oA+j8gAWINRvApW0qxH1Ocov:c4YI9t
MD5:	ED257CF65EE799F5FB3B148FB4AA7EDE
SHA1:	7A1ED2BC5625C8B0351A41CABC69CA52D521F7F9
SHA-256:	6BD2A8ACE08D880F7FCDB955824F0B378DED87BB680002B45644E4336136B0C6
SHA-512:	7CEC10082AAAA088B25ADB0EFF0EDFBFBC98879C08D446A58DFAADF7EB9DAB296A5D73A57520D05D902D7EEBCC46A6494DBF4FD22EC36AA782DF8B8D21B005BE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_PNG" GUID="{21A4CDC7-48A9-42C0-88C7-5D4A91340E97}">.. <Properties>.. <Property Class="Text" GUID="" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{21A4CDC7-48A9-42C0-88C7-5D4A91340E97}</Property>.. <Property Class="Type" GUID="{5F86110B-3C0F-4C61-BD89-16E3D1C18C64}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Image File</Property>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="2" DecimalPlaces="2">_PNG</Property>.. <Property Class="Number" GUID="{CF585700-63E6-43D0-80D6-56057B26064E}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">3</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_TIF\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1900), with CRLF line terminators
Category:	dropped
Size (bytes):	5015
Entropy (8bit):	5.404701834152169
Encrypted:	false
SSDEEP:	96:kR6qd2uI0MdOM7bd2ul0MdOMsfbd/u2CMdOQM0X2dzgi10ZmcpTbcwz0MdOM8bd2:3dO8dO97dO5gi1QmcpJdOvdOd
MD5:	473846F23140022BC55C3127C84AF856
SHA1:	6DFF4869DD999962169BA73A98BCC5E59425B009
SHA-256:	02340156044F9E8EE3922FB40B01AEB71C781D2139FFCD78D046CED13B0C999E
SHA-512:	958BEE7B83E77019A2AEAABB36555D56F560BE0C8479C04D4FDB188AC45C74BBD2A655060B81167E7BF083C8C3821B0CCE085044DB4E1EEB047FDF780475D3DB
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_TIF" GUID="{ACA35711-3BB7-4084-A8EB-1D227D80010D}">.. <Properties>.. <Property Class="Text" GUID="{82C581D1-CD13-4916-BA3D-A029C8E6796D}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_TIF</Property>.. <Property Class="Type" GUID="{C38A9DC8-D8AE-4A6D-A885-6EE446E1D3B8}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_TIF\_TIFF\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3109
Entropy (8bit):	5.08979859980463
Encrypted:	false
SSDEEP:	96:kCePqd2uI0MdOMdbd/ul0MdOM9bcwz0MdOMb6Lbdwk0MdOMS:mdOLdOIdObdOd
MD5:	FFF0BD30417CBAE523098600CE7A429D
SHA1:	48AAD218CE629F5ADE156D86CF74DD8A14DA6517
SHA-256:	6F2EB833A305B2549F5B96EB368C1D3233B71E8473BABFB2CB04D812DFBF0F4A
SHA-512:	F76144A5301C0F43D5B7FE25E57438A6706AA871508555D7BA9D3519D1EF741B181C59872570538F8A79611911004E81951DCE9B6A717AFBF77F162050034EBF
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_TIFF" GUID="{9540803C-2C88-41A9-9CCA-A5F11066F92C}">.. <Properties>.. <Property Class="Text" GUID="{347FA556-1B08-4F3F-860E-A4D205F9A5DB}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_TIFF</Property>.. <Property Class="Type" GUID="{EFE35C39-EB11-4CFE-89A5-66CFDCBF45C8}" Name="Type" inheritaction="" calculatebefore="0" inheri

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_TIF\_TIFF\is-DRMTQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3109
Entropy (8bit):	5.08979859980463
Encrypted:	false
SSDEEP:	96:kCePqd2uI0MdOMdbd/ul0MdOM9bcwz0MdOMb6Lbdwk0MdOMS:mdOLdOIdObdOd
MD5:	FFF0BD30417CBAE523098600CE7A429D
SHA1:	48AAD218CE629F5ADE156D86CF74DD8A14DA6517
SHA-256:	6F2EB833A305B2549F5B96EB368C1D3233B71E8473BABFB2CB04D812DFBF0F4A
SHA-512:	F76144A5301C0F43D5B7FE25E57438A6706AA871508555D7BA9D3519D1EF741B181C59872570538F8A79611911004E81951DCE9B6A717AFBF77F162050034EBF
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_TIFF" GUID="{9540803C-2C88-41A9-9CCA-A5F11066F92C}">.. <Properties>.. <Property Class="Text" GUID="{347FA556-1B08-4F3F-860E-A4D205F9A5DB}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_TIFF</Property>.. <Property Class="Type" GUID="{EFE35C39-EB11-4CFE-89A5-66CFDCBF45C8}" Name="Type" inheritaction="" calculatebefore="0" inheri

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_TIF\is-6UEJI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1900), with CRLF line terminators
Category:	dropped
Size (bytes):	5015
Entropy (8bit):	5.404701834152169
Encrypted:	false
SSDEEP:	96:kR6qd2uI0MdOM7bd2ul0MdOMsfbd/u2CMdOQM0X2dzgi10ZmcpTbcwz0MdOM8bd2:3dO8dO97dO5gi1QmcpJdOvdOd
MD5:	473846F23140022BC55C3127C84AF856
SHA1:	6DFF4869DD999962169BA73A98BCC5E59425B009
SHA-256:	02340156044F9E8EE3922FB40B01AEB71C781D2139FFCD78D046CED13B0C999E
SHA-512:	958BEE7B83E77019A2AEAABB36555D56F560BE0C8479C04D4FDB188AC45C74BBD2A655060B81167E7BF083C8C3821B0CCE085044DB4E1EEB047FDF780475D3DB
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_TIF" GUID="{ACA35711-3BB7-4084-A8EB-1D227D80010D}">.. <Properties>.. <Property Class="Text" GUID="{82C581D1-CD13-4916-BA3D-A029C8E6796D}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_TIF</Property>.. <Property Class="Type" GUID="{C38A9DC8-D8AE-4A6D-A885-6EE446E1D3B8}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_WMF\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3114
Entropy (8bit):	5.101574348333988
Encrypted:	false
SSDEEP:	96:krCnLqd2uI0MdOMRbd/ul0MdOMy5bdw20MdOMfbcwk0MdOMaC:u8tdOldOV9dONdOVC
MD5:	71DE9532F758B4A06F27D968A9B9AAA2
SHA1:	DA813E67350E81F2B109B33F80DD5A72214C6A08
SHA-256:	BD850216FF0AC00BA8D84FC7A09B12E2168C84E18C519295A6C0802E8B01B2D2
SHA-512:	2B318D0456EA2A4773EC82C5CF52101A3DD391AEFC2DB614C1C6C506D8E873282EB54A4F93359D3C4CB2D6C4C98B11F7F4993C66F199B5EE58D032B3F65F1037
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_WMF" GUID="{A77AEBAF-E7D0-4DB1-945D-0828B39AA23C}">.. <Properties>.. <Property Class="Text" GUID="{7D9CF77C-6423-4C90-8DD0-24A3C1553842}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_WMF</Property>.. <Property Class="Type" GUID="{32463B80-A297-41F3-ABC8-C042AE828D19}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\_WMF\is-7NS97.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3114
Entropy (8bit):	5.101574348333988
Encrypted:	false
SSDEEP:	96:krCnLqd2uI0MdOMRbd/ul0MdOMy5bdw20MdOMfbcwk0MdOMaC:u8tdOldOV9dONdOVC
MD5:	71DE9532F758B4A06F27D968A9B9AAA2
SHA1:	DA813E67350E81F2B109B33F80DD5A72214C6A08
SHA-256:	BD850216FF0AC00BA8D84FC7A09B12E2168C84E18C519295A6C0802E8B01B2D2
SHA-512:	2B318D0456EA2A4773EC82C5CF52101A3DD391AEFC2DB614C1C6C506D8E873282EB54A4F93359D3C4CB2D6C4C98B11F7F4993C66F199B5EE58D032B3F65F1037
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_WMF" GUID="{A77AEBAF-E7D0-4DB1-945D-0828B39AA23C}">.. <Properties>.. <Property Class="Text" GUID="{7D9CF77C-6423-4C90-8DD0-24A3C1553842}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_WMF</Property>.. <Property Class="Type" GUID="{32463B80-A297-41F3-ABC8-C042AE828D19}" Name="Type" inheritaction="" calculatebefore="0" inherite

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Image File\is-5NHJB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1867), with CRLF line terminators
Category:	dropped
Size (bytes):	4989
Entropy (8bit):	5.264635064266197
Encrypted:	false
SSDEEP:	96:kk1ByQqd2uI0MdOMebd2ul0MdOM1bcw20MdOMRwfbddz0MdOM0X1dPDesybdwk0t:TyWdOhdOldOLzdOfDodOP
MD5:	945E8122B55613177A5B9A300CA4328C
SHA1:	AF4E5344FB8539E23BF3B9BB74627E53D1CC8D15
SHA-256:	84D199E2E01B0E0F0DEE8FE1108587AC7AF34237F521A3137DFCD5EC124E6526
SHA-512:	E209A4EBC298B51561F009A1072DF93027EA6E5F3FAE68798438BB81CE4F0F978946C1E26373FD2FF4A187552E3506AB6A1D24488B0D6304AE01FD018FB9E300
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Image File" GUID="{07F11ECD-1839-4F8B-A7F0-446F2D2B3A04}">.. <Properties>.. <Property Class="Text" GUID="{501DD7A3-93DA-4A66-B6EE-39C14E14C4EC}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Image File</Property>.. <Property Class="Type" GUID="{780C92F3-D68A-48F1-8B19-85F17FF6F689}" Name="Type" inheritaction="" calculatebefor

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1329), with CRLF line terminators
Category:	dropped
Size (bytes):	7624
Entropy (8bit):	5.645496894165138
Encrypted:	false
SSDEEP:	96:SE77vWpRInaUIgINH1dC3XIkkk1U8OPlRFx/v5w3flC+TxEnGPbqDAUZy/+Awrpl:SEnOPUCNRlX5GU2ETDPsGAAfu7rNZ8f
MD5:	13DCA0F0E83FE6941824308215D626A0
SHA1:	40117EB533E44E9118F346915D86C3343C44736C
SHA-256:	90E234DC4B346DF07814D4D2E70EFB08BEE7B01425E6035C765B697182C8EA5C
SHA-512:	36E7C86F7971FB69E5502E9BA232D1C268159D8D07A689F293CCC19089FFB88E80C45DA4905EC9F97D38F11076C61642553659616325D9A100F7692612E78658
Malicious:	false
Preview:	<?xml version="1.0" encoding="windows-1252"?>..<Item Class="Item" Name="_Item" GUID="{B4FCA309-B704-43F8-94CC-B83408399B58}">.. <Properties>.. <Property Class="Text" GUID="{7C748DF7-4FAD-46C6-865E-0017B8D5CC86}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Item</Property>.. <Property Class="Text" GUID="{C9DA322F-145D-45D3-B76F-B2AD8CA0E317}" Name="Default Properties View" inheritaction="Inherit Formula" hidden="True" group="Item" OrderIndex="1" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">Form</Property>.. <Property Class="Text" GUID="{856F5A3A-EDA9-40B3-BCA0-6F555A7E10F1}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{367C4437-FD69-43C8-9D61-C581CA2D1E79}" Name="Item #" group="Item" OrderIndex="3" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Type" GUID="{1F418524-

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Assembly\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1329), with CRLF line terminators
Category:	dropped
Size (bytes):	5607
Entropy (8bit):	5.489205714656663
Encrypted:	false
SSDEEP:	96:H61WrE+1dNbkggggd5r9rNeaj5QaF9xEFqOSkoEt2yW9KmJtfr9x4Mnj:aooLZ5zajYw+RRqMj
MD5:	2FDF0DC7EAF5211CD72D5A2F142B02D3
SHA1:	742D104D9C94F56C7FCE3C1B76B07D30CEEDB23C
SHA-256:	BC58754B89D6C4CC23913CB8B62F8637A31B964A46F7179AF3CD1B4EADBC8D42
SHA-512:	DEAE54B1E43856A36055AF9B89A11B45101AC5532957705D936441AEE514C331BC61BA75BB69745DF39222C23B8F4BB74E22FF7AFEC2316ADDA67BF2A0CEFD69
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Assembly" GUID="{DD465D64-9A05-4B65-8BEA-2ACD464A3F11}">.. <Properties>.. <Property Class="Text" GUID="{EFF7FAA8-7E71-4A03-BA7C-2E752A471B73}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Assembly</Property>.. <Property Class="Type" GUID="{5E1C76E7-4637-4DEE-AD7D-2724FB7E3411}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Item</Property>.. <Property Class="Text" GUID="{C9DA322F-145D-45D3-B76F-B2AD8CA0E317}" Name="Default Properties View" inheritaction="Inherit Formula" hidden="True" group="Item" OrderIndex="3" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">Input</Property>.. <Property Class="Image" GUID="{5281657A-EF69-43E9-9589-C06E855A8271}" Name="Icon" inheritaction="Inherit Formula" group="Other" OrderIndex="5" DecimalPlaces="2" List="cmbList" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAA

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Assembly\is-Q7JLM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1329), with CRLF line terminators
Category:	dropped
Size (bytes):	5607
Entropy (8bit):	5.489205714656663
Encrypted:	false
SSDEEP:	96:H61WrE+1dNbkggggd5r9rNeaj5QaF9xEFqOSkoEt2yW9KmJtfr9x4Mnj:aooLZ5zajYw+RRqMj
MD5:	2FDF0DC7EAF5211CD72D5A2F142B02D3
SHA1:	742D104D9C94F56C7FCE3C1B76B07D30CEEDB23C
SHA-256:	BC58754B89D6C4CC23913CB8B62F8637A31B964A46F7179AF3CD1B4EADBC8D42
SHA-512:	DEAE54B1E43856A36055AF9B89A11B45101AC5532957705D936441AEE514C331BC61BA75BB69745DF39222C23B8F4BB74E22FF7AFEC2316ADDA67BF2A0CEFD69
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Assembly" GUID="{DD465D64-9A05-4B65-8BEA-2ACD464A3F11}">.. <Properties>.. <Property Class="Text" GUID="{EFF7FAA8-7E71-4A03-BA7C-2E752A471B73}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Assembly</Property>.. <Property Class="Type" GUID="{5E1C76E7-4637-4DEE-AD7D-2724FB7E3411}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Item</Property>.. <Property Class="Text" GUID="{C9DA322F-145D-45D3-B76F-B2AD8CA0E317}" Name="Default Properties View" inheritaction="Inherit Formula" hidden="True" group="Item" OrderIndex="3" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">Input</Property>.. <Property Class="Image" GUID="{5281657A-EF69-43E9-9589-C06E855A8271}" Name="Icon" inheritaction="Inherit Formula" group="Other" OrderIndex="5" DecimalPlaces="2" List="cmbList" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAA

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Part\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1359), with CRLF line terminators
Category:	dropped
Size (bytes):	6280
Entropy (8bit):	5.669605132892685
Encrypted:	false
SSDEEP:	96:5aDWUz+qd1d2GEG2/IhjyplOn8K9gFzaj5VaF94ug1k+MfnBM:w6lBGEGsWOElUE5kOsfBM
MD5:	FAAD0008905EA87F790F3EB570CBCA13
SHA1:	95BFD7EF93F2DC31172AC725BACF993110197C5D
SHA-256:	7FF125462002FBCBE7AEB8B257DEF83E5ACC9D8FFB2ABF11021B8578D6DDD95D
SHA-512:	F92FB6C4E7837AE626669905CA7D8FE76F5D6D7CA13DC5A98DDE942885508C8C21167FB2926A7649E7A7BBE0A09F994BBE7A1E5F4C0BEB83B74DCD9F32B0D5EA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Part" GUID="{FB5BA722-2D0C-4588-8EC2-0F69D0EA1CAA}">.. <Properties>.. <Property Class="Text" GUID="{4505C10B-F738-4094-B62A-36B3D3BA29EA}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Part</Property>.. <Property Class="Type" GUID="{9A88B1A0-0FCF-4383-84D5-B5C3840F5AF0}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Item</Property>.. <Property Class="Text" GUID="{C9DA322F-145D-45D3-B76F-B2AD8CA0E317}" Name="Default Properties View" inheritaction="Inherit Formula" hidden="True" group="Item" OrderIndex="40" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">Input</Property>.. <Property Class="Text" GUID="{741CE49E-4E89-48DD-8E13-56663D17C8F0}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{FB5BA722-2D0C-4588-8EC2-0F69D0EA1CAA}</Property>.. <Property Class="Image"

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Part\_Equipment\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1359), with CRLF line terminators
Category:	dropped
Size (bytes):	3892
Entropy (8bit):	5.710240998723208
Encrypted:	false
SSDEEP:	96:7y9k+N1Tcld1dc8o5FzNqplHgM5BnBt6k:2WMwlo5Tqt5Bnj6k
MD5:	305AF878C917C955F34A4F274BC19815
SHA1:	88C786C41803C8CF3573E0388C45B04AC78EC091
SHA-256:	5DB5DFA9A513A70770AF236F68ED96291E3D11B5CF0E1173608E363A07ABE3C8
SHA-512:	88A59971EDCFC80174A683520CF7FE34530B9069AFD13599A726362B1046371A3AFD844148E3A072ABC0EA4B2FCB756894B565FF73E749B188E317767CAFC6B0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Equipment" GUID="{8F5FF02E-FB72-485E-813E-C3734D92547E}">.. <Properties>.. <Property Class="Text" GUID="{E300750A-8623-45B5-A4E7-9854D14734BF}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Equipment</Property>.. <Property Class="Type" GUID="{2C320D24-A38A-4606-9603-ACF602D570C8}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="2">Part</Property>.. <Property Class="Text" GUID="{F74F1966-8871-4C0E-B6CC-E47DE4A1239E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="5" DecimalPlaces="2">{8F5FF02E-FB72-485E-813E-C3734D92547E}</Property>.. <Property Class="Image" GUID="{EBAD6AB8-9B0C-4B44-935A-EF566AF1CF38}" Name="Icon" inheritaction="Inherit Result" OrderIndex="8" DecimalPlaces="2" TreeList="cmbTreeList" PluginToExecute="cmbPluginToExecute" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAA

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Part\_Equipment\is-AS13O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1359), with CRLF line terminators
Category:	dropped
Size (bytes):	3892
Entropy (8bit):	5.710240998723208
Encrypted:	false
SSDEEP:	96:7y9k+N1Tcld1dc8o5FzNqplHgM5BnBt6k:2WMwlo5Tqt5Bnj6k
MD5:	305AF878C917C955F34A4F274BC19815
SHA1:	88C786C41803C8CF3573E0388C45B04AC78EC091
SHA-256:	5DB5DFA9A513A70770AF236F68ED96291E3D11B5CF0E1173608E363A07ABE3C8
SHA-512:	88A59971EDCFC80174A683520CF7FE34530B9069AFD13599A726362B1046371A3AFD844148E3A072ABC0EA4B2FCB756894B565FF73E749B188E317767CAFC6B0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Equipment" GUID="{8F5FF02E-FB72-485E-813E-C3734D92547E}">.. <Properties>.. <Property Class="Text" GUID="{E300750A-8623-45B5-A4E7-9854D14734BF}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Equipment</Property>.. <Property Class="Type" GUID="{2C320D24-A38A-4606-9603-ACF602D570C8}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="2">Part</Property>.. <Property Class="Text" GUID="{F74F1966-8871-4C0E-B6CC-E47DE4A1239E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="5" DecimalPlaces="2">{8F5FF02E-FB72-485E-813E-C3734D92547E}</Property>.. <Property Class="Image" GUID="{EBAD6AB8-9B0C-4B44-935A-EF566AF1CF38}" Name="Icon" inheritaction="Inherit Result" OrderIndex="8" DecimalPlaces="2" TreeList="cmbTreeList" PluginToExecute="cmbPluginToExecute" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAA

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Part\_Labor\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1359), with CRLF line terminators
Category:	dropped
Size (bytes):	3880
Entropy (8bit):	5.6914221626528
Encrypted:	false
SSDEEP:	96:ZUJBYld1d3Oz7zqqJC8KqplQVgM5BnBt6k:ZjizqqJwqC5Bnj6k
MD5:	A591E5D98727FC441D5E5D3E98AD6794
SHA1:	D2969C994BE5251D046F7AA79454E8873E091D01
SHA-256:	9AB5F0F403D42B3AD1E3612FC0890536BCB148A53C564BD5FC0855A2A504C94C
SHA-512:	8D9529104745D41DB2358728EF812FC24249100C363B1F9AFB7E515258B5157DAF40E7085CB0CFDDDFA1E522D077180B7C53134CDF79455E9D7E5DF2D9950A56
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Labor" GUID="{4F4C44C7-44BD-47DA-BE51-AF8BAD76BDD9}">.. <Properties>.. <Property Class="Text" GUID="{1ED68BFC-7BC6-46A3-901A-2A653026CB5E}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Labor</Property>.. <Property Class="Type" GUID="{78321EDF-D30C-4D8F-AF57-B2A6C8B1C7DB}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="2">Part</Property>.. <Property Class="Text" GUID="{AF14006E-303A-493A-95B2-DE9B6DD31B86}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="5" DecimalPlaces="2">{4F4C44C7-44BD-47DA-BE51-AF8BAD76BDD9}</Property>.. <Property Class="Image" GUID="{FD997B33-2069-4CE0-8711-452359A0031C}" Name="Icon" inheritaction="Inherit Result" OrderIndex="8" DecimalPlaces="2" TreeList="cmbTreeList" PluginToExecute="cmbPluginToExecute" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoA

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Part\_Labor\is-8THF5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1359), with CRLF line terminators
Category:	dropped
Size (bytes):	3880
Entropy (8bit):	5.6914221626528
Encrypted:	false
SSDEEP:	96:ZUJBYld1d3Oz7zqqJC8KqplQVgM5BnBt6k:ZjizqqJwqC5Bnj6k
MD5:	A591E5D98727FC441D5E5D3E98AD6794
SHA1:	D2969C994BE5251D046F7AA79454E8873E091D01
SHA-256:	9AB5F0F403D42B3AD1E3612FC0890536BCB148A53C564BD5FC0855A2A504C94C
SHA-512:	8D9529104745D41DB2358728EF812FC24249100C363B1F9AFB7E515258B5157DAF40E7085CB0CFDDDFA1E522D077180B7C53134CDF79455E9D7E5DF2D9950A56
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Labor" GUID="{4F4C44C7-44BD-47DA-BE51-AF8BAD76BDD9}">.. <Properties>.. <Property Class="Text" GUID="{1ED68BFC-7BC6-46A3-901A-2A653026CB5E}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Labor</Property>.. <Property Class="Type" GUID="{78321EDF-D30C-4D8F-AF57-B2A6C8B1C7DB}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="2">Part</Property>.. <Property Class="Text" GUID="{AF14006E-303A-493A-95B2-DE9B6DD31B86}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="5" DecimalPlaces="2">{4F4C44C7-44BD-47DA-BE51-AF8BAD76BDD9}</Property>.. <Property Class="Image" GUID="{FD997B33-2069-4CE0-8711-452359A0031C}" Name="Icon" inheritaction="Inherit Result" OrderIndex="8" DecimalPlaces="2" TreeList="cmbTreeList" PluginToExecute="cmbPluginToExecute" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoA

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Part\_Material\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1159), with CRLF line terminators
Category:	dropped
Size (bytes):	3747
Entropy (8bit):	5.916607007884031
Encrypted:	false
SSDEEP:	96:WrrVfhqJNIF16wDee14KDPPyplIZ6Gn5M:WXmS16wyemyPykZ6Gn5M
MD5:	E726412771C5662EE5730B6C21DFBDF4
SHA1:	C967DBA5C59CBB052C570917846FF475D48F1A57
SHA-256:	8F5BA81E55B6700762C51CB884878E7BF27DFE0407E0222E068EB28EA75A3C2E
SHA-512:	B5DBFDE140E54AE24C55E8160DF5A7E0C67878F701CCCF3F54FDEA42ACEABDFE19D1D37992B9F90EE249E42A8AC02A71C81783264941A6A3C096063503A646E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Material" GUID="{23F49ED0-A3BA-4D1D-9090-F2ED327A3E73}">.. <Properties>.. <Property Class="Text" GUID="{D71A908E-8B6C-432C-9D58-DEA72FF81497}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Material</Property>.. <Property Class="Type" GUID="{D227C994-0D4D-4332-9FCD-CEA474843607}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Part</Property>.. <Property Class="Text" GUID="{6E7092D5-8EFA-450D-A411-AD4C2ECE0104}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{23F49ED0-A3BA-4D1D-9090-F2ED327A3E73}</Property>.. <Property Class="Image" GUID="{1660E86F-D884-4DE4-BAD1-CB7F52A70CD8}" Name="Icon" inheritaction="Inherit Result" OrderIndex="5" DecimalPlaces="2" TreeList="cmbTreeList" PluginToExecute="cmbPluginToExecute" Transparent="True" ImageType="TdxPNGImage" ImageData="iVBORw0KGgo

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Part\_Material\is-QN72H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1159), with CRLF line terminators
Category:	dropped
Size (bytes):	3747
Entropy (8bit):	5.916607007884031
Encrypted:	false
SSDEEP:	96:WrrVfhqJNIF16wDee14KDPPyplIZ6Gn5M:WXmS16wyemyPykZ6Gn5M
MD5:	E726412771C5662EE5730B6C21DFBDF4
SHA1:	C967DBA5C59CBB052C570917846FF475D48F1A57
SHA-256:	8F5BA81E55B6700762C51CB884878E7BF27DFE0407E0222E068EB28EA75A3C2E
SHA-512:	B5DBFDE140E54AE24C55E8160DF5A7E0C67878F701CCCF3F54FDEA42ACEABDFE19D1D37992B9F90EE249E42A8AC02A71C81783264941A6A3C096063503A646E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Material" GUID="{23F49ED0-A3BA-4D1D-9090-F2ED327A3E73}">.. <Properties>.. <Property Class="Text" GUID="{D71A908E-8B6C-432C-9D58-DEA72FF81497}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Material</Property>.. <Property Class="Type" GUID="{D227C994-0D4D-4332-9FCD-CEA474843607}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">Part</Property>.. <Property Class="Text" GUID="{6E7092D5-8EFA-450D-A411-AD4C2ECE0104}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{23F49ED0-A3BA-4D1D-9090-F2ED327A3E73}</Property>.. <Property Class="Image" GUID="{1660E86F-D884-4DE4-BAD1-CB7F52A70CD8}" Name="Icon" inheritaction="Inherit Result" OrderIndex="5" DecimalPlaces="2" TreeList="cmbTreeList" PluginToExecute="cmbPluginToExecute" Transparent="True" ImageType="TdxPNGImage" ImageData="iVBORw0KGgo

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Part\_Other\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1327), with CRLF line terminators
Category:	dropped
Size (bytes):	3848
Entropy (8bit):	5.230756238013961
Encrypted:	false
SSDEEP:	48:conxHdX/tTe1dJgN/MHYUiplcXwOkpGD5anK3jgb5Bta6skt3hU2B:dn31S1dipMHqplmepgM5BnBt6k
MD5:	23B1D883BBCC23E9C3037836DFE035ED
SHA1:	209BFE778D1589DCDE73927AF77E4286B3A64B10
SHA-256:	6AF9C0D2869651E7816A9AA9AB1880385A17CB12DCFBDD23617AE41AAE2501E0
SHA-512:	B7559EA4C4C9AC68BC4B47B19576C5DCE1E5FEC87A5258113917958C7570C968CF5889DDA7B8C62D7A74D68D40082FB2C5C594251980B6C7D9994139AE9595E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Other" GUID="{52BA35F9-4C50-46CA-A22E-B5002011DF70}">.. <Properties>.. <Property Class="Text" GUID="{FBEA4634-7430-40AE-B82C-12B8A1FEC2F8}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Other</Property>.. <Property Class="Type" GUID="{46F65851-49DA-4978-9772-E93BD7EFD572}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="2">Part</Property>.. <Property Class="Image" GUID="{B42E9583-1174-4307-9E8C-2669ECEA376E}" Name="Icon" inheritaction="Inherit Result" group="Item" OrderIndex="5" DecimalPlaces="2" List="cmbList" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAAATCwAAEwsAAAAAAAAAAAAA/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Part\_Other\is-VKE6L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1327), with CRLF line terminators
Category:	dropped
Size (bytes):	3848
Entropy (8bit):	5.230756238013961
Encrypted:	false
SSDEEP:	48:conxHdX/tTe1dJgN/MHYUiplcXwOkpGD5anK3jgb5Bta6skt3hU2B:dn31S1dipMHqplmepgM5BnBt6k
MD5:	23B1D883BBCC23E9C3037836DFE035ED
SHA1:	209BFE778D1589DCDE73927AF77E4286B3A64B10
SHA-256:	6AF9C0D2869651E7816A9AA9AB1880385A17CB12DCFBDD23617AE41AAE2501E0
SHA-512:	B7559EA4C4C9AC68BC4B47B19576C5DCE1E5FEC87A5258113917958C7570C968CF5889DDA7B8C62D7A74D68D40082FB2C5C594251980B6C7D9994139AE9595E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Other" GUID="{52BA35F9-4C50-46CA-A22E-B5002011DF70}">.. <Properties>.. <Property Class="Text" GUID="{FBEA4634-7430-40AE-B82C-12B8A1FEC2F8}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Other</Property>.. <Property Class="Type" GUID="{46F65851-49DA-4978-9772-E93BD7EFD572}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="2">Part</Property>.. <Property Class="Image" GUID="{B42E9583-1174-4307-9E8C-2669ECEA376E}" Name="Icon" inheritaction="Inherit Result" group="Item" OrderIndex="5" DecimalPlaces="2" List="cmbList" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAAATCwAAEwsAAAAAAAAAAAAA/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Part\_Subcontract\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1359), with CRLF line terminators
Category:	dropped
Size (bytes):	3898
Entropy (8bit):	5.688013666890459
Encrypted:	false
SSDEEP:	96:V89Gor6ld1dnL3mkrGfJfntqplPggMZ6Btn5M:e9x6fmkuJftqzIZ6jn5M
MD5:	41DB3ACC91131BBFA7D0650C32257345
SHA1:	B5A535149641431BAE95921CC897B02CB61A0D21
SHA-256:	BFC5A44DE9792A4578E0A207E404BB20BB7791365FDCAD2C1855A2D594217F73
SHA-512:	2631B1B8AC9EA8740135CC1455F966A6666BB4409E49CA97D4F75E802108CD7023048379EACF0ECA96D612C30E45AA850D2101582C0885A16ED2029DC4480653
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Subcontract" GUID="{23F736BF-1931-4BBD-A4F4-70CBB1D0F20D}">.. <Properties>.. <Property Class="Text" GUID="{66DEEA0F-1D7E-4A71-8690-BC43CE637409}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Subcontract</Property>.. <Property Class="Type" GUID="{AA8B3EFD-9CDA-46E7-8F26-1C0AEBB8D4DA}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="2">Part</Property>.. <Property Class="Text" GUID="{0ACBF0DF-189F-4829-A8E7-4CE8343D03C4}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="5" DecimalPlaces="2">{23F736BF-1931-4BBD-A4F4-70CBB1D0F20D}</Property>.. <Property Class="Image" GUID="{159D16EC-4043-47B0-9122-278230D271E8}" Name="Icon" inheritaction="Inherit Result" OrderIndex="8" DecimalPlaces="2" TreeList="cmbTreeList" PluginToExecute="cmbPluginToExecute" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAA

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Part\_Subcontract\is-621BD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1359), with CRLF line terminators
Category:	dropped
Size (bytes):	3898
Entropy (8bit):	5.688013666890459
Encrypted:	false
SSDEEP:	96:V89Gor6ld1dnL3mkrGfJfntqplPggMZ6Btn5M:e9x6fmkuJftqzIZ6jn5M
MD5:	41DB3ACC91131BBFA7D0650C32257345
SHA1:	B5A535149641431BAE95921CC897B02CB61A0D21
SHA-256:	BFC5A44DE9792A4578E0A207E404BB20BB7791365FDCAD2C1855A2D594217F73
SHA-512:	2631B1B8AC9EA8740135CC1455F966A6666BB4409E49CA97D4F75E802108CD7023048379EACF0ECA96D612C30E45AA850D2101582C0885A16ED2029DC4480653
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Subcontract" GUID="{23F736BF-1931-4BBD-A4F4-70CBB1D0F20D}">.. <Properties>.. <Property Class="Text" GUID="{66DEEA0F-1D7E-4A71-8690-BC43CE637409}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Subcontract</Property>.. <Property Class="Type" GUID="{AA8B3EFD-9CDA-46E7-8F26-1C0AEBB8D4DA}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="2">Part</Property>.. <Property Class="Text" GUID="{0ACBF0DF-189F-4829-A8E7-4CE8343D03C4}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="5" DecimalPlaces="2">{23F736BF-1931-4BBD-A4F4-70CBB1D0F20D}</Property>.. <Property Class="Image" GUID="{159D16EC-4043-47B0-9122-278230D271E8}" Name="Icon" inheritaction="Inherit Result" OrderIndex="8" DecimalPlaces="2" TreeList="cmbTreeList" PluginToExecute="cmbPluginToExecute" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAA

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Part\is-J2AFA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1359), with CRLF line terminators
Category:	dropped
Size (bytes):	6280
Entropy (8bit):	5.669605132892685
Encrypted:	false
SSDEEP:	96:5aDWUz+qd1d2GEG2/IhjyplOn8K9gFzaj5VaF94ug1k+MfnBM:w6lBGEGsWOElUE5kOsfBM
MD5:	FAAD0008905EA87F790F3EB570CBCA13
SHA1:	95BFD7EF93F2DC31172AC725BACF993110197C5D
SHA-256:	7FF125462002FBCBE7AEB8B257DEF83E5ACC9D8FFB2ABF11021B8578D6DDD95D
SHA-512:	F92FB6C4E7837AE626669905CA7D8FE76F5D6D7CA13DC5A98DDE942885508C8C21167FB2926A7649E7A7BBE0A09F994BBE7A1E5F4C0BEB83B74DCD9F32B0D5EA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Part" GUID="{FB5BA722-2D0C-4588-8EC2-0F69D0EA1CAA}">.. <Properties>.. <Property Class="Text" GUID="{4505C10B-F738-4094-B62A-36B3D3BA29EA}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Part</Property>.. <Property Class="Type" GUID="{9A88B1A0-0FCF-4383-84D5-B5C3840F5AF0}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Item</Property>.. <Property Class="Text" GUID="{C9DA322F-145D-45D3-B76F-B2AD8CA0E317}" Name="Default Properties View" inheritaction="Inherit Formula" hidden="True" group="Item" OrderIndex="40" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">Input</Property>.. <Property Class="Text" GUID="{741CE49E-4E89-48DD-8E13-56663D17C8F0}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{FB5BA722-2D0C-4588-8EC2-0F69D0EA1CAA}</Property>.. <Property Class="Image"

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Takeoff Item\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1300), with CRLF line terminators
Category:	dropped
Size (bytes):	10303
Entropy (8bit):	5.522750273364871
Encrypted:	false
SSDEEP:	192:pUivb54B+rEORdfX9UQzPdc9CDEmwohHcE:9m+rEORdfNaE
MD5:	C1DBA12CD2137016A5552F03C464867C
SHA1:	BC424790009EB473A5648271F994D0D701692266
SHA-256:	CCF1A5CE1403D993BFEB18928EC6857D2A0D5C330FCC2A175719598D017918FA
SHA-512:	E3DA560643C98286CCC4961BF66DDB9DB63B4476EA5E16B002EECC32B313F62DE90E3DDEDF87D9E8E0039B72FBBF527D8A37CEAB17D0F1763E5961448A401D7D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="_Takeoff Item" GUID="{B34CB36E-60D9-4D17-B4AE-91E4462D8211}">.. <Properties>.. <Property Class="Number" GUID="{4C334375-551B-425F-9DF2-4C2F3F6A28EB}" Name="Qty" group="Estimating" OrderIndex="0" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Takeoff]</Property>.. <Property Class="Text" GUID="{B26FA057-C6D8-4378-942B-028A2B8C9EA3}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">_Takeoff Item</Property>.. <Property Class="Type" GUID="{B4C78BFA-03D6-4E88-8A1B-ED852DE3FD52}" Name="Type" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Item</Property>.. <Property Class="Text" GUID="{C9DA322F-145D-45D3-B76F-B2AD8CA0E317}" Name="Default Properties View" inheritaction="Inherit Formula" hidden="True" group="Item" OrderIndex="5" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">Form</Property>.. <Property Class="Text"

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Takeoff Item\_Area\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1099), with CRLF line terminators
Category:	dropped
Size (bytes):	5314
Entropy (8bit):	5.660613971059562
Encrypted:	false
SSDEEP:	96:TZcrxhark0iTERE6jSTT8d9YivPEK58t7YXFC:Vm/SZd9YiHEy8D
MD5:	16E40ABF113D13489EE50145157F9C20
SHA1:	3B88B643BC4707CF7F2D3AC74A7E92568EE3A04B
SHA-256:	6C242EE2EE1B14B8091CDDD9B5F8B28DFF947A10AF7C8F29EA91EAF4D75C5EA8
SHA-512:	98904EA2F9AA1399295783807528AAF19504164618317ED11721544CDD9D346D5A4069EF6B177149534E8073988443441FDBC4962E37C92E160E524169DC46F7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Area" GUID="{D3BA488A-791D-41B2-9A40-1DEC2B872A64}">.. <Properties>.. <Property Class="Number" GUID="{5B4A684F-1768-4C2C-A206-7AFB7AFDA01E}" Name="Qty" inputunits="SQ [Scale Units]" group="Estimating" OrderIndex="0" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Takeoff]</Property>.. <Property Class="Text" GUID="{E880611E-1A1B-4BEA-AD3D-B29DAAB1E814}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">_Area</Property>.. <Property Class="Type" GUID="{80237181-BE23-4E01-8266-675920BDAEF4}" Name="Type" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Takeoff Item</Property>.. <Property Class="Text" GUID="{53F0E19B-1501-47F5-ABA0-F3B1FCA9E298}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{D3BA488A-791D-41B2-9A40-1DEC2B872A64}</Property>.. <Property Class="Image"

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Takeoff Item\_Area\is-55KNU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1099), with CRLF line terminators
Category:	dropped
Size (bytes):	5314
Entropy (8bit):	5.660613971059562
Encrypted:	false
SSDEEP:	96:TZcrxhark0iTERE6jSTT8d9YivPEK58t7YXFC:Vm/SZd9YiHEy8D
MD5:	16E40ABF113D13489EE50145157F9C20
SHA1:	3B88B643BC4707CF7F2D3AC74A7E92568EE3A04B
SHA-256:	6C242EE2EE1B14B8091CDDD9B5F8B28DFF947A10AF7C8F29EA91EAF4D75C5EA8
SHA-512:	98904EA2F9AA1399295783807528AAF19504164618317ED11721544CDD9D346D5A4069EF6B177149534E8073988443441FDBC4962E37C92E160E524169DC46F7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Area" GUID="{D3BA488A-791D-41B2-9A40-1DEC2B872A64}">.. <Properties>.. <Property Class="Number" GUID="{5B4A684F-1768-4C2C-A206-7AFB7AFDA01E}" Name="Qty" inputunits="SQ [Scale Units]" group="Estimating" OrderIndex="0" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Takeoff]</Property>.. <Property Class="Text" GUID="{E880611E-1A1B-4BEA-AD3D-B29DAAB1E814}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">_Area</Property>.. <Property Class="Type" GUID="{80237181-BE23-4E01-8266-675920BDAEF4}" Name="Type" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Takeoff Item</Property>.. <Property Class="Text" GUID="{53F0E19B-1501-47F5-ABA0-F3B1FCA9E298}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{D3BA488A-791D-41B2-9A40-1DEC2B872A64}</Property>.. <Property Class="Image"

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Takeoff Item\_Count\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1300), with CRLF line terminators
Category:	dropped
Size (bytes):	11993
Entropy (8bit):	5.468037911534869
Encrypted:	false
SSDEEP:	192:Pf3Eb/5VZptx3Yqe75PakS445n9ZE8h9TOU5ncQoV3V9GvJwmS+36jsrF:Ub/52GvJmQKsrF
MD5:	CA9785B787E62434F7D1132C41984BCE
SHA1:	97AE4D9E4CF6D3CA65FA32CB6C53E86B6A08DB9F
SHA-256:	EED4F76771EC602499677A9DAD16254ED463B4EFF7FDDC543D2027CDA0E75040
SHA-512:	5F18DD9EE0A02BD5C0D6BADB394250529FC5EED75075DB0BA5DDE5F500A412148C03A6B4D875624429A250A72066EAF083366EB7B29FC3B4894A3483EDED86BC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Count" GUID="{3E29EF7A-8D7A-418C-BC8B-B694CAFDCCFB}">.. <Properties>.. <Property Class="Number" GUID="{DB19BF26-7F2C-4797-ADB8-F9697EA7EE88}" Name="Qty" inputunits="EA" group="Estimating" OrderIndex="0" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Takeoff]</Property>.. <Property Class="Text" GUID="{9F235007-E0E4-49BB-A9EA-155CC89DB8D3}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">_Count</Property>.. <Property Class="Type" GUID="{3C8489CC-4DBC-42E8-8E4D-8520F8E15FC3}" Name="Type" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Takeoff Item</Property>.. <Property Class="Number" GUID="{EA45A612-F19C-495A-ABA1-3D32CAA78B49}" Name="SwiftTube VideoID" group="Videos" OrderIndex="6" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">113</Property>.. <Property Class="Text" GUID="{99DDF26B-C887-4434-BFDB-5A26E773F

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Takeoff Item\_Count\is-91LOI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1300), with CRLF line terminators
Category:	dropped
Size (bytes):	11993
Entropy (8bit):	5.468037911534869
Encrypted:	false
SSDEEP:	192:Pf3Eb/5VZptx3Yqe75PakS445n9ZE8h9TOU5ncQoV3V9GvJwmS+36jsrF:Ub/52GvJmQKsrF
MD5:	CA9785B787E62434F7D1132C41984BCE
SHA1:	97AE4D9E4CF6D3CA65FA32CB6C53E86B6A08DB9F
SHA-256:	EED4F76771EC602499677A9DAD16254ED463B4EFF7FDDC543D2027CDA0E75040
SHA-512:	5F18DD9EE0A02BD5C0D6BADB394250529FC5EED75075DB0BA5DDE5F500A412148C03A6B4D875624429A250A72066EAF083366EB7B29FC3B4894A3483EDED86BC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Count" GUID="{3E29EF7A-8D7A-418C-BC8B-B694CAFDCCFB}">.. <Properties>.. <Property Class="Number" GUID="{DB19BF26-7F2C-4797-ADB8-F9697EA7EE88}" Name="Qty" inputunits="EA" group="Estimating" OrderIndex="0" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Takeoff]</Property>.. <Property Class="Text" GUID="{9F235007-E0E4-49BB-A9EA-155CC89DB8D3}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">_Count</Property>.. <Property Class="Type" GUID="{3C8489CC-4DBC-42E8-8E4D-8520F8E15FC3}" Name="Type" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Takeoff Item</Property>.. <Property Class="Number" GUID="{EA45A612-F19C-495A-ABA1-3D32CAA78B49}" Name="SwiftTube VideoID" group="Videos" OrderIndex="6" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">113</Property>.. <Property Class="Text" GUID="{99DDF26B-C887-4434-BFDB-5A26E773F

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Takeoff Item\_Line\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1299), with CRLF line terminators
Category:	dropped
Size (bytes):	4878
Entropy (8bit):	5.563810198452858
Encrypted:	false
SSDEEP:	96:ZoKytNrzIWAap1dngsP4W9AJpqS53nrWVkfsXb6AC:Zoh4WHC5ZWOUr6X
MD5:	57942BA8249474AD1721E0254D414CC2
SHA1:	D471BB52D1A102D51C56E47047BC5103AD781103
SHA-256:	7988BF58ACBE0DF1AA119E94658C7208BD8B3F012218711F22E8A38B1BE6560D
SHA-512:	330D30B73224F86ACECED765B6870CE16AAF9CB1E5AAD35AF57E39522066246AD432CA7070875E9B3D4ECD3584BABC289664256D3E39CBAA9E7D77F4BEEE890F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Line" GUID="{65FEA8FC-4963-4FC5-9C31-3C4E857DEFF5}">.. <Properties>.. <Property Class="Number" GUID="{B1552C16-9AC4-4E90-8C2A-C5EDD359E0A2}" Name="Qty" inputunits="[Scale Units]" group="Estimating" OrderIndex="0" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Takeoff]</Property>.. <Property Class="Text" GUID="{D89F5B3D-0E4C-4386-AF42-0CB2323EB199}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">_Line</Property>.. <Property Class="Type" GUID="{7705C17C-E740-467D-9DB7-7E57EC6D3D4F}" Name="Type" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Takeoff Item</Property>.. <Property Class="Text" GUID="{4AFA02AA-6ABE-4099-808D-4ED10A9F1706}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{65FEA8FC-4963-4FC5-9C31-3C4E857DEFF5}</Property>.. <Property Class="Image" GUI

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Takeoff Item\_Line\_Linear\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1297), with CRLF line terminators
Category:	dropped
Size (bytes):	2947
Entropy (8bit):	5.377033916153265
Encrypted:	false
SSDEEP:	24:2dVfDiDik+X2ZJ/CApWp/RhOApW3uof2WAdOcliF5GXPwtTr3+a7pdqXf1Oc3HIe:cVOgOmM/AYtTSa1d8k4kFTKVHuaqYjd
MD5:	81436392126B4966C404740FD056141C
SHA1:	DA726E9ACA68CA46E7D058BD9FCA2C35CB16F84D
SHA-256:	323EDF08F6BA5CA6F7D3AC09852842443B08A34029B13766A039C3955F39E4FE
SHA-512:	25F2758EE18BD557B3C696A9DE0F9C921C580AF20C08EB0BE4E18F921CF948AC0E3FE0DBAE77603A68864A61C3C3A8B745446DCFC6045C0D7E6299479CE7E368
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Linear" GUID="{6EF2093D-222C-4298-B295-E85858ABCBFE}">.. <Properties>.. <Property Class="Text" GUID="{D89F5B3D-0E4C-4386-AF42-0CB2323EB199}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">_Linear</Property>.. <Property Class="Type" GUID="{7705C17C-E740-467D-9DB7-7E57EC6D3D4F}" Name="Type" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Line</Property>.. <Property Class="Text" GUID="{4AFA02AA-6ABE-4099-808D-4ED10A9F1706}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{6EF2093D-222C-4298-B295-E85858ABCBFE}</Property>.. <Property Class="Image" GUID="{0E5B95E1-23D1-4ADE-9DC9-52654D49B25C}" Name="Icon" inheritaction="Inherit Result" OrderIndex="6" DecimalPlaces="2" Transparent="-1" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADCHgAAwh4A

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Takeoff Item\_Line\_Linear\is-5QKI6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1297), with CRLF line terminators
Category:	dropped
Size (bytes):	2947
Entropy (8bit):	5.377033916153265
Encrypted:	false
SSDEEP:	24:2dVfDiDik+X2ZJ/CApWp/RhOApW3uof2WAdOcliF5GXPwtTr3+a7pdqXf1Oc3HIe:cVOgOmM/AYtTSa1d8k4kFTKVHuaqYjd
MD5:	81436392126B4966C404740FD056141C
SHA1:	DA726E9ACA68CA46E7D058BD9FCA2C35CB16F84D
SHA-256:	323EDF08F6BA5CA6F7D3AC09852842443B08A34029B13766A039C3955F39E4FE
SHA-512:	25F2758EE18BD557B3C696A9DE0F9C921C580AF20C08EB0BE4E18F921CF948AC0E3FE0DBAE77603A68864A61C3C3A8B745446DCFC6045C0D7E6299479CE7E368
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Linear" GUID="{6EF2093D-222C-4298-B295-E85858ABCBFE}">.. <Properties>.. <Property Class="Text" GUID="{D89F5B3D-0E4C-4386-AF42-0CB2323EB199}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">_Linear</Property>.. <Property Class="Type" GUID="{7705C17C-E740-467D-9DB7-7E57EC6D3D4F}" Name="Type" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Line</Property>.. <Property Class="Text" GUID="{4AFA02AA-6ABE-4099-808D-4ED10A9F1706}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{6EF2093D-222C-4298-B295-E85858ABCBFE}</Property>.. <Property Class="Image" GUID="{0E5B95E1-23D1-4ADE-9DC9-52654D49B25C}" Name="Icon" inheritaction="Inherit Result" OrderIndex="6" DecimalPlaces="2" Transparent="-1" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAADCHgAAwh4A

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Takeoff Item\_Line\_Segment\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1311), with CRLF line terminators
Category:	dropped
Size (bytes):	2965
Entropy (8bit):	5.307915465524229
Encrypted:	false
SSDEEP:	48:cV0QiOMMJXkR8tTXXa1d5tNtNt11F1F1FtNNt2TKHYHuXYrm:k0tXMWR2jq1dEe4iYrm
MD5:	87039D2D8F2136F379CBD0261D999921
SHA1:	A8DD7CE38EB59DF0D43535AE566E78CD50EFD134
SHA-256:	E2EF97808A0106752C66938298439491440F1B4E28A4287DBBEBAD0CE5F159C3
SHA-512:	E0F9C8427100C480E6F62640C15333AED8201FC17197487B6F56BA9A81719DF7583D414B92B887111A3A0CA25048F74ACC682CEE8960E8B49FB181EF5BB6B9EA
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Segment" GUID="{0EBD002C-24AA-4CF6-99FC-CE9599963510}">.. <Properties>.. <Property Class="Text" GUID="{D89F5B3D-0E4C-4386-AF42-0CB2323EB199}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">_Segment</Property>.. <Property Class="Type" GUID="{7705C17C-E740-467D-9DB7-7E57EC6D3D4F}" Name="Type" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Line</Property>.. <Property Class="Text" GUID="{4AFA02AA-6ABE-4099-808D-4ED10A9F1706}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{0EBD002C-24AA-4CF6-99FC-CE9599963510}</Property>.. <Property Class="Number" GUID="{4624FE34-F780-4712-A9DA-27FAD4CF8562}" Name="OrderIndex" systemhidden="True" OrderIndex="6" DecimalPlaces="2">1</Property>.. <Property Class="Image" GUID="{ABAFAFDD-23A9-4C37-94AA-A8D3B5CFF416}" Name="Icon" inheritact

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Takeoff Item\_Line\_Segment\is-PESNI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1311), with CRLF line terminators
Category:	dropped
Size (bytes):	2965
Entropy (8bit):	5.307915465524229
Encrypted:	false
SSDEEP:	48:cV0QiOMMJXkR8tTXXa1d5tNtNt11F1F1FtNNt2TKHYHuXYrm:k0tXMWR2jq1dEe4iYrm
MD5:	87039D2D8F2136F379CBD0261D999921
SHA1:	A8DD7CE38EB59DF0D43535AE566E78CD50EFD134
SHA-256:	E2EF97808A0106752C66938298439491440F1B4E28A4287DBBEBAD0CE5F159C3
SHA-512:	E0F9C8427100C480E6F62640C15333AED8201FC17197487B6F56BA9A81719DF7583D414B92B887111A3A0CA25048F74ACC682CEE8960E8B49FB181EF5BB6B9EA
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Segment" GUID="{0EBD002C-24AA-4CF6-99FC-CE9599963510}">.. <Properties>.. <Property Class="Text" GUID="{D89F5B3D-0E4C-4386-AF42-0CB2323EB199}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">_Segment</Property>.. <Property Class="Type" GUID="{7705C17C-E740-467D-9DB7-7E57EC6D3D4F}" Name="Type" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Line</Property>.. <Property Class="Text" GUID="{4AFA02AA-6ABE-4099-808D-4ED10A9F1706}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{0EBD002C-24AA-4CF6-99FC-CE9599963510}</Property>.. <Property Class="Number" GUID="{4624FE34-F780-4712-A9DA-27FAD4CF8562}" Name="OrderIndex" systemhidden="True" OrderIndex="6" DecimalPlaces="2">1</Property>.. <Property Class="Image" GUID="{ABAFAFDD-23A9-4C37-94AA-A8D3B5CFF416}" Name="Icon" inheritact

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Takeoff Item\_Line\is-P4N7U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1299), with CRLF line terminators
Category:	dropped
Size (bytes):	4878
Entropy (8bit):	5.563810198452858
Encrypted:	false
SSDEEP:	96:ZoKytNrzIWAap1dngsP4W9AJpqS53nrWVkfsXb6AC:Zoh4WHC5ZWOUr6X
MD5:	57942BA8249474AD1721E0254D414CC2
SHA1:	D471BB52D1A102D51C56E47047BC5103AD781103
SHA-256:	7988BF58ACBE0DF1AA119E94658C7208BD8B3F012218711F22E8A38B1BE6560D
SHA-512:	330D30B73224F86ACECED765B6870CE16AAF9CB1E5AAD35AF57E39522066246AD432CA7070875E9B3D4ECD3584BABC289664256D3E39CBAA9E7D77F4BEEE890F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Line" GUID="{65FEA8FC-4963-4FC5-9C31-3C4E857DEFF5}">.. <Properties>.. <Property Class="Number" GUID="{B1552C16-9AC4-4E90-8C2A-C5EDD359E0A2}" Name="Qty" inputunits="[Scale Units]" group="Estimating" OrderIndex="0" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Takeoff]</Property>.. <Property Class="Text" GUID="{D89F5B3D-0E4C-4386-AF42-0CB2323EB199}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">_Line</Property>.. <Property Class="Type" GUID="{7705C17C-E740-467D-9DB7-7E57EC6D3D4F}" Name="Type" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Takeoff Item</Property>.. <Property Class="Text" GUID="{4AFA02AA-6ABE-4099-808D-4ED10A9F1706}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="4" DecimalPlaces="2">{65FEA8FC-4963-4FC5-9C31-3C4E857DEFF5}</Property>.. <Property Class="Image" GUI

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\_Takeoff Item\is-F7MKE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1300), with CRLF line terminators
Category:	dropped
Size (bytes):	10303
Entropy (8bit):	5.522750273364871
Encrypted:	false
SSDEEP:	192:pUivb54B+rEORdfX9UQzPdc9CDEmwohHcE:9m+rEORdfNaE
MD5:	C1DBA12CD2137016A5552F03C464867C
SHA1:	BC424790009EB473A5648271F994D0D701692266
SHA-256:	CCF1A5CE1403D993BFEB18928EC6857D2A0D5C330FCC2A175719598D017918FA
SHA-512:	E3DA560643C98286CCC4961BF66DDB9DB63B4476EA5E16B002EECC32B313F62DE90E3DDEDF87D9E8E0039B72FBBF527D8A37CEAB17D0F1763E5961448A401D7D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="_Takeoff Item" GUID="{B34CB36E-60D9-4D17-B4AE-91E4462D8211}">.. <Properties>.. <Property Class="Number" GUID="{4C334375-551B-425F-9DF2-4C2F3F6A28EB}" Name="Qty" group="Estimating" OrderIndex="0" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">[Takeoff]</Property>.. <Property Class="Text" GUID="{B26FA057-C6D8-4378-942B-028A2B8C9EA3}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">_Takeoff Item</Property>.. <Property Class="Type" GUID="{B4C78BFA-03D6-4E88-8A1B-ED852DE3FD52}" Name="Type" required="True" group="Item" OrderIndex="3" DecimalPlaces="2">Item</Property>.. <Property Class="Text" GUID="{C9DA322F-145D-45D3-B76F-B2AD8CA0E317}" Name="Default Properties View" inheritaction="Inherit Formula" hidden="True" group="Item" OrderIndex="5" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">Form</Property>.. <Property Class="Text"

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Item\is-LM9RJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1329), with CRLF line terminators
Category:	dropped
Size (bytes):	7624
Entropy (8bit):	5.645496894165138
Encrypted:	false
SSDEEP:	96:SE77vWpRInaUIgINH1dC3XIkkk1U8OPlRFx/v5w3flC+TxEnGPbqDAUZy/+Awrpl:SEnOPUCNRlX5GU2ETDPsGAAfu7rNZ8f
MD5:	13DCA0F0E83FE6941824308215D626A0
SHA1:	40117EB533E44E9118F346915D86C3343C44736C
SHA-256:	90E234DC4B346DF07814D4D2E70EFB08BEE7B01425E6035C765B697182C8EA5C
SHA-512:	36E7C86F7971FB69E5502E9BA232D1C268159D8D07A689F293CCC19089FFB88E80C45DA4905EC9F97D38F11076C61642553659616325D9A100F7692612E78658
Malicious:	false
Preview:	<?xml version="1.0" encoding="windows-1252"?>..<Item Class="Item" Name="_Item" GUID="{B4FCA309-B704-43F8-94CC-B83408399B58}">.. <Properties>.. <Property Class="Text" GUID="{7C748DF7-4FAD-46C6-865E-0017B8D5CC86}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Item</Property>.. <Property Class="Text" GUID="{C9DA322F-145D-45D3-B76F-B2AD8CA0E317}" Name="Default Properties View" inheritaction="Inherit Formula" hidden="True" group="Item" OrderIndex="1" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList">Form</Property>.. <Property Class="Text" GUID="{856F5A3A-EDA9-40B3-BCA0-6F555A7E10F1}" Name="Description" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Text" GUID="{367C4437-FD69-43C8-9D61-C581CA2D1E79}" Name="Item #" group="Item" OrderIndex="3" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList"/>.. <Property Class="Type" GUID="{1F418524-

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Job\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (896), with CRLF line terminators
Category:	dropped
Size (bytes):	2477
Entropy (8bit):	5.771859421738349
Encrypted:	false
SSDEEP:	48:cbhgJgGtTGzc2fE3qBC8jM6tmLq3kfqYtAwMWbITM0XTw:MhIqzf0qtj/mm0qaARbA0Xk
MD5:	EAF8360BF36D889D3C6BD875EDCB1D32
SHA1:	9BF7751BB4F26C9D3E4B0CA839A1AF72F147B1A8
SHA-256:	4F98F8BCD064FAA0EFB338557FCF0FE84CB7351E4F03A8C53496A7DB19A6A6E6
SHA-512:	F4FD5664412D5EE8B6EF14820EC1943FFDDC8EB68EE196EC1867A86D63D1C318AFB74C1B76A57F0E37DDAB6FCBE08613085DD638010D48F0D32F7EB1ACB07D4B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Job" GUID="{BF68BA86-388A-4B55-B4B1-961E3CD40806}">.. <Properties>.. <Property Class="Text" GUID="{9DA2D09C-7DF9-452A-A56B-508E08974088}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_Job</Property>.. <Property Class="Type" GUID="{D505560A-B1BA-4827-8331-21C36C4F21EB}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">All</Property>.. <Property Class="Image" GUID="{AA51A925-28F1-4C51-8010-1A2C7D637276}" Name="Icon" inheritaction="Inherit Result" group="Item" OrderIndex="2" DecimalPlaces="" TreeList="cmbTreeList" PluginToExecute="cmbPluginToExecute" Transparent="False" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAIGNIUk0AAHolAACAgwAA+f8AAIDpAAB1MAAA6mAAADqYAAAXb5JfxUYAAAAJcEhZcwAACwwAAAsMAT9AIsgAAAFSSURBVDhPpZPbTsJAFEX7/18k2vv9D0x8MDFEqgWKLW0pY53tOSNTKrXyAMkJgbDXXmc6GACMW+amMBcPAMu213GSyPEkaQr6DNtxXo2Ll7YeAFEcH4UQaDuB

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Job\is-CFPDP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (896), with CRLF line terminators
Category:	dropped
Size (bytes):	2477
Entropy (8bit):	5.771859421738349
Encrypted:	false
SSDEEP:	48:cbhgJgGtTGzc2fE3qBC8jM6tmLq3kfqYtAwMWbITM0XTw:MhIqzf0qtj/mm0qaARbA0Xk
MD5:	EAF8360BF36D889D3C6BD875EDCB1D32
SHA1:	9BF7751BB4F26C9D3E4B0CA839A1AF72F147B1A8
SHA-256:	4F98F8BCD064FAA0EFB338557FCF0FE84CB7351E4F03A8C53496A7DB19A6A6E6
SHA-512:	F4FD5664412D5EE8B6EF14820EC1943FFDDC8EB68EE196EC1867A86D63D1C318AFB74C1B76A57F0E37DDAB6FCBE08613085DD638010D48F0D32F7EB1ACB07D4B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Job" GUID="{BF68BA86-388A-4B55-B4B1-961E3CD40806}">.. <Properties>.. <Property Class="Text" GUID="{9DA2D09C-7DF9-452A-A56B-508E08974088}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_Job</Property>.. <Property Class="Type" GUID="{D505560A-B1BA-4827-8331-21C36C4F21EB}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">All</Property>.. <Property Class="Image" GUID="{AA51A925-28F1-4C51-8010-1A2C7D637276}" Name="Icon" inheritaction="Inherit Result" group="Item" OrderIndex="2" DecimalPlaces="" TreeList="cmbTreeList" PluginToExecute="cmbPluginToExecute" Transparent="False" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAIGNIUk0AAHolAACAgwAA+f8AAIDpAAB1MAAA6mAAADqYAAAXb5JfxUYAAAAJcEhZcwAACwwAAAsMAT9AIsgAAAFSSURBVDhPpZPbTsJAFEX7/18k2vv9D0x8MDFEqgWKLW0pY53tOSNTKrXyAMkJgbDXXmc6GACMW+amMBcPAMu213GSyPEkaQr6DNtxXo2Ll7YeAFEcH4UQaDuB

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_List\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (825), with CRLF line terminators
Category:	dropped
Size (bytes):	1984
Entropy (8bit):	5.845342414456473
Encrypted:	false
SSDEEP:	48:cEVhsbGtZ78RmdOetYUi4hfbDHyoF8ipeKnJJTyYtAwMi:ZVGbG/KmscpfbmWRrXeaARi
MD5:	BF18FD3D688ABD52A62444EA72383815
SHA1:	830645906497920628783E95EF320B802E621522
SHA-256:	0F705DF3199995BDCD25207BA6B3B41B41C3C01841BAFB1ECD7E1462C0910FDB
SHA-512:	745AADEA3415D7A6695FFE61DBB042DE5F4E7929AE0ED0F855A83212F97D6190226B8F731B86E7585F0BA870323FF17F7178E7F6EB7EF6E69495AB58327120CE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_List" GUID="{A3784DC3-987E-48A0-B0F6-702CEF8173E9}">.. <Properties>.. <Property Class="Text" GUID="{3614099F-BF4F-48CB-BF13-26FFF58FC2A2}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{A3784DC3-987E-48A0-B0F6-702CEF8173E9}</Property>.. <Property Class="Number" GUID="{0486F6CF-05DB-4226-AA61-F54E11311FF1}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">14</Property>.. <Property Class="Text" GUID="{D715B33D-BB16-40E0-A153-087FA2D53E4F}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="2" DecimalPlaces="2">_List</Property>.. <Property Class="Type" GUID="{C51F8718-D019-4E5E-B1F9-E08F7F123FEB}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="2">All</Property>.. <Property Class="Image" GUID="{F6062E66-D12E-4A10-ACA1-0182F0A5653B}" Name="Icon" inheritaction="Inherit Formula" group

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_List\_Simple List\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1434), with CRLF line terminators
Category:	dropped
Size (bytes):	4633
Entropy (8bit):	5.372718347216872
Encrypted:	false
SSDEEP:	96:k8TbUbd2uU0MdOMKTr/bd/ul0MdOMnbdwC0MdOMMLbcw70MdOMn6bd/u44MdOM04:zdOvradOsdOD5dOuUdOry9uA
MD5:	55C3FB571E7411AA304C27B8D69A8D62
SHA1:	FC98CFC5173A0FD2233754779B0ADBBB63542C2A
SHA-256:	B4C5043960CC7185376763BFDFCF42D4F1A194D2558DC3A574B77C336CC4F44E
SHA-512:	AB61EC366EF9E75487E86650054F4787F8F0416E02278071A82C228714C05DEB9A1A019FF9FF8B47AF0BEAECB5EEEC4789F452EF782FDF82B5F53A69AA409946
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Simple List" GUID="{295C97C3-0219-42E9-A5B8-E3CB8347B056}">.. <Properties>.. <Property Class="Text" GUID="{CF42ADE6-1471-410E-BDD2-6AFF5BEC07DD}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Simple List</Property>.. <Property Class="Type" GUID="{08D79D5E-E563-4C9C-A28B-7921FB7D9E8F}" Name="Type" inheritact

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_List\_Simple List\is-0DQ33.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1434), with CRLF line terminators
Category:	dropped
Size (bytes):	4633
Entropy (8bit):	5.372718347216872
Encrypted:	false
SSDEEP:	96:k8TbUbd2uU0MdOMKTr/bd/ul0MdOMnbdwC0MdOMMLbcw70MdOMn6bd/u44MdOM04:zdOvradOsdOD5dOuUdOry9uA
MD5:	55C3FB571E7411AA304C27B8D69A8D62
SHA1:	FC98CFC5173A0FD2233754779B0ADBBB63542C2A
SHA-256:	B4C5043960CC7185376763BFDFCF42D4F1A194D2558DC3A574B77C336CC4F44E
SHA-512:	AB61EC366EF9E75487E86650054F4787F8F0416E02278071A82C228714C05DEB9A1A019FF9FF8B47AF0BEAECB5EEEC4789F452EF782FDF82B5F53A69AA409946
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Simple List" GUID="{295C97C3-0219-42E9-A5B8-E3CB8347B056}">.. <Properties>.. <Property Class="Text" GUID="{CF42ADE6-1471-410E-BDD2-6AFF5BEC07DD}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Simple List</Property>.. <Property Class="Type" GUID="{08D79D5E-E563-4C9C-A28B-7921FB7D9E8F}" Name="Type" inheritact

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_List\is-31K54.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (825), with CRLF line terminators
Category:	dropped
Size (bytes):	1984
Entropy (8bit):	5.845342414456473
Encrypted:	false
SSDEEP:	48:cEVhsbGtZ78RmdOetYUi4hfbDHyoF8ipeKnJJTyYtAwMi:ZVGbG/KmscpfbmWRrXeaARi
MD5:	BF18FD3D688ABD52A62444EA72383815
SHA1:	830645906497920628783E95EF320B802E621522
SHA-256:	0F705DF3199995BDCD25207BA6B3B41B41C3C01841BAFB1ECD7E1462C0910FDB
SHA-512:	745AADEA3415D7A6695FFE61DBB042DE5F4E7929AE0ED0F855A83212F97D6190226B8F731B86E7585F0BA870323FF17F7178E7F6EB7EF6E69495AB58327120CE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_List" GUID="{A3784DC3-987E-48A0-B0F6-702CEF8173E9}">.. <Properties>.. <Property Class="Text" GUID="{3614099F-BF4F-48CB-BF13-26FFF58FC2A2}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{A3784DC3-987E-48A0-B0F6-702CEF8173E9}</Property>.. <Property Class="Number" GUID="{0486F6CF-05DB-4226-AA61-F54E11311FF1}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">14</Property>.. <Property Class="Text" GUID="{D715B33D-BB16-40E0-A153-087FA2D53E4F}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="2" DecimalPlaces="2">_List</Property>.. <Property Class="Type" GUID="{C51F8718-D019-4E5E-B1F9-E08F7F123FEB}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="2">All</Property>.. <Property Class="Image" GUID="{F6062E66-D12E-4A10-ACA1-0182F0A5653B}" Name="Icon" inheritaction="Inherit Formula" group

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1328), with CRLF line terminators
Category:	dropped
Size (bytes):	3297
Entropy (8bit):	5.386614396432641
Encrypted:	false
SSDEEP:	48:cny7z9cKYlBtYUw1dBsXbHOaeCdHsu7dHdfu6lQ6CD5anKMAYywMi:GyCKY9Y1dBsituRTQ6kZxRi
MD5:	592C0FBF074F9780E6128DF8A89B92E8
SHA1:	21C196AFF39AC54BDC688F8C1CD3E4C5930F7A4F
SHA-256:	F5ABD2D0DA4F6147D0CC0ACA81566EFCE7170B14A3EBF37046D7F9546F204A2C
SHA-512:	F7E07BD69E62998DCC548BE5F7320F4AD2809F6ABE88F5BB9CABF8E8D7A8B18455C4DC75DA73C9710768BAE35666F97709D7C721958E0C9CF76D7D625A4D7AC0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Page Item" GUID="{09377DD2-2EFA-41AD-82EF-0369E098B446}">.. <Properties>.. <Property Class="Text" GUID="{33DA2C8B-1C72-4842-8F7E-ABD4A30B4076}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Page Item</Property>.. <Property Class="Type" GUID="{F88B9401-0D3D-4018-B763-37B5D05CC22C}" Name="Type" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">All</Property>.. <Property Class="Image" GUID="{D184F8AE-9E85-4E98-BDEA-2084D7E59CCE}" Name="Icon" inheritaction="Inherit Formula" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAAASCwAAEgsAAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////bGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxs////////////////bGxs/////////f399/f68/L37e3y6Ojv4+Pr397n3NzmbGxs/////

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_ArrowMarkup\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (518), with CRLF line terminators
Category:	dropped
Size (bytes):	7591
Entropy (8bit):	5.503383243391543
Encrypted:	false
SSDEEP:	96:kbIqH2XmwMHoWiM11KTkIjnHkrqCMC2GfuDrqNEBRJbWIAZMt8h:kzHkYoWZ7KYgnHr5XGmyNkrbAqih
MD5:	C843C814293532F02B5B92A95EC3B0E2
SHA1:	1C66F0ECB136BF12AF058C878E94CA0E66BB7A9A
SHA-256:	E84F7CAD68EE0AE80AF95BA84A95F7BE76A16C84558F8EC74BDF1DC51DD18175
SHA-512:	BD6D718DA514B67D659C2FE9285D224EA4FE3109295F63DAB32661EEE7EED876504FA3ADE5E36E2A092F7CC338B6BBD29BC54DF45490DC043B1EF0AD8E2B0CB5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_ArrowMarkup" GUID="{C227C381-B129-442A-8979-72CC96BC2559}">.. <Properties>.. <Property Class="Text" GUID="{6792D1BA-886D-4442-839D-F2DD1ECFD6A6}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_ArrowMarkup</Property>.. <Property Class="Type" GUID="{044EB0D2-6EE8-4648-A33C-831A3D5E774E}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Page Item</Property>.. <Property Class="Image" GUID="{95FC4966-308E-4069-8D6B-FB4E24D363E1}" Name="Icon" inheritaction="Inherit Formula" locked="True" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" Transparent="True" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAALGPC/xhBQAAAAlwSFlzAAAFiQAABYkBbWid+gAAAGlJREFUOE9jGCHAe3GDAhC/B+L5UCHSAFCjARD/h2KyDQkAYpArUA0BcgSA2IFIXADEqC4BMhqQBEnFBTCn7ScBIxsQAHYFsQCoYT6S5gSoMHGAUs2gACRPMwgANYFiChTYpPl5KAAGBgAP7JmAFua6XgAAAABJRU5Erk

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_ArrowMarkup\is-JA4JU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (518), with CRLF line terminators
Category:	dropped
Size (bytes):	7591
Entropy (8bit):	5.503383243391543
Encrypted:	false
SSDEEP:	96:kbIqH2XmwMHoWiM11KTkIjnHkrqCMC2GfuDrqNEBRJbWIAZMt8h:kzHkYoWZ7KYgnHr5XGmyNkrbAqih
MD5:	C843C814293532F02B5B92A95EC3B0E2
SHA1:	1C66F0ECB136BF12AF058C878E94CA0E66BB7A9A
SHA-256:	E84F7CAD68EE0AE80AF95BA84A95F7BE76A16C84558F8EC74BDF1DC51DD18175
SHA-512:	BD6D718DA514B67D659C2FE9285D224EA4FE3109295F63DAB32661EEE7EED876504FA3ADE5E36E2A092F7CC338B6BBD29BC54DF45490DC043B1EF0AD8E2B0CB5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_ArrowMarkup" GUID="{C227C381-B129-442A-8979-72CC96BC2559}">.. <Properties>.. <Property Class="Text" GUID="{6792D1BA-886D-4442-839D-F2DD1ECFD6A6}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_ArrowMarkup</Property>.. <Property Class="Type" GUID="{044EB0D2-6EE8-4648-A33C-831A3D5E774E}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Page Item</Property>.. <Property Class="Image" GUID="{95FC4966-308E-4069-8D6B-FB4E24D363E1}" Name="Icon" inheritaction="Inherit Formula" locked="True" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" Transparent="True" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAALGPC/xhBQAAAAlwSFlzAAAFiQAABYkBbWid+gAAAGlJREFUOE9jGCHAe3GDAhC/B+L5UCHSAFCjARD/h2KyDQkAYpArUA0BcgSA2IFIXADEqC4BMhqQBEnFBTCn7ScBIxsQAHYFsQCoYT6S5gSoMHGAUs2gACRPMwgANYFiChTYpPl5KAAGBgAP7JmAFua6XgAAAABJRU5Erk

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_BoxMarkup\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (584), with CRLF line terminators
Category:	dropped
Size (bytes):	5158
Entropy (8bit):	5.5490581220249
Encrypted:	false
SSDEEP:	48:ctQJevdACDonj4IEU406IaU0Vz0xdDIYaUp3eIFtYUT4hSe/dwu5OYX9udBPAnlZ:e0qdAHod2OIXcSgdO29B/db88w45
MD5:	07DEEFFF91F641BBE7A187CE14E0753D
SHA1:	DB387CB95C0FC74BC77C56D581D4ED27CB417018
SHA-256:	62672EC55295B1635E4A681AC3C4EC7CB8295940942B4C10EAF52392E5C42D24
SHA-512:	9F3B3BD33738EA57AAD1A362AA3290DC6DAE1C5BAC8E719CB45F4F64E68543D96D557349A2AFCB401A83EF09894531B9BB551BB003E6DFBD0A73B1D3E93C03E8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_BoxMarkup" GUID="{D45436B1-5BAC-4C5F-B795-623EB15EE283}">.. <Properties>.. <Property Class="Text" GUID="{2A258761-CEFD-40CF-BA42-B916BBC58C0E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{D45436B1-5BAC-4C5F-B795-623EB15EE283}</Property>.. <Property Class="Number" GUID="{8D589063-FDC0-48F9-8557-6112945D5356}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">9</Property>.. <Property Class="Memo" GUID="{C36E18E1-164A-42A6-B70C-F6572DAE60BD}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Transparency" Order="0" ShowUnits="False" SameLine="False" Tab="General"/>.. <Item Name="Line Width" Order="1" ShowUnits="False" SameLine

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_BoxMarkup\is-9M0O2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (584), with CRLF line terminators
Category:	dropped
Size (bytes):	5158
Entropy (8bit):	5.5490581220249
Encrypted:	false
SSDEEP:	48:ctQJevdACDonj4IEU406IaU0Vz0xdDIYaUp3eIFtYUT4hSe/dwu5OYX9udBPAnlZ:e0qdAHod2OIXcSgdO29B/db88w45
MD5:	07DEEFFF91F641BBE7A187CE14E0753D
SHA1:	DB387CB95C0FC74BC77C56D581D4ED27CB417018
SHA-256:	62672EC55295B1635E4A681AC3C4EC7CB8295940942B4C10EAF52392E5C42D24
SHA-512:	9F3B3BD33738EA57AAD1A362AA3290DC6DAE1C5BAC8E719CB45F4F64E68543D96D557349A2AFCB401A83EF09894531B9BB551BB003E6DFBD0A73B1D3E93C03E8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_BoxMarkup" GUID="{D45436B1-5BAC-4C5F-B795-623EB15EE283}">.. <Properties>.. <Property Class="Text" GUID="{2A258761-CEFD-40CF-BA42-B916BBC58C0E}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{D45436B1-5BAC-4C5F-B795-623EB15EE283}</Property>.. <Property Class="Number" GUID="{8D589063-FDC0-48F9-8557-6112945D5356}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">9</Property>.. <Property Class="Memo" GUID="{C36E18E1-164A-42A6-B70C-F6572DAE60BD}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Transparency" Order="0" ShowUnits="False" SameLine="False" Tab="General"/>.. <Item Name="Line Width" Order="1" ShowUnits="False" SameLine

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_CircleMarkup\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1328), with CRLF line terminators
Category:	dropped
Size (bytes):	5235
Entropy (8bit):	5.611693802687921
Encrypted:	false
SSDEEP:	48:ce+OzM/AP0CDonj4IEU406IaU0Vz0xdDIYQ3iOctYUw1dKqqaIeLOTbgn84Uujkd:ldg/DHopPWY1dy8OTbgn8wYc21Ac
MD5:	ADDCBA56D4F05B22C97D948E96144392
SHA1:	B78B7D5FB58A1802BD522CB4D628D34858BDD9B8
SHA-256:	8368689C6AE7A366711D12F84657E095F9D5F8BE32A5B3D52D447D9C936C5443
SHA-512:	7B496393C27D84AFEB4D19E35A03144911FBDF7D7D960195781C87B243BBCBED02A4ACE5DF49BC6606819F29524E78F4DAD905E56624AD635438BE42A7481D6D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_CircleMarkup" GUID="{67773586-9619-43A1-8114-BF779D1AF1A5}">.. <Properties>.. <Property Class="Text" GUID="{F42CCB64-DF30-442F-ABB1-49A468F2337A}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{67773586-9619-43A1-8114-BF779D1AF1A5}</Property>.. <Property Class="Number" GUID="{C58AA6F5-A73E-4263-B4CB-D7414E28D6F9}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">11</Property>.. <Property Class="Memo" GUID="{B5A16CBB-81F9-4E49-A33C-57C01813E800}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Transparency" Order="0" ShowUnits="False" SameLine="False" Tab="General"/>.. <Item Name="Line Width" Order="1" ShowUnits="False" Same

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_CircleMarkup\is-53871.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1328), with CRLF line terminators
Category:	dropped
Size (bytes):	5235
Entropy (8bit):	5.611693802687921
Encrypted:	false
SSDEEP:	48:ce+OzM/AP0CDonj4IEU406IaU0Vz0xdDIYQ3iOctYUw1dKqqaIeLOTbgn84Uujkd:ldg/DHopPWY1dy8OTbgn8wYc21Ac
MD5:	ADDCBA56D4F05B22C97D948E96144392
SHA1:	B78B7D5FB58A1802BD522CB4D628D34858BDD9B8
SHA-256:	8368689C6AE7A366711D12F84657E095F9D5F8BE32A5B3D52D447D9C936C5443
SHA-512:	7B496393C27D84AFEB4D19E35A03144911FBDF7D7D960195781C87B243BBCBED02A4ACE5DF49BC6606819F29524E78F4DAD905E56624AD635438BE42A7481D6D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_CircleMarkup" GUID="{67773586-9619-43A1-8114-BF779D1AF1A5}">.. <Properties>.. <Property Class="Text" GUID="{F42CCB64-DF30-442F-ABB1-49A468F2337A}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{67773586-9619-43A1-8114-BF779D1AF1A5}</Property>.. <Property Class="Number" GUID="{C58AA6F5-A73E-4263-B4CB-D7414E28D6F9}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">11</Property>.. <Property Class="Memo" GUID="{B5A16CBB-81F9-4E49-A33C-57C01813E800}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Transparency" Order="0" ShowUnits="False" SameLine="False" Tab="General"/>.. <Item Name="Line Width" Order="1" ShowUnits="False" Same

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_CutLine\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1328), with CRLF line terminators
Category:	dropped
Size (bytes):	5912
Entropy (8bit):	5.62873804674484
Encrypted:	false
SSDEEP:	96:vpAq1Y6HoHolY1dy8OTbgn8wYW2zAK38iG45:BoQ55bg8A0FsiB
MD5:	C155C1F0A23D2368D35E8564364C1B5B
SHA1:	4105F146B53BB94E4E76D385B61EC042708B9344
SHA-256:	06F4F2F1085BC65C27D4E2076527B86F1CA798CFDE4EE794FBC948CC79117341
SHA-512:	0EF3A7CFF7D7E3A144270D75467BEC5670994628949C78878FC065398D5C9DC75E95E4EDD6E5D448262D74FB64D946AE76AD47530A25E7B26B15E7FB67790204
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_CutLine" GUID="{7FA53738-ED41-430C-93F3-7F5D6D22AF43}">.. <Properties>.. <Property Class="Text" GUID="{11B9138E-6976-41C8-BF97-766DD815F173}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{7FA53738-ED41-430C-93F3-7F5D6D22AF43}</Property>.. <Property Class="Number" GUID="{789CCD2B-A4B1-435B-864A-9F7367F06D37}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">10</Property>.. <Property Class="Memo" GUID="{84FCEAAE-4A8E-4407-A468-811D164741E9}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Transparency" Order="0" ShowUnits="False" SameLine="False" Tab="General"/>.. <Item Name="Line Width" Order="1" ShowUnits="False" SameLine=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_CutLine\is-10RL3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1328), with CRLF line terminators
Category:	dropped
Size (bytes):	5912
Entropy (8bit):	5.62873804674484
Encrypted:	false
SSDEEP:	96:vpAq1Y6HoHolY1dy8OTbgn8wYW2zAK38iG45:BoQ55bg8A0FsiB
MD5:	C155C1F0A23D2368D35E8564364C1B5B
SHA1:	4105F146B53BB94E4E76D385B61EC042708B9344
SHA-256:	06F4F2F1085BC65C27D4E2076527B86F1CA798CFDE4EE794FBC948CC79117341
SHA-512:	0EF3A7CFF7D7E3A144270D75467BEC5670994628949C78878FC065398D5C9DC75E95E4EDD6E5D448262D74FB64D946AE76AD47530A25E7B26B15E7FB67790204
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_CutLine" GUID="{7FA53738-ED41-430C-93F3-7F5D6D22AF43}">.. <Properties>.. <Property Class="Text" GUID="{11B9138E-6976-41C8-BF97-766DD815F173}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{7FA53738-ED41-430C-93F3-7F5D6D22AF43}</Property>.. <Property Class="Number" GUID="{789CCD2B-A4B1-435B-864A-9F7367F06D37}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">10</Property>.. <Property Class="Memo" GUID="{84FCEAAE-4A8E-4407-A468-811D164741E9}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Transparency" Order="0" ShowUnits="False" SameLine="False" Tab="General"/>.. <Item Name="Line Width" Order="1" ShowUnits="False" SameLine=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Dimension\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (4095), with CRLF line terminators
Category:	dropped
Size (bytes):	7817
Entropy (8bit):	6.041967374734126
Encrypted:	false
SSDEEP:	96:n4uQrda5CrxpCcNcaOsS6XyND3D7L831utmnfruITIOv05MUtTd8IY/:fQZ+C9pjcaOvQiD3D748EnKY/
MD5:	86B74F4A98850190B98DF2F093D8392C
SHA1:	8C91752A074BDA11657C10CC4BF561A983167504
SHA-256:	A43551DB1CB4DD30CD73975E000B51C317AFC60CAF9B5A5702DB745D03051EF4
SHA-512:	2F3DA3183EB66848AA720B364005855B1932E838C29A984D097995728E69C2BFA76770B706D6B45B75A8CF4C61E3360AA2928B5F8852ED101988A15385F7CEE7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Dimension" GUID="{96A630C2-E657-46EF-9BA5-6871EF0EAD83}">.. <Properties>.. <Property Class="Text" GUID="{623855D0-918F-466A-9050-82A4629D0D7B}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_Dimension</Property>.. <Property Class="Type" GUID="{076ABD2E-8A2F-4D89-8C39-DA99B208AC03}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Page Item</Property>.. <Property Class="Image" GUID="{C3C7BB5C-7A79-4617-92E7-B3404902F7EF}" Name="Icon" inheritaction="Inherit Formula" group="Item" OrderIndex="2" DecimalPlaces="" List="cmbList" Transparent="True" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAALGOfPtRkwAAACBjSFJNAACHDwAAjA8AAP1SAACBQAAAfXkAAOmLAAA85QAAGcxzPIV3AAAKOWlDQ1BQaG90b3Nob3AgSUNDIHByb2ZpbGUAAEjHnZZ3VFTXFofPvXd6oc0wAlKG3rvAANJ7k15FYZgZYCgDDjM0sSGiAhFFRJoiSFDEgNFQJFZEsRAUVLAHJAgoMRhFVCxvRtaLrqy89/

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Dimension\is-G9BBN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (4095), with CRLF line terminators
Category:	dropped
Size (bytes):	7817
Entropy (8bit):	6.041967374734126
Encrypted:	false
SSDEEP:	96:n4uQrda5CrxpCcNcaOsS6XyND3D7L831utmnfruITIOv05MUtTd8IY/:fQZ+C9pjcaOvQiD3D748EnKY/
MD5:	86B74F4A98850190B98DF2F093D8392C
SHA1:	8C91752A074BDA11657C10CC4BF561A983167504
SHA-256:	A43551DB1CB4DD30CD73975E000B51C317AFC60CAF9B5A5702DB745D03051EF4
SHA-512:	2F3DA3183EB66848AA720B364005855B1932E838C29A984D097995728E69C2BFA76770B706D6B45B75A8CF4C61E3360AA2928B5F8852ED101988A15385F7CEE7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Dimension" GUID="{96A630C2-E657-46EF-9BA5-6871EF0EAD83}">.. <Properties>.. <Property Class="Text" GUID="{623855D0-918F-466A-9050-82A4629D0D7B}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_Dimension</Property>.. <Property Class="Type" GUID="{076ABD2E-8A2F-4D89-8C39-DA99B208AC03}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Page Item</Property>.. <Property Class="Image" GUID="{C3C7BB5C-7A79-4617-92E7-B3404902F7EF}" Name="Icon" inheritaction="Inherit Formula" group="Item" OrderIndex="2" DecimalPlaces="" List="cmbList" Transparent="True" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAALGOfPtRkwAAACBjSFJNAACHDwAAjA8AAP1SAACBQAAAfXkAAOmLAAA85QAAGcxzPIV3AAAKOWlDQ1BQaG90b3Nob3AgSUNDIHByb2ZpbGUAAEjHnZZ3VFTXFofPvXd6oc0wAlKG3rvAANJ7k15FYZgZYCgDDjM0sSGiAhFFRJoiSFDEgNFQJFZEsRAUVLAHJAgoMRhFVCxvRtaLrqy89/

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Highlighter\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (4181), with CRLF line terminators
Category:	dropped
Size (bytes):	6109
Entropy (8bit):	6.105460541782404
Encrypted:	false
SSDEEP:	96:koYaflY5CrxpCcNcaOsS6XyND3D7L831utjCDxhbGBw43zXcIa:Xl0C9pjcaOvQiD3D7485CDHyTDi
MD5:	50325286CDCDBC44D5F800F75A837CC1
SHA1:	29F94ABB122DA3DC85DE41DF5B58D76C26EFFDF0
SHA-256:	C886F622D25C827FC8F297B1E12DE041FF0C4D9FF768A3FB78707111FC0FACF5
SHA-512:	01CCCD20638B2A4BD0733989F825022A8B38FD8454336098DF9D07B9DA46561F916E02FF8D0B64EF419C6DC36A074A972FA787BD4DB5BB09A5EE99E9B138FDE1
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Highlighter" GUID="{38369737-B955-4AB7-B081-D64E4A09A5F7}">.. <Properties>.. <Property Class="Text" GUID="{CA78BB50-A514-4BA8-AAA8-C8D416EE8FFA}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_Highlighter</Property>.. <Property Class="Type" GUID="{8EE3807A-F97B-407C-91E5-2C039653E6B0}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Page Item</Property>.. <Property Class="Image" GUID="{3F7BA634-D1FC-4006-8269-FFC74D288198}" Name="Icon" inheritaction="Inherit Formula" group="Item" OrderIndex="2" DecimalPlaces="" List="cmbList" Transparent="-1" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAALGOfPtRkwAAACBjSFJNAACHDwAAjA8AAP1SAACBQAAAfXkAAOmLAAA85QAAGcxzPIV3AAAKOWlDQ1BQaG90b3Nob3AgSUNDIHByb2ZpbGUAAEjHnZZ3VFTXFofPvXd6oc0wAlKG3rvAANJ7k15FYZgZYCgDDjM0sSGiAhFFRJoiSFDEgNFQJFZEsRAUVLAHJAgoMRhFVCxvRta

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Highlighter\is-HIADV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (4181), with CRLF line terminators
Category:	dropped
Size (bytes):	6109
Entropy (8bit):	6.105460541782404
Encrypted:	false
SSDEEP:	96:koYaflY5CrxpCcNcaOsS6XyND3D7L831utjCDxhbGBw43zXcIa:Xl0C9pjcaOvQiD3D7485CDHyTDi
MD5:	50325286CDCDBC44D5F800F75A837CC1
SHA1:	29F94ABB122DA3DC85DE41DF5B58D76C26EFFDF0
SHA-256:	C886F622D25C827FC8F297B1E12DE041FF0C4D9FF768A3FB78707111FC0FACF5
SHA-512:	01CCCD20638B2A4BD0733989F825022A8B38FD8454336098DF9D07B9DA46561F916E02FF8D0B64EF419C6DC36A074A972FA787BD4DB5BB09A5EE99E9B138FDE1
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Highlighter" GUID="{38369737-B955-4AB7-B081-D64E4A09A5F7}">.. <Properties>.. <Property Class="Text" GUID="{CA78BB50-A514-4BA8-AAA8-C8D416EE8FFA}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_Highlighter</Property>.. <Property Class="Type" GUID="{8EE3807A-F97B-407C-91E5-2C039653E6B0}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Page Item</Property>.. <Property Class="Image" GUID="{3F7BA634-D1FC-4006-8269-FFC74D288198}" Name="Icon" inheritaction="Inherit Formula" group="Item" OrderIndex="2" DecimalPlaces="" List="cmbList" Transparent="-1" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAALGOfPtRkwAAACBjSFJNAACHDwAAjA8AAP1SAACBQAAAfXkAAOmLAAA85QAAGcxzPIV3AAAKOWlDQ1BQaG90b3Nob3AgSUNDIHByb2ZpbGUAAEjHnZZ3VFTXFofPvXd6oc0wAlKG3rvAANJ7k15FYZgZYCgDDjM0sSGiAhFFRJoiSFDEgNFQJFZEsRAUVLAHJAgoMRhFVCxvRta

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Legend\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (4163), with CRLF line terminators
Category:	dropped
Size (bytes):	7435
Entropy (8bit):	6.066863474172322
Encrypted:	false
SSDEEP:	96:ZYcC+n7dua5CrxpCcNcaOsS6XyND3D7L831utr0ceAOvEqcEeEUKyCWose3:Z57du+C9pjcaOvQiD3D748edAAuW
MD5:	744AFEBCFF847FD320137CB1AAF6C1CF
SHA1:	1B249F41A8448FBF2AA0E203BB41D93CA1C6DA5D
SHA-256:	AD3F257286959553CFEC819D116DDFA437DC0755B910B6D418E083C6ED85C905
SHA-512:	1F892D8190879BBBCF4CD7B1B83B0B0BF2D3DC4F39BA0C5DB100C8DD9020D71AB45CD42455078C9A9E85E51335582792A6B6569600687F3FE3EF876E43F7DA83
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Legend" GUID="{B5DD03D5-B732-4605-8246-296553A6FF6D}">.. <Properties>.. <Property Class="Text" GUID="{C191D034-A795-4176-A179-AE59CEF5DD9C}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_Legend</Property>.. <Property Class="Type" GUID="{4952EA38-E215-4F40-87AD-70ABE7CF54FB}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Page Item</Property>.. <Property Class="Image" GUID="{36006350-EDC9-4FD8-9B65-924AEB359E2E}" Name="Icon" inheritaction="Inherit Formula" group="Item" OrderIndex="2" DecimalPlaces="" List="cmbList" Transparent="True" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAALGOfPtRkwAAACBjSFJNAACHDwAAjA8AAP1SAACBQAAAfXkAAOmLAAA85QAAGcxzPIV3AAAKOWlDQ1BQaG90b3Nob3AgSUNDIHByb2ZpbGUAAEjHnZZ3VFTXFofPvXd6oc0wAlKG3rvAANJ7k15FYZgZYCgDDjM0sSGiAhFFRJoiSFDEgNFQJFZEsRAUVLAHJAgoMRhFVCxvRtaLrqy89/Ly++Os

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Legend\is-MH0FH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (4163), with CRLF line terminators
Category:	dropped
Size (bytes):	7435
Entropy (8bit):	6.066863474172322
Encrypted:	false
SSDEEP:	96:ZYcC+n7dua5CrxpCcNcaOsS6XyND3D7L831utr0ceAOvEqcEeEUKyCWose3:Z57du+C9pjcaOvQiD3D748edAAuW
MD5:	744AFEBCFF847FD320137CB1AAF6C1CF
SHA1:	1B249F41A8448FBF2AA0E203BB41D93CA1C6DA5D
SHA-256:	AD3F257286959553CFEC819D116DDFA437DC0755B910B6D418E083C6ED85C905
SHA-512:	1F892D8190879BBBCF4CD7B1B83B0B0BF2D3DC4F39BA0C5DB100C8DD9020D71AB45CD42455078C9A9E85E51335582792A6B6569600687F3FE3EF876E43F7DA83
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Legend" GUID="{B5DD03D5-B732-4605-8246-296553A6FF6D}">.. <Properties>.. <Property Class="Text" GUID="{C191D034-A795-4176-A179-AE59CEF5DD9C}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_Legend</Property>.. <Property Class="Type" GUID="{4952EA38-E215-4F40-87AD-70ABE7CF54FB}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Page Item</Property>.. <Property Class="Image" GUID="{36006350-EDC9-4FD8-9B65-924AEB359E2E}" Name="Icon" inheritaction="Inherit Formula" group="Item" OrderIndex="2" DecimalPlaces="" List="cmbList" Transparent="True" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAALGOfPtRkwAAACBjSFJNAACHDwAAjA8AAP1SAACBQAAAfXkAAOmLAAA85QAAGcxzPIV3AAAKOWlDQ1BQaG90b3Nob3AgSUNDIHByb2ZpbGUAAEjHnZZ3VFTXFofPvXd6oc0wAlKG3rvAANJ7k15FYZgZYCgDDjM0sSGiAhFFRJoiSFDEgNFQJFZEsRAUVLAHJAgoMRhFVCxvRtaLrqy89/Ly++Os

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Note\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1360), with CRLF line terminators
Category:	dropped
Size (bytes):	7603
Entropy (8bit):	5.6110391752964235
Encrypted:	false
SSDEEP:	96:B4D8W5ZdXIYdTnHgkHk16WAF8OUIDNhd1dVjpH3GvRQ:wfjdIgDNRpWvW
MD5:	621009C796770B92AC373FEA2492D351
SHA1:	ACC911E648EC2DA97B82A0EBA5CFA263519E0157
SHA-256:	192BEA12962395B084E64CF146F140B326CDA181AEDF26A93A276C3ADB564DDE
SHA-512:	80C03480AF7C79D8F2E8F55A75D0EDD691AAF605E082B21D8643FA55179FD818AD1F0B7154898BA8939096B205050088E1CA241197AC60B107CC1AC9CB1973AB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Note" GUID="{22D750C8-DB1C-42A1-BC3C-F570A9F7CA60}">.. <Properties>.. <Property Class="Text" GUID="{4E4DAB68-DBE6-456F-A516-0A0868413B59}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Note</Property>.. <Property Class="Type" GUID="{964D548C-D186-4DBB-81A7-7881E3F3BE38}" Name="Type" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">Page Item</Property>.. <Property Class="Memo" GUID="{7E9C8B32-9F86-4352-A87E-2A8BD144A9E8}" Name="Text" input="True" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList"/>.. <Property Class="Number" GUID="{82196D56-C63F-4B79-9AFB-A3ABB7F5DC8D}" Name="Text Height" inheritaction="Inherit Formula" locked="True" hidden="True" units="px" inputunits="px" group="Item" OrderIndex="4" DecimalPlaces="" List="cmbList" PluginToExecute="cmbList" Expression="True">if ([Scaled] = true) then begin.. If (Item.GetPropertyResult

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Note\_Hyperlink\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (5047), with CRLF line terminators
Category:	dropped
Size (bytes):	8948
Entropy (8bit):	5.8519530548990035
Encrypted:	false
SSDEEP:	192:SdOeuVdO4CdO3dOTdOVydOQC9pjcaOvQiD3D748Q/0I1Y:SdOldOzdO3dOTdOAdOQuRcxvQibno/0F
MD5:	55C88D488883B8ECD95585354EFBB8D6
SHA1:	CBC84D95B2E015F5EFFBBE45BC73BE24CF8E4F5B
SHA-256:	2A6AD99033B1D5E323C1231E27C7054C4D28A4C92541450FE25214673285A465
SHA-512:	305C36497DFECC4D5A12BD90CB8FE6E8DBA5C319139C434BC768A3C6E06FAC9DD817B0B5E77D2752935585D238BB4633332F1810D16086BB00E7B7914600D0F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Hyperlink" GUID="{2765C7C9-C87F-4C3E-BD85-1F7EBCE02205}">.. <Properties>.. <Property Class="Text" GUID="{CBC7AA37-3A00-4FA3-A043-16EF2783850F}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Hyperlink</Property>.. <Property Class="Type" GUID="{061096CF-3B17-4384-82F9-249F484BFD52}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Note\_Hyperlink\is-J2I6C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (5047), with CRLF line terminators
Category:	dropped
Size (bytes):	8948
Entropy (8bit):	5.8519530548990035
Encrypted:	false
SSDEEP:	192:SdOeuVdO4CdO3dOTdOVydOQC9pjcaOvQiD3D748Q/0I1Y:SdOldOzdO3dOTdOAdOQuRcxvQibno/0F
MD5:	55C88D488883B8ECD95585354EFBB8D6
SHA1:	CBC84D95B2E015F5EFFBBE45BC73BE24CF8E4F5B
SHA-256:	2A6AD99033B1D5E323C1231E27C7054C4D28A4C92541450FE25214673285A465
SHA-512:	305C36497DFECC4D5A12BD90CB8FE6E8DBA5C319139C434BC768A3C6E06FAC9DD817B0B5E77D2752935585D238BB4633332F1810D16086BB00E7B7914600D0F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Hyperlink" GUID="{2765C7C9-C87F-4C3E-BD85-1F7EBCE02205}">.. <Properties>.. <Property Class="Text" GUID="{CBC7AA37-3A00-4FA3-A043-16EF2783850F}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Hyperlink</Property>.. <Property Class="Type" GUID="{061096CF-3B17-4384-82F9-249F484BFD52}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Note\_Label\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3819
Entropy (8bit):	5.400210136419622
Encrypted:	false
SSDEEP:	48:cEfZo5lhXqwa24DIN/32sSDonK5hcgLEiaULxJufLgsDHhquz:ZfZWDqD24DI135IcHhquz
MD5:	AEB8D09CA40E549BF161A8CA9D89142B
SHA1:	821D4C148810658F87C41787E220E69739B9D179
SHA-256:	51E698D2ECB2A6D0E6F519D4421436A20A02D65BD3F1FC36C6C15F0F2FDDB817
SHA-512:	EC8DFBACBD6C3C172EB047AB3DAD3FCD19B927870D467B41484A31CF6E3C9351FC970206CE2115611593A794A8781F5ED6ED4B51D8077428BB1420083096F2E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Label" GUID="{78885BB1-B239-4CDD-80CB-B6DC272BC425}">.. <Properties>.. <Property Class="Text" GUID="{ABCC3133-E3C4-419A-909F-337B8B1A6B93}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_Label</Property>.. <Property Class="Type" GUID="{95B51047-C7AF-4A87-9ABA-0BD0254DBD61}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Note</Property>.. <Property Class="Memo" GUID="{66D22307-EF01-4B70-8800-F198BDF65E6B}" Name="Text" input="True" group="Item" OrderIndex="2" DecimalPlaces="" List="cmbList">[..\..\Name]</Property>.. <Property Class="CheckBox" GUID="{413B1B49-D1C7-4EA1-9ED8-B11CFA741873}" Name="AutoSize" input="True" group="Item" OrderIndex="4" DecimalPlaces="" List="cmbList" PluginToExecute="cmbList">True</Property>.. <Property Class="CheckBox" GUID="{AD971EEE-EC80-4081-A142-15A927619E7E}" Name="AutoCenter" input="True" group="Item" OrderIndex="7"

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Note\_Label\_Area Label\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3180
Entropy (8bit):	5.36197408896371
Encrypted:	false
SSDEEP:	48:cStC9QMqmz23Z4JDonK5FgILcalE2CkufLg09vtUuU:VEmMqZZ4hq9vOuU
MD5:	5FCF7380BBC5947FCBB0DD0F9D24F0E9
SHA1:	0DBBC145DF132B0FAFC3903CD2D26F6855E966D6
SHA-256:	5637EF26476B90FB362B02630ABF9AC3FF3E705C2B3A064359A058544F13076A
SHA-512:	6172A1D24363D1EFFA913D4F9C630F327637C73AF212FAAA13F68E736FFFE123A724869C2D7F0A00E1353A2560EECF04A2B4B9EE28DA369BA196F780423B98FC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Area Label" GUID="{71320E53-2749-4F22-8E6C-BDAD901108E8}">.. <Properties>.. <Property Class="Text" GUID="{B34D72C6-3FEC-44CC-87B9-98CF42A35FEE}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_Area Label</Property>.. <Property Class="Type" GUID="{21E3F2A1-92F8-42EB-A681-8B99A5E54BD6}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Label</Property>.. <Property Class="Memo" GUID="{2C2D05A5-5F23-4DCF-A143-A8452A0E3887}" Name="Text" input="True" group="Item" OrderIndex="2" DecimalPlaces="" List="cmbList">[..\..\Name]..[..\Takeoff] [..\..\!Units('Takeoff')]</Property>.. <Property Class="CheckBox" GUID="{781ABEA8-78A3-4AFA-8A18-17D9CA0EE9CC}" Name="Scaled" input="True" group="Item" OrderIndex="22" DecimalPlaces="2">True</Property>.. <Property Class="Memo" GUID="{4D8AE826-A495-418B-9E69-DE6776F91A8F}" Name="Form Layout" systemhidden="True" Orde

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Note\_Label\_Area Label\_Subtract Area Label\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.546478064005775
Encrypted:	false
SSDEEP:	24:2dFDulX2swvApWaogAW6DqHoWbqtS13BVz1OcvsS9f2WAdOcojv:cslvOiqo1Yg/RT
MD5:	5362AEDFF545C517B5B287C836C87656
SHA1:	FC37F97799C010FBFF1479FF34E98348F5158CFE
SHA-256:	584756D369F1113F5067FB385F178534EA5BFBEFA9A6D1DF365E463AA5950764
SHA-512:	3E152CC68AD4D76ABE9A4433CA121D0D81EF338ED1F1379B8C4B86EE5CE644651FF1BE59B1BF9C3B716641BC5A025E1464B5CBFFE33D85293C6AA7165E43A4C3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Subtract Area Label" GUID="{4AD8852B-BE8A-4153-9117-A4E28A6507EE}">.. <Properties>.. <Property Class="Text" GUID="{12E1DE8C-E9A6-4C04-91BE-DD839F2A3035}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_Subtract Area Label</Property>.. <Property Class="Type" GUID="{F2FA0949-8E51-44D2-BB40-63F745C31ACB}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Area Label</Property>.. <Property Class="Memo" GUID="{14CA6CB5-AAC4-4DB5-B2BB-552CFBACC3C4}" Name="Text" input="True" group="Item" OrderIndex="2" DecimalPlaces="" List="cmbList">[..\..\Name]..[..\Takeoff] [..\..\..\!Units('Takeoff')]</Property>.. <Property Class="Number" GUID="{D76C7A48-B989-4CCF-8B1D-D7969971878E}" Name="OrderIndex" systemhidden="True" OrderIndex="10" DecimalPlaces="">0</Property>.. <Property Class="Text" GUID="{54707732-320D-4128-A46C-1B6FF45B0D30}" Name="GUID" inheritaction

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Note\_Label\_Area Label\_Subtract Area Label\is-7FHHG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.546478064005775
Encrypted:	false
SSDEEP:	24:2dFDulX2swvApWaogAW6DqHoWbqtS13BVz1OcvsS9f2WAdOcojv:cslvOiqo1Yg/RT
MD5:	5362AEDFF545C517B5B287C836C87656
SHA1:	FC37F97799C010FBFF1479FF34E98348F5158CFE
SHA-256:	584756D369F1113F5067FB385F178534EA5BFBEFA9A6D1DF365E463AA5950764
SHA-512:	3E152CC68AD4D76ABE9A4433CA121D0D81EF338ED1F1379B8C4B86EE5CE644651FF1BE59B1BF9C3B716641BC5A025E1464B5CBFFE33D85293C6AA7165E43A4C3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Subtract Area Label" GUID="{4AD8852B-BE8A-4153-9117-A4E28A6507EE}">.. <Properties>.. <Property Class="Text" GUID="{12E1DE8C-E9A6-4C04-91BE-DD839F2A3035}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_Subtract Area Label</Property>.. <Property Class="Type" GUID="{F2FA0949-8E51-44D2-BB40-63F745C31ACB}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Area Label</Property>.. <Property Class="Memo" GUID="{14CA6CB5-AAC4-4DB5-B2BB-552CFBACC3C4}" Name="Text" input="True" group="Item" OrderIndex="2" DecimalPlaces="" List="cmbList">[..\..\Name]..[..\Takeoff] [..\..\..\!Units('Takeoff')]</Property>.. <Property Class="Number" GUID="{D76C7A48-B989-4CCF-8B1D-D7969971878E}" Name="OrderIndex" systemhidden="True" OrderIndex="10" DecimalPlaces="">0</Property>.. <Property Class="Text" GUID="{54707732-320D-4128-A46C-1B6FF45B0D30}" Name="GUID" inheritaction

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Note\_Label\_Area Label\is-22O0A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3180
Entropy (8bit):	5.36197408896371
Encrypted:	false
SSDEEP:	48:cStC9QMqmz23Z4JDonK5FgILcalE2CkufLg09vtUuU:VEmMqZZ4hq9vOuU
MD5:	5FCF7380BBC5947FCBB0DD0F9D24F0E9
SHA1:	0DBBC145DF132B0FAFC3903CD2D26F6855E966D6
SHA-256:	5637EF26476B90FB362B02630ABF9AC3FF3E705C2B3A064359A058544F13076A
SHA-512:	6172A1D24363D1EFFA913D4F9C630F327637C73AF212FAAA13F68E736FFFE123A724869C2D7F0A00E1353A2560EECF04A2B4B9EE28DA369BA196F780423B98FC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Area Label" GUID="{71320E53-2749-4F22-8E6C-BDAD901108E8}">.. <Properties>.. <Property Class="Text" GUID="{B34D72C6-3FEC-44CC-87B9-98CF42A35FEE}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_Area Label</Property>.. <Property Class="Type" GUID="{21E3F2A1-92F8-42EB-A681-8B99A5E54BD6}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Label</Property>.. <Property Class="Memo" GUID="{2C2D05A5-5F23-4DCF-A143-A8452A0E3887}" Name="Text" input="True" group="Item" OrderIndex="2" DecimalPlaces="" List="cmbList">[..\..\Name]..[..\Takeoff] [..\..\!Units('Takeoff')]</Property>.. <Property Class="CheckBox" GUID="{781ABEA8-78A3-4AFA-8A18-17D9CA0EE9CC}" Name="Scaled" input="True" group="Item" OrderIndex="22" DecimalPlaces="2">True</Property>.. <Property Class="Memo" GUID="{4D8AE826-A495-418B-9E69-DE6776F91A8F}" Name="Form Layout" systemhidden="True" Orde

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Note\_Label\is-7O12A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3819
Entropy (8bit):	5.400210136419622
Encrypted:	false
SSDEEP:	48:cEfZo5lhXqwa24DIN/32sSDonK5hcgLEiaULxJufLgsDHhquz:ZfZWDqD24DI135IcHhquz
MD5:	AEB8D09CA40E549BF161A8CA9D89142B
SHA1:	821D4C148810658F87C41787E220E69739B9D179
SHA-256:	51E698D2ECB2A6D0E6F519D4421436A20A02D65BD3F1FC36C6C15F0F2FDDB817
SHA-512:	EC8DFBACBD6C3C172EB047AB3DAD3FCD19B927870D467B41484A31CF6E3C9351FC970206CE2115611593A794A8781F5ED6ED4B51D8077428BB1420083096F2E7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Label" GUID="{78885BB1-B239-4CDD-80CB-B6DC272BC425}">.. <Properties>.. <Property Class="Text" GUID="{ABCC3133-E3C4-419A-909F-337B8B1A6B93}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_Label</Property>.. <Property Class="Type" GUID="{95B51047-C7AF-4A87-9ABA-0BD0254DBD61}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Note</Property>.. <Property Class="Memo" GUID="{66D22307-EF01-4B70-8800-F198BDF65E6B}" Name="Text" input="True" group="Item" OrderIndex="2" DecimalPlaces="" List="cmbList">[..\..\Name]</Property>.. <Property Class="CheckBox" GUID="{413B1B49-D1C7-4EA1-9ED8-B11CFA741873}" Name="AutoSize" input="True" group="Item" OrderIndex="4" DecimalPlaces="" List="cmbList" PluginToExecute="cmbList">True</Property>.. <Property Class="CheckBox" GUID="{AD971EEE-EC80-4081-A142-15A927619E7E}" Name="AutoCenter" input="True" group="Item" OrderIndex="7"

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Note\is-T1S6K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1360), with CRLF line terminators
Category:	dropped
Size (bytes):	7603
Entropy (8bit):	5.6110391752964235
Encrypted:	false
SSDEEP:	96:B4D8W5ZdXIYdTnHgkHk16WAF8OUIDNhd1dVjpH3GvRQ:wfjdIgDNRpWvW
MD5:	621009C796770B92AC373FEA2492D351
SHA1:	ACC911E648EC2DA97B82A0EBA5CFA263519E0157
SHA-256:	192BEA12962395B084E64CF146F140B326CDA181AEDF26A93A276C3ADB564DDE
SHA-512:	80C03480AF7C79D8F2E8F55A75D0EDD691AAF605E082B21D8643FA55179FD818AD1F0B7154898BA8939096B205050088E1CA241197AC60B107CC1AC9CB1973AB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Note" GUID="{22D750C8-DB1C-42A1-BC3C-F570A9F7CA60}">.. <Properties>.. <Property Class="Text" GUID="{4E4DAB68-DBE6-456F-A516-0A0868413B59}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Note</Property>.. <Property Class="Type" GUID="{964D548C-D186-4DBB-81A7-7881E3F3BE38}" Name="Type" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">Page Item</Property>.. <Property Class="Memo" GUID="{7E9C8B32-9F86-4352-A87E-2A8BD144A9E8}" Name="Text" input="True" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList"/>.. <Property Class="Number" GUID="{82196D56-C63F-4B79-9AFB-A3ABB7F5DC8D}" Name="Text Height" inheritaction="Inherit Formula" locked="True" hidden="True" units="px" inputunits="px" group="Item" OrderIndex="4" DecimalPlaces="" List="cmbList" PluginToExecute="cmbList" Expression="True">if ([Scaled] = true) then begin.. If (Item.GetPropertyResult

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Overlay\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1980), with CRLF line terminators
Category:	dropped
Size (bytes):	6370
Entropy (8bit):	5.2314224474436015
Encrypted:	false
SSDEEP:	96:k44Kqd2uUDMdOkQWtbd/ulDMdOkQWao6bd/uChMdOkQWRX2d1qd04hMdOqQWGbdA:GfdOE7dOE/HdOEIdOCMdOEPdOEi
MD5:	823F6453CD389DF903792D391F103182
SHA1:	8261BB8FF142E8D024C027FEADCE0CA9FA8B55E7
SHA-256:	DB338FB0C342257C2196EC0D536EF20E4A81CD38F701A1CA92A32F4E0CD147C2
SHA-512:	E9FB7EC0EF1C761F8785105FDCE90A7D85919D686BCD3B94EA977AF77D76BC57EFB9FD4946BC1B7A4A4F3C9BFE8FD4D1A88790CDA6BE034FE8CF091FB1E298A2
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Overlay" GUID="{6A6CDB37-6865-45A5-8D5D-3CE070E7D0E5}">.. <Properties>.. <Property Class="Text" GUID="{B277DA14-FEC2-4140-9330-A87F64E3DB28}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ParseFormula="-1" ListParseFormula="0" ToolHint="">_Overlay</Property>.. <Property Class="

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Overlay\_Comparative Overlay\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (4577), with CRLF line terminators
Category:	dropped
Size (bytes):	7722
Entropy (8bit):	5.866863759609333
Encrypted:	false
SSDEEP:	192:gdOBdOv2dOlC9pjcaOvQiD3D748HedOegdOp:gdOBdOOdOluRcxvQibnPedOegdOp
MD5:	CC5CC77892D8185C6711944571CD8C85
SHA1:	A8787FCD0FEEA73C7EB49C0F11395CE27E24B8D7
SHA-256:	730364F7C55AEE4F0AD2C7F9A9B115E1C6B0B5C480C27D367B745D4CC893ACE0
SHA-512:	1553B412FACF28DCC5C04A3CCC731812B88536FAF507B660EA2B3C27943185A42AD9D3970C225ECAA065A370A7180E03BB921F4267ABA5BFBA7893BA18FFCB1F
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Comparative Overlay" GUID="{D303BB83-3F3D-4F91-8C91-4A85B5BBB63D}">.. <Properties>.. <Property Class="Text" GUID="{4ABF7E75-380A-4A7F-BD2E-C45962D5DDEF}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Comparative Overlay</Property>.. <Property Class="Type" GUID="{E3C60ECB-F8A5-4445-90FF-6F4394A27D0B}" Name="Type" inheritaction

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Overlay\_Comparative Overlay\is-I08FS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (4577), with CRLF line terminators
Category:	dropped
Size (bytes):	7722
Entropy (8bit):	5.866863759609333
Encrypted:	false
SSDEEP:	192:gdOBdOv2dOlC9pjcaOvQiD3D748HedOegdOp:gdOBdOOdOluRcxvQibnPedOegdOp
MD5:	CC5CC77892D8185C6711944571CD8C85
SHA1:	A8787FCD0FEEA73C7EB49C0F11395CE27E24B8D7
SHA-256:	730364F7C55AEE4F0AD2C7F9A9B115E1C6B0B5C480C27D367B745D4CC893ACE0
SHA-512:	1553B412FACF28DCC5C04A3CCC731812B88536FAF507B660EA2B3C27943185A42AD9D3970C225ECAA065A370A7180E03BB921F4267ABA5BFBA7893BA18FFCB1F
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Comparative Overlay" GUID="{D303BB83-3F3D-4F91-8C91-4A85B5BBB63D}">.. <Properties>.. <Property Class="Text" GUID="{4ABF7E75-380A-4A7F-BD2E-C45962D5DDEF}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Comparative Overlay</Property>.. <Property Class="Type" GUID="{E3C60ECB-F8A5-4445-90FF-6F4394A27D0B}" Name="Type" inheritaction

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Overlay\is-16RFM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1980), with CRLF line terminators
Category:	dropped
Size (bytes):	6370
Entropy (8bit):	5.2314224474436015
Encrypted:	false
SSDEEP:	96:k44Kqd2uUDMdOkQWtbd/ulDMdOkQWao6bd/uChMdOkQWRX2d1qd04hMdOqQWGbdA:GfdOE7dOE/HdOEIdOCMdOEPdOEi
MD5:	823F6453CD389DF903792D391F103182
SHA1:	8261BB8FF142E8D024C027FEADCE0CA9FA8B55E7
SHA-256:	DB338FB0C342257C2196EC0D536EF20E4A81CD38F701A1CA92A32F4E0CD147C2
SHA-512:	E9FB7EC0EF1C761F8785105FDCE90A7D85919D686BCD3B94EA977AF77D76BC57EFB9FD4946BC1B7A4A4F3C9BFE8FD4D1A88790CDA6BE034FE8CF091FB1E298A2
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Overlay" GUID="{6A6CDB37-6865-45A5-8D5D-3CE070E7D0E5}">.. <Properties>.. <Property Class="Text" GUID="{B277DA14-FEC2-4140-9330-A87F64E3DB28}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ParseFormula="-1" ListParseFormula="0" ToolHint="">_Overlay</Property>.. <Property Class="

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_PenMarkup\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (724), with CRLF line terminators
Category:	dropped
Size (bytes):	5298
Entropy (8bit):	5.5841514935907925
Encrypted:	false
SSDEEP:	48:crOaVHoj/0ThiCDonj4IEU406IaU0Vz0xdDIYBdOXcfttYUT4hR20Vq3IdVYXIdd:w3Hoz0ThiHocBPcR20TD2FdTqX8345
MD5:	5DBB4F3A9A0E3E953CC579A935439092
SHA1:	D4D439217743EA945403D05174E3C31BCD86D70D
SHA-256:	ADA51D60B0B933006827C9EB91428DE2E349DBE270158A9F5E7BA341FC0B324E
SHA-512:	ED7CF2B2E649B0FF04C8020A672B60C811C506629923FDC0FFAFAD8022686493A48DA72AF23ED4C8CA7FEF701AA495B3FC7A959F485F68CF53DE95A2DBFF36A4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_PenMarkup" GUID="{DB99F76E-CFE7-454A-B568-A87C53D11F48}">.. <Properties>.. <Property Class="Text" GUID="{FC9C4DB0-2B87-4A6F-A334-30E9B5C821A9}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{DB99F76E-CFE7-454A-B568-A87C53D11F48}</Property>.. <Property Class="Number" GUID="{8280E387-49E7-40D3-A56E-AE7D285D2159}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">8</Property>.. <Property Class="Memo" GUID="{811B372D-857B-4E87-9B3A-9DD8F68AC0D6}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Transparency" Order="0" ShowUnits="False" SameLine="False" Tab="General"/>.. <Item Name="Line Width" Order="1" ShowUnits="False" SameLine

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_PenMarkup\is-F8PV3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (724), with CRLF line terminators
Category:	dropped
Size (bytes):	5298
Entropy (8bit):	5.5841514935907925
Encrypted:	false
SSDEEP:	48:crOaVHoj/0ThiCDonj4IEU406IaU0Vz0xdDIYBdOXcfttYUT4hR20Vq3IdVYXIdd:w3Hoz0ThiHocBPcR20TD2FdTqX8345
MD5:	5DBB4F3A9A0E3E953CC579A935439092
SHA1:	D4D439217743EA945403D05174E3C31BCD86D70D
SHA-256:	ADA51D60B0B933006827C9EB91428DE2E349DBE270158A9F5E7BA341FC0B324E
SHA-512:	ED7CF2B2E649B0FF04C8020A672B60C811C506629923FDC0FFAFAD8022686493A48DA72AF23ED4C8CA7FEF701AA495B3FC7A959F485F68CF53DE95A2DBFF36A4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_PenMarkup" GUID="{DB99F76E-CFE7-454A-B568-A87C53D11F48}">.. <Properties>.. <Property Class="Text" GUID="{FC9C4DB0-2B87-4A6F-A334-30E9B5C821A9}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{DB99F76E-CFE7-454A-B568-A87C53D11F48}</Property>.. <Property Class="Number" GUID="{8280E387-49E7-40D3-A56E-AE7D285D2159}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">8</Property>.. <Property Class="Memo" GUID="{811B372D-857B-4E87-9B3A-9DD8F68AC0D6}" Name="Form Layout" systemhidden="True" OrderIndex="9" DecimalPlaces="2"><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Transparency" Order="0" ShowUnits="False" SameLine="False" Tab="General"/>.. <Item Name="Line Width" Order="1" ShowUnits="False" SameLine

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_RevisionCloud\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (2105), with CRLF line terminators
Category:	dropped
Size (bytes):	4372
Entropy (8bit):	4.710950646444888
Encrypted:	false
SSDEEP:	48:cDG5JT1ORD5ddegwo/DonKuWpwrg1Xn37tYUFfoGO36ncJagSQQRuKh2RRtPCI:mGj1UDHdZxnjHJVoR36ncJa5BZ0YI
MD5:	71E905CA90D846AE46893CBE6CCD53F4
SHA1:	90272D698ED62F97C8B272CDD5A564C177A4A203
SHA-256:	BA6C731591F698D090DD2625956496D433E7970A299A8D8C1FF70699818893B1
SHA-512:	4F1740127F59CF7DD1C0009A2DAC25002C5230A9003BFA9C605213AD0EB9D29825DD224BC7FEA45AF72FEBBBAC82909B898716B822E7155EB101BE99F6FC2EAD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_RevisionCloud" GUID="{04C71ED0-6D89-4E73-AE88-0CD1EDA967AB}">.. <Properties>.. <Property Class="Text" GUID="{08DE6081-26CD-4CC8-B8BB-C9C1EC9C1112}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{04C71ED0-6D89-4E73-AE88-0CD1EDA967AB}</Property>.. <Property Class="Number" GUID="{74A19144-3A91-4E53-BEE5-7F07C1AEBFD3}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">5.75</Property>.. <Property Class="Memo" GUID="{0B37E044-2148-4B67-971C-313236ED2F86}" Name="Form Layout" systemhidden="True" OrderIndex="13" DecimalPlaces=""><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="BorderColor" Order="1" ShowUnits="False" SameLine="

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_RevisionCloud\is-IPBIE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (2105), with CRLF line terminators
Category:	dropped
Size (bytes):	4372
Entropy (8bit):	4.710950646444888
Encrypted:	false
SSDEEP:	48:cDG5JT1ORD5ddegwo/DonKuWpwrg1Xn37tYUFfoGO36ncJagSQQRuKh2RRtPCI:mGj1UDHdZxnjHJVoR36ncJa5BZ0YI
MD5:	71E905CA90D846AE46893CBE6CCD53F4
SHA1:	90272D698ED62F97C8B272CDD5A564C177A4A203
SHA-256:	BA6C731591F698D090DD2625956496D433E7970A299A8D8C1FF70699818893B1
SHA-512:	4F1740127F59CF7DD1C0009A2DAC25002C5230A9003BFA9C605213AD0EB9D29825DD224BC7FEA45AF72FEBBBAC82909B898716B822E7155EB101BE99F6FC2EAD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_RevisionCloud" GUID="{04C71ED0-6D89-4E73-AE88-0CD1EDA967AB}">.. <Properties>.. <Property Class="Text" GUID="{08DE6081-26CD-4CC8-B8BB-C9C1EC9C1112}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{04C71ED0-6D89-4E73-AE88-0CD1EDA967AB}</Property>.. <Property Class="Number" GUID="{74A19144-3A91-4E53-BEE5-7F07C1AEBFD3}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">5.75</Property>.. <Property Class="Memo" GUID="{0B37E044-2148-4B67-971C-313236ED2F86}" Name="Form Layout" systemhidden="True" OrderIndex="13" DecimalPlaces=""><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="BorderColor" Order="1" ShowUnits="False" SameLine="

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_RubberStamp\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	6032
Entropy (8bit):	5.694806604232056
Encrypted:	false
SSDEEP:	96:qw8AV9aWUjoFDEnAFTxKzB0JU8i0UirLArLqR25LI:q4V913FwnAn+0aYPGqMe
MD5:	E9A7FED814638BA3650C9AECEF33E088
SHA1:	A1C90280E99C4F197D11ABC7810163B6BE3942F1
SHA-256:	4A83D107C001AA09300FD72D14D7BDB3C809CD5DEEB552216404394E73A5B156
SHA-512:	B015E978BF58A94F946FE824EEF0794ACF0C8D941D7FCE73034D7D76008277990A9F1AA5108682370BAB306FB47EC4E6541B720D10F2AF55409AA57B3844A6FD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_RubberStamp" GUID="{C168A2C9-98B7-4FF4-9C02-FB5066F2AAAE}">.. <Properties>.. <Property Class="Text" GUID="{132D16FC-6D41-437D-AB30-464E329EA59A}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_RubberStamp</Property>.. <Property Class="Image" GUID="{CE8FF840-77C3-4F58-B6CB-C9E58F79D6DC}" Name="Icon" inheritaction="Inherit Formula" group="Item" OrderIndex="2" DecimalPlaces="" List="cmbList" Transparent="True" ImageType="TIcon" ImageData="AAABAAEAEBAAAAEAIABoBAAAFgAAACgAAAAQAAAAIAAAAAEAIAAAAAAAQAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAREE6SjYwKNA0Lyi6LSkjnDEwLX02NDFfLi0qQTAvLiMqKSgGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPDk0KkI0HvRnVDb/ZlqR/3dqf/98bWP/eGlQ/2ZYQf9XSjf/ST8v/EI7LuU1MCjGLCciqDAtKok8OTZlMi8sA1ZOQGBYQiP/bFc3/wEB/P8AAP//AAD+/woJ9v8hH+r/My/Y/0U/xP9XT7H/al6d/3xuif+EdXD/e2tR/2RXRjeDcFJsY00r/4V5Yv9PTdz/NzXk/x4c6/8JCPb/AAD+/wAA//8AAP//AAD//wAA//8AAP//AAD//1JElf91Zkw9

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_RubberStamp\is-FOEND.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	6032
Entropy (8bit):	5.694806604232056
Encrypted:	false
SSDEEP:	96:qw8AV9aWUjoFDEnAFTxKzB0JU8i0UirLArLqR25LI:q4V913FwnAn+0aYPGqMe
MD5:	E9A7FED814638BA3650C9AECEF33E088
SHA1:	A1C90280E99C4F197D11ABC7810163B6BE3942F1
SHA-256:	4A83D107C001AA09300FD72D14D7BDB3C809CD5DEEB552216404394E73A5B156
SHA-512:	B015E978BF58A94F946FE824EEF0794ACF0C8D941D7FCE73034D7D76008277990A9F1AA5108682370BAB306FB47EC4E6541B720D10F2AF55409AA57B3844A6FD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_RubberStamp" GUID="{C168A2C9-98B7-4FF4-9C02-FB5066F2AAAE}">.. <Properties>.. <Property Class="Text" GUID="{132D16FC-6D41-437D-AB30-464E329EA59A}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_RubberStamp</Property>.. <Property Class="Image" GUID="{CE8FF840-77C3-4F58-B6CB-C9E58F79D6DC}" Name="Icon" inheritaction="Inherit Formula" group="Item" OrderIndex="2" DecimalPlaces="" List="cmbList" Transparent="True" ImageType="TIcon" ImageData="AAABAAEAEBAAAAEAIABoBAAAFgAAACgAAAAQAAAAIAAAAAEAIAAAAAAAQAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAREE6SjYwKNA0Lyi6LSkjnDEwLX02NDFfLi0qQTAvLiMqKSgGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPDk0KkI0HvRnVDb/ZlqR/3dqf/98bWP/eGlQ/2ZYQf9XSjf/ST8v/EI7LuU1MCjGLCciqDAtKok8OTZlMi8sA1ZOQGBYQiP/bFc3/wEB/P8AAP//AAD+/woJ9v8hH+r/My/Y/0U/xP9XT7H/al6d/3xuif+EdXD/e2tR/2RXRjeDcFJsY00r/4V5Yv9PTdz/NzXk/x4c6/8JCPb/AAD+/wAA//8AAP//AAD//wAA//8AAP//AAD//1JElf91Zkw9

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_StickyTab\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	4860
Entropy (8bit):	5.333439313360074
Encrypted:	false
SSDEEP:	48:cU+/4/DonKCVngm5gm9wCOjctYUFfnXvGAggoDwvqez9ZV52Hpmt75UiOXuK1Q1V:Z+/4iVKCuWVn9oPk+Q1uIHLIg4c
MD5:	B9CAD2BB42C54B955097CF7D5514B2AD
SHA1:	751D7417E5C63F6C4DA5144B03E49E786DEE8B8A
SHA-256:	5520D198CF37CF6DA6CECE1608C457F9D1BC3EEAAE10A4E2DB252357DDD15A41
SHA-512:	AB4652AAB693BC40511AE213FAC4B8AEF614E8BA9590A5C6F1A9EE6234B5B2FB1C9DCBF3F1AEEBECC686AF60ACB1419C3177F86EC989611EF79687C6B738C9C3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_StickyTab" GUID="{4BFB3703-2F43-4D7E-8C4F-318F39F7DA4F}">.. <Properties>.. <Property Class="Text" GUID="{B5AA1357-2DB3-42A7-96FE-E47C66314A42}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{4BFB3703-2F43-4D7E-8C4F-318F39F7DA4F}</Property>.. <Property Class="Number" GUID="{56AD3CF3-C8CD-495F-9447-C8C0F19659E2}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">-1</Property>.. <Property Class="Memo" GUID="{F9EEC4CD-AE92-4D95-969F-4DD73C3F438C}" Name="Form Layout" systemhidden="True" OrderIndex="13" DecimalPlaces=""><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Primary Label" Order="1" ShowUnits="False" SameLine="Fals

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_StickyTab\is-CTU5D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	4860
Entropy (8bit):	5.333439313360074
Encrypted:	false
SSDEEP:	48:cU+/4/DonKCVngm5gm9wCOjctYUFfnXvGAggoDwvqez9ZV52Hpmt75UiOXuK1Q1V:Z+/4iVKCuWVn9oPk+Q1uIHLIg4c
MD5:	B9CAD2BB42C54B955097CF7D5514B2AD
SHA1:	751D7417E5C63F6C4DA5144B03E49E786DEE8B8A
SHA-256:	5520D198CF37CF6DA6CECE1608C457F9D1BC3EEAAE10A4E2DB252357DDD15A41
SHA-512:	AB4652AAB693BC40511AE213FAC4B8AEF614E8BA9590A5C6F1A9EE6234B5B2FB1C9DCBF3F1AEEBECC686AF60ACB1419C3177F86EC989611EF79687C6B738C9C3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_StickyTab" GUID="{4BFB3703-2F43-4D7E-8C4F-318F39F7DA4F}">.. <Properties>.. <Property Class="Text" GUID="{B5AA1357-2DB3-42A7-96FE-E47C66314A42}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{4BFB3703-2F43-4D7E-8C4F-318F39F7DA4F}</Property>.. <Property Class="Number" GUID="{56AD3CF3-C8CD-495F-9447-C8C0F19659E2}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">-1</Property>.. <Property Class="Memo" GUID="{F9EEC4CD-AE92-4D95-969F-4DD73C3F438C}" Name="Form Layout" systemhidden="True" OrderIndex="13" DecimalPlaces=""><?xml version="1.0" encoding="UTF-8"?>..<Items>.. <Item Name="Name" Order="0" ShowUnits="False" SameLine="False" Tab=""/>.. <Item Name="Primary Label" Order="1" ShowUnits="False" SameLine="Fals

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Takeoff Section\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1328), with CRLF line terminators
Category:	dropped
Size (bytes):	7059
Entropy (8bit):	5.602515829001433
Encrypted:	false
SSDEEP:	96:9fSwN+Xh1d3Fudn9BMpl94kqJlgRgfX0saqUug+teYomFWmPmDBBqQEYu:z+Xq9BMp4hZk8teYomFWEI0l
MD5:	3FFC4020AE32771304E740D5A4168275
SHA1:	5DA65C343D8F9C9D0B93AD572D45709278C8FB18
SHA-256:	48C0BEBAA2526B7CA05FEFB8786971162AC59C3BC5BB58BD953FDAFCDF715D4A
SHA-512:	0DDFAAD021CD4A03F4CA0B4EF38E799C18C15E7FDD031F2C2C86450D70954D079AD450EB5BB6BE67683804553E50CC69272B51196A5F37F2B4F0E18823B1F52A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="_Takeoff Section" GUID="{EE7D5BCE-B9BB-4AED-AD06-E37682D03203}">.. <Properties>.. <Property Class="Text" GUID="{29E07DE7-661D-4716-ADFC-08F4852DB9C9}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Takeoff Section</Property>.. <Property Class="Text" GUID="{BF40A5F6-1540-45A2-B9E9-0E44B03781CE}" Name="Fill Type" input="True" group="Item" OrderIndex="1" DecimalPlaces="2" SimpleList="Solid..Hatch Pattern..Texture" List="cmbList" PluginToExecute="cmbList">[..]</Property>.. <Property Class="Type" GUID="{1EA6F8C6-67AE-48A7-83CA-AC8AFB571CE6}" Name="Type" required="True" group="Item" OrderIndex="2" DecimalPlaces="2">Page Item</Property>.. <Property Class="Color" GUID="{715056F0-2435-4E3C-A24D-5DD8975074C4}" Name="Color" inheritaction="Inherit Formula" input="True" group="Item" OrderIndex="4" DecimalPlaces="2">[..]</Property>.. <Property Class="Imag

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Takeoff Section\_Area Section\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1643), with CRLF line terminators
Category:	dropped
Size (bytes):	3285
Entropy (8bit):	4.477791387988541
Encrypted:	false
SSDEEP:	48:cgUQ7Td9KtT1YikvciMVUkkgB4IwGYU7+b4UYU7/YU7VqQ:LD3d65T4IwGab4UDZqQ
MD5:	2C50819CF20016DE1D40EE090CD98C92
SHA1:	F11C242706A11457BD3C08079982ABF4EF432B51
SHA-256:	9F0198FE64CF804105E8F584A3C537C160D5B4B1520FB84F2E529F988C9CDDA3
SHA-512:	795DA10C7038FDAD046286B3EC5B983EFEEE5D9C72B8C90D380C5AB78CACC633294725CB12FA7650C16145249A0674DFBB239316065F69AB6A4D930D6B13F633
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Area Section" GUID="{1EC779A8-64FF-4246-B6D0-5EF056B287D2}">.. <Properties>.. <Property Class="Text" GUID="{6CA77F5C-CE7E-42C3-BE08-6503C7FBB78D}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Area Section</Property>.. <Property Class="Type" GUID="{1954C7A6-14BC-4CB8-A72F-E35A0B91B065}" Name="Type" required="True" group="Item" OrderIndex="2" DecimalPlaces="2">Takeoff Section</Property>.. <Property Class="Text" GUID="{6BB2EC90-529B-45E6-B998-C33B2A482A04}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{1EC779A8-64FF-4246-B6D0-5EF056B287D2}</Property>.. <Property Class="Image" GUID="{8B74E425-793C-48DD-B337-436572B8315B}" Name="Icon" inheritaction="Inherit Result" OrderIndex="5" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02BAAAAAAAADYAAAAoAAAAEAAAABAAAAABACAA

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Takeoff Section\_Area Section\_Area Subtract Section\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (759), with CRLF line terminators
Category:	dropped
Size (bytes):	3905
Entropy (8bit):	5.08017687898928
Encrypted:	false
SSDEEP:	96:kG+Cqd2uI0MdOMG0bd/u20MdOMeN6bd/uh4MdOMwbdwU00MdOMZbcwC0MdOMA:PJdO5adOPfdOngdOPdOp
MD5:	38C49FDCFCF6C82F6CE60856341C8B55
SHA1:	CE149DC9A5C14F3B20BE71A4975E65E5A4CBE1BA
SHA-256:	089C13FA29AB55D88D491BD1389807060727A787FD0404FEBCB44F2BB0789694
SHA-512:	07C9A3D70F94E44ED6D053884C4FF7A7877560C01142F9B57BBD25DF6992EEC90E113C887DCF8E2822D910B3B7CF65CD5F1ADD53B574550FCDF61E11CAE72D8A
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Area Subtract Section" GUID="{65B0005E-A4D0-4576-8028-8003B405DACF}">.. <Properties>.. <Property Class="Text" GUID="{66FA2B32-D4E8-459F-89D2-004DDEE22D58}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Area Subtract Section</Property>.. <Property Class="Type" GUID="{0ADC7290-DEB9-4200-A390-1FFE24D8F2FA}" Name="Type" inheritac

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Takeoff Section\_Area Section\_Area Subtract Section\is-KEMH7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (759), with CRLF line terminators
Category:	dropped
Size (bytes):	3905
Entropy (8bit):	5.08017687898928
Encrypted:	false
SSDEEP:	96:kG+Cqd2uI0MdOMG0bd/u20MdOMeN6bd/uh4MdOMwbdwU00MdOMZbcwC0MdOMA:PJdO5adOPfdOngdOPdOp
MD5:	38C49FDCFCF6C82F6CE60856341C8B55
SHA1:	CE149DC9A5C14F3B20BE71A4975E65E5A4CBE1BA
SHA-256:	089C13FA29AB55D88D491BD1389807060727A787FD0404FEBCB44F2BB0789694
SHA-512:	07C9A3D70F94E44ED6D053884C4FF7A7877560C01142F9B57BBD25DF6992EEC90E113C887DCF8E2822D910B3B7CF65CD5F1ADD53B574550FCDF61E11CAE72D8A
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Area Subtract Section" GUID="{65B0005E-A4D0-4576-8028-8003B405DACF}">.. <Properties>.. <Property Class="Text" GUID="{66FA2B32-D4E8-459F-89D2-004DDEE22D58}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Area Subtract Section</Property>.. <Property Class="Type" GUID="{0ADC7290-DEB9-4200-A390-1FFE24D8F2FA}" Name="Type" inheritac

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Takeoff Section\_Area Section\is-JRQQ7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1643), with CRLF line terminators
Category:	dropped
Size (bytes):	3285
Entropy (8bit):	4.477791387988541
Encrypted:	false
SSDEEP:	48:cgUQ7Td9KtT1YikvciMVUkkgB4IwGYU7+b4UYU7/YU7VqQ:LD3d65T4IwGab4UDZqQ
MD5:	2C50819CF20016DE1D40EE090CD98C92
SHA1:	F11C242706A11457BD3C08079982ABF4EF432B51
SHA-256:	9F0198FE64CF804105E8F584A3C537C160D5B4B1520FB84F2E529F988C9CDDA3
SHA-512:	795DA10C7038FDAD046286B3EC5B983EFEEE5D9C72B8C90D380C5AB78CACC633294725CB12FA7650C16145249A0674DFBB239316065F69AB6A4D930D6B13F633
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Area Section" GUID="{1EC779A8-64FF-4246-B6D0-5EF056B287D2}">.. <Properties>.. <Property Class="Text" GUID="{6CA77F5C-CE7E-42C3-BE08-6503C7FBB78D}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Area Section</Property>.. <Property Class="Type" GUID="{1954C7A6-14BC-4CB8-A72F-E35A0B91B065}" Name="Type" required="True" group="Item" OrderIndex="2" DecimalPlaces="2">Takeoff Section</Property>.. <Property Class="Text" GUID="{6BB2EC90-529B-45E6-B998-C33B2A482A04}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{1EC779A8-64FF-4246-B6D0-5EF056B287D2}</Property>.. <Property Class="Image" GUID="{8B74E425-793C-48DD-B337-436572B8315B}" Name="Icon" inheritaction="Inherit Result" OrderIndex="5" DecimalPlaces="2" Transparent="True" ImageType="TBitmap" ImageData="Qk02BAAAAAAAADYAAAAoAAAAEAAAABAAAAABACAA

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Takeoff Section\_Count Section\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1673), with CRLF line terminators
Category:	dropped
Size (bytes):	4805
Entropy (8bit):	4.851419735037555
Encrypted:	false
SSDEEP:	96:ZgX793wGeIfil9Nj38ucszxVFNQNqcTUOO:291eCmboszx5ozYp
MD5:	C418CB79AE00455CA27E324F50FDFA0E
SHA1:	7956ACD823C707E5C19B563A98721527675E7230
SHA-256:	4AF32845AC0BB75FB09C54AA2C765440818B67FD53952909D68742E2F6376CA0
SHA-512:	0654D6CE6BDC8B48F2F3EF06582984D2F187348B6FB9E920421D00482F8FB121DCC2D5F79FD9BAD6E5134A7A6487055B8C0D0A3F930C05E6FB74472B41BA2CD1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Count Section" GUID="{6CA895E3-181E-46FB-A2D1-A9E72EF78990}">.. <Properties>.. <Property Class="Text" GUID="{E93D5CB9-0276-4034-B665-B51294FACCC4}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Count Section</Property>.. <Property Class="Type" GUID="{B987CB70-8D5F-4793-B8F4-EA2C9FDDC012}" Name="Type" required="True" group="Item" OrderIndex="2" DecimalPlaces="2">Takeoff Section</Property>.. <Property Class="Text" GUID="{B4C143B2-0ED2-4934-9708-D131CDBF0D7F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{6CA895E3-181E-46FB-A2D1-A9E72EF78990}</Property>.. <Property Class="Number" GUID="{2EC31097-F181-4954-A3C7-BECA53F803FA}" Name="OrderIndex" systemhidden="True" OrderIndex="5" DecimalPlaces="2">2</Property>.. <Property Class="Number" GUID="{E0E9A806-5B47-4977-A634-CD1424B55FF5}" Nam

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Takeoff Section\_Count Section\is-VHF5J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1673), with CRLF line terminators
Category:	dropped
Size (bytes):	4805
Entropy (8bit):	4.851419735037555
Encrypted:	false
SSDEEP:	96:ZgX793wGeIfil9Nj38ucszxVFNQNqcTUOO:291eCmboszx5ozYp
MD5:	C418CB79AE00455CA27E324F50FDFA0E
SHA1:	7956ACD823C707E5C19B563A98721527675E7230
SHA-256:	4AF32845AC0BB75FB09C54AA2C765440818B67FD53952909D68742E2F6376CA0
SHA-512:	0654D6CE6BDC8B48F2F3EF06582984D2F187348B6FB9E920421D00482F8FB121DCC2D5F79FD9BAD6E5134A7A6487055B8C0D0A3F930C05E6FB74472B41BA2CD1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Count Section" GUID="{6CA895E3-181E-46FB-A2D1-A9E72EF78990}">.. <Properties>.. <Property Class="Text" GUID="{E93D5CB9-0276-4034-B665-B51294FACCC4}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Count Section</Property>.. <Property Class="Type" GUID="{B987CB70-8D5F-4793-B8F4-EA2C9FDDC012}" Name="Type" required="True" group="Item" OrderIndex="2" DecimalPlaces="2">Takeoff Section</Property>.. <Property Class="Text" GUID="{B4C143B2-0ED2-4934-9708-D131CDBF0D7F}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{6CA895E3-181E-46FB-A2D1-A9E72EF78990}</Property>.. <Property Class="Number" GUID="{2EC31097-F181-4954-A3C7-BECA53F803FA}" Name="OrderIndex" systemhidden="True" OrderIndex="5" DecimalPlaces="2">2</Property>.. <Property Class="Number" GUID="{E0E9A806-5B47-4977-A634-CD1424B55FF5}" Nam

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Takeoff Section\_Line Section\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1817
Entropy (8bit):	5.498092692673178
Encrypted:	false
SSDEEP:	48:cEFg/Jc94kRDgE6wGYU7+z+uYU7MYU7OtYvO:ZFg/QnDgE6wGanYhO
MD5:	3DCEC99156A801341053EB58C14472A7
SHA1:	11925D787A6F3F918CB5CCADA12DC22CCC97233F
SHA-256:	74E94985B3D068A109A6581519C0E333DEC92C52484A50D68856691829E26CFE
SHA-512:	EE3154148A8C7C6B6DB16713571C66F02FE3FA530FB189280F035A5E6CE68DDD3BD560EDA637E4DB5589301B010DA5A009205C098B945A90D539B793272CA457
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Line Section" GUID="{ADA29304-0B36-44C9-B6C6-947E6F975B7B}">.. <Properties>.. <Property Class="Text" GUID="{12882488-5B59-4727-8109-BECD49CFFDBB}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Line Section</Property>.. <Property Class="Type" GUID="{D526C340-6DFA-4365-82F7-23F9A62DF4E9}" Name="Type" required="True" group="Item" OrderIndex="2" DecimalPlaces="2">Takeoff Section</Property>.. <Property Class="Text" GUID="{F5AD209A-33FB-4BC6-84A7-0EB62E5895FB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{ADA29304-0B36-44C9-B6C6-947E6F975B7B}</Property>.. <Property Class="Number" GUID="{96D2123C-4F05-4ED0-A162-8B4F3430129E}" Name="OrderIndex" systemhidden="True" OrderIndex="5" DecimalPlaces="2">1</Property>.. <Property Class="Number" GUID="{E0E9A806-5B47-4977-A634-CD1424B55FF5}" Name=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Takeoff Section\_Line Section\_Linear Section\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1329), with CRLF line terminators
Category:	dropped
Size (bytes):	2431
Entropy (8bit):	4.907656843074358
Encrypted:	false
SSDEEP:	48:cEyMljXAoWOZjSE134tYUK1dwcP0cP333338zzI:ZyMljvNZuyqC1db
MD5:	E3A8E520A69706969E184BB60CE6EB0A
SHA1:	B4310E6FC1044CF7E2ED40ED70D47A5A8C7D4DBC
SHA-256:	1CB74C8CFA643961624B2D56B7381C3BA7BBB7AC1E969B1AEE4A84D071DF0680
SHA-512:	F428623B6B946B3AF2776E178175FDF14502B1D71B38C3C7CE6E55CCEDD94D645124A4AF98D3B8E146B27E1C6BBCFFE26E40DD1F2075D1B4FB742851CE1131D0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Linear Section" GUID="{056C5C74-7154-4F76-AE6D-1B572D95181A}">.. <Properties>.. <Property Class="Text" GUID="{F47985B7-3445-4C39-AD98-6EFC3DAA1BBF}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_Linear Section</Property>.. <Property Class="Type" GUID="{9011ADA1-9DCF-4BA5-8E9D-AF96A49F151B}" Name="Type" required="True" group="Item" OrderIndex="2" DecimalPlaces="">Line Section</Property>.. <Property Class="Text" GUID="{B580A27A-65AA-4466-A47F-C585B4A9C496}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="5" DecimalPlaces="">{056C5C74-7154-4F76-AE6D-1B572D95181A}</Property>.. <Property Class="Number" GUID="{29E48AE9-3F36-4017-9AF6-492A237E3AD0}" Name="OrderIndex" systemhidden="True" OrderIndex="8" DecimalPlaces="">5</Property>.. <Property Class="Number" GUID="{4A6533A4-EE46-4924-A8DC-D730C230D87F}" Name="He

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Takeoff Section\_Line Section\_Linear Section\is-8CMDI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1329), with CRLF line terminators
Category:	dropped
Size (bytes):	2431
Entropy (8bit):	4.907656843074358
Encrypted:	false
SSDEEP:	48:cEyMljXAoWOZjSE134tYUK1dwcP0cP333338zzI:ZyMljvNZuyqC1db
MD5:	E3A8E520A69706969E184BB60CE6EB0A
SHA1:	B4310E6FC1044CF7E2ED40ED70D47A5A8C7D4DBC
SHA-256:	1CB74C8CFA643961624B2D56B7381C3BA7BBB7AC1E969B1AEE4A84D071DF0680
SHA-512:	F428623B6B946B3AF2776E178175FDF14502B1D71B38C3C7CE6E55CCEDD94D645124A4AF98D3B8E146B27E1C6BBCFFE26E40DD1F2075D1B4FB742851CE1131D0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Linear Section" GUID="{056C5C74-7154-4F76-AE6D-1B572D95181A}">.. <Properties>.. <Property Class="Text" GUID="{F47985B7-3445-4C39-AD98-6EFC3DAA1BBF}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_Linear Section</Property>.. <Property Class="Type" GUID="{9011ADA1-9DCF-4BA5-8E9D-AF96A49F151B}" Name="Type" required="True" group="Item" OrderIndex="2" DecimalPlaces="">Line Section</Property>.. <Property Class="Text" GUID="{B580A27A-65AA-4466-A47F-C585B4A9C496}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="5" DecimalPlaces="">{056C5C74-7154-4F76-AE6D-1B572D95181A}</Property>.. <Property Class="Number" GUID="{29E48AE9-3F36-4017-9AF6-492A237E3AD0}" Name="OrderIndex" systemhidden="True" OrderIndex="8" DecimalPlaces="">5</Property>.. <Property Class="Number" GUID="{4A6533A4-EE46-4924-A8DC-D730C230D87F}" Name="He

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Takeoff Section\_Line Section\_Segment Section\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1329), with CRLF line terminators
Category:	dropped
Size (bytes):	2448
Entropy (8bit):	4.797990658025553
Encrypted:	false
SSDEEP:	48:cJbJcc4wRT4s77GtYUK1dBUUF99999FUUx:mb93T4M70C1dl
MD5:	E543DFADCD48C2C05E4ECC9BA770AC19
SHA1:	49319B13A00DF4DDAB1A7B96014855C887594A7E
SHA-256:	10927CC754879FA77B33CD144BFC862DDCFA991D171833C781FA3254CA4D7A13
SHA-512:	6DE3B572183AB17B98F08ED025A935565CD66CB7B84B90C6637281A4385FBF689191CB250D4A8102BB48C576D67DD2834C020549FB1FD6AD4B7EC2755C0D7AC6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Segment Section" GUID="{AF773134-5308-4535-9A97-5E8E426E9370}">.. <Properties>.. <Property Class="Text" GUID="{12882488-5B59-4727-8109-BECD49CFFDBB}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_Segment Section</Property>.. <Property Class="Type" GUID="{D526C340-6DFA-4365-82F7-23F9A62DF4E9}" Name="Type" required="True" group="Item" OrderIndex="2" DecimalPlaces="">Line Section</Property>.. <Property Class="Text" GUID="{F5AD209A-33FB-4BC6-84A7-0EB62E5895FB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="5" DecimalPlaces="">{AF773134-5308-4535-9A97-5E8E426E9370}</Property>.. <Property Class="Number" GUID="{96D2123C-4F05-4ED0-A162-8B4F3430129E}" Name="OrderIndex" systemhidden="True" OrderIndex="8" DecimalPlaces="">0</Property>.. <Property Class="Number" GUID="{81FD5EFC-B9D9-4189-8087-7CD94DC71C4F}" Name="

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Takeoff Section\_Line Section\_Segment Section\is-BIUKV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1329), with CRLF line terminators
Category:	dropped
Size (bytes):	2448
Entropy (8bit):	4.797990658025553
Encrypted:	false
SSDEEP:	48:cJbJcc4wRT4s77GtYUK1dBUUF99999FUUx:mb93T4M70C1dl
MD5:	E543DFADCD48C2C05E4ECC9BA770AC19
SHA1:	49319B13A00DF4DDAB1A7B96014855C887594A7E
SHA-256:	10927CC754879FA77B33CD144BFC862DDCFA991D171833C781FA3254CA4D7A13
SHA-512:	6DE3B572183AB17B98F08ED025A935565CD66CB7B84B90C6637281A4385FBF689191CB250D4A8102BB48C576D67DD2834C020549FB1FD6AD4B7EC2755C0D7AC6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Segment Section" GUID="{AF773134-5308-4535-9A97-5E8E426E9370}">.. <Properties>.. <Property Class="Text" GUID="{12882488-5B59-4727-8109-BECD49CFFDBB}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_Segment Section</Property>.. <Property Class="Type" GUID="{D526C340-6DFA-4365-82F7-23F9A62DF4E9}" Name="Type" required="True" group="Item" OrderIndex="2" DecimalPlaces="">Line Section</Property>.. <Property Class="Text" GUID="{F5AD209A-33FB-4BC6-84A7-0EB62E5895FB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="5" DecimalPlaces="">{AF773134-5308-4535-9A97-5E8E426E9370}</Property>.. <Property Class="Number" GUID="{96D2123C-4F05-4ED0-A162-8B4F3430129E}" Name="OrderIndex" systemhidden="True" OrderIndex="8" DecimalPlaces="">0</Property>.. <Property Class="Number" GUID="{81FD5EFC-B9D9-4189-8087-7CD94DC71C4F}" Name="

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Takeoff Section\_Line Section\is-2UOHN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1817
Entropy (8bit):	5.498092692673178
Encrypted:	false
SSDEEP:	48:cEFg/Jc94kRDgE6wGYU7+z+uYU7MYU7OtYvO:ZFg/QnDgE6wGanYhO
MD5:	3DCEC99156A801341053EB58C14472A7
SHA1:	11925D787A6F3F918CB5CCADA12DC22CCC97233F
SHA-256:	74E94985B3D068A109A6581519C0E333DEC92C52484A50D68856691829E26CFE
SHA-512:	EE3154148A8C7C6B6DB16713571C66F02FE3FA530FB189280F035A5E6CE68DDD3BD560EDA637E4DB5589301B010DA5A009205C098B945A90D539B793272CA457
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Line Section" GUID="{ADA29304-0B36-44C9-B6C6-947E6F975B7B}">.. <Properties>.. <Property Class="Text" GUID="{12882488-5B59-4727-8109-BECD49CFFDBB}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Line Section</Property>.. <Property Class="Type" GUID="{D526C340-6DFA-4365-82F7-23F9A62DF4E9}" Name="Type" required="True" group="Item" OrderIndex="2" DecimalPlaces="2">Takeoff Section</Property>.. <Property Class="Text" GUID="{F5AD209A-33FB-4BC6-84A7-0EB62E5895FB}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{ADA29304-0B36-44C9-B6C6-947E6F975B7B}</Property>.. <Property Class="Number" GUID="{96D2123C-4F05-4ED0-A162-8B4F3430129E}" Name="OrderIndex" systemhidden="True" OrderIndex="5" DecimalPlaces="2">1</Property>.. <Property Class="Number" GUID="{E0E9A806-5B47-4977-A634-CD1424B55FF5}" Name=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Takeoff Section\is-58HLL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1328), with CRLF line terminators
Category:	dropped
Size (bytes):	7059
Entropy (8bit):	5.602515829001433
Encrypted:	false
SSDEEP:	96:9fSwN+Xh1d3Fudn9BMpl94kqJlgRgfX0saqUug+teYomFWmPmDBBqQEYu:z+Xq9BMp4hZk8teYomFWEI0l
MD5:	3FFC4020AE32771304E740D5A4168275
SHA1:	5DA65C343D8F9C9D0B93AD572D45709278C8FB18
SHA-256:	48C0BEBAA2526B7CA05FEFB8786971162AC59C3BC5BB58BD953FDAFCDF715D4A
SHA-512:	0DDFAAD021CD4A03F4CA0B4EF38E799C18C15E7FDD031F2C2C86450D70954D079AD450EB5BB6BE67683804553E50CC69272B51196A5F37F2B4F0E18823B1F52A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Folder" Name="_Takeoff Section" GUID="{EE7D5BCE-B9BB-4AED-AD06-E37682D03203}">.. <Properties>.. <Property Class="Text" GUID="{29E07DE7-661D-4716-ADFC-08F4852DB9C9}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Takeoff Section</Property>.. <Property Class="Text" GUID="{BF40A5F6-1540-45A2-B9E9-0E44B03781CE}" Name="Fill Type" input="True" group="Item" OrderIndex="1" DecimalPlaces="2" SimpleList="Solid..Hatch Pattern..Texture" List="cmbList" PluginToExecute="cmbList">[..]</Property>.. <Property Class="Type" GUID="{1EA6F8C6-67AE-48A7-83CA-AC8AFB571CE6}" Name="Type" required="True" group="Item" OrderIndex="2" DecimalPlaces="2">Page Item</Property>.. <Property Class="Color" GUID="{715056F0-2435-4E3C-A24D-5DD8975074C4}" Name="Color" inheritaction="Inherit Formula" input="True" group="Item" OrderIndex="4" DecimalPlaces="2">[..]</Property>.. <Property Class="Imag

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Triangulate\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1047), with CRLF line terminators
Category:	dropped
Size (bytes):	3797
Entropy (8bit):	5.812654016632052
Encrypted:	false
SSDEEP:	48:cYUyEH6/D5anK2PEZrbLuERH+iPtYUZ4h0tDdzAT9eQxRoX79uYyS7vRIeeI8A8:gyG6NG8+il20tRsT9XRoxJIDI78
MD5:	5D85EADAC26295D3102D846ADB74D90D
SHA1:	001D6585CD1EB0439701524A29C44515ED427999
SHA-256:	F2161195479BBFAF74A1DD53D9D602631DC1F27FE9F80EBB94A6743BA08C42E1
SHA-512:	E063579BFFB75F26C7242FB9FE770713C426DA38D0B023C4A2C1D73E9A5B61C2F98952B12EBB5A56F7C32619221BAC3C86A3C84ED472BB596BA25ECE697D9E3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Triangulate" GUID="{9A798947-6725-46CA-9961-D2737FF4A968}">.. <Properties>.. <Property Class="Text" GUID="{EA97CC5A-9DE7-4C34-ACEE-80C0BF2E1422}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{9A798947-6725-46CA-9961-D2737FF4A968}</Property>.. <Property Class="Number" GUID="{293BCD44-0B92-4AED-8636-41F52983B95E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Memo" GUID="{448E57A0-654D-496F-864F-3AFAEC494732}" Name="Form Layout" systemhidden="True" OrderIndex="13" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?>..<Items>.. <Item Name="Name" Order="0"/>.. <Item Name="Transparency" Order="1"/>.. <Item Name="Color" Order="1"/>.. <Item Name="Text Color" Order=&qu

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\_Triangulate\is-MPE79.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1047), with CRLF line terminators
Category:	dropped
Size (bytes):	3797
Entropy (8bit):	5.812654016632052
Encrypted:	false
SSDEEP:	48:cYUyEH6/D5anK2PEZrbLuERH+iPtYUZ4h0tDdzAT9eQxRoX79uYyS7vRIeeI8A8:gyG6NG8+il20tRsT9XRoxJIDI78
MD5:	5D85EADAC26295D3102D846ADB74D90D
SHA1:	001D6585CD1EB0439701524A29C44515ED427999
SHA-256:	F2161195479BBFAF74A1DD53D9D602631DC1F27FE9F80EBB94A6743BA08C42E1
SHA-512:	E063579BFFB75F26C7242FB9FE770713C426DA38D0B023C4A2C1D73E9A5B61C2F98952B12EBB5A56F7C32619221BAC3C86A3C84ED472BB596BA25ECE697D9E3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Triangulate" GUID="{9A798947-6725-46CA-9961-D2737FF4A968}">.. <Properties>.. <Property Class="Text" GUID="{EA97CC5A-9DE7-4C34-ACEE-80C0BF2E1422}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{9A798947-6725-46CA-9961-D2737FF4A968}</Property>.. <Property Class="Number" GUID="{293BCD44-0B92-4AED-8636-41F52983B95E}" Name="OrderIndex" systemhidden="True" OrderIndex="3" DecimalPlaces="2">4</Property>.. <Property Class="Memo" GUID="{448E57A0-654D-496F-864F-3AFAEC494732}" Name="Form Layout" systemhidden="True" OrderIndex="13" DecimalPlaces=""><?xml version="1.0" encoding="iso-8859-1"?>..<Items>.. <Item Name="Name" Order="0"/>.. <Item Name="Transparency" Order="1"/>.. <Item Name="Color" Order="1"/>.. <Item Name="Text Color" Order=&qu

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page Item\is-12QK5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1328), with CRLF line terminators
Category:	dropped
Size (bytes):	3297
Entropy (8bit):	5.386614396432641
Encrypted:	false
SSDEEP:	48:cny7z9cKYlBtYUw1dBsXbHOaeCdHsu7dHdfu6lQ6CD5anKMAYywMi:GyCKY9Y1dBsituRTQ6kZxRi
MD5:	592C0FBF074F9780E6128DF8A89B92E8
SHA1:	21C196AFF39AC54BDC688F8C1CD3E4C5930F7A4F
SHA-256:	F5ABD2D0DA4F6147D0CC0ACA81566EFCE7170B14A3EBF37046D7F9546F204A2C
SHA-512:	F7E07BD69E62998DCC548BE5F7320F4AD2809F6ABE88F5BB9CABF8E8D7A8B18455C4DC75DA73C9710768BAE35666F97709D7C721958E0C9CF76D7D625A4D7AC0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Page Item" GUID="{09377DD2-2EFA-41AD-82EF-0369E098B446}">.. <Properties>.. <Property Class="Text" GUID="{33DA2C8B-1C72-4842-8F7E-ABD4A30B4076}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Page Item</Property>.. <Property Class="Type" GUID="{F88B9401-0D3D-4018-B763-37B5D05CC22C}" Name="Type" required="True" group="Item" OrderIndex="1" DecimalPlaces="2">All</Property>.. <Property Class="Image" GUID="{D184F8AE-9E85-4E98-BDEA-2084D7E59CCE}" Name="Icon" inheritaction="Inherit Formula" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAAASCwAAEgsAAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////bGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxs////////////////bGxs/////////f399/f68/L37e3y6Ojv4+Pr397n3NzmbGxs/////

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1311), with CRLF line terminators
Category:	dropped
Size (bytes):	2707
Entropy (8bit):	5.6188289429796825
Encrypted:	false
SSDEEP:	48:cs+RtTF52d3DymvpKFYFnYgpQRZ/QzQkggoRcjxpV0JrNTp2Y/wMi:H+LR52dzgi10ZmcpO0Jx92GRi
MD5:	4D9D22ACE89112BFC19F0041FE979835
SHA1:	5702F83A815A8C19339C9884A97F99ED60509383
SHA-256:	B2CB04EACDDC548EEC137D044E023EC85B3534F323ADF48CCDD53B6DEBA450FF
SHA-512:	11C41B77A92059CF38EDC7BA3CCAA4F5BFAAB8F4C92821B88EACA0483E9AA35ED216D23C5F090CFD213060B6439636E9C15F965B7F9A81E25715EC74D854BDC4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Page" GUID="{FA995725-9384-46E7-B656-7022173139E1}">.. <Properties>.. <Property Class="Type" GUID="{A164414F-98F4-47DE-B3F3-4718380C4A9D}" Name="Type" required="True" group="Item" OrderIndex="0" DecimalPlaces="">All</Property>.. <Property Class="Image" GUID="{A3D18FBB-6F44-4285-B9FA-FAA85DFE2C7C}" Name="Icon" inheritaction="Inherit Result" group="Item" OrderIndex="1" DecimalPlaces="" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAADwAAABAAAAABABgAAAAAAAADAAATCwAAEwsAAAAAAAAAAAAA/wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD/AAAA/wD/NC4aNC4aNC4aNC4aNC4aNC4aNC4aNC4aNC4aNC4aNC4aNC4a/wD//wD/AAAA/wD/jZeE3+zw3erv2uju2Oft1eXs0uTq0OLpzeDoyt/nyN3mNC4a/wD//wD/AAAA/wD/jZeE4e3xGBocGBocGBocGBocGBocGBocGBocGBocyt/mNC4a/wD//wD/AAAA/wD/jZeE4+7yGBocSGKCSGKCSGKCSGKCSGKCSGKCGBoczODnNC4a/wD//wD/AAAA/wD/jZeE5e/zGBocnL7LnL7LnL7LnL7LnL7LSGKCGBoczuHoNC4a/wD//wD/AAAA/wD/jZeE5/H0GBocGBocGBocGBocGBocnL

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_.BMP Page\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3120
Entropy (8bit):	5.10362818058099
Encrypted:	false
SSDEEP:	96:ks2qd2uI0MdOMjbd/u20MdOMJbcwz0MdOMkBZbdwk0MdOM0C:+dOEdOWdOdBPdOQ
MD5:	6EC793589B3F65EBDDB36B019A1029AA
SHA1:	D6A23A2E3428EF34D526C577A8D305F29DB824AB
SHA-256:	EE4785CF21B80EFC7A4C2CCE600C7232A257A8CF7EEEF47992BECB1821F3B8CB
SHA-512:	3A3E43682890E1E986DF13CDC5F5334BCC6FA80197151B1F55A34E341E20A60AFE4A18E10112A166700A9235A19B2EA784A0D1BEA6B103660314F745B9E29462
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.BMP Page" GUID="{1A8BE204-98E7-4B21-8CEB-7F9220742BB9}">.. <Properties>.. <Property Class="Text" GUID="{8D4B12F6-BD95-48AC-B85C-DC573ADEE6C2}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.BMP Page</Property>.. <Property Class="Type" GUID="{8F12C834-63D7-4DC1-BFC1-2DB3EA85C282}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_.BMP Page\is-74S33.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3120
Entropy (8bit):	5.10362818058099
Encrypted:	false
SSDEEP:	96:ks2qd2uI0MdOMjbd/u20MdOMJbcwz0MdOMkBZbdwk0MdOM0C:+dOEdOWdOdBPdOQ
MD5:	6EC793589B3F65EBDDB36B019A1029AA
SHA1:	D6A23A2E3428EF34D526C577A8D305F29DB824AB
SHA-256:	EE4785CF21B80EFC7A4C2CCE600C7232A257A8CF7EEEF47992BECB1821F3B8CB
SHA-512:	3A3E43682890E1E986DF13CDC5F5334BCC6FA80197151B1F55A34E341E20A60AFE4A18E10112A166700A9235A19B2EA784A0D1BEA6B103660314F745B9E29462
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.BMP Page" GUID="{1A8BE204-98E7-4B21-8CEB-7F9220742BB9}">.. <Properties>.. <Property Class="Text" GUID="{8D4B12F6-BD95-48AC-B85C-DC573ADEE6C2}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.BMP Page</Property>.. <Property Class="Type" GUID="{8F12C834-63D7-4DC1-BFC1-2DB3EA85C282}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_.CPC Page\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (859), with CRLF line terminators
Category:	dropped
Size (bytes):	3488
Entropy (8bit):	5.050013846352688
Encrypted:	false
SSDEEP:	96:kMFnbd2uUDMdOkQWSQbdwCDMdOkQWibd/u7DMdOkQWEbcw4DMdOkQWT:rdOESRdOEOdOEWdOET
MD5:	A47F9595AF4AC6E4E121297B9754A272
SHA1:	A9907C1805571D249D6A74DA8BB040B0B7ABC937
SHA-256:	D619289E1574039AF044AC1EFA001752A9A05D8776B0D6362BB422166E04FE5C
SHA-512:	82F9B53EC50B790FC4E388C6A4ED66F4FAAC3EB958A22F1FF86ED4E1FE1F815549E58BECAA5CFD4085D002F6D19FC245056C363EAA8714CBEFBA9ACBB5DF4FC0
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.CPC Page" GUID="{4C3E84DC-37B8-44F8-9BB1-66ABBD30D406}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ParseFormula="-1" ListParseFormula="0" ToolHint="">_.CPC Page</Property>.. <Property Class="Number" GUID="{7B4A7EC3-48D8-4722

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_.CPC Page\is-1BUIN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (859), with CRLF line terminators
Category:	dropped
Size (bytes):	3488
Entropy (8bit):	5.050013846352688
Encrypted:	false
SSDEEP:	96:kMFnbd2uUDMdOkQWSQbdwCDMdOkQWibd/u7DMdOkQWEbcw4DMdOkQWT:rdOESRdOEOdOEWdOET
MD5:	A47F9595AF4AC6E4E121297B9754A272
SHA1:	A9907C1805571D249D6A74DA8BB040B0B7ABC937
SHA-256:	D619289E1574039AF044AC1EFA001752A9A05D8776B0D6362BB422166E04FE5C
SHA-512:	82F9B53EC50B790FC4E388C6A4ED66F4FAAC3EB958A22F1FF86ED4E1FE1F815549E58BECAA5CFD4085D002F6D19FC245056C363EAA8714CBEFBA9ACBB5DF4FC0
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.CPC Page" GUID="{4C3E84DC-37B8-44F8-9BB1-66ABBD30D406}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" ExpressionType="Pascal" RememberValue="0" ParseFormula="-1" ListParseFormula="0" ToolHint="">_.CPC Page</Property>.. <Property Class="Number" GUID="{7B4A7EC3-48D8-4722

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_.EMF Page\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3120
Entropy (8bit):	5.100105712122214
Encrypted:	false
SSDEEP:	96:kKxqd2uI0MdOMAbd/u20MdOMHbcwz0MdOMhbdwk0MdOMA:TdODdOEdOAdOr
MD5:	78A6F55CCB855D554677A4BB9BE4BAD3
SHA1:	8DEE6932F3C7D8C4872E032F98F9D701F82A6F59
SHA-256:	8B64AC6B455C9DDA2435101F85707E91BB57A1768D969506D644F8A913786278
SHA-512:	4922740432DE819B4DFD1933AB4BBD378D518415CE536C32111CEA723296FE6F48E125FAEF80B01033EE502602A498A87AFFF0B52888C59474E809EDF81B4DDC
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.EMF Page" GUID="{D5DBF928-88F8-4844-98AC-6C59028FA15E}">.. <Properties>.. <Property Class="Text" GUID="{706F255D-D96A-4012-B978-AA38895C4A9F}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.EMF Page</Property>.. <Property Class="Type" GUID="{7B6BDDD6-72F6-4683-8ED9-F039B49FB105}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_.EMF Page\is-58VM0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3120
Entropy (8bit):	5.100105712122214
Encrypted:	false
SSDEEP:	96:kKxqd2uI0MdOMAbd/u20MdOMHbcwz0MdOMhbdwk0MdOMA:TdODdOEdOAdOr
MD5:	78A6F55CCB855D554677A4BB9BE4BAD3
SHA1:	8DEE6932F3C7D8C4872E032F98F9D701F82A6F59
SHA-256:	8B64AC6B455C9DDA2435101F85707E91BB57A1768D969506D644F8A913786278
SHA-512:	4922740432DE819B4DFD1933AB4BBD378D518415CE536C32111CEA723296FE6F48E125FAEF80B01033EE502602A498A87AFFF0B52888C59474E809EDF81B4DDC
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.EMF Page" GUID="{D5DBF928-88F8-4844-98AC-6C59028FA15E}">.. <Properties>.. <Property Class="Text" GUID="{706F255D-D96A-4012-B978-AA38895C4A9F}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.EMF Page</Property>.. <Property Class="Type" GUID="{7B6BDDD6-72F6-4683-8ED9-F039B49FB105}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_.JPG Page\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3120
Entropy (8bit):	5.108591797180444
Encrypted:	false
SSDEEP:	96:kDxuqd2uI0MdOMabd/u20MdOMUCbcwz0MdOMtbdwk0MdOMc:rdO1dOsdOwdOP
MD5:	A4F5F98857A30D2B1EAF374FABC4FEAF
SHA1:	D49B3090D82CC0A9817DE853AF274A2351A9FD13
SHA-256:	FDF73C3A57E3255E7769353944ADB6CA348D3B71AD1A132BA899AAE05AF417B7
SHA-512:	129392C3603E3CC37A74C380AC5CA59DF06485FA538F47C39927E080214FEFCAD45E34909D8D91EC10DF4F6D491718819FCA7BC8D72FF5FE889C7EAD49070240
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.JPG Page" GUID="{6008D446-9EB4-4819-BCD4-6DA7DB471DC8}">.. <Properties>.. <Property Class="Text" GUID="{D1AA01CF-3B22-45B8-97C8-289667574294}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.JPG Page</Property>.. <Property Class="Type" GUID="{BDDDAA97-D560-4AEB-89E6-56C365230104}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_.JPG Page\is-QNKGL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3120
Entropy (8bit):	5.108591797180444
Encrypted:	false
SSDEEP:	96:kDxuqd2uI0MdOMabd/u20MdOMUCbcwz0MdOMtbdwk0MdOMc:rdO1dOsdOwdOP
MD5:	A4F5F98857A30D2B1EAF374FABC4FEAF
SHA1:	D49B3090D82CC0A9817DE853AF274A2351A9FD13
SHA-256:	FDF73C3A57E3255E7769353944ADB6CA348D3B71AD1A132BA899AAE05AF417B7
SHA-512:	129392C3603E3CC37A74C380AC5CA59DF06485FA538F47C39927E080214FEFCAD45E34909D8D91EC10DF4F6D491718819FCA7BC8D72FF5FE889C7EAD49070240
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.JPG Page" GUID="{6008D446-9EB4-4819-BCD4-6DA7DB471DC8}">.. <Properties>.. <Property Class="Text" GUID="{D1AA01CF-3B22-45B8-97C8-289667574294}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.JPG Page</Property>.. <Property Class="Type" GUID="{BDDDAA97-D560-4AEB-89E6-56C365230104}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_.OSE Page\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3120
Entropy (8bit):	5.104746902850013
Encrypted:	false
SSDEEP:	96:krqtqd2uI0MdOMAbd/u20MdOMIbcwz0MdOMpXbdwk0MdOM9z:dDdOLdOLdOkBdO4z
MD5:	E5DF1DCD23C6E746241276FF53B4AA58
SHA1:	5E2271BD21E61CF055AF5AD431655AD77F997817
SHA-256:	3616548536769C656B255CB3E44303D597A739AAE66A4CFA946837E0BE71DA32
SHA-512:	CD3436A63B1874061CBC23954734105F7964678AA13411BD6A70440C8A2008FD4AAC77C4374236D76E964C47245F2CFE58E24D019F903A8D202DBEE6E9A2B0FD
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.OSE Page" GUID="{36231D4C-B6ED-41A6-B95E-DD2405AB6802}">.. <Properties>.. <Property Class="Text" GUID="{710365F5-7A8D-4BFF-A204-1B6E5CAFC6F5}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.OSE Page</Property>.. <Property Class="Type" GUID="{8197F60C-00CE-425E-B8A7-59CE7CC48996}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_.OSE Page\is-D6H98.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3120
Entropy (8bit):	5.104746902850013
Encrypted:	false
SSDEEP:	96:krqtqd2uI0MdOMAbd/u20MdOMIbcwz0MdOMpXbdwk0MdOM9z:dDdOLdOLdOkBdO4z
MD5:	E5DF1DCD23C6E746241276FF53B4AA58
SHA1:	5E2271BD21E61CF055AF5AD431655AD77F997817
SHA-256:	3616548536769C656B255CB3E44303D597A739AAE66A4CFA946837E0BE71DA32
SHA-512:	CD3436A63B1874061CBC23954734105F7964678AA13411BD6A70440C8A2008FD4AAC77C4374236D76E964C47245F2CFE58E24D019F903A8D202DBEE6E9A2B0FD
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.OSE Page" GUID="{36231D4C-B6ED-41A6-B95E-DD2405AB6802}">.. <Properties>.. <Property Class="Text" GUID="{710365F5-7A8D-4BFF-A204-1B6E5CAFC6F5}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.OSE Page</Property>.. <Property Class="Type" GUID="{8197F60C-00CE-425E-B8A7-59CE7CC48996}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_.PDF Page\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1471), with CRLF line terminators
Category:	dropped
Size (bytes):	4593
Entropy (8bit):	5.415397042311092
Encrypted:	false
SSDEEP:	96:kCxAqd2uI0MdOMTbd/ul0MdOM1zfbd/u20MdOM0TqZIrebcwz0MdOMyx9bdwk0MB:FUdOLdOkzRdOTT4dONbdOm
MD5:	8CAB1D644329DFE477CCAE3F95CB757D
SHA1:	870C05B66EE31711C8C72C7B65CABE34CEA4A0F2
SHA-256:	F2D44FD1F459313EC31EC15336CE50EB836332C35FE01EDBF0FBB740E5041DFC
SHA-512:	60CA15C762C8C19DCFBC64CAC251A36C6BEF921262ED372E0E404CEB85BCACEF29ABF8A107E5FE1D76F5BC42665291513144B20CB63753DE7107997C7115AA90
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.PDF Page" GUID="{F578F3D1-9F89-44C6-9B20-FD0C2776DF1F}">.. <Properties>.. <Property Class="Text" GUID="{BDEC8904-3222-4B64-8DB6-B5BB4A072D73}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.PDF Page</Property>.. <Property Class="Type" GUID="{CE857459-91E6-4847-94AD-1C8B8466529C}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_.PDF Page\is-98G4E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1471), with CRLF line terminators
Category:	dropped
Size (bytes):	4593
Entropy (8bit):	5.415397042311092
Encrypted:	false
SSDEEP:	96:kCxAqd2uI0MdOMTbd/ul0MdOM1zfbd/u20MdOM0TqZIrebcwz0MdOMyx9bdwk0MB:FUdOLdOkzRdOTT4dONbdOm
MD5:	8CAB1D644329DFE477CCAE3F95CB757D
SHA1:	870C05B66EE31711C8C72C7B65CABE34CEA4A0F2
SHA-256:	F2D44FD1F459313EC31EC15336CE50EB836332C35FE01EDBF0FBB740E5041DFC
SHA-512:	60CA15C762C8C19DCFBC64CAC251A36C6BEF921262ED372E0E404CEB85BCACEF29ABF8A107E5FE1D76F5BC42665291513144B20CB63753DE7107997C7115AA90
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.PDF Page" GUID="{F578F3D1-9F89-44C6-9B20-FD0C2776DF1F}">.. <Properties>.. <Property Class="Text" GUID="{BDEC8904-3222-4B64-8DB6-B5BB4A072D73}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.PDF Page</Property>.. <Property Class="Type" GUID="{CE857459-91E6-4847-94AD-1C8B8466529C}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_.PLN Page\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3120
Entropy (8bit):	5.105451016356105
Encrypted:	false
SSDEEP:	96:kV2Rqd2uI0MdOMZbd/u20MdOMTbcwz0MdOMz0Wbdwk0MdOM/:mSdO2dOkdOevdOs
MD5:	109F59004194021A4E4CC54F8499AD92
SHA1:	5A9D6CFC01DBA84E5AEFD4F8B55841ADCA770F4F
SHA-256:	06F43B141F3FAB0A3DC44891CED80AAACF05B86C45C0EE483A06805B5B8C3930
SHA-512:	416A73712ED15807D49B2AE18F7966CCCE8B4519E610B7CC9F5D5EA12977908422C4098B2006ABCFCBDAC2DDF78413370199A420BD6C3DDA625BD1E09F3114F9
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.PLN Page" GUID="{842FD502-106F-4A56-A3BB-2D68D63B2739}">.. <Properties>.. <Property Class="Text" GUID="{AC741AF1-AE36-4D48-8464-9CBAF15EAA61}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.PLN Page</Property>.. <Property Class="Type" GUID="{96E4DDF7-1B4B-4454-BF08-62B944067596}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_.PLN Page\is-7FTDJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3120
Entropy (8bit):	5.105451016356105
Encrypted:	false
SSDEEP:	96:kV2Rqd2uI0MdOMZbd/u20MdOMTbcwz0MdOMz0Wbdwk0MdOM/:mSdO2dOkdOevdOs
MD5:	109F59004194021A4E4CC54F8499AD92
SHA1:	5A9D6CFC01DBA84E5AEFD4F8B55841ADCA770F4F
SHA-256:	06F43B141F3FAB0A3DC44891CED80AAACF05B86C45C0EE483A06805B5B8C3930
SHA-512:	416A73712ED15807D49B2AE18F7966CCCE8B4519E610B7CC9F5D5EA12977908422C4098B2006ABCFCBDAC2DDF78413370199A420BD6C3DDA625BD1E09F3114F9
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.PLN Page" GUID="{842FD502-106F-4A56-A3BB-2D68D63B2739}">.. <Properties>.. <Property Class="Text" GUID="{AC741AF1-AE36-4D48-8464-9CBAF15EAA61}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.PLN Page</Property>.. <Property Class="Type" GUID="{96E4DDF7-1B4B-4454-BF08-62B944067596}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_.PLT Page\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3120
Entropy (8bit):	5.095210863837559
Encrypted:	false
SSDEEP:	96:k2+5qd2uI0MdOM3Rbd/u20MdOMbbcwz0MdOMSoIbdwk0MdOMN:SdOKdOIdO5dOi
MD5:	FA6AFBB7C36A34E1F8548FAF682C31E7
SHA1:	72132FE1536E77B15B208DBDFE1F908106804784
SHA-256:	0AB810039A6D5BAAC741C805BB0CCD846B48130EAB8CEE37BB93E5F5EDCAF625
SHA-512:	DF18884CBDB8171B2E05B41FED6E090E8AC18BE00AED88AC4A8C8FCA9530FBBCD3D076BDF756753DC022A5449581B90E68BF17FA50C2120C859DC11292CB7E67
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.PLT Page" GUID="{10618B88-C9FE-453D-B760-8100420FC115}">.. <Properties>.. <Property Class="Text" GUID="{44F33EC9-4EF6-4AE4-B8BD-77F1FC9FE41C}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.PLT Page</Property>.. <Property Class="Type" GUID="{CB85CA6A-CDEB-4BD8-BA0F-C8D95AB5A489}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_.PLT Page\is-0I71J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3120
Entropy (8bit):	5.095210863837559
Encrypted:	false
SSDEEP:	96:k2+5qd2uI0MdOM3Rbd/u20MdOMbbcwz0MdOMSoIbdwk0MdOMN:SdOKdOIdO5dOi
MD5:	FA6AFBB7C36A34E1F8548FAF682C31E7
SHA1:	72132FE1536E77B15B208DBDFE1F908106804784
SHA-256:	0AB810039A6D5BAAC741C805BB0CCD846B48130EAB8CEE37BB93E5F5EDCAF625
SHA-512:	DF18884CBDB8171B2E05B41FED6E090E8AC18BE00AED88AC4A8C8FCA9530FBBCD3D076BDF756753DC022A5449581B90E68BF17FA50C2120C859DC11292CB7E67
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.PLT Page" GUID="{10618B88-C9FE-453D-B760-8100420FC115}">.. <Properties>.. <Property Class="Text" GUID="{44F33EC9-4EF6-4AE4-B8BD-77F1FC9FE41C}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.PLT Page</Property>.. <Property Class="Type" GUID="{CB85CA6A-CDEB-4BD8-BA0F-C8D95AB5A489}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_.PNG Page\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	823
Entropy (8bit):	5.346711735041366
Encrypted:	false
SSDEEP:	24:2dFDOX2Rf2WAdOc3RvApWJ7S60cgAWhMhcj91Ocov:cMYTPnSt
MD5:	D5DE4607609D8839E04D47D5EE5770B8
SHA1:	35514C66147B9D0B26C8A223BCC102F1FD82B5A3
SHA-256:	6942D9DC3AC798E20F01D5670DC19A2A3E914058D09FE889659A1CE305CFC512
SHA-512:	2459616331DFE9535B4AD5708E856CE7B10D1F18D3A5A8BD8D041A4415E93E1FB880B3551F1E3CB879581AA01B96085A0F7D0D3A73162A4C343CB0565C1FAC9C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_.PNG Page" GUID="{C669C472-C8C8-4055-82CB-A4071437EC9F}">.. <Properties>.. <Property Class="Text" GUID="" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{C669C472-C8C8-4055-82CB-A4071437EC9F}</Property>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="2" DecimalPlaces="2">_.PNG Page</Property>.. <Property Class="Type" GUID="{3FEB66B8-1C58-4CDD-84AE-EEF7FFCC974D}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="">Page</Property>.. <Property Class="Number" GUID="{BA4ECA35-CBA9-41DC-AB6D-4BE83C58DB70}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">3</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_.PNG Page\is-OU34V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	823
Entropy (8bit):	5.346711735041366
Encrypted:	false
SSDEEP:	24:2dFDOX2Rf2WAdOc3RvApWJ7S60cgAWhMhcj91Ocov:cMYTPnSt
MD5:	D5DE4607609D8839E04D47D5EE5770B8
SHA1:	35514C66147B9D0B26C8A223BCC102F1FD82B5A3
SHA-256:	6942D9DC3AC798E20F01D5670DC19A2A3E914058D09FE889659A1CE305CFC512
SHA-512:	2459616331DFE9535B4AD5708E856CE7B10D1F18D3A5A8BD8D041A4415E93E1FB880B3551F1E3CB879581AA01B96085A0F7D0D3A73162A4C343CB0565C1FAC9C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_.PNG Page" GUID="{C669C472-C8C8-4055-82CB-A4071437EC9F}">.. <Properties>.. <Property Class="Text" GUID="" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="0" DecimalPlaces="2">{C669C472-C8C8-4055-82CB-A4071437EC9F}</Property>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="2" DecimalPlaces="2">_.PNG Page</Property>.. <Property Class="Type" GUID="{3FEB66B8-1C58-4CDD-84AE-EEF7FFCC974D}" Name="Type" group="Item" OrderIndex="3" DecimalPlaces="">Page</Property>.. <Property Class="Number" GUID="{BA4ECA35-CBA9-41DC-AB6D-4BE83C58DB70}" Name="OrderIndex" systemhidden="True" OrderIndex="4" DecimalPlaces="2">3</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_.TIF Page\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1900), with CRLF line terminators
Category:	dropped
Size (bytes):	5021
Entropy (8bit):	5.411954275687836
Encrypted:	false
SSDEEP:	96:kqtqd2uI0MdOMhbd2ul0MdOMhkfbd/u2CMdOQM0X2dzgi10ZmcpZbcwz0MdOMNbU:HdOOdOkk7dO5gi1Qmcp/dOsdOd
MD5:	F106AE52C118532887CF16FC9BF97FBD
SHA1:	314E363836422D5639D4DA49A4D45C46C87447B1
SHA-256:	5756CDCDD62B5F8B9D26DE716357305E4D661180633920550BB78803619354F3
SHA-512:	16347A8FFE62DCC9E3F60FC9756AEC558A685B1F448FB11374942E5ECC1BF8F112F36B3DDCBB43C6E0E781AB186B7D612E5E9C6D3372AF9A593FE023FB1A867B
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.TIF Page" GUID="{7C6CF11D-7396-44DE-A544-60AE2FF0CE26}">.. <Properties>.. <Property Class="Text" GUID="{447757B2-7560-4D75-AA54-93988E568499}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.TIF Page</Property>.. <Property Class="Type" GUID="{1E66A6BE-E65E-406E-8EE1-C067D943C723}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_.TIF Page\_.TIFF Page\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3127
Entropy (8bit):	5.099039635831749
Encrypted:	false
SSDEEP:	96:ki/qd2uI0MdOM4bd/ul0MdOMubcwz0MdOMhbdwk0MdOMS:/dOCdO/dOIdOd
MD5:	096FE7EBBF113AC625D1457C5F3831E7
SHA1:	8F13482DD1AE2F919FB26BC901B7605244F80F8E
SHA-256:	5FEE36EEC5E9246730DE71304E2EFBF77DC8BAACDF766949F07850D9AE23E01C
SHA-512:	82BBA525F32C886FD19B6A6BC782735D0C4CAFF5801CEA1DD242945EB730BB46567656073E084D7B42752DDEB002F7C2C3A0AA2751263E345520DB1B56F3ABBF
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.TIFF Page" GUID="{4E79C9F4-42AF-4DB7-8B34-DEE85FC92541}">.. <Properties>.. <Property Class="Text" GUID="{BA329612-ED38-4F5A-856F-DEE97E13C076}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.TIFF Page</Property>.. <Property Class="Type" GUID="{83F83FDE-B1C5-4137-BC0F-EAAAC7B4A6E9}" Name="Type" inheritaction="" calculatebefor

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_.TIF Page\_.TIFF Page\is-TB10K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3127
Entropy (8bit):	5.099039635831749
Encrypted:	false
SSDEEP:	96:ki/qd2uI0MdOM4bd/ul0MdOMubcwz0MdOMhbdwk0MdOMS:/dOCdO/dOIdOd
MD5:	096FE7EBBF113AC625D1457C5F3831E7
SHA1:	8F13482DD1AE2F919FB26BC901B7605244F80F8E
SHA-256:	5FEE36EEC5E9246730DE71304E2EFBF77DC8BAACDF766949F07850D9AE23E01C
SHA-512:	82BBA525F32C886FD19B6A6BC782735D0C4CAFF5801CEA1DD242945EB730BB46567656073E084D7B42752DDEB002F7C2C3A0AA2751263E345520DB1B56F3ABBF
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.TIFF Page" GUID="{4E79C9F4-42AF-4DB7-8B34-DEE85FC92541}">.. <Properties>.. <Property Class="Text" GUID="{BA329612-ED38-4F5A-856F-DEE97E13C076}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.TIFF Page</Property>.. <Property Class="Type" GUID="{83F83FDE-B1C5-4137-BC0F-EAAAC7B4A6E9}" Name="Type" inheritaction="" calculatebefor

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_.TIF Page\is-P2JI1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1900), with CRLF line terminators
Category:	dropped
Size (bytes):	5021
Entropy (8bit):	5.411954275687836
Encrypted:	false
SSDEEP:	96:kqtqd2uI0MdOMhbd2ul0MdOMhkfbd/u2CMdOQM0X2dzgi10ZmcpZbcwz0MdOMNbU:HdOOdOkk7dO5gi1Qmcp/dOsdOd
MD5:	F106AE52C118532887CF16FC9BF97FBD
SHA1:	314E363836422D5639D4DA49A4D45C46C87447B1
SHA-256:	5756CDCDD62B5F8B9D26DE716357305E4D661180633920550BB78803619354F3
SHA-512:	16347A8FFE62DCC9E3F60FC9756AEC558A685B1F448FB11374942E5ECC1BF8F112F36B3DDCBB43C6E0E781AB186B7D612E5E9C6D3372AF9A593FE023FB1A867B
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.TIF Page" GUID="{7C6CF11D-7396-44DE-A544-60AE2FF0CE26}">.. <Properties>.. <Property Class="Text" GUID="{447757B2-7560-4D75-AA54-93988E568499}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.TIF Page</Property>.. <Property Class="Type" GUID="{1E66A6BE-E65E-406E-8EE1-C067D943C723}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_.WMF Page\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3120
Entropy (8bit):	5.102002785079681
Encrypted:	false
SSDEEP:	96:kvsqd2uI0MdOM1bd/u20MdOMKbcwz0MdOMvbdwk0MdOM6:fdOadOddOCdOl
MD5:	9D8663AFC07CEB6DF5724492F80EC4B1
SHA1:	E50A5DC60D34EAAE0F32EAFEC288F0CA5741790C
SHA-256:	BD9F13BEB33106C573DE259D9D0B846D26C17AE9C741B0B658522C69471E3B97
SHA-512:	5F07A382127292DD5FA2F69C7BE87861D7C1325A19A517EA443A7A9DEB19F9E73C4241837D9ADF41765A4BD132CD7568606A7877D83D4BEFF11920C7F67ACA61
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.WMF Page" GUID="{C4FC2C50-A76D-4D2E-BB2B-ED35EEB8AF51}">.. <Properties>.. <Property Class="Text" GUID="{DC6C814E-7FC8-45AC-A6D2-5D92C33640B6}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.WMF Page</Property>.. <Property Class="Type" GUID="{D7ACF323-D04F-4138-936C-D1577E35EF29}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_.WMF Page\is-13LBQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3120
Entropy (8bit):	5.102002785079681
Encrypted:	false
SSDEEP:	96:kvsqd2uI0MdOM1bd/u20MdOMKbcwz0MdOMvbdwk0MdOM6:fdOadOddOCdOl
MD5:	9D8663AFC07CEB6DF5724492F80EC4B1
SHA1:	E50A5DC60D34EAAE0F32EAFEC288F0CA5741790C
SHA-256:	BD9F13BEB33106C573DE259D9D0B846D26C17AE9C741B0B658522C69471E3B97
SHA-512:	5F07A382127292DD5FA2F69C7BE87861D7C1325A19A517EA443A7A9DEB19F9E73C4241837D9ADF41765A4BD132CD7568606A7877D83D4BEFF11920C7F67ACA61
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.WMF Page" GUID="{C4FC2C50-A76D-4D2E-BB2B-ED35EEB8AF51}">.. <Properties>.. <Property Class="Text" GUID="{DC6C814E-7FC8-45AC-A6D2-5D92C33640B6}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.WMF Page</Property>.. <Property Class="Type" GUID="{D7ACF323-D04F-4138-936C-D1577E35EF29}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_CAD Page\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1871), with CRLF line terminators
Category:	dropped
Size (bytes):	4991
Entropy (8bit):	5.365029336837335
Encrypted:	false
SSDEEP:	96:kSyrmqd2uI0MdOM+fbd/ul0MdOM0X1d7kiGrzl7XLQqDcbd/u20MdOMzbdwz0MdH:4sdOxudOLkiGrzl7XLQqDydOJdO0dO0
MD5:	9FA1C313EAA4C0F6FECD7632AF757354
SHA1:	72137F28E254039FE42BA2A33D229E8E2138ECFF
SHA-256:	47107E6CF4CEAFFF33338FAEAA0E85116EC6E68F59B932AFB0FC5E6D1A0FBA5B
SHA-512:	C8BE85AD181BA8A85B89E4540972A399E4C6C8441A455A0B0144AE553A0240D1BCF73DBAEC051474123D1855553FE40488EEA85DF4A40CEEF6B24E6ED120C5F7
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_CAD Page" GUID="{8F2C128B-6410-41E9-AC9D-A88B8ACAEBEB}">.. <Properties>.. <Property Class="Text" GUID="{5F55368E-6AEC-4889-8563-3A59C6F29811}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_CAD Page</Property>.. <Property Class="Image" GUID="{1DB366C6-FFA8-45D4-A19A-E690619AD75F}" Name="Icon" inheritaction="Inherit Result" cal

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_CAD Page\_.DWF Page\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3124
Entropy (8bit):	5.106681951012025
Encrypted:	false
SSDEEP:	96:kbo7qd2uI0MdOMhkbd/u20MdOMsbcwz0MdOMoTBbdwk0MdOMc:XdOJdO3dONdOP
MD5:	0E0F7FBB24228D933CDB0FD337C2A783
SHA1:	57467E49500EF91E78854B7112876D22DE30C33A
SHA-256:	ADA22F166D62D6DE4119D8A7D9F04A8FA4FD3707DB7102B96A4DBCC0287CC806
SHA-512:	7C015D6B5B2C7B7B0EE24AB7D6C973D8A8A3B0CA33FE68EE5460018FD2CC4939B9B0EA43FF135E3983E73E46EC79CCA6CDB797E09296D4807A9989BEC37073CD
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.DWF Page" GUID="{DE2435C1-E45F-42A8-9E4E-8883A6586904}">.. <Properties>.. <Property Class="Text" GUID="{6033BC78-DD46-47EE-9CA2-1D1F9496B90C}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.DWF Page</Property>.. <Property Class="Type" GUID="{BEC3733B-213F-4170-8F6B-9B9075A6DA72}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_CAD Page\_.DWF Page\is-AA2N9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3124
Entropy (8bit):	5.106681951012025
Encrypted:	false
SSDEEP:	96:kbo7qd2uI0MdOMhkbd/u20MdOMsbcwz0MdOMoTBbdwk0MdOMc:XdOJdO3dONdOP
MD5:	0E0F7FBB24228D933CDB0FD337C2A783
SHA1:	57467E49500EF91E78854B7112876D22DE30C33A
SHA-256:	ADA22F166D62D6DE4119D8A7D9F04A8FA4FD3707DB7102B96A4DBCC0287CC806
SHA-512:	7C015D6B5B2C7B7B0EE24AB7D6C973D8A8A3B0CA33FE68EE5460018FD2CC4939B9B0EA43FF135E3983E73E46EC79CCA6CDB797E09296D4807A9989BEC37073CD
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.DWF Page" GUID="{DE2435C1-E45F-42A8-9E4E-8883A6586904}">.. <Properties>.. <Property Class="Text" GUID="{6033BC78-DD46-47EE-9CA2-1D1F9496B90C}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.DWF Page</Property>.. <Property Class="Type" GUID="{BEC3733B-213F-4170-8F6B-9B9075A6DA72}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_CAD Page\_.DWG Page\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3124
Entropy (8bit):	5.105377307480666
Encrypted:	false
SSDEEP:	96:kk1kqd2uI0MdOMW4bd/u20MdOMGbcwz0MdOMiNbdwk0MdOM5:edO1edOldOZdOm
MD5:	03E4477415683FFBA93AEBF311FCBE4F
SHA1:	1B262EB904D65F67F0C7C2ECD10290E7245E39CD
SHA-256:	1B075C5A0D1FA61A5395F52BC31953864CC38CA51C1F8E9463011628D1A9C009
SHA-512:	46B69777BFCD1E1EAD800B3E0464FBCD7ECEE08E6D4810DA6438BDDC1E2D8B366D30FA0FC822EDFCEE27221D0EB84D1B7CC9C0EC1615152CC2A999988AEB9598
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.DWG Page" GUID="{956E139C-AB28-4E69-9179-B64E201C3FFF}">.. <Properties>.. <Property Class="Text" GUID="{CEADD407-D4E4-41E1-B349-BF90436CE6D5}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.DWG Page</Property>.. <Property Class="Type" GUID="{CA636653-2EFF-4075-886C-67C9AEDF5E2E}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_CAD Page\_.DWG Page\is-NT3PS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3124
Entropy (8bit):	5.105377307480666
Encrypted:	false
SSDEEP:	96:kk1kqd2uI0MdOMW4bd/u20MdOMGbcwz0MdOMiNbdwk0MdOM5:edO1edOldOZdOm
MD5:	03E4477415683FFBA93AEBF311FCBE4F
SHA1:	1B262EB904D65F67F0C7C2ECD10290E7245E39CD
SHA-256:	1B075C5A0D1FA61A5395F52BC31953864CC38CA51C1F8E9463011628D1A9C009
SHA-512:	46B69777BFCD1E1EAD800B3E0464FBCD7ECEE08E6D4810DA6438BDDC1E2D8B366D30FA0FC822EDFCEE27221D0EB84D1B7CC9C0EC1615152CC2A999988AEB9598
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.DWG Page" GUID="{956E139C-AB28-4E69-9179-B64E201C3FFF}">.. <Properties>.. <Property Class="Text" GUID="{CEADD407-D4E4-41E1-B349-BF90436CE6D5}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.DWG Page</Property>.. <Property Class="Type" GUID="{CA636653-2EFF-4075-886C-67C9AEDF5E2E}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_CAD Page\_.DXF Page\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3124
Entropy (8bit):	5.103668272155422
Encrypted:	false
SSDEEP:	96:kP95qd2uI0MdOMcbd/u20MdOMDebcwz0MdOMQbdwk0MdOMS:cdObdOw8dObdOd
MD5:	0D98B7D1986D79A557118FF647FA7A22
SHA1:	5FD13AA116258FA81CDA418AED2A2FB8E05AB0CE
SHA-256:	F5215F19F26E686D842C162B7A7560750DED8413849C60274BE24B1DE619495C
SHA-512:	DEC15327F2B61BA2F86EBA37AE582F15B491D4FED32DD3326E25E1F9EF1B3A76C82D665A52412FD8905E592B3ABF5E06C2AFB21B3D4BE64ED25615B734A01E7C
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.DXF Page" GUID="{DB8BDBED-4E99-49C1-AE5B-BE555B97407B}">.. <Properties>.. <Property Class="Text" GUID="{8D9D159D-8F7C-4485-907A-621F98336A16}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.DXF Page</Property>.. <Property Class="Type" GUID="{4F618658-0EA3-4CAB-AFF5-47B9D2C6E3AE}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_CAD Page\_.DXF Page\is-1SM51.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (758), with CRLF line terminators
Category:	dropped
Size (bytes):	3124
Entropy (8bit):	5.103668272155422
Encrypted:	false
SSDEEP:	96:kP95qd2uI0MdOMcbd/u20MdOMDebcwz0MdOMQbdwk0MdOMS:cdObdOw8dObdOd
MD5:	0D98B7D1986D79A557118FF647FA7A22
SHA1:	5FD13AA116258FA81CDA418AED2A2FB8E05AB0CE
SHA-256:	F5215F19F26E686D842C162B7A7560750DED8413849C60274BE24B1DE619495C
SHA-512:	DEC15327F2B61BA2F86EBA37AE582F15B491D4FED32DD3326E25E1F9EF1B3A76C82D665A52412FD8905E592B3ABF5E06C2AFB21B3D4BE64ED25615B734A01E7C
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_.DXF Page" GUID="{DB8BDBED-4E99-49C1-AE5B-BE555B97407B}">.. <Properties>.. <Property Class="Text" GUID="{8D9D159D-8F7C-4485-907A-621F98336A16}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_.DXF Page</Property>.. <Property Class="Type" GUID="{4F618658-0EA3-4CAB-AFF5-47B9D2C6E3AE}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\_CAD Page\is-JHOF1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1871), with CRLF line terminators
Category:	dropped
Size (bytes):	4991
Entropy (8bit):	5.365029336837335
Encrypted:	false
SSDEEP:	96:kSyrmqd2uI0MdOM+fbd/ul0MdOM0X1d7kiGrzl7XLQqDcbd/u20MdOMzbdwz0MdH:4sdOxudOLkiGrzl7XLQqDydOJdO0dO0
MD5:	9FA1C313EAA4C0F6FECD7632AF757354
SHA1:	72137F28E254039FE42BA2A33D229E8E2138ECFF
SHA-256:	47107E6CF4CEAFFF33338FAEAA0E85116EC6E68F59B932AFB0FC5E6D1A0FBA5B
SHA-512:	C8BE85AD181BA8A85B89E4540972A399E4C6C8441A455A0B0144AE553A0240D1BCF73DBAEC051474123D1855553FE40488EEA85DF4A40CEEF6B24E6ED120C5F7
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_CAD Page" GUID="{8F2C128B-6410-41E9-AC9D-A88B8ACAEBEB}">.. <Properties>.. <Property Class="Text" GUID="{5F55368E-6AEC-4889-8563-3A59C6F29811}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_CAD Page</Property>.. <Property Class="Image" GUID="{1DB366C6-FFA8-45D4-A19A-E690619AD75F}" Name="Icon" inheritaction="Inherit Result" cal

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Page\is-FR177.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1311), with CRLF line terminators
Category:	dropped
Size (bytes):	2707
Entropy (8bit):	5.6188289429796825
Encrypted:	false
SSDEEP:	48:cs+RtTF52d3DymvpKFYFnYgpQRZ/QzQkggoRcjxpV0JrNTp2Y/wMi:H+LR52dzgi10ZmcpO0Jx92GRi
MD5:	4D9D22ACE89112BFC19F0041FE979835
SHA1:	5702F83A815A8C19339C9884A97F99ED60509383
SHA-256:	B2CB04EACDDC548EEC137D044E023EC85B3534F323ADF48CCDD53B6DEBA450FF
SHA-512:	11C41B77A92059CF38EDC7BA3CCAA4F5BFAAB8F4C92821B88EACA0483E9AA35ED216D23C5F090CFD213060B6439636E9C15F965B7F9A81E25715EC74D854BDC4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Page" GUID="{FA995725-9384-46E7-B656-7022173139E1}">.. <Properties>.. <Property Class="Type" GUID="{A164414F-98F4-47DE-B3F3-4718380C4A9D}" Name="Type" required="True" group="Item" OrderIndex="0" DecimalPlaces="">All</Property>.. <Property Class="Image" GUID="{A3D18FBB-6F44-4285-B9FA-FAA85DFE2C7C}" Name="Icon" inheritaction="Inherit Result" group="Item" OrderIndex="1" DecimalPlaces="" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAADwAAABAAAAABABgAAAAAAAADAAATCwAAEwsAAAAAAAAAAAAA/wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD/AAAA/wD/NC4aNC4aNC4aNC4aNC4aNC4aNC4aNC4aNC4aNC4aNC4aNC4a/wD//wD/AAAA/wD/jZeE3+zw3erv2uju2Oft1eXs0uTq0OLpzeDoyt/nyN3mNC4a/wD//wD/AAAA/wD/jZeE4e3xGBocGBocGBocGBocGBocGBocGBocGBocyt/mNC4a/wD//wD/AAAA/wD/jZeE4+7yGBocSGKCSGKCSGKCSGKCSGKCSGKCGBoczODnNC4a/wD//wD/AAAA/wD/jZeE5e/zGBocnL7LnL7LnL7LnL7LnL7LSGKCGBoczuHoNC4a/wD//wD/AAAA/wD/jZeE5/H0GBocGBocGBocGBocGBocnL

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Plugin\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (3138), with CRLF line terminators
Category:	dropped
Size (bytes):	11317
Entropy (8bit):	5.9400615764392946
Encrypted:	false
SSDEEP:	192:cxmDL0GGb3TCukgykGlTBA6vQVMZ/LEnanVSAZwsF9:sGQPfW5vz/u0Vh9
MD5:	893D77D3B9D529336D8705E4F78F1D52
SHA1:	0853C678CC70997E9DC8CDC4A3469F9A536D92AC
SHA-256:	8BCB4EC6A1598B69413945E3E4ADE54DB742BF82F88253A396225D98F48CEDE3
SHA-512:	5EA2CF917A5C84A1227809AEC43696EAB046AC51E62C953F0C326AAD7309641A13B51C592BBE5CF1E97BF6D59288A24A3CC4365542BFA73D204B8E04A355E605
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Plugin" GUID="{52789364-ED84-450E-B6E5-6F96CE511F6A}">.. <Properties>.. <Property Class="Text" GUID="{A535804E-662F-4144-B4E9-BD870B163ED7}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Plugin</Property>.. <Property Class="Type" GUID="{850402B6-02BB-47E3-A5F6-BD20F02A35D2}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">All</Property>.. <Property Class="Image" GUID="{5647A1FD-3F62-418F-BD68-4246D57D52D4}" Name="Icon" inheritaction="Inherit Result" input="True" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" Transparent="False" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAAoBJREFUOE+Nk29IU2EUxp/Ny9xkc7hkaqihhTrxT1MDF0hokH5ojtrAwL5oYBhOUUE0nIGEGqQRihWmYUXYB6P6En0QjCILSbQ/mmEF2ZQylHKYlvPp1DeJoR

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Plugin\is-UJ452.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (3138), with CRLF line terminators
Category:	dropped
Size (bytes):	11317
Entropy (8bit):	5.9400615764392946
Encrypted:	false
SSDEEP:	192:cxmDL0GGb3TCukgykGlTBA6vQVMZ/LEnanVSAZwsF9:sGQPfW5vz/u0Vh9
MD5:	893D77D3B9D529336D8705E4F78F1D52
SHA1:	0853C678CC70997E9DC8CDC4A3469F9A536D92AC
SHA-256:	8BCB4EC6A1598B69413945E3E4ADE54DB742BF82F88253A396225D98F48CEDE3
SHA-512:	5EA2CF917A5C84A1227809AEC43696EAB046AC51E62C953F0C326AAD7309641A13B51C592BBE5CF1E97BF6D59288A24A3CC4365542BFA73D204B8E04A355E605
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Plugin" GUID="{52789364-ED84-450E-B6E5-6F96CE511F6A}">.. <Properties>.. <Property Class="Text" GUID="{A535804E-662F-4144-B4E9-BD870B163ED7}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Plugin</Property>.. <Property Class="Type" GUID="{850402B6-02BB-47E3-A5F6-BD20F02A35D2}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">All</Property>.. <Property Class="Image" GUID="{5647A1FD-3F62-418F-BD68-4246D57D52D4}" Name="Icon" inheritaction="Inherit Result" input="True" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" Transparent="False" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAAoBJREFUOE+Nk29IU2EUxp/Ny9xkc7hkaqihhTrxT1MDF0hokH5ojtrAwL5oYBhOUUE0nIGEGqQRihWmYUXYB6P6En0QjCILSbQ/mmEF2ZQylHKYlvPp1DeJoR

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Report\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1010), with CRLF line terminators
Category:	dropped
Size (bytes):	2159
Entropy (8bit):	5.834545229109697
Encrypted:	false
SSDEEP:	48:c9VkA7NEtTb4h3mez4gXRJNWpeWf5QkxVsYowMi:qC0AgWeE2RXWf2kx2FRi
MD5:	82854B844A0FA42CAC2ADC305A0D24A1
SHA1:	87D867C3CA3259545D977A2A881CA59B59CE115E
SHA-256:	A3FAA369AF96BD56712C6778D494CF945BAFFAB24351CE80A08A1219EA777B72
SHA-512:	57D02F0858654821D613B821CE44C4F7EBF4D52B0C1981ED00B3BC850F237807056BFE355E49E2D82AEB7335122CBB6A162A7CE467EBAA437097A8BA4A92FB9F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Report" GUID="{B9740906-3077-40FF-90F3-D92FF4708382}">.. <Properties>.. <Property Class="Text" GUID="{30EAED6C-B7DF-4778-B20E-CB2833C70794}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Report</Property>.. <Property Class="Type" GUID="{2F94AB4A-D17A-473C-A39C-8E2691F61983}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2"/>.. <Property Class="Image" GUID="{5D3D0683-08EB-499C-8408-98AFD0E8DCD2}" Name="Icon" inheritaction="Inherit Result" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList" Transparent="False" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAAAlwSFlzAAALDQAACw0B7QfALAAAAZpJREFUOE+l010oQ2EYB/CzC3Lj80JpuWFumAtqWrKlXCofaT4ibka+1liEdqHcEFptNixSttQamuYjbSVbygVpLaVcuV

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Report\is-2S257.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1010), with CRLF line terminators
Category:	dropped
Size (bytes):	2159
Entropy (8bit):	5.834545229109697
Encrypted:	false
SSDEEP:	48:c9VkA7NEtTb4h3mez4gXRJNWpeWf5QkxVsYowMi:qC0AgWeE2RXWf2kx2FRi
MD5:	82854B844A0FA42CAC2ADC305A0D24A1
SHA1:	87D867C3CA3259545D977A2A881CA59B59CE115E
SHA-256:	A3FAA369AF96BD56712C6778D494CF945BAFFAB24351CE80A08A1219EA777B72
SHA-512:	57D02F0858654821D613B821CE44C4F7EBF4D52B0C1981ED00B3BC850F237807056BFE355E49E2D82AEB7335122CBB6A162A7CE467EBAA437097A8BA4A92FB9F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Report" GUID="{B9740906-3077-40FF-90F3-D92FF4708382}">.. <Properties>.. <Property Class="Text" GUID="{30EAED6C-B7DF-4778-B20E-CB2833C70794}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Report</Property>.. <Property Class="Type" GUID="{2F94AB4A-D17A-473C-A39C-8E2691F61983}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2"/>.. <Property Class="Image" GUID="{5D3D0683-08EB-499C-8408-98AFD0E8DCD2}" Name="Icon" inheritaction="Inherit Result" group="Item" OrderIndex="2" DecimalPlaces="2" List="cmbList" PluginToExecute="cmbList" Transparent="False" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAAAlwSFlzAAALDQAACw0B7QfALAAAAZpJREFUOE+l010oQ2EYB/CzC3Lj80JpuWFumAtqWrKlXCofaT4ibka+1liEdqHcEFptNixSttQamuYjbSVbygVpLaVcuV

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Storage\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1372), with CRLF line terminators
Category:	dropped
Size (bytes):	2491
Entropy (8bit):	5.473809927304996
Encrypted:	false
SSDEEP:	48:c1JdT/2tTed1dkrCRk15XCcfWdyeDZZji1OyW8Szi3gBAS:q1EKd1dZa1ZC+W9Fxl8SDAS
MD5:	0CBAF010B81AA8CACE270150F43B009F
SHA1:	F2315562F9EEFE5C78E66B3C08B4BC98EAA39CAF
SHA-256:	698F153B29A1E4264D17B37C9F47332B7476F9576F360C873A7DF143C43EC00D
SHA-512:	361F9CA716A12B80C4D7FA9CEAA76A8456883D5D32E024312D6840F1AC236C7B87038C2F41F6323681E2FDCDB3B5937362657A6041063AE3F39F9474B4EFBDC7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Storage" GUID="{6033D1FD-F464-42BA-93B4-9137AE3440A3}">.. <Properties>.. <Property Class="Text" GUID="{285983CF-AEC5-46EC-BDE2-18299247538F}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Storage</Property>.. <Property Class="Type" GUID="{3023B90C-26F5-4C04-A6C8-149B8E6313AE}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">All</Property>.. <Property Class="Image" GUID="{895D14A5-B644-413E-9BC2-0AC4E407F62E}" Name="Icon" inheritaction="Inherit Result" group="Item" OrderIndex="2" DecimalPlaces="2" TreeList="cmbTreeList" PluginToExecute="cmbPluginToExecute" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAAASCwAAEgsAAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////3d3dvb29tra2yMjI1tbW0dHRzMzM4+Pj/////////////////////////f39tra2mpqaq6uru7u71dXV6urq/

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Storage\_ADO Storage\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	871
Entropy (8bit):	5.39992207140193
Encrypted:	false
SSDEEP:	24:2dFDjhhZjX2RvApWctcfgAW0QFh1OcCP8ITVSgrff2WAdOclX5v:c1N71GJBBtRW
MD5:	32BAF109E2A1816196C20229710E545D
SHA1:	4E59EFC7273A213689B6C250F129230336FE0A09
SHA-256:	CB6AD0AC2ABBD6E8F2CC9F7228628492320FD117E6E15787AD32265E4E35FFE7
SHA-512:	AE5D1B703261ECC5F96E72FF055655A917BC141B9E72B218CC7C084D2590E1FED8B082071339F01A967FEC5F1C9069DA6A5A636CAD23A412A4513F934CA6055A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_ADO Storage" GUID="{D5F22270-68E3-48D7-B072-51759FABF472}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_ADO Storage</Property>.. <Property Class="Type" GUID="{A5AF81A0-DAD1-49C4-A957-1649B1D85CBD}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Storage</Property>.. <Property Class="Number" GUID="{55905E1F-5F16-4867-A1D3-DF19B61921AF}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">2.5</Property>.. <Property Class="Text" GUID="{5EDDFBA9-6742-49E8-AB40-0A7BF3CCB003}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{D5F22270-68E3-48D7-B072-51759FABF472}</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Storage\_ADO Storage\_MS Access Storage\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	923
Entropy (8bit):	5.430994853509369
Encrypted:	false
SSDEEP:	24:2dFDF5jhJmABpX2SGBvApWc5jtXE8gAW7mgWp1OctLTIf2WAdOcDmAB/v:cBmABpBeZxWOUg9ABn
MD5:	82F0F2D591F272C161FA814727559991
SHA1:	745335B979070623D3DD79BF07DC86B910482A05
SHA-256:	02CFAB32A31E6337E314CDA04B2EAB59E382314B33A9776428766031EAD85B71
SHA-512:	EFC8F0BACA111DEF8BF09F297672A2242290284907AD3AE8F4657E68F0C9218A3F87157BD4A9411E7DA7F163B7BFB34A4DA26F6135CFD830AD9BEA33AB2990C4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_MS Access Storage" GUID="{3938E256-DC3D-48CF-B824-7887B33A5DF9}">.. <Properties>.. <Property Class="Text" GUID="{C42E0445-4C89-4F00-9E83-EDAC77E9426A}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_MS Access Storage</Property>.. <Property Class="Type" GUID="{91A3288E-15D9-491D-80EA-1199524D8E56}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">ADO Storage</Property>.. <Property Class="Number" GUID="{E9EA3B85-1411-4BC0-8C76-99EDE438E8B7}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">0</Property>.. <Property Class="Text" GUID="{D4AD31A7-2778-496E-B7F9-B56A5D0A8B68}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{3938E256-DC3D-48CF-B824-7887B33A5DF9}</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Storage\_ADO Storage\_MS Access Storage\is-8CK5D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	923
Entropy (8bit):	5.430994853509369
Encrypted:	false
SSDEEP:	24:2dFDF5jhJmABpX2SGBvApWc5jtXE8gAW7mgWp1OctLTIf2WAdOcDmAB/v:cBmABpBeZxWOUg9ABn
MD5:	82F0F2D591F272C161FA814727559991
SHA1:	745335B979070623D3DD79BF07DC86B910482A05
SHA-256:	02CFAB32A31E6337E314CDA04B2EAB59E382314B33A9776428766031EAD85B71
SHA-512:	EFC8F0BACA111DEF8BF09F297672A2242290284907AD3AE8F4657E68F0C9218A3F87157BD4A9411E7DA7F163B7BFB34A4DA26F6135CFD830AD9BEA33AB2990C4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_MS Access Storage" GUID="{3938E256-DC3D-48CF-B824-7887B33A5DF9}">.. <Properties>.. <Property Class="Text" GUID="{C42E0445-4C89-4F00-9E83-EDAC77E9426A}" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_MS Access Storage</Property>.. <Property Class="Type" GUID="{91A3288E-15D9-491D-80EA-1199524D8E56}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">ADO Storage</Property>.. <Property Class="Number" GUID="{E9EA3B85-1411-4BC0-8C76-99EDE438E8B7}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">0</Property>.. <Property Class="Text" GUID="{D4AD31A7-2778-496E-B7F9-B56A5D0A8B68}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{3938E256-DC3D-48CF-B824-7887B33A5DF9}</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Storage\_ADO Storage\is-EG9L5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	871
Entropy (8bit):	5.39992207140193
Encrypted:	false
SSDEEP:	24:2dFDjhhZjX2RvApWctcfgAW0QFh1OcCP8ITVSgrff2WAdOclX5v:c1N71GJBBtRW
MD5:	32BAF109E2A1816196C20229710E545D
SHA1:	4E59EFC7273A213689B6C250F129230336FE0A09
SHA-256:	CB6AD0AC2ABBD6E8F2CC9F7228628492320FD117E6E15787AD32265E4E35FFE7
SHA-512:	AE5D1B703261ECC5F96E72FF055655A917BC141B9E72B218CC7C084D2590E1FED8B082071339F01A967FEC5F1C9069DA6A5A636CAD23A412A4513F934CA6055A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_ADO Storage" GUID="{D5F22270-68E3-48D7-B072-51759FABF472}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_ADO Storage</Property>.. <Property Class="Type" GUID="{A5AF81A0-DAD1-49C4-A957-1649B1D85CBD}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2">Storage</Property>.. <Property Class="Number" GUID="{55905E1F-5F16-4867-A1D3-DF19B61921AF}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">2.5</Property>.. <Property Class="Text" GUID="{5EDDFBA9-6742-49E8-AB40-0A7BF3CCB003}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{D5F22270-68E3-48D7-B072-51759FABF472}</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Storage\_Folder Storage\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (2735), with CRLF line terminators
Category:	dropped
Size (bytes):	4988
Entropy (8bit):	5.36129761936231
Encrypted:	false
SSDEEP:	96:6DY26a1d6i6MzgRFmd9Rx1DzHokwN4lD4:6Dr6JiZ8Gd9ZzJlD4
MD5:	91F93E9DE1835E382DD71FFECC5435D0
SHA1:	87390DA6D2D8CE38370C9F6A06B3D7C93DD9E29E
SHA-256:	9C14894B744E5D3B50FD2940DB9C1FD2B7C6C74A8CEACFF81D4F3623EBD6A225
SHA-512:	A39B6A87E2901DCAC9873AEFC3047E13957BE64551F1EB5D59349AEDF5F06F51E58A810B1754C4B22322EC25EEC3C034AD939ED9F0A611E4A932BC5276628C93
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Folder Storage" GUID="{39211581-6581-4937-A48A-5C7D13E0A45A}">.. <Properties>.. <Property Class="Text" GUID="{F6487577-4833-40C5-B86B-9EAF2E0F3773}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_Folder Storage</Property>.. <Property Class="Type" GUID="{BA10786F-0CA2-4B29-9A32-5B7DC786A204}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Storage</Property>.. <Property Class="Image" GUID="{1962EAB8-46CE-429F-8DDB-D046489B2896}" Name="Icon" inheritaction="Inherit Formula" group="Item" OrderIndex="2" DecimalPlaces="" List="cmbList" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAAATCwAAEwsAAAAAAAAAAAAA/wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD/f39/ampqampqampqampqampqampqampqampqampqampqampqf39//wD//w

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Storage\_Folder Storage\is-5QKDV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (2735), with CRLF line terminators
Category:	dropped
Size (bytes):	4988
Entropy (8bit):	5.36129761936231
Encrypted:	false
SSDEEP:	96:6DY26a1d6i6MzgRFmd9Rx1DzHokwN4lD4:6Dr6JiZ8Gd9ZzJlD4
MD5:	91F93E9DE1835E382DD71FFECC5435D0
SHA1:	87390DA6D2D8CE38370C9F6A06B3D7C93DD9E29E
SHA-256:	9C14894B744E5D3B50FD2940DB9C1FD2B7C6C74A8CEACFF81D4F3623EBD6A225
SHA-512:	A39B6A87E2901DCAC9873AEFC3047E13957BE64551F1EB5D59349AEDF5F06F51E58A810B1754C4B22322EC25EEC3C034AD939ED9F0A611E4A932BC5276628C93
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Folder Storage" GUID="{39211581-6581-4937-A48A-5C7D13E0A45A}">.. <Properties>.. <Property Class="Text" GUID="{F6487577-4833-40C5-B86B-9EAF2E0F3773}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_Folder Storage</Property>.. <Property Class="Type" GUID="{BA10786F-0CA2-4B29-9A32-5B7DC786A204}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="">Storage</Property>.. <Property Class="Image" GUID="{1962EAB8-46CE-429F-8DDB-D046489B2896}" Name="Icon" inheritaction="Inherit Formula" group="Item" OrderIndex="2" DecimalPlaces="" List="cmbList" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAAATCwAAEwsAAAAAAAAAAAAA/wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD//wD/f39/ampqampqampqampqampqampqampqampqampqampqampqf39//wD//w

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Storage\_MDB List Storage\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1864), with CRLF line terminators
Category:	dropped
Size (bytes):	5003
Entropy (8bit):	5.499302249038683
Encrypted:	false
SSDEEP:	96:kNSUEqd2uI0MdOMj/bd/ul0MdOMYbd/u24MdOM0X1dObtyZQbcwz0MdOMnhbdwkK:BFdOhdOPdOebtTdOKHdOd
MD5:	89EE966AF89B04012ED5E29BEB8F5922
SHA1:	5AE353DBF0EC86DC5750CF3603F074EF7C735C8C
SHA-256:	541E90D2A7A3B0ED2FFA1D4D9BAB7F0EFC1461E328F5628344F0160298C8DDD3
SHA-512:	67489DE8BE7C59E1458BA5B1F828B9876D275CCC768075922C68374D144CAF44EE4B484B7025777DA68361619CA58B6FC2AF051A64453837CBFAFD7008F39C2B
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_MDB List Storage" GUID="{48410388-E803-4737-A502-BFA695C8D467}">.. <Properties>.. <Property Class="Text" GUID="{89537621-7683-4E9F-A0A6-8470EFA8AAEB}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_MDB List Storage</Property>.. <Property Class="Type" GUID="{9B65CC11-672D-4521-886C-0F71F1B33FCB}" Name="Type" inheritaction="" ca

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Storage\_MDB List Storage\_MDB Table\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1879), with CRLF line terminators
Category:	dropped
Size (bytes):	5014
Entropy (8bit):	5.465766153030925
Encrypted:	false
SSDEEP:	96:kaHqd2uI0MdOMkbd/ul0MdOMjb6bd/u24MdOM0X1dKvv9Yk4JqZJZLbcwz0MdOM1:tdOgdOU2dO4VYkyKxdOxdOd
MD5:	1F54B94118D144CF8360281729D25392
SHA1:	23C7EDE2A74EB4F66865CDF383103E6294FE58D0
SHA-256:	653843EC8B78EBBB14079D89868FDAF85E62E25857DC3F9AF48A03AEBDBFB28F
SHA-512:	5EC782DF5BCEDAE890315EB19C1CEBA70243A332A541C56DF45397070737E7B4C79C2C6141C10EC2AA83B296490B1766CEA8FA1C5C3C7130D39545ECF0DC06EB
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_MDB Table" GUID="{CF5A20CA-0A35-4163-8A3A-61F493639091}">.. <Properties>.. <Property Class="Text" GUID="{53D2142D-079B-49D0-AEDB-9DA8BB458333}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_MDB Table</Property>.. <Property Class="Type" GUID="{6EAC90CD-2427-4ECA-B4DC-6167E98C564B}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Storage\_MDB List Storage\_MDB Table\is-L71DV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1879), with CRLF line terminators
Category:	dropped
Size (bytes):	5014
Entropy (8bit):	5.465766153030925
Encrypted:	false
SSDEEP:	96:kaHqd2uI0MdOMkbd/ul0MdOMjb6bd/u24MdOM0X1dKvv9Yk4JqZJZLbcwz0MdOM1:tdOgdOU2dO4VYkyKxdOxdOd
MD5:	1F54B94118D144CF8360281729D25392
SHA1:	23C7EDE2A74EB4F66865CDF383103E6294FE58D0
SHA-256:	653843EC8B78EBBB14079D89868FDAF85E62E25857DC3F9AF48A03AEBDBFB28F
SHA-512:	5EC782DF5BCEDAE890315EB19C1CEBA70243A332A541C56DF45397070737E7B4C79C2C6141C10EC2AA83B296490B1766CEA8FA1C5C3C7130D39545ECF0DC06EB
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_MDB Table" GUID="{CF5A20CA-0A35-4163-8A3A-61F493639091}">.. <Properties>.. <Property Class="Text" GUID="{53D2142D-079B-49D0-AEDB-9DA8BB458333}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_MDB Table</Property>.. <Property Class="Type" GUID="{6EAC90CD-2427-4ECA-B4DC-6167E98C564B}" Name="Type" inheritaction="" calculatebefore=

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Storage\_MDB List Storage\is-S1OD3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1864), with CRLF line terminators
Category:	dropped
Size (bytes):	5003
Entropy (8bit):	5.499302249038683
Encrypted:	false
SSDEEP:	96:kNSUEqd2uI0MdOMj/bd/ul0MdOMYbd/u24MdOM0X1dObtyZQbcwz0MdOMnhbdwkK:BFdOhdOPdOebtTdOKHdOd
MD5:	89EE966AF89B04012ED5E29BEB8F5922
SHA1:	5AE353DBF0EC86DC5750CF3603F074EF7C735C8C
SHA-256:	541E90D2A7A3B0ED2FFA1D4D9BAB7F0EFC1461E328F5628344F0160298C8DDD3
SHA-512:	67489DE8BE7C59E1458BA5B1F828B9876D275CCC768075922C68374D144CAF44EE4B484B7025777DA68361619CA58B6FC2AF051A64453837CBFAFD7008F39C2B
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_MDB List Storage" GUID="{48410388-E803-4737-A502-BFA695C8D467}">.. <Properties>.. <Property Class="Text" GUID="{89537621-7683-4E9F-A0A6-8470EFA8AAEB}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_MDB List Storage</Property>.. <Property Class="Type" GUID="{9B65CC11-672D-4521-886C-0F71F1B33FCB}" Name="Type" inheritaction="" ca

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Storage\_VCServer Storage\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (2787), with CRLF line terminators
Category:	dropped
Size (bytes):	4899
Entropy (8bit):	6.068625276873546
Encrypted:	false
SSDEEP:	96:USCyI2EZ+dzPf+VW7SgQKXCCsZCKsJzPaYUxW+tLxRjlfHA+7lkA3:m2EodzPA4QKyCsZ+zCYU/tLnlHB7r
MD5:	9B24989F26F495D3643DCAA44CB57A93
SHA1:	2795130AE31835245C465A326F914AFE31A1FA31
SHA-256:	E2480B7753985ABD3B55C569E91C64C003526150BF5601B43793D47E873BFEA8
SHA-512:	3027DF39737701498800872571FB995E750BFA7B525953953CD710488AF027F01543BD6AE18E37D75E24E2FADEBE109880C4145AA10D0EE0846472B5B5D1627B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_VCServer Storage" GUID="{4BF9BA91-576D-44A5-9046-4D6A1A595AC6}">.. <Properties>.. <Property Class="Text" GUID="{51518649-CC30-4A88-B58B-91D1D3195EE7}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_VCServer Storage</Property>.. <Property Class="Image" GUID="{B311F920-B27E-4E62-AF29-246FCD80FB13}" Name="Icon" inheritaction="Inherit Formula" group="Item" OrderIndex="2" DecimalPlaces="" List="cmbList" Transparent="True" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAJsSURBVDhPjZPfS5phFMeFbvwD1o333fgPjMGQUO8cW2ODQJhDr72pC0MdOmShBqEUkRd2Icul5Y855sBNI2nSpuXWRRFDHf4If2Raisvyle/e53EakWM7cDgvvOf7ec45z3k4nD82OjoqEgqFbrlcXpyamsLMzAyUSuWZSCT6wOPxJrlc7p1+7q3ICj1msxnRaBT5fB6tVgsXFxeo1+vUY7EYJBLJ/sjICO+WWKVSweVy0cS+dbtdtNttNJtN1Go16pVKBQKBYGMooFwuD8QMwwzE1WoVxWIRuVyOQmQyWW0ogCQQ65/caDRwenqKUqlE

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Storage\_VCServer Storage\is-JN0CH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (2787), with CRLF line terminators
Category:	dropped
Size (bytes):	4899
Entropy (8bit):	6.068625276873546
Encrypted:	false
SSDEEP:	96:USCyI2EZ+dzPf+VW7SgQKXCCsZCKsJzPaYUxW+tLxRjlfHA+7lkA3:m2EodzPA4QKyCsZ+zCYU/tLnlHB7r
MD5:	9B24989F26F495D3643DCAA44CB57A93
SHA1:	2795130AE31835245C465A326F914AFE31A1FA31
SHA-256:	E2480B7753985ABD3B55C569E91C64C003526150BF5601B43793D47E873BFEA8
SHA-512:	3027DF39737701498800872571FB995E750BFA7B525953953CD710488AF027F01543BD6AE18E37D75E24E2FADEBE109880C4145AA10D0EE0846472B5B5D1627B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_VCServer Storage" GUID="{4BF9BA91-576D-44A5-9046-4D6A1A595AC6}">.. <Properties>.. <Property Class="Text" GUID="{51518649-CC30-4A88-B58B-91D1D3195EE7}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">_VCServer Storage</Property>.. <Property Class="Image" GUID="{B311F920-B27E-4E62-AF29-246FCD80FB13}" Name="Icon" inheritaction="Inherit Formula" group="Item" OrderIndex="2" DecimalPlaces="" List="cmbList" Transparent="True" ImageType="TdxPNGImage" ImageData="iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAJsSURBVDhPjZPfS5phFMeFbvwD1o333fgPjMGQUO8cW2ODQJhDr72pC0MdOmShBqEUkRd2Icul5Y855sBNI2nSpuXWRRFDHf4If2Raisvyle/e53EakWM7cDgvvOf7ec45z3k4nD82OjoqEgqFbrlcXpyamsLMzAyUSuWZSCT6wOPxJrlc7p1+7q3ICj1msxnRaBT5fB6tVgsXFxeo1+vUY7EYJBLJ/sjICO+WWKVSweVy0cS+dbtdtNttNJtN1Go16pVKBQKBYGMooFwuD8QMwwzE1WoVxWIRuVyOQmQyWW0ogCQQ65/caDRwenqKUqlE

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Storage\is-Q6HUB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1372), with CRLF line terminators
Category:	dropped
Size (bytes):	2491
Entropy (8bit):	5.473809927304996
Encrypted:	false
SSDEEP:	48:c1JdT/2tTed1dkrCRk15XCcfWdyeDZZji1OyW8Szi3gBAS:q1EKd1dZa1ZC+W9Fxl8SDAS
MD5:	0CBAF010B81AA8CACE270150F43B009F
SHA1:	F2315562F9EEFE5C78E66B3C08B4BC98EAA39CAF
SHA-256:	698F153B29A1E4264D17B37C9F47332B7476F9576F360C873A7DF143C43EC00D
SHA-512:	361F9CA716A12B80C4D7FA9CEAA76A8456883D5D32E024312D6840F1AC236C7B87038C2F41F6323681E2FDCDB3B5937362657A6041063AE3F39F9474B4EFBDC7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="_Storage" GUID="{6033D1FD-F464-42BA-93B4-9137AE3440A3}">.. <Properties>.. <Property Class="Text" GUID="{285983CF-AEC5-46EC-BDE2-18299247538F}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">_Storage</Property>.. <Property Class="Type" GUID="{3023B90C-26F5-4C04-A6C8-149B8E6313AE}" Name="Type" group="Item" OrderIndex="1" DecimalPlaces="2">All</Property>.. <Property Class="Image" GUID="{895D14A5-B644-413E-9BC2-0AC4E407F62E}" Name="Icon" inheritaction="Inherit Result" group="Item" OrderIndex="2" DecimalPlaces="2" TreeList="cmbTreeList" PluginToExecute="cmbPluginToExecute" Transparent="True" ImageType="TBitmap" ImageData="Qk02AwAAAAAAADYAAAAoAAAAEAAAABAAAAABABgAAAAAAAADAAASCwAAEgsAAAAAAAAAAAAA////////////////////////////////////////////////////////////////////////////////3d3dvb29tra2yMjI1tbW0dHRzMzM4+Pj/////////////////////////f39tra2mpqaq6uru7u71dXV6urq/

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Texture\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (4644), with CRLF line terminators
Category:	dropped
Size (bytes):	7914
Entropy (8bit):	5.858686066000423
Encrypted:	false
SSDEEP:	192:xqdOmdO2HdOxC9pjcaOvQiD3D748RQhTdOZodO+:cdOmdOAdOxuRcxvQibnpATdOSdO+
MD5:	83E3E3851DF4EE15007C19E3A319C16D
SHA1:	E16174056D2EC4E4C368FEBA8D4747EFED61739E
SHA-256:	938C9305023A63E4FB860E69A412237395B87B58C5A9DCD4E7E487067CE09C7E
SHA-512:	BA227A742BDE545EAADE8831A6EDB3037E70D10208E01A0AED1D38033DEBA596E5C79C4641132EB91900DC8FC3A898997C1EBE077CEB9B96E576AAFC0097ED0F
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Texture" GUID="{FDC5A525-2362-4C86-AA68-07722FC506D0}">.. <Properties>.. <Property Class="Text" GUID="{7CA87F91-6169-45B7-A552-29BF13EFE025}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Texture</Property>.. <Property Class="Type" GUID="{E2BFB16C-1983-4195-8B47-C0EC25773721}" Name="Type"

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\_Texture\is-VKS8I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (4644), with CRLF line terminators
Category:	dropped
Size (bytes):	7914
Entropy (8bit):	5.858686066000423
Encrypted:	false
SSDEEP:	192:xqdOmdO2HdOxC9pjcaOvQiD3D748RQhTdOZodO+:cdOmdOAdOxuRcxvQibnpATdOSdO+
MD5:	83E3E3851DF4EE15007C19E3A319C16D
SHA1:	E16174056D2EC4E4C368FEBA8D4747EFED61739E
SHA-256:	938C9305023A63E4FB860E69A412237395B87B58C5A9DCD4E7E487067CE09C7E
SHA-512:	BA227A742BDE545EAADE8831A6EDB3037E70D10208E01A0AED1D38033DEBA596E5C79C4641132EB91900DC8FC3A898997C1EBE077CEB9B96E576AAFC0097ED0F
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Texture" GUID="{FDC5A525-2362-4C86-AA68-07722FC506D0}">.. <Properties>.. <Property Class="Text" GUID="{7CA87F91-6169-45B7-A552-29BF13EFE025}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" DecimalPlaces="2" ListType="Simple List" SimpleList="" FixedSimpleList="0" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Texture</Property>.. <Property Class="Type" GUID="{E2BFB16C-1983-4195-8B47-C0EC25773721}" Name="Type"

C:\Program Files (x86)\PlanSwift11\Data\_Types\_All\is-SFFQA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1688), with CRLF line terminators
Category:	dropped
Size (bytes):	6136
Entropy (8bit):	5.414134921177981
Encrypted:	false
SSDEEP:	96:kPV1obcwI0MdO84bdwl0MdOKqd2u20MdOpBkAbd2uz0MdOz6bd/uk4MdOyLh7I0g:ujhdO8NdOqdOfJdOzgdOyLh2y74dOxdE
MD5:	49DAC5E6C1594879178701832666E644
SHA1:	147FEB42566C67D858CBECA6EB0C91FBEB15E5E7
SHA-256:	A718B1D776CB32B45574BF73293CF4510AE57AA668BE7591A79BF8EA29E1BBE8
SHA-512:	4DF2A69FBE8B98239B37CDD7E83E798804644F5E01591CFDA595CC66EFB9AFEEFCAD2C5E27E8720A32E297AB02C511D916C30D3F062FE737CF54947FBF809083
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Folder" Name="_All" GUID="{A343E721-1948-452D-9C02-CFB512B26FC1}">.. <Properties>.. <Property Class="Text" GUID="{02F528BD-A772-413E-BEA9-AC07D92A0749}" Name="GUID" inheritaction="" calculatebefore="0" inherited="False" input="False" inputcondition="" locked="False" hidden="False" systemlocked="True" systemhidden="True" required="False" units="" inputunits="" group="" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0">{A343E721-1948-452D-9C02-CFB512B26FC1}</Property>.. <Property Class="Number" GUID="{AE1A70B3-36BC-4F7A-AB51-184F00160D5D}" Name="OrderIndex" inheritaction="" calculatebefore="0" inhe

C:\Program Files (x86)\PlanSwift11\Data\_Types\is-S72K6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (2208), with CRLF line terminators
Category:	dropped
Size (bytes):	5308
Entropy (8bit):	5.211631425427944
Encrypted:	false
SSDEEP:	96:k0Kk6qd2uI0MdOMxLbd/ul0MdOMLibd/u24MdOM0YFW+eOcIWbdwz0MdOMBbcwkQ:ZkdOe6dObdOuW+BcadOfdOx
MD5:	430A2CA6DAA0C740D0BCBCF671F9E561
SHA1:	F52E258088584637787AA40DBAC7692FA7483636
SHA-256:	22AC449C39D0C3E2668841B552757EBFCDE76930A4A39B261FD4AF4EB6D84930
SHA-512:	C291FE541AF104A8611174A170717B9C15C9AFBF36693D5E0C54A2ACAEE4A9D08871B499E303815CE2F242C61F39951783A1220CDA793369A7E9CD950226E6E0
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Types" GUID="{01B29FFC-E81D-4701-B19D-11C87B97175D}">.. <Properties>.. <Property Class="Text" GUID="{C33D5B04-C01D-4930-88D3-562905A3D3CE}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Types</Property>.. <Property Class="Type" GUID="{036C68FC-5BEF-4D6F-82C9-889B99EDB749}" Name="Type" inheritaction="" calculatebefore="0" inhe

C:\Program Files (x86)\PlanSwift11\Data\_Units\CM\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2313
Entropy (8bit):	5.444760232727337
Encrypted:	false
SSDEEP:	24:2dFDiEXX2sTT/CApWWfvN2AWQl1KgAW3fnkW+bMBjWpBaoBmWG1AylVHW881bW3Y:c0ElDp//4bMWBaoiX+wiKJZwl/FT3
MD5:	A3460EF4B16436B881331D8122E86FF3
SHA1:	C90334E7542447E05116B4ACB6EAB82252712BF0
SHA-256:	9FFC9DE656AF0ABB722BCE6D0E8B13BB0EC3DFC3A18CD1D96ACE9BB3A369AD50
SHA-512:	A47577358BB887886DD4FDC0E93BE70801ABC3FB7804AB2DE951883E941155F8D764AA10DBEA4A439F0236AA3282C54B341E5A10706E600EEB2B7E35FEC4941B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="CM" GUID="{07B813B9-C8CC-4A15-86EC-3031F5F452FD}">.. <Properties>.. <Property Class="Text" GUID="{A9D2489E-71FD-4C61-AD50-9F4A82712FD3}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">CM</Property>.. <Property Class="Text" GUID="{B696CF26-D6C6-4D34-910E-186E48D1B7C2}" Name="Measurement Type" group="Item" OrderIndex="1" DecimalPlaces="" List="cmbList">Metric</Property>.. <Property Class="Type" GUID="{C44E5E11-14CE-4D0B-9490-128259637E78}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces=""/>.. <Property Class="Number" GUID="{9E17DF77-39E8-43C0-827A-69DEBFD88CB4}" Name="Convert_IN" group="Item" OrderIndex="3" DecimalPlaces="" List="cmbList">1/2.54</Property>.. <Property Class="Number" GUID="{58C51D1B-5FD5-49B7-B045-4F54491D9BAC}" Name="Convert_FT" group="Item" OrderIndex="4" DecimalPlaces="" List="cmbList">1/30.48</Property>.. <Property Cl

C:\Program Files (x86)\PlanSwift11\Data\_Units\CM\is-0CT4G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2313
Entropy (8bit):	5.444760232727337
Encrypted:	false
SSDEEP:	24:2dFDiEXX2sTT/CApWWfvN2AWQl1KgAW3fnkW+bMBjWpBaoBmWG1AylVHW881bW3Y:c0ElDp//4bMWBaoiX+wiKJZwl/FT3
MD5:	A3460EF4B16436B881331D8122E86FF3
SHA1:	C90334E7542447E05116B4ACB6EAB82252712BF0
SHA-256:	9FFC9DE656AF0ABB722BCE6D0E8B13BB0EC3DFC3A18CD1D96ACE9BB3A369AD50
SHA-512:	A47577358BB887886DD4FDC0E93BE70801ABC3FB7804AB2DE951883E941155F8D764AA10DBEA4A439F0236AA3282C54B341E5A10706E600EEB2B7E35FEC4941B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="CM" GUID="{07B813B9-C8CC-4A15-86EC-3031F5F452FD}">.. <Properties>.. <Property Class="Text" GUID="{A9D2489E-71FD-4C61-AD50-9F4A82712FD3}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">CM</Property>.. <Property Class="Text" GUID="{B696CF26-D6C6-4D34-910E-186E48D1B7C2}" Name="Measurement Type" group="Item" OrderIndex="1" DecimalPlaces="" List="cmbList">Metric</Property>.. <Property Class="Type" GUID="{C44E5E11-14CE-4D0B-9490-128259637E78}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces=""/>.. <Property Class="Number" GUID="{9E17DF77-39E8-43C0-827A-69DEBFD88CB4}" Name="Convert_IN" group="Item" OrderIndex="3" DecimalPlaces="" List="cmbList">1/2.54</Property>.. <Property Class="Number" GUID="{58C51D1B-5FD5-49B7-B045-4F54491D9BAC}" Name="Convert_FT" group="Item" OrderIndex="4" DecimalPlaces="" List="cmbList">1/30.48</Property>.. <Property Cl

C:\Program Files (x86)\PlanSwift11\Data\_Units\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (2208), with CRLF line terminators
Category:	dropped
Size (bytes):	5308
Entropy (8bit):	5.235807438306779
Encrypted:	false
SSDEEP:	96:k2jFqd2uI0MdOMehz3bcwl0MdOMyRnlbd/u24MdOM0YNHdbCcTL9IrwEXbd/uz0/:7dO5ZdOdbdO6N9MpodOfdOi
MD5:	16A8E452ACB162C3711C8F5617805EEF
SHA1:	7869FA87D392C2CA13F3FECC88A306678EB8594D
SHA-256:	FF278F1C4FC4F6A460DF858D6B519843FF9ED014DE40C24B85DEDFC80FC00DE1
SHA-512:	9BC0B1DC80C5A55BE9AD3EC3AE8CA01DCED6506C5B6C9522D85D1D0707D0E8039FF3A77312F81ABE6D71C8D53EBDF3A6A4A71A106A589B7C79F3AC7A9D785823
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Units" GUID="{692B765A-7804-4E33-8BEF-9347B0AE29F1}">.. <Properties>.. <Property Class="Text" GUID="{6DB33FD5-15E1-49E1-AC5A-4E41DB03AAA6}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Units</Property>.. <Property Class="Text" GUID="{D0D3EA84-5297-42C7-AF67-5E7639C33356}" Name="GUID" inheritaction="Ignore" calculatebefore="0

C:\Program Files (x86)\PlanSwift11\Data\_Units\EA\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	837
Entropy (8bit):	5.382813059035705
Encrypted:	false
SSDEEP:	24:2dVfDVXX2RvApWv7Deu1OcNiGtvgAWVlmf2WAdOcP1v:cVJXODAicl
MD5:	C8DA40AC470369E8BD0E3D92ADE489AD
SHA1:	27F8CDABFBDADD71FDF9BF2AB64B402ABD44D2A3
SHA-256:	879B382B2486DFB7BFEEC0163849CAC1E3B71A94630896548A9DF7478AF782DF
SHA-512:	9404AF6F9DE5D2BC968D1D4BCF87C509A9DEEBC1D587C30B24485FCE20909C3CC8C743F53E96D34C0187F15BFA9A0691ECA50C07BF16D239580133C0F578FC05
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="EA" GUID="{106AB79F-D5DA-4FBF-8719-B5ACC8B2308A}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">EA</Property>.. <Property Class="Number" GUID="{9C4883C3-9CF0-49DE-AEED-9A1B81B68906}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">8</Property>.. <Property Class="Type" GUID="{7F0D5337-CD9A-4A2A-B9FC-84500FB76B63}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2"/>.. <Property Class="Text" GUID="{1472EB12-5DEC-4C36-B4D0-7A028160CF26}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{106AB79F-D5DA-4FBF-8719-B5ACC8B2308A}</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\_Units\EA\is-I96O5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	837
Entropy (8bit):	5.382813059035705
Encrypted:	false
SSDEEP:	24:2dVfDVXX2RvApWv7Deu1OcNiGtvgAWVlmf2WAdOcP1v:cVJXODAicl
MD5:	C8DA40AC470369E8BD0E3D92ADE489AD
SHA1:	27F8CDABFBDADD71FDF9BF2AB64B402ABD44D2A3
SHA-256:	879B382B2486DFB7BFEEC0163849CAC1E3B71A94630896548A9DF7478AF782DF
SHA-512:	9404AF6F9DE5D2BC968D1D4BCF87C509A9DEEBC1D587C30B24485FCE20909C3CC8C743F53E96D34C0187F15BFA9A0691ECA50C07BF16D239580133C0F578FC05
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="EA" GUID="{106AB79F-D5DA-4FBF-8719-B5ACC8B2308A}">.. <Properties>.. <Property Class="Text" GUID="" Name="Name" inheritaction="Ignore" required="True" group="Item" OrderIndex="0" DecimalPlaces="2">EA</Property>.. <Property Class="Number" GUID="{9C4883C3-9CF0-49DE-AEED-9A1B81B68906}" Name="OrderIndex" systemhidden="True" OrderIndex="1" DecimalPlaces="2">8</Property>.. <Property Class="Type" GUID="{7F0D5337-CD9A-4A2A-B9FC-84500FB76B63}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces="2"/>.. <Property Class="Text" GUID="{1472EB12-5DEC-4C36-B4D0-7A028160CF26}" Name="GUID" inheritaction="Ignore" systemlocked="True" systemhidden="True" OrderIndex="3" DecimalPlaces="2">{106AB79F-D5DA-4FBF-8719-B5ACC8B2308A}</Property>.. </Properties>..</Item>..

C:\Program Files (x86)\PlanSwift11\Data\_Units\FT\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (759), with CRLF line terminators
Category:	dropped
Size (bytes):	9048
Entropy (8bit):	5.049821478703749
Encrypted:	false
SSDEEP:	192:NDdOTdOE8dO0dOodOCdOqdObOdOBdOjdOamdOQWdOm:RdOTdOE8dO0dOodOCdOqdObOdOBdOjd7
MD5:	17B9DD4C98A80024D9866F8730162717
SHA1:	19E3543F1D4DE296DE15864FEB9B8C7A3F30621F
SHA-256:	85E2F3E02E850E63AFA3FE9BBB181FE6301581C8045AAE89622649C9581E54CF
SHA-512:	635FD56EDE3A2203F8866B6D08B3C7089DC1A4B6D1B32BB83A1396AB74BD3E885147A4CC53FE883104B735DEE9D55793ABA0885430DE48ED06822FE817F34E94
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="FT" GUID="{0D591BC5-0C0B-4371-9886-C94DD5121462}">.. <Properties>.. <Property Class="Text" GUID="{D2DA78E9-AFE1-46BB-9540-EBA6F6A2F8D1}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">FT</Property>.. <Property Class="Text" GUID="{B696CF26-D6C6-4D34-910E-186E48D1B7C2}" Name="Measurement Type" inheritaction="" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\_Units\FT\is-0J79N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (759), with CRLF line terminators
Category:	dropped
Size (bytes):	9048
Entropy (8bit):	5.049821478703749
Encrypted:	false
SSDEEP:	192:NDdOTdOE8dO0dOodOCdOqdObOdOBdOjdOamdOQWdOm:RdOTdOE8dO0dOodOCdOqdObOdOBdOjd7
MD5:	17B9DD4C98A80024D9866F8730162717
SHA1:	19E3543F1D4DE296DE15864FEB9B8C7A3F30621F
SHA-256:	85E2F3E02E850E63AFA3FE9BBB181FE6301581C8045AAE89622649C9581E54CF
SHA-512:	635FD56EDE3A2203F8866B6D08B3C7089DC1A4B6D1B32BB83A1396AB74BD3E885147A4CC53FE883104B735DEE9D55793ABA0885430DE48ED06822FE817F34E94
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="FT" GUID="{0D591BC5-0C0B-4371-9886-C94DD5121462}">.. <Properties>.. <Property Class="Text" GUID="{D2DA78E9-AFE1-46BB-9540-EBA6F6A2F8D1}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">FT</Property>.. <Property Class="Text" GUID="{B696CF26-D6C6-4D34-910E-186E48D1B7C2}" Name="Measurement Type" inheritaction="" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\_Units\IN\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2309
Entropy (8bit):	5.44954111369073
Encrypted:	false
SSDEEP:	24:2dFD7LQX2CWf/CApW2+fvN2AWQISZohgAWR7jW+ZtemWppnylVHWGi84hrmbWPdO:c9sJyq/9jeAh4htdEioxZL/sHKaVT0
MD5:	091CED9B229078A34F8AF67C0325E8A1
SHA1:	47DEE3DC444628B56FC918901A33CA6F533574E8
SHA-256:	B0CCBBDFCCFD58B4E3EDC0B0F3DFC76BE04EAE657A547E9D2BB59A759EDAF21F
SHA-512:	7188F6384B5C7621FB61D3105758BC68CAB6F2BD1905B0185317A257FE38FC45A37B72027390B836967CC2376401538BC0DF73314A8D87E7CF24AC157722AC2C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="IN" GUID="{09CFB02D-EABB-4A1B-A41E-AC43CBF8E762}">.. <Properties>.. <Property Class="Text" GUID="{7D9F5962-184E-4EF3-9389-87F847E147B6}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">IN</Property>.. <Property Class="Text" GUID="{B696CF26-D6C6-4D34-910E-186E48D1B7C2}" Name="Measurement Type" group="Item" OrderIndex="1" DecimalPlaces="" List="cmbList">English</Property>.. <Property Class="Type" GUID="{5DB3870A-04DA-4898-9F83-9AEA04F5610F}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces=""/>.. <Property Class="Number" GUID="{F1D24476-5AD9-4504-B482-C3D341EDF852}" Name="Convert_FT" group="Item" OrderIndex="3" DecimalPlaces="" List="cmbList">1/12</Property>.. <Property Class="Number" GUID="{4798B2B4-2E69-43D3-9FB0-1C79888C4B73}" Name="Convert_YD" group="Item" OrderIndex="4" DecimalPlaces="" List="cmbList">1/36</Property>.. <Property Class=

C:\Program Files (x86)\PlanSwift11\Data\_Units\IN\is-4B4DQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2309
Entropy (8bit):	5.44954111369073
Encrypted:	false
SSDEEP:	24:2dFD7LQX2CWf/CApW2+fvN2AWQISZohgAWR7jW+ZtemWppnylVHWGi84hrmbWPdO:c9sJyq/9jeAh4htdEioxZL/sHKaVT0
MD5:	091CED9B229078A34F8AF67C0325E8A1
SHA1:	47DEE3DC444628B56FC918901A33CA6F533574E8
SHA-256:	B0CCBBDFCCFD58B4E3EDC0B0F3DFC76BE04EAE657A547E9D2BB59A759EDAF21F
SHA-512:	7188F6384B5C7621FB61D3105758BC68CAB6F2BD1905B0185317A257FE38FC45A37B72027390B836967CC2376401538BC0DF73314A8D87E7CF24AC157722AC2C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="IN" GUID="{09CFB02D-EABB-4A1B-A41E-AC43CBF8E762}">.. <Properties>.. <Property Class="Text" GUID="{7D9F5962-184E-4EF3-9389-87F847E147B6}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">IN</Property>.. <Property Class="Text" GUID="{B696CF26-D6C6-4D34-910E-186E48D1B7C2}" Name="Measurement Type" group="Item" OrderIndex="1" DecimalPlaces="" List="cmbList">English</Property>.. <Property Class="Type" GUID="{5DB3870A-04DA-4898-9F83-9AEA04F5610F}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces=""/>.. <Property Class="Number" GUID="{F1D24476-5AD9-4504-B482-C3D341EDF852}" Name="Convert_FT" group="Item" OrderIndex="3" DecimalPlaces="" List="cmbList">1/12</Property>.. <Property Class="Number" GUID="{4798B2B4-2E69-43D3-9FB0-1C79888C4B73}" Name="Convert_YD" group="Item" OrderIndex="4" DecimalPlaces="" List="cmbList">1/36</Property>.. <Property Class=

C:\Program Files (x86)\PlanSwift11\Data\_Units\KM\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (759), with CRLF line terminators
Category:	dropped
Size (bytes):	9061
Entropy (8bit):	5.056482055302454
Encrypted:	false
SSDEEP:	192:EpWdO7dOPdOPdO4dO6dO3dOeOdOudO2dOSdO0+dOs:EpWdO7dOPdOPdO4dO6dO3dOeOdOudO28
MD5:	A4C87994F37A02AE51EE76780059A803
SHA1:	F010256115C9D8A63CF7BE823DD02AD178FF2143
SHA-256:	A39AEB32A9C1D0EE554B27E34F41658C323FF0832D444495A403F4B07D9CB291
SHA-512:	2B0013CD57FC04339281E327F2608160EA994A26D89E5FA91C7839D286AB1D60AAE18F1DCED6F0DBE3477C90CE0EF6A242262626593CB52AD8C38368883E5CFF
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="KM" GUID="{82FAB7D7-F0EF-4636-A6F5-2836492D43B9}">.. <Properties>.. <Property Class="Text" GUID="{FEC57342-5604-447C-9F9B-6C618E4FC355}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">KM</Property>.. <Property Class="Text" GUID="{7349EA27-E145-40B1-A297-14DF71277361}" Name="Measurement Type" inheritaction="" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\_Units\KM\is-EK1VF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (759), with CRLF line terminators
Category:	dropped
Size (bytes):	9061
Entropy (8bit):	5.056482055302454
Encrypted:	false
SSDEEP:	192:EpWdO7dOPdOPdO4dO6dO3dOeOdOudO2dOSdO0+dOs:EpWdO7dOPdOPdO4dO6dO3dOeOdOudO28
MD5:	A4C87994F37A02AE51EE76780059A803
SHA1:	F010256115C9D8A63CF7BE823DD02AD178FF2143
SHA-256:	A39AEB32A9C1D0EE554B27E34F41658C323FF0832D444495A403F4B07D9CB291
SHA-512:	2B0013CD57FC04339281E327F2608160EA994A26D89E5FA91C7839D286AB1D60AAE18F1DCED6F0DBE3477C90CE0EF6A242262626593CB52AD8C38368883E5CFF
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="KM" GUID="{82FAB7D7-F0EF-4636-A6F5-2836492D43B9}">.. <Properties>.. <Property Class="Text" GUID="{FEC57342-5604-447C-9F9B-6C618E4FC355}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">KM</Property>.. <Property Class="Text" GUID="{7349EA27-E145-40B1-A297-14DF71277361}" Name="Measurement Type" inheritaction="" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\_Units\MI\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (759), with CRLF line terminators
Category:	dropped
Size (bytes):	9056
Entropy (8bit):	5.0543682428561985
Encrypted:	false
SSDEEP:	192:vdOHdOAdOyzdONdOBdOsOdO8OdOpdO1dONdOsdOQ:vdOHdOAdOqdONdOBdOsOdO8OdOpdO1da
MD5:	252665CFD119D9688BB3383766A0984B
SHA1:	F75F92E52A7E2F4E5B3826F88ACFBAA3ACC127D6
SHA-256:	43EC5BDCBC80EEC41EDD0607160ED8C293A49A0CE2B6075E88687E40D479CDA8
SHA-512:	B64175FED85DE7CBAF817441237C49FC74F5A0EDE0848D5938EA0BD004C8084F70651136BF5A6ABE4D27199F3337B5F014A76590EED2F4DB72F3CDB9BEDF4F5A
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="MI" GUID="{267C3399-52A6-408D-A068-1A8CB7EE27E0}">.. <Properties>.. <Property Class="Text" GUID="{398C86F4-4EA2-4FA1-B811-EE6ACF31FBA9}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">MI</Property>.. <Property Class="Text" GUID="{B696CF26-D6C6-4D34-910E-186E48D1B7C2}" Name="Measurement Type" inheritaction="" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\_Units\MI\is-CF7Q7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (759), with CRLF line terminators
Category:	dropped
Size (bytes):	9056
Entropy (8bit):	5.0543682428561985
Encrypted:	false
SSDEEP:	192:vdOHdOAdOyzdONdOBdOsOdO8OdOpdO1dONdOsdOQ:vdOHdOAdOqdONdOBdOsOdO8OdOpdO1da
MD5:	252665CFD119D9688BB3383766A0984B
SHA1:	F75F92E52A7E2F4E5B3826F88ACFBAA3ACC127D6
SHA-256:	43EC5BDCBC80EEC41EDD0607160ED8C293A49A0CE2B6075E88687E40D479CDA8
SHA-512:	B64175FED85DE7CBAF817441237C49FC74F5A0EDE0848D5938EA0BD004C8084F70651136BF5A6ABE4D27199F3337B5F014A76590EED2F4DB72F3CDB9BEDF4F5A
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="MI" GUID="{267C3399-52A6-408D-A068-1A8CB7EE27E0}">.. <Properties>.. <Property Class="Text" GUID="{398C86F4-4EA2-4FA1-B811-EE6ACF31FBA9}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">MI</Property>.. <Property Class="Text" GUID="{B696CF26-D6C6-4D34-910E-186E48D1B7C2}" Name="Measurement Type" inheritaction="" calculatebefore="0"

C:\Program Files (x86)\PlanSwift11\Data\_Units\MM\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (759), with CRLF line terminators
Category:	dropped
Size (bytes):	9050
Entropy (8bit):	5.05555423368995
Encrypted:	false
SSDEEP:	192:WgdO7dOhdOudO0dO1dOEdOsOdOGdOXdOSdOcWdOJ:WgdO7dOhdOudO0dO1dOEdOsOdOGdOXd7
MD5:	B74634C8F86E6A3FD062BD4E23621894
SHA1:	325CA86A7AEAAF4F1E25ECA5C5F2BDDD8C19D531
SHA-256:	14798A1667EB2DC3C3269F22026D14FB8F4E80EFBEAD36DC90AA6E545DDD67C7
SHA-512:	13154AE12B779EC909413B34F05CCBBB7867DDA3CB9CD8D51C35DC97D3E57E78A30611394A091A3A65AF3AA3F788101D5F410A1A43643A85EE0C3E40B5F1B9D2
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="MM" GUID="{2EEDDAD7-7D97-4E3C-BD93-C000831E6F10}">.. <Properties>.. <Property Class="Text" GUID="{44948BFD-8172-4C26-9E70-9A188A14FF67}" Name="Name" inheritaction="" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">MM</Property>.. <Property Class="Text" GUID="{A0477584-94A7-417A-8B4C-60E8CF349B18}" Name="Measurement Type" inheritaction="" calculatebefore="0" inheri

C:\Program Files (x86)\PlanSwift11\Data\_Units\MM\is-4GPJ8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (759), with CRLF line terminators
Category:	dropped
Size (bytes):	9050
Entropy (8bit):	5.05555423368995
Encrypted:	false
SSDEEP:	192:WgdO7dOhdOudO0dO1dOEdOsOdOGdOXdOSdOcWdOJ:WgdO7dOhdOudO0dO1dOEdOsOdOGdOXd7
MD5:	B74634C8F86E6A3FD062BD4E23621894
SHA1:	325CA86A7AEAAF4F1E25ECA5C5F2BDDD8C19D531
SHA-256:	14798A1667EB2DC3C3269F22026D14FB8F4E80EFBEAD36DC90AA6E545DDD67C7
SHA-512:	13154AE12B779EC909413B34F05CCBBB7867DDA3CB9CD8D51C35DC97D3E57E78A30611394A091A3A65AF3AA3F788101D5F410A1A43643A85EE0C3E40B5F1B9D2
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="MM" GUID="{2EEDDAD7-7D97-4E3C-BD93-C000831E6F10}">.. <Properties>.. <Property Class="Text" GUID="{44948BFD-8172-4C26-9E70-9A188A14FF67}" Name="Name" inheritaction="" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">MM</Property>.. <Property Class="Text" GUID="{A0477584-94A7-417A-8B4C-60E8CF349B18}" Name="Measurement Type" inheritaction="" calculatebefore="0" inheri

C:\Program Files (x86)\PlanSwift11\Data\_Units\M\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2318
Entropy (8bit):	5.452107822423812
Encrypted:	false
SSDEEP:	24:2dFDExiX2a08/CApWk49N2AWQlCJgAWvLnkW+9ZrjWpCRT4mWG1DylVHW88hzpba:ciir0cAkQU9ZUCRTJy+6i3OlulTO
MD5:	426EF61A0255546E158FE05F1387B71C
SHA1:	E4A938CCA4B19AFF6039BD7B40BA6FCE8B50D4AE
SHA-256:	CD02664FAEBEF6C761DEB0C26EFC009A7BABDAF5C903EC0670DD58AADADAC882
SHA-512:	7FA7E35312A6662DD0F1BEC14E1DF1F739DE59F250668E83A38C032FC0637C75B54FFB707E757AEFA6297F82030F0F3C1D0C1BAB7D6FCA21ECC293A48C651D6B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="M" GUID="{4FB35581-F68E-47F7-8FD5-562A5E2DC650}">.. <Properties>.. <Property Class="Text" GUID="{FEC57342-5604-447C-9F9B-6C618E4FC355}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">M</Property>.. <Property Class="Text" GUID="{7349EA27-E145-40B1-A297-14DF71277361}" Name="Measurement Type" group="Item" OrderIndex="1" DecimalPlaces="" List="cmbList">Metric</Property>.. <Property Class="Type" GUID="{427DE190-4502-4BD0-8E4E-ECEF54074C58}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces=""/>.. <Property Class="Number" GUID="{9D4A7245-5055-4637-BDB9-9A5ACA116BA9}" Name="Convert_IN" group="Item" OrderIndex="3" DecimalPlaces="" List="cmbList">39.370078</Property>.. <Property Class="Number" GUID="{11B4A473-30B2-4001-B936-8D7A75EAA22E}" Name="Convert_FT" group="Item" OrderIndex="4" DecimalPlaces="" List="cmbList">3.2808398</Property>.. <Property

C:\Program Files (x86)\PlanSwift11\Data\_Units\M\is-KSPA2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2318
Entropy (8bit):	5.452107822423812
Encrypted:	false
SSDEEP:	24:2dFDExiX2a08/CApWk49N2AWQlCJgAWvLnkW+9ZrjWpCRT4mWG1DylVHW88hzpba:ciir0cAkQU9ZUCRTJy+6i3OlulTO
MD5:	426EF61A0255546E158FE05F1387B71C
SHA1:	E4A938CCA4B19AFF6039BD7B40BA6FCE8B50D4AE
SHA-256:	CD02664FAEBEF6C761DEB0C26EFC009A7BABDAF5C903EC0670DD58AADADAC882
SHA-512:	7FA7E35312A6662DD0F1BEC14E1DF1F739DE59F250668E83A38C032FC0637C75B54FFB707E757AEFA6297F82030F0F3C1D0C1BAB7D6FCA21ECC293A48C651D6B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="M" GUID="{4FB35581-F68E-47F7-8FD5-562A5E2DC650}">.. <Properties>.. <Property Class="Text" GUID="{FEC57342-5604-447C-9F9B-6C618E4FC355}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">M</Property>.. <Property Class="Text" GUID="{7349EA27-E145-40B1-A297-14DF71277361}" Name="Measurement Type" group="Item" OrderIndex="1" DecimalPlaces="" List="cmbList">Metric</Property>.. <Property Class="Type" GUID="{427DE190-4502-4BD0-8E4E-ECEF54074C58}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces=""/>.. <Property Class="Number" GUID="{9D4A7245-5055-4637-BDB9-9A5ACA116BA9}" Name="Convert_IN" group="Item" OrderIndex="3" DecimalPlaces="" List="cmbList">39.370078</Property>.. <Property Class="Number" GUID="{11B4A473-30B2-4001-B936-8D7A75EAA22E}" Name="Convert_FT" group="Item" OrderIndex="4" DecimalPlaces="" List="cmbList">3.2808398</Property>.. <Property

C:\Program Files (x86)\PlanSwift11\Data\_Units\YD\Data.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	5.450813357881934
Encrypted:	false
SSDEEP:	48:caL75+/La9tTGHehHmI5orWi3mR27Wl5Tq:TyLWty6HmI53i3C27Wl5Tq
MD5:	CE4A3B188F55F5A60C0095CBF93971F0
SHA1:	2FB18E5B4F607201F2E5E8558C61A7AD04FD081E
SHA-256:	FDE2CACD999653A412962A07A86DDFE50F7C424D2F27B46AEFA03E8CF6D46094
SHA-512:	59F4A0724A5E2D4242147CF1124C98DD255B7ECBE9425C8B64CF6C1946E8FEAAE20ECAB096F79DF964B6B79F3E03A5EA9EE2FE9F15E576DC890674E3EAF3DF29
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="YD" GUID="{5F78F537-AF4D-4E55-B4BA-34D03B4C3FE0}">.. <Properties>.. <Property Class="Text" GUID="{398C86F4-4EA2-4FA1-B811-EE6ACF31FBA9}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">YD</Property>.. <Property Class="Text" GUID="{B696CF26-D6C6-4D34-910E-186E48D1B7C2}" Name="Measurement Type" group="Item" OrderIndex="1" DecimalPlaces="" List="cmbList">English</Property>.. <Property Class="Type" GUID="{329643BB-793A-4695-BA9E-12556371BAA3}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces=""/>.. <Property Class="Number" GUID="{0EA19198-C3DC-4C82-9D62-EFE87D417CDF}" Name="Convert_IN" group="Item" OrderIndex="3" DecimalPlaces="" List="cmbList">36</Property>.. <Property Class="Number" GUID="{47057078-94F1-4AE0-A959-A6DECB2D6B97}" Name="Convert_FT" group="Item" OrderIndex="4" DecimalPlaces="" List="cmbList">3</Property>.. <Property Class="Numb

C:\Program Files (x86)\PlanSwift11\Data\_Units\YD\is-T38PL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	5.450813357881934
Encrypted:	false
SSDEEP:	48:caL75+/La9tTGHehHmI5orWi3mR27Wl5Tq:TyLWty6HmI53i3C27Wl5Tq
MD5:	CE4A3B188F55F5A60C0095CBF93971F0
SHA1:	2FB18E5B4F607201F2E5E8558C61A7AD04FD081E
SHA-256:	FDE2CACD999653A412962A07A86DDFE50F7C424D2F27B46AEFA03E8CF6D46094
SHA-512:	59F4A0724A5E2D4242147CF1124C98DD255B7ECBE9425C8B64CF6C1946E8FEAAE20ECAB096F79DF964B6B79F3E03A5EA9EE2FE9F15E576DC890674E3EAF3DF29
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<Item Class="Item" Name="YD" GUID="{5F78F537-AF4D-4E55-B4BA-34D03B4C3FE0}">.. <Properties>.. <Property Class="Text" GUID="{398C86F4-4EA2-4FA1-B811-EE6ACF31FBA9}" Name="Name" inheritaction="Ignore" input="True" required="True" group="Item" OrderIndex="0" DecimalPlaces="">YD</Property>.. <Property Class="Text" GUID="{B696CF26-D6C6-4D34-910E-186E48D1B7C2}" Name="Measurement Type" group="Item" OrderIndex="1" DecimalPlaces="" List="cmbList">English</Property>.. <Property Class="Type" GUID="{329643BB-793A-4695-BA9E-12556371BAA3}" Name="Type" group="Item" OrderIndex="2" DecimalPlaces=""/>.. <Property Class="Number" GUID="{0EA19198-C3DC-4C82-9D62-EFE87D417CDF}" Name="Convert_IN" group="Item" OrderIndex="3" DecimalPlaces="" List="cmbList">36</Property>.. <Property Class="Number" GUID="{47057078-94F1-4AE0-A959-A6DECB2D6B97}" Name="Convert_FT" group="Item" OrderIndex="4" DecimalPlaces="" List="cmbList">3</Property>.. <Property Class="Numb

C:\Program Files (x86)\PlanSwift11\Data\_Units\is-KRL50.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (2208), with CRLF line terminators
Category:	dropped
Size (bytes):	5308
Entropy (8bit):	5.235807438306779
Encrypted:	false
SSDEEP:	96:k2jFqd2uI0MdOMehz3bcwl0MdOMyRnlbd/u24MdOM0YNHdbCcTL9IrwEXbd/uz0/:7dO5ZdOdbdO6N9MpodOfdOi
MD5:	16A8E452ACB162C3711C8F5617805EEF
SHA1:	7869FA87D392C2CA13F3FECC88A306678EB8594D
SHA-256:	FF278F1C4FC4F6A460DF858D6B519843FF9ED014DE40C24B85DEDFC80FC00DE1
SHA-512:	9BC0B1DC80C5A55BE9AD3EC3AE8CA01DCED6506C5B6C9522D85D1D0707D0E8039FF3A77312F81ABE6D71C8D53EBDF3A6A4A71A106A589B7C79F3AC7A9D785823
Malicious:	false
Preview:	<?xml version="1.0" encoding="iso-8859-1"?>..<Item Class="Item" Name="_Units" GUID="{692B765A-7804-4E33-8BEF-9347B0AE29F1}">.. <Properties>.. <Property Class="Text" GUID="{6DB33FD5-15E1-49E1-AC5A-4E41DB03AAA6}" Name="Name" inheritaction="Ignore" calculatebefore="0" inherited="False" input="True" inputcondition="" locked="False" hidden="False" systemlocked="False" systemhidden="False" required="True" units="" inputunits="" group="Item" PullFrom="" OrderIndex="0" Adjust="" ListType="Simple List" SimpleList="" List="" ListResultColumn="" TreeList="" ListFromProperty="False" ListShowSearch="False" ListColumnAutoWidth="False" ListVisibleColumnsInDropdown="" ListPropertiesToSet="" ListShowOnlyTypes="" ListReturnFullPath="False" ListShow1Level="False" PluginToExecute="" PluginToExecuteButtonCaption="" Expression="0" RememberValue="0" ToolHint="">_Units</Property>.. <Property Class="Text" GUID="{D0D3EA84-5297-42C7-AF67-5E7639C33356}" Name="GUID" inheritaction="Ignore" calculatebefore="0

C:\Program Files (x86)\PlanSwift11\Logs\ActionLog.log

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	413
Entropy (8bit):	3.8789879595236436
Encrypted:	false
SSDEEP:	6:S/ASEsp6/ASJaDz0gu8hzo6lMEsp6lMJaDz0gu8hzo65ERr4ov:aA9spyAomh3nspWGmhQOy
MD5:	FDD0443DE8867B2051FB00B97278B30B
SHA1:	09E55A6BE8C60030946DD0590040E165AA169A39
SHA-256:	3F4A5BB88DF39504D5260B6430B337AAB4F63ADC839269CEFEE779EE96290457
SHA-512:	2ACC2C96383BF749D22A86D340FB7F0A1EE68DC3850B334F151D4710405053320657FAAE8778A21945EBE23863CE1119AD7FBB484917FC34962AB86994A090EA
Malicious:	false
Preview:	================ 08/28/2024 04:41:11 PM ================..*APPLICATION START UP..================ 08/28/2024 04:41:11 PM ================..Professional 11.0.0.129..================ 08/28/2024 04:41:45 PM ================..APPLICATION START UP..================ 08/28/2024 04:41:45 PM ================..*Professional 11.0.0.129..================ 08/28/2024 04:41:57 PM ================..Main Form Shown..

C:\Program Files (x86)\PlanSwift11\Logs\WebLog.log

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	3209
Entropy (8bit):	4.677528670373366
Encrypted:	false
SSDEEP:	48:gqADxhqpXdJaCQwqnk1czkzlSbZMG2Efd4d+SdWbEZkBcG3b+S6nmdTuJdQ71frc:gquKTqk1F8GwSxkEpckQRfAXR
MD5:	D0C0879C6F1D46AD37B5F2A45B4EA5E4
SHA1:	396C534946C3A9852219ED919D59B1D62321A25F
SHA-256:	989CEF8E04761A408C40015BC0A7364A6F5845EB1F4B426F9C91F291D28C8096
SHA-512:	F7DB154B5DB1C557CD6F8E9693775853085C541507A1BEBB23A5106DD7B027BB2E1C8C12B8738627AB14F063F07AAD2718FA172B6947D05F410CA354B08675F8
Malicious:	false
Preview:	================ 08/28/2024 04:41:54 PM ================..Last Error Text-------------------------------------------------------------------..================ 08/28/2024 04:41:54 PM ================..Last Error Text - ChilkatLog:.. SynchronousRequest:.. DllDate: Feb 5 2018.. ChilkatVersion: 9.5.0.72.. UnlockPrefix: PLNSWF.CB1052019.. Architecture: Little Endian; 32-bit.. Language: Delphi/C++ Builder XE2/XE3.. VerboseLogging: 0.. domain: www.planswift.com.. port: 443.. ssl: 1.. httpRequest:.. httpVersion: 1.1.. verb: POST.. path: /status/.. contentType: multipart/form-data.. charset: windows-1252.. sendCharset: 0.. mimeHeader: .. requestParams:.. requestItem:.. name: data.. value: addhmdbbilinanobiopbhncggbgbpmhicnjfmgkopcoohkcbcmejmfkbpoifigaegcmjaflplihimpcnilfdlfibnahpfbiimckdlbjgcfpiaekpdfbficpkdhngmdpmjdgiihighijgiedonfimadaljeodihknnodfhlaicedjmkeokhnnnfajmgkmjmmckhbddnemobafppapcjjpmd

C:\Program Files (x86)\PlanSwift11\PERSIST.INI

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	39
Entropy (8bit):	4.304257026388136
Encrypted:	false
SSDEEP:	3:x5/Aqg/x3wdn:P/
MD5:	2495C006237DDB1F47CCFFFD0EDF9B35
SHA1:	F08E35402216CFD51F44AAB805FB8A06B9350E68
SHA-256:	FC01C06AF2E0069F2939A97582D7B3E07A37133DDAC7BB629ECFD7977255D0F7
SHA-512:	4F9858211A085DE39E2FEBF2A8BFB67628D2E602EBD1D3DFA910918677906DD5A741875A1906FE8758F42BEB326D39218459B7501EAAC21B73FB9C38C052F665
Malicious:	false
Preview:	[JOBLOCKING]..DISABLEJOB_LOCKING=TRUE..

C:\Program Files (x86)\PlanSwift11\ReportsAddressBook.dat

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	data
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.080096564177317
Encrypted:	false
SSDEEP:	6:jhlulm1rXUhB+hi+lJjaeolYRmq2I4goGsfl:u2rkhB+hiaJja0ToGsfl
MD5:	65ED5F3A60F4CEEF6FF39B4DCA9A2C3B
SHA1:	7D2B5A9575FB9470BBACA99B5573BC6E72DDBEC8
SHA-256:	2CF7EE755E0D89F09C56DDCE1BC5AF5ECD83DDA187DC038EC0AF2A8C104D18FA
SHA-512:	5ED670D03E7ACA9463CC07571D41CFE3D92599C13AA026619EAD4F70A01D06A8BAB5F390EB2C2479CEB5806F2C41F59AC6D94C1B861DA2D60C0091EB28B23A1A
Malicious:	false
Preview:	Ver...(\..?............ID.@.......NAME.`.......ADDRESS1.0.......ADDRESS2.@.......CITY. .......STATE.........ZIP.@.......EMAIL.........WORKPHONE.........MOBILEPHONE.........FAX.........TYPE.(.......GUID.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.Data.v17.2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6393584
Entropy (8bit):	6.38882007185756
Encrypted:	false
SSDEEP:	49152:Hn1LAb4DEh1c2BO1zjOqsD5WL1S1dFw9jO6XXzGRdovRHYpfLC4qh6AQ/hiq9PUJ:H1L5EhuCO1zjyWL1S1dFAjO6XaCr
MD5:	46C5A5DB4CF39CA54BB80FEBA2DA3E3D
SHA1:	D6F0F7C8AC55AA8AADBE8758A72E1E1376DAE6F3
SHA-256:	5713342030339805894F61B2FA8B276B676549C12D77136C4D5AA216EE5EC828
SHA-512:	FCF21A2BB030353BCFDA0D3F98C813375D075EB15D8AFDA35C355BDC35D804BCACEECB159EEB21F4E62DA075AA1976E3085716F552CE956BEDB43EFFE8510E3D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...G..Z...........!.....na...........a.. ....a...... ........................a...........@...................................a.S.....a.X............xa.......a.....p.a.............................................. ............... ..H............text....ma.. ...na................. ..`.rsrc...X.....a......pa.............@..@.reloc........a......va.............@..B..................a.....H........M9.p>(.............M.#.P ......................................j.j..f'8{......!.-...73..%......a..t=..+"..EF..EJ.oa&.k..L....}x....,.j......]n.x!.....Ma.+u0....../_.~..x...=..W8...)`..(.....s....z....(......6.......(......0...........s....}t....s....}u....(......}p.....}q.....}r......}s....(....s....}v....,(..,...r...po....-..{v...r...p.s....o......,\..o.....+>.o.......(....,..{v.....(......(....o....+..{v.....(....o....&.o[...-....,..o!....*...........

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.Images.v17.2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4678384
Entropy (8bit):	7.420107443856783
Encrypted:	false
SSDEEP:	49152:HPtHZT11v2pAeyATtVhPiY13pxT2VbqWmUZrW4MWoczQWunpe2Kqo:1R2pyY1ZpubDZCxWzQWunptKF
MD5:	37CE7703F14C2E2A01A596057EC3B0E4
SHA1:	A3C9BED6D4E02C86903322793E25535BCC4DC3B1
SHA-256:	12D2A9AEDCFF881B25CD70ED7C822330F096E7DA1FCA0ED4CDE82108D4F03ED2
SHA-512:	D0F5036299D2D2225A423E8F69BC43FB6A03F4F6DDFD3187414A04E9B61D098A250511DB6B4DA6164F8EB55AE1A50D8437B290B28D740EE43834DD34AFB8A76B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W..Z...........!.....BG..........`G.. ....G...... ........................G...........@.................................``G.K.....G.8............LG.......G.....(_G.............................................. ............... ..H............text....@G.. ...BG................. ..`.rsrc...8.....G......DG.............@..@.reloc........G......JG.............@..B.................`G.....H........QD.P.................@.P .........................................B6....Fc.[`.X.Z1...HG..;....y4...k.....j{..P<VD!.6.qDkeT....Z.B.{m..D.HZ.......%..C.C.g......x)V}@....O.4...)C{e\|..i._...(.....s....}.....s....}.....s....}.....s....}.....s....}......{.....o....-...{.....o....(.......0..k...........(.....o......(......(.........(......(....,..(....-....~....(......(....-...3.....(....(......(.......(....f..{.....{.....{....(........0............sX......}.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.Pdf.v17.2.Core.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2906864
Entropy (8bit):	6.1304802211075815
Encrypted:	false
SSDEEP:	49152:BOMYXWO56WVCCguWl65E18ca36JMgsEpgSm:BdYmq+0KI
MD5:	CC3160FFAC3F03E36E65CFCCFD43444F
SHA1:	EEB7AE7EADDD43303266FACED404F9206D887338
SHA-256:	676C6CA18045724C69A17D4F189979173555401E9FC1B3E62204C4DA783364CB
SHA-512:	5E6D38FECBFA4071DC9769CCFC8E104FF0CF537DD5B36DD15C3D052182562C78E272837224D245D6E0F25AB615ADCCBB759F13A5662D272311D85E654436A5AF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\..Z...........!.....:,.........~X,.. ...`,...... ........................,...........@.................................,X,.O....`,..............D,.......,......V,.............................................. ............... ..H............text....8,.. ...:,................. ..`.rsrc........`,......<,.............@..@.reloc........,......B,.............@..B................`X,.....H...........@...........0.......P .......................................q...S..../....Q$..x.EIU.Mms..^..\|...0.M.".3.6....'.,9....t...I.i.x%KL..`.............`m.3.E...m.a(.>.)z.q......o..a..l.[J..%&...s....&...sL...&...sf...&...s_..."..s....&...s......s......(K...,..0(....sL...z.r...poM...,..1(....sL...z..{....:.(......}......{...."..}......:.(O.....(.....^../.r...p.3(....sP...z..{....:.(......}......{...."..}......{...."..}......{...."..}......{...

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.Printing.v17.2.Core.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4263152
Entropy (8bit):	6.510018353229873
Encrypted:	false
SSDEEP:	49152:q848JdwidmwOhp/tPmmcL8gxegZHO1Ee+hxYbnQURe5PN+3m+o7Hn6ajZZ6n3ZCM:Y9Nn5DXgxlZWt
MD5:	6C35010320D7B3DF8090617EF7B4F172
SHA1:	2FE8FE54A530AA66D753841FA2B9C94DB70CB1A7
SHA-256:	8A86C1CF664DB65C7C6F06D3FC236B35474ED2810F5EAD18A7AABDF28B4A979B
SHA-512:	F308858A93F747F9A88C50BEF4885E1ADCF431AAF0966336B6727A51798AE29A259F30703A487CC860AC5D34181C9F048BA3590B7F220D64FEE073DC7F3FA262
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...g..Z...........!......@.........N.A.. ... A...... .......................`A...........@...................................A.W.... A...............@......@A.......A.............................................. ............... ..H............text...T.@.. ....@................. ..`.rsrc........ A.......@.............@..@.reloc.......@A.......@.............@..B................0.A.....H.......0....#!.........8.......P .........................................!g...$2.....@..2.b...._.{t.&.P.u.0.\|-.".xJ.^:.E.......9...Ne...<P..J_....S..K.tW.S.6..J/ .".uq..[.EP..3.t..y.....V$\|.....J.0..-........,..o....,..o....o[....o.7...(.7.....o.......{....2.{....tw...."..(.H.."..}.......(....2.(....ux...j.(....-.~.....(....o....Z.(....-...(....o......u}...,...t}...oz@...o.....u)...,...t)....o.........(.....(....ty...r...p.{(.....(....o......"..o...."

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.Sparkline.v17.2.Core.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	89328
Entropy (8bit):	5.936010072096629
Encrypted:	false
SSDEEP:	1536:eovLCaWmC9Evc8ww+3qkgT2mJDcDyQW+v/HFey290ywmizNaiI:pmaWmC9EvfF+3qkCgbv/HFz290ywNJab
MD5:	3413FE6B192A55D1BCD6160822B33A4B
SHA1:	D9E184656F4EB8A564182AE00F798424EBE08AF1
SHA-256:	257A4E440A1961BC7867165573585043A5FE4C785A977A0EF9B64DF1045C5638
SHA-512:	364106E044D0133E4565E60FAEC0AFFA8D091ACEA7458C35A1677AD88EC8F311764ABC3675B48144E660A6A6922FAD24811C19559F20269A38876B7C4BE250D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Y..Z...........!.....<...........Z... ...`....... ....................................@.................................pZ..K....`...............F..............8Y............................................... ............... ..H............text....:... ...<.................. ..`.rsrc........`.......>..............@..@.reloc...............D..............@..B.................Z......H.......t................p...&..P ...........................................<.7....g.]s.F..A.8S/...ii..S...X...:.B.{g._.P.0....7..6#H....Mk8...5....H.$....e.f.,YF;...:.:...m..[8..w...Y.\|...7..,...oy...2.-...ox.......0..)........{.........(&...t......\|......(...+...3.....0..)........{.........((...t......\|......(...+...3.J.{.....{....()...J.{.....{....(.....{....~.{.........}.....{....-..(......{....~.{.........}.....{....-..(......{....^.{.........}....

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.Utils.v17.2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10894576
Entropy (8bit):	7.2837073232040055
Encrypted:	false
SSDEEP:	98304:lUIhpD5Y2WAOfraPMJI/83OJCpC3JPM52zZZaAgbbXI/ox4LPv:lBhpD5Y2WAOfraPPCpiJPMPDbbYw4LPv
MD5:	42D84BF7B26528B8277F33F66D1146D9
SHA1:	0EF927BFE101A71B63B99A58C8D9D74F01B17F9E
SHA-256:	AD0A16A479E9664C6C822C219DD6ECF59F1A5B742EFA0596A815CA7B085EF472
SHA-512:	E39D6679A48DB965B389905D790287D665AA08A7C005929C4DE47FCEDD1A3B46EB78DF2B5E1FC3479C40C36AB68CCFE2DE847E95C8F307FA306B1C553AE67E3B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..Z...........!.................;... ...@....... ....................................@..................................;..S....@..h............&.......`......P:............................................... ............... ..H............text........ ...................... ..`.rsrc...h....@......................@..@.reloc.......`.......$..............@..B.................;......H........`..x.%.........8.....m.P ......................................j.+.]..vh8c.]ox/2..s..%]...x..2wc..I..!n....m.9IN.0.......?R.8}r.:~....~.-.F...U^m....K..,.........fU="o4:.Z.....].+s.@,..0.....................(.......}.....(.......}......}......}......}......}.....0...........................(......0........................(.......}.....(......}......}......}..........(......{......{....R.{....,..{.......j..{....>..}......}......{......{....*n.{....

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.XtraEditors.v17.2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6003440
Entropy (8bit):	6.336301207421368
Encrypted:	false
SSDEEP:	49152:uNnm/IpxW91bWdkU7YtHqkSYVK/sp46tIZv34GhDfsJx27:uNyn1bxOY8kpVt1Wvpj
MD5:	0FD285B929989BC0600351331CBDE8E5
SHA1:	FCBDE267826F8C4D15E27D487E4CB819B552A8C5
SHA-256:	43AA1A815C6CF21797166E07101F6C73635A48DF81F528121E10825F97BC4B8E
SHA-512:	4DD22BE44290E15507863D028C5EE4404282104BD76934A6F047187D6A5A87DDCEED601B1A46BE778453F62B03D86D0E6B1D6EFD7F54BA8623FF320442246AEC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z...........!.....z[...........[.. ....[...... ........................[...........@.................................\.[.O.....[...............[.......[.....$.[.............................................. ............... ..H............text....x[.. ...z[................. ..`.rsrc.........[......\|[.............@..@.reloc........[.......[.............@..B..................[.....H.......8h/...,..........M......P ......................................H}.e.g.P../.W2"....<.'o..7.....a.........R.^...3..\RvxtM)h6...........GF..s....{^El.>.B$.Fo.i.d_3....ji....fO/D\|x........]"..(....n.(A....u....,...t....}....J.(B....oC...u....:.(B.....oD.....0..F........(E....+..o....t......o5....(F...,......o....-....u......,..o`................1.......0...........u......-.s......(B....oG...*....0..@........(E....+..o....t......u....,......o....-....u......,

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.XtraLayout.v17.2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2029296
Entropy (8bit):	6.091141632740869
Encrypted:	false
SSDEEP:	24576:Q4TYimb7TXGhyCMuezlX1gSW3g/BZ5fzbtkMJZ:QuEtZ/tk6Z
MD5:	B7EB4804E39CDE56725BDC96414FDC9F
SHA1:	7786C42E2BBC2C61038CF4401AFBB6D681671C4B
SHA-256:	BBC36CCFE902FEAC3AE66509F35276DAD195D76217BACD070C9107EAC7E37A7E
SHA-512:	CD8E1BA05FDE0CD889FDA5FB51BD051CED009A757A42689FE9C2F8265F43F5F4F887AC56E008CA20007240C5AABB5EF2A5E98405CF1F150003254994ED0C8726
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z...........!................>.... ........... .......................@............@.....................................K............................ ....................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................ .......H.......P{..hw..............5...P ........................................o..w.i..DQ...Y.m}I"...f..sk\..50.9.A{....2..4.V...Jg.R(H..QE^C!x.D..<...)..J.....W.jIqi..^.F+A...4{^W.5.y).....n.3..b".....{...."..}......{...."..}......{...."..}....2.{....o......{...."..}......{...."..}......{...."..}....:..}.....(.......}.....r...p}.....(.....s....}....2.(....ug..."..(......{...."..}......{...."..}......0..[........(.....o....t....o......(....o.....+..o....t

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\DevExpress.XtraTreeList.v17.2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1443568
Entropy (8bit):	6.142835984889151
Encrypted:	false
SSDEEP:	24576:lrsvXhpPGc3LrmikEAMgiAizeTMCf+re/8kwC1POTlYPxdJ2e:+93LrmikEAMgiAiz97TlmR
MD5:	80B7395EA425C09C25C2FBF721B0DDFE
SHA1:	FE2D6AF07AA49A19365A11E3D72D12EB5C9A6875
SHA-256:	89350F4964340601773B160476E19214553D6FA3E177BA7244833CB186B5F168
SHA-512:	A80CBE9350E8B5A76E6DA60B6C14B97BA16984D77066CA4615C39F4EEDE1179AE40340201491FFB463C2DB1E5EC2B7E2A0390BEB7210BF2EF80033BD0570F41D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z...........!..................... ... ....... .......................`............@.....................................O.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........hH..........pY...`..P ..........................................\.Q...)...g.&:...E.....y^.9..j.}"B.a.o.b..,.d....Du,;...K....BZ.My..9.(.orm.L5..M...m...h.9....:P{..\|f-B...Ep..19.pO.........0..............(1.....(,.......0...............(,.....(....Q.{....oj...,..uO...,......(6...Q.P(...+6.{.....o]......0..!........(<.........;....o4...((...o........0.."........(<.........;....o4...((....o....B.(G....oZ........0..#.........(-......(0...-..o....*.Q..

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ExcelConnectService.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37376
Entropy (8bit):	5.841941000132943
Encrypted:	false
SSDEEP:	768:G9yjr9Fk8tojuXNFsxmgKmOgOYZXGS9QXyqZE6hA:62ZlSMNycgLEyAG
MD5:	1B68623BFA702CA4C79782ADED128698
SHA1:	6BBF365A994173204070CDDA493775496129617C
SHA-256:	B2D968A981B0354D80B1B4BEA35053A7CA24D1CE2B933CC7D555989532DE1370
SHA-512:	5B5F1B21D3BCDB1A9BF8B3CF96FEE3A7E381596FB860237B6C8CF5CEB4D0353F22C6CB9845AEE5F0121447FF5CDDC552E625A396EB1A5CD7F535682D3B3D2E9D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.[.........." ..0.................. ........... ....................................`.................................T...O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......48...l..........................................................V.(......}......}....Z.o....-...o....().....{...."..}......{......{....2.(....o......0..K.......~m...-$..+...(.........(....(....( ....m...~m...{!...~m....(....o....o"...2.(....o....Z.(....o....r...poT...Z.(....o....r...poT...Z.(....o....r...poT......(....o.....(....~#...~#....~#...~#...oi...(".....(....-...(....o$......1...s%...(...+..(....o....,..(....o....o....r!..po'....2.r+..p($...*

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ExcelImport.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	5.722661457182719
Encrypted:	false
SSDEEP:	768:VIZR+FMStbMSttX2ulN7HNM5mHe0Gf0K6iD1:QR+FMSBrt57pNGf0KT
MD5:	9F6033AC4D0F4522672094B65C8D360D
SHA1:	651EF691F096BA7CA57369A370F1CCD1785674F8
SHA-256:	509D771F9DDC757A8F812C2EEB100604635DD3AC44E321CA16B8A4FD2CBFDD76
SHA-512:	3E10C8139C8FE752BD6AD4E1DE1673D93D5EA72EE45A988673E268C28AA0EDA87D56C410F3D86F3D19C0CFE859C81AF20D3E23A3EA3B0280FC0F4F16071FAFF0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.[...........!..0..\...........{... ........... ....................................`.................................T{..O....................................z............................................... ............... ..H............text....[... ...\.................. ..`.rsrc................^..............@..@.reloc...............b..............@..B.................{......H........,...L..........dy................................................(....V.(......(......(......{...."..}......{...."..}....2.s....o....^.(.....(....s....o.......0...........(.....r...ps....(....(....t....}.....rK..ps....(....(....t$...}......(....oD...}.....(....oF.......~....~....~....~....~....~....~....~....~....~....~....~....~....~....oB...}......(....oP...o@...oL.....(....V.(......(......(......{...."..}......{...."..}......{......{......{......

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Microsoft.Office.Tools.Common.v4.0.Utilities.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32664
Entropy (8bit):	6.067183560016906
Encrypted:	false
SSDEEP:	384:RWw7k8otmBsHC+w4TEn4jo+qMzEeBoOR/VEPY+GQ4A4agQS6Lc7DQWgyxmYi/Tjr:AwJTwYB4E5n/xe5ar/Mi2jpvc7H
MD5:	090635087D067BCEF8056D5751F2D0C4
SHA1:	0AD9C2B6C79A3327D138819ED0435D18EE9AAC78
SHA-256:	8CB09317C326E9B0F83C337EAE7CCDEAAD3E45E5DA3603E1EBC90C5A06AD1702
SHA-512:	41F3075E362710FFCEB088623967A795E58E632BB48B237A38AB2BB443B06900BC3C9A77CEB3B9379AFEF5BE0C2F90BDE8161B2A3264F0C7DD089BA569403DDC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#..K...........!.....X..........nv... ........... ..............................,x....@..................................v..O.......d............h..............tu............................................... ............... ..H............text...tV... ...X.................. ..`.rsrc...d............Z..............@..@.reloc...............f..............@..B................Pv......H....... &..TO..................P .......................................2...B..5....vO{:R.G.._(P%+.....\|cn.A..@.E.#.....w.....?o......."[......6...\|..z...:,.L.......A..\|.T^k.A....R-...N.......(/............o~...}......{....op...}......{....v.{....ox.....o....u.........2.{....ov...2.{....ow...2.{....ox...6.{.....or...6.{.....os...6.{.....ot...6.{.....ou...2.{....on...2.{....oe...2.{....of...2.{....oo...2.{....ok...2.{....oi...2.{....oj...*2.{....om...

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Newtonsoft.Json.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	653824
Entropy (8bit):	5.911899312502532
Encrypted:	false
SSDEEP:	12288:WvS56CuBAXYxeeNvWHc3oY2osSeBTdb+:K07SAIxOhAVeBTdS
MD5:	F33CBE589B769956284868104686CC2D
SHA1:	2FB0BE100DE03680FC4309C9FA5A29E69397A980
SHA-256:	973FD70CE48E5AC433A101B42871680C51E2FEBA2AEEC3D400DEA4115AF3A278
SHA-512:	FFD65F6487BC71C967ABCF90A666080C67B8DB010D5282D2060C9D87A9828519A14F5D3A6FE76D81E1D3251C2104A2E9E6186AF0EFFD5F331B1342682811EBF4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....K............" ..0.................. ... ....... .......................`.......M....`.....................................O.... ..T....................@..........8............................................ ............... ..H............text........ ...................... ..`.rsrc...T.... ......................@..@.reloc.......@......................@..B........................H.......Hj......................\.........................................{...."..}......($...:.($.....}...."..(%.....(......{ ..."..} .....{!..."..}!.....{"..."..}".....{#..."..}#.....{$..."..}$.....{...>..}.....(......{+...>..}+.....(......{%..."..}%.....0...........{&......(....-....(....6..s....}&....0...........{'......(....-....(....6..s....}'....0...........{(......(....-....(....6..s....}(....0...........{)......(....-....(....*6..s..

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\PsService.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	42496
Entropy (8bit):	5.749504408019078
Encrypted:	false
SSDEEP:	768:E8klfUNLujPMxdrrQFqh/cndhwbvTw3PUHs8bKKQq77yqMvWMDn3FaVWg/:EDsujkxDcdw7w3T8byqMyB
MD5:	3ACCD239468934329EE8B919C55554C5
SHA1:	AB333512299A4BA32A134DBEB98616289C4963F2
SHA-256:	9F8C516D3A8B819678915B4059538CDDB549BD9B3D446988A50E1D6319A56C8B
SHA-512:	006FB57442043ED787E6F72E13CB54C6562F3B515577C5616629765264E65B49FEE213CF29D7E77DBB5C30AA5473E28253B36771D2F493F48A777D67D465F933
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.[.........." ..0................. ........... ....................................`.....................................O.......x...........................P................................................ ............... ..H............text........ ...................... ..`.rsrc...x...........................@..@.reloc..............................@..B........................H........<...\|.............`...........................................:.(......}......0..)........{.........( ...t......\|......(...+...3.....0..)........{.........("...t......\|......(...+...3.b.{....%-.&..s#...o$...N..}.....r...po......{...."..}......{......{...."..}......{...."..}......{...."..}......{....-.~%....{....r...pr...po,.....{....-.~%....{....r!..pr...po,.....{....-.~%....(....%-.&..(....o8...o.....(&...~....%-.&~......}...s'...%.....(...+..

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\PsSwift_Excel.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	145920
Entropy (8bit):	6.284366835672585
Encrypted:	false
SSDEEP:	3072:QiM8e1v6VEEJ6BrihSXAk7DFLdXeEeXSJd4dH08IICZkoWq4VaWD9UZ:QGe1v6VEEbSDddISJd4dHyZSy
MD5:	647B60EF82811B042243740BF933B904
SHA1:	C151058512D5375282CF79AF591DEA8AA0E3BCC6
SHA-256:	D31EA960A571DED3BC521C6D9A277E4D480618D279AC0B621237C6C4016472E8
SHA-512:	F36503D82DAC1BD06DBDAB309F9DAAA75CE57357A6DB4ED12DC20A70821BEAE18D52355B1BFDB6F978CEDD4A872B6A5791524D4292C3849A928024B27248D802
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.[.........." ..0..2...........Q... ...`....... ....................................`.................................@Q..O....`...............................P............................................... ............... ..H............text....1... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B................tQ......H...........................p.............................................{...."..}........0...........:.....{......_o!....{......_o!....{.....o!....{.....o!....{......_o!....{.....o!....{......._o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o!.......0...........{.....o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\PsSwift_Excel.dll.manifest (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (8071)
Category:	dropped
Size (bytes):	48907
Entropy (8bit):	5.497931853993181
Encrypted:	false
SSDEEP:	768:4U5tUelzqErhM59Yyid3jo6LDxMuWy0o1mUtBIKLC/Or2U8g5o2/0oJzZMKOTQhP:5lzqErhM59Yyid3jo6LDxMuWy0o1mUtr
MD5:	963A390F88484467C1B4A7EDE6DD9578
SHA1:	75CECE1ACD16C1C3105D0D029A2EA445BEC909E9
SHA-256:	68248E949D12F5F56D8BB393D9C6742756C43308010A26863A103F0432A79AF2
SHA-512:	9283476526DC883832BDD2A40FA5F292E68B06CD65A70641E2D060D37FC1F45F5DA67BF8FBC32C4F6DC2EBEBB646F75A62B62BC036900280D805EB3EFCE347ED
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.<asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">. <asmv1:assemblyIdentity name="PsSwift_Excel.dll" version="1.0.0.0" publicKeyToken="521392d9a4d6ce82" language="neutral" processorArchitecture="msil" type="win32" />. <description xmlns="urn:schemas-microsoft-com:asm.v1">PsSwift_Excel</description>. <application />. <entryPoint>. <co.v1:customHostSpecified />. </entryPoint>. <trustInfo>. <security>. <applicationRequestMinimum>. <PermissionSet Unrestricted="true" ID="Custom" S

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\PsSwift_Excel.vsto (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (8100)
Category:	dropped
Size (bytes):	9884
Entropy (8bit):	6.059363818458377
Encrypted:	false
SSDEEP:	192:fNsFzeso5l2xT/nABpKoVzk/B/nABbbf+sfwgvGbAK3GrdsdFA:VsFir2tqHYZTsIgvOAdsdG
MD5:	21585E6A3E5E998909B3D14EE8124BB7
SHA1:	FDDA369E6FD4EBD4D0202F7DAC64E121C9C5F225
SHA-256:	9867F1EB0D9F6AE7E160A11F2884A2AA869F4666A104CE3A9B2D944683CE8952
SHA-512:	CEF8E0BCDC9C3101236308302D5228E683D36C9FD4294AE5C09E3CBCFDEDD8043DCE74DA399FEC8E797AD1BB5C76E967DDEC186238321B39CF85055A033614D5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.<asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xrml="urn:mpeg:mpeg21:2003:01-REL-R-NS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">. <assemblyIdentity name="PsSwift_Excel.vsto" version="1.0.0.0" publicKeyToken="521392d9a4d6ce82" language="neutral" processorArchitecture="msil" xmlns="urn:schemas-microsoft-com:asm.v1" />. <description asmv2:publisher="PsSwift_Excel" asmv2:product="PsSwift_Excel" xmlns="urn:schemas-microsoft-com:asm.v1" />. <deployment install="false" />. <compatibleFrameworks xmlns="urn:schemas-microsoft-com:clicko

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\PsTokenService.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27648
Entropy (8bit):	5.543669788173604
Encrypted:	false
SSDEEP:	384:Uba88nxJ70U6EJEKQ4WPQTI0yjXFhKJrWVTn4cNO9MFRvfmGSzi51tkNzo7vm:Um77/tTIfj4WbO9MFH5INMT
MD5:	9CAB294A1475FFB98EFE67EB5B1F1F06
SHA1:	26C65EF417A51748DEEEBA1B10905C983963389E
SHA-256:	56503E0AAF9852070F1D4647A46509E5C1A8CC42DCA8195241A4EFC43FFA17A0
SHA-512:	50C8D965AAB5C7DF621F44CE9EE4F5CF58C9B227B6B56FCFEDDBEBEED182B81DF07EB216FA9580DC3C7FDF679A5CDAD2C65AB74417927650CFD7D14299CD5FAF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.[.........." ..0..d..........J.... ........... ....................................`.....................................O.................................................................................... ............... ..H............text...Pc... ...d.................. ..`.rsrc................f..............@..@.reloc...............j..............@..B................,.......H......../...R...........................................................0.. ........(.....(.............o....(......{....N..}.....r...po@.....{...."..}......{....N..}.....r...po@.....{....N..}.....r...po@.......0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3...{....N..}.....r/..po@.....{....N..}.....r=..po@.....{....N..}.....rG..po@.....{....N..}.....rc..po@.....{....N..}.....ro..po@.....{....N..

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Area16.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	321
Entropy (8bit):	6.637815540440772
Encrypted:	false
SSDEEP:	6:6v/lhPfdq7P3lDugQbMRpsNvMQfwFDfvxiJ/LaSUT4ILTscSN65nqVJo7ZgWtljp:6v/703lDlOMRpab4RvmFHwnqVJo99
MD5:	664765B9044D8808CFDB44F6429085F7
SHA1:	87E6AACAA9271FB39341672AD84BA7E555123D51
SHA-256:	70EABE6BAF081337B71437113B5E98BC00CA2EFD73F7A155BBEA025A6C3E7D3C
SHA-512:	5F6BB28E0E406CD968495388021E981F720B355660B234042E968DFACB072FE4D5B35B6675E3F0D3078C67248BA8C71B2FA6D370E4232652F74FBC0F680E4A3B
Malicious:	false
Preview:	.PNG........IHDR.............(-.S...WPLTE...J..J.~P.qK..K.~K..J..J..H..L..J..J..L..J..K..L..J..L..L.~L..I..K..Q..P..L..R..X..N..4..A....tRNS.....{.H&....@/..N.oa.x+......IDAT...I.. .E.O'=j..1._gJL.1..0.......r.F1@q."MB.;.].Z.~.l.].d.Y6.v.I....t......].4~...h...\.c&.1:.M\|......}F.0..Hi....}..X..'.....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Area16Masked.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1797
Entropy (8bit):	6.118552677990541
Encrypted:	false
SSDEEP:	48:b/6164knA9WIP7/c0+7wM4Cj3EHJ3+BxHxkzQU6C:bSHknmWIP7/wVgHOxHxkzQU6C
MD5:	2D097363E8063DC242BD9D471BB6E47F
SHA1:	89338A735FD6247D3F400316E94F253511935D84
SHA-256:	990B51E86B5D462A9EBFBA23443DE5D14FE873BC60C6BD9E5059C3074E58C61C
SHA-512:	499E22642B494C8E07E662DD8B96FF4C1D2417F286391CB3F1FDA80DDB374A9AE8EE7EF5F5799A87D4080821AF379DD53AE7073FB873A379063106C347C3CD81
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-07T22:45:42-07:00" xmp:ModifyDate="2018-03-17T20:33:59-06:00" xmp:MetadataDate="2018-03-17T20:33:59-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:c89fcff2-65f7-402d-9f63-1a5fe4a96b3b" xmpMM:DocumentID="adobe:docid:photoshop:622488e6-6ee7-f546-a057-5661f4a78c37"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Area32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 32, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	225
Entropy (8bit):	5.814136933093717
Encrypted:	false
SSDEEP:	6:6v/lhPjcF6hps//SDRj/l7ZJXSglYiNMp:6v/7QF6h+CDt/fJLYV
MD5:	5D42D43ED875DDCF476EBE77F708A50B
SHA1:	D1A95AFAC93A357E2596B2AA217CA781D27EF56F
SHA-256:	3D8607B72889C8085E8A38285330EA7F885D3A782AB515595E7521E13542019B
SHA-512:	A6F71B28FDD9D57C60B684B9687129DF7AAEB4E788102B6A309E9F4EF4421283F91064C55EB592D31180CF49849A8462CBE2A30E7D9F513CCFBD21097943ACFE
Malicious:	false
Preview:	.PNG........IHDR... ... ......Tg....'PLTE...K..K..K..K..K..K..K..K..K..K..K..K...2OQ....tRNS.@... ...`0...L...]IDAT(.c..Q...Us.2....s...k$..3@p8.! s.....>`.c.....A(.II....P.....3(..H.`.........4.x`....@...;..........IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Connect16.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 17, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	287
Entropy (8bit):	6.620902485562652
Encrypted:	false
SSDEEP:	6:6v/lhPOtWp/yc10qrdxbvHirRWJFkrG5k5MVRJ90smgwClfftJyFKuSNOqFoup:6v/7KWp/ZprXziVWJ2GxysmgwAfVJW1w
MD5:	D7D994882D2AB71D7AEAF448383A3799
SHA1:	F4E258621CA08A1416B1FD13DDD2B29F92FB2B2E
SHA-256:	F6CCCA28A1CF39CE5FEB7D74F4560494DCA6F9FA6ACB17EF11939671E083CA27
SHA-512:	57CDC58790823E9092359027E00565350ADED90053F5743CA933F90D05FBDF5C464FAECB80D54AC3D17E4545A24014DF960BB6103766505BCD9ED8930A2FBEE6
Malicious:	false
Preview:	.PNG........IHDR..............q.....BPLTE...K..J..K.~K..K..K..K..K..L..I.zK..K..L..K.~J..L..J..K..L..O..N..1.U,....tRNS..G...#....ka@0:......zIDAT...I.. ..e6..3.....&.....S...tj..e[b\...#....}7L.2Aw!..?o.. iw&.X0.+A(.....A...g..F.[....`N.m2.:Kc..(.7g...t.......p...T>.....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Connect16Masked.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1792
Entropy (8bit):	6.095121493546184
Encrypted:	false
SSDEEP:	48:T22/6164knA9WIPFU2/c0ukuPN3bXHJ3rYHxNpA3YG:y2SHknmWIPh/YkSHGHxLA3YG
MD5:	CA790A9DC95904856F5D196FD74BF859
SHA1:	BF0879C506B753527F61FEAEBDBD6DBA6BD59E1C
SHA-256:	67FC4B33BE3793AF869BCCA522F41DD5BC1D8B6D7BD4399AE27312BE6F273BA4
SHA-512:	C7BB47207A61BCD55BDA523E55F696C62E390DE5F3B17FD6C3F031D8C96F9B55EBFC53C0EECFCCFC9C57E69CCA9AC025C73E1653ED6F9B3B448D787753C6C1A2
Malicious:	false
Preview:	.PNG........IHDR..............,.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-07T22:45:42-07:00" xmp:ModifyDate="2018-03-17T20:35:10-06:00" xmp:MetadataDate="2018-03-17T20:35:10-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:bd996b5c-b3a8-4c1f-8e80-21c55c28c1d7" xmpMM:DocumentID="adobe:docid:photoshop:1e3a3057-8645-1b47-9d2f-356e5665ec2a"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Connect32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 33, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	303
Entropy (8bit):	6.438978860448429
Encrypted:	false
SSDEEP:	6:6v/lhPa5xcF6ZOvk9PC4R5bFHbpi/w+G9lup:6v/73F6ZvjNfHc
MD5:	E5A5891A6F8614EFC31B26CEB19B8CE1
SHA1:	90BB1EFA5185F5A57A204F2BE460871DBE7956D7
SHA-256:	A8055E15253AB262D74DF54A566847FB5841E2425749D6524A220CC7BDB78878
SHA-512:	8A11DCD113E15D806B5C9FAABCE5B73A441C8C464544C2DE831706D7B22A2423F0A013A6A746BC0A10DDB66C1889BCA67E761412898769B2553292B4337F78AB
Malicious:	false
Preview:	.PNG........IHDR... ...!.......Yc...3PLTE...K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K....<....tRNS....P@.p....`0 ~yEc....IDAT8..... ..)U......XS'..=.^.6.....r.F.b..)Bw...\|.....=..R....;...d+...69.R.=............l-8.....=..C.\|....c.9K.._!X.z-.....w...M..........Z:)w.T.0....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Convert16.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 17, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	402
Entropy (8bit):	6.726116681992308
Encrypted:	false
SSDEEP:	12:6v/7KWp/IWc5LHkBRMIHg/W8l5iDDp8MuN/2qpEmE:TcIFLuRLgO8lYDKvN/2qpEmE
MD5:	155B5079B1FF000689E919663170A0A7
SHA1:	240C2E70CC6B170CBD3B68672758EFDAEE6FA70A
SHA-256:	E0EFD47EA00494B084AF462852387CB26178562A502F5FDFE0A7CC3B24E418BB
SHA-512:	7F3D4B70692F4C2E85ECDE3CCABB889B90677E8E5C9473837D04361B7F85841B6FE5735CF0DF190275699A917C0F71CCD65DF3052208F8FB73095CB6175F88E1
Malicious:	false
Preview:	.PNG........IHDR..............q.....xPLTE...4y.>}.<y.<y.<y.<y.<y.<z.<y.<y.<y.=z.8t.<y.<y.<y.<y.>w.<y.<x.<y.<y.;y.;x.:z.<y.;y.<y.={.=w.;y.=z.;{.=}.A..<z.?..C..A..3....."tRNS.......)......g....o`.$.SKJG8..z.....IDAT..M....0..1.8.;C...... ..?.*...=.=.Jw c.U.IB....\|t...c..,^.....0.k...e.19d....Wy'.b..&...I.{...Z..i..ttw..y........r.l.M7....V..Q...p0.....;Q.....8'..............IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Convert16Masked.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1904
Entropy (8bit):	6.298460953131784
Encrypted:	false
SSDEEP:	48:T22/6164knA9WIPH/c0WWSFM3UHJ3WdHxX6FXuEI:y2SHknmWIPH/hS9HKHxZ
MD5:	16A9CBA7DEA487EB54C2D16DEE54B038
SHA1:	4878397AD1E949B618B1CB8C2CEB88C971966B73
SHA-256:	ED66DCF1920160D069C5F5CE45661BB66DEC4471281B6DB41CBBA82B8D6BD2FF
SHA-512:	6CAC51B6AD8413E8C3507DCCCA6F632FDFA992F19013962286B255C068726A3475DD153CB2B5423509E72474DFD2A62B7A3E1159B562C0A286C6972D79585DAE
Malicious:	false
Preview:	.PNG........IHDR..............,.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-07T22:45:44-07:00" xmp:ModifyDate="2018-03-17T20:36:37-06:00" xmp:MetadataDate="2018-03-17T20:36:37-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:aed13df8-a84e-4202-9161-f1326676e901" xmpMM:DocumentID="adobe:docid:photoshop:1b23bebd-447b-2a42-8eab-11da176d059a"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Count16.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	351
Entropy (8bit):	6.625026950484395
Encrypted:	false
SSDEEP:	6:6v/lhPfMcRg6raoxu8vDOopIefrCy854vHtK62Jr5D0SBSgi8v2E0Q4oXhp:6v/7365oxvrfeb6HtFwrG8JplXP
MD5:	07B7383C7FC9AEC7EE67FF9A7FF2231F
SHA1:	A579C86EB16277C229844DB5AB4AD34CF21F8808
SHA-256:	6A6D153B8B6A42590E8E9545F8815C044D0310A50649F2FB9ADFCA48A1894665
SHA-512:	DA644CAA67E315E9ACEEE48168B827589D3785641ED1B21809BF941335A966D48DA053065093F251C1431E23F7CBE6A95407731D1923A5047AEC0FBF0183D430
Malicious:	false
Preview:	.PNG........IHDR.............(-.S...fPLTE...K..N..N..N..N..M..N..M..N..N..O..N..N..M..K..Q..M..N..N..Q..M..N..N..N..N..N..N..O..N..S..P..U..R..".......tRNS......"....{OE>(..]X)....ol>*XCqE....IDAT..U....0.D)............h+.$s.....u..8.2...........""5.#.u,.I.I..$....j.L...$.....p[.)..%.=q..._y.X....E.^...Y?.3..`.%........E...@.[...,....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Count16Masked.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1876
Entropy (8bit):	6.263164842550989
Encrypted:	false
SSDEEP:	48:b/6164knA9WIPv/c0lVWGYJ3EbHJ3XHxc+szot:bSHknmWIPv/rA+H1Hxc+Qot
MD5:	C95787BA8873B1BD891BA9FF9E49F661
SHA1:	0CC76240D24254A7433932384B5D31A1356D18E9
SHA-256:	1094801DC0733B0A2FE73CA1904E3031A81BD48538FDE2C6B36DA79555F02BB8
SHA-512:	BE3C0F42B6B39B7AC5C64832B73F0609633684B83ADD4E631C498828A6580690B782F403337F2A0480D693D9142ED41E568A3956A9BF89766F0EF2824F85ADB4
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-07T22:45:42-07:00" xmp:ModifyDate="2018-03-17T20:31:24-06:00" xmp:MetadataDate="2018-03-17T20:31:24-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:72b218eb-3f71-4352-a1a8-8ba26cafe6bf" xmpMM:DocumentID="adobe:docid:photoshop:bc5e16d2-774f-904d-b3b4-1e112485ea6e"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Count32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 32, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	317
Entropy (8bit):	6.469720428177924
Encrypted:	false
SSDEEP:	6:6v/lhPkdHLENWT7StLzzu5s4pc+AB3u2FbPZym7fvSp:6v/7s5LBgR4SzB3u+97fvY
MD5:	4E1D61CC18B8C86B6C21BCC12E37F3B4
SHA1:	DEA5EC41836C6B9663D9A2EA930CF9B02174CEC9
SHA-256:	AEE86801ADB09FF1E063A56A824F4C1BBF39EE044AAF8010F9D0B7E30D06191B
SHA-512:	C6BA961AB1F43C38FDB231779DC10F8950E37C5D0E1FD2F36548BCBF2381E8F4D27681F005C9B2463808BF9809860171F4133D053B4096C5574B9A47C1B4EB76
Malicious:	false
Preview:	.PNG........IHDR... ... .....D......3PLTE...N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..g..$....tRNS....0.@.`...p. PS.......IDAT8..... .DI!......:LDah....-,... ...A..............g.e.....2.....'C.R;.~..$..'.\'..K..e.<.\.{..p.IC\|...q;q1..aT.[......`..h......j.T..=..6..........i..N...@..G..^<....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Dissconect16.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1837
Entropy (8bit):	6.216679916294268
Encrypted:	false
SSDEEP:	48:T22/6164knA9WIPXp/c0Bum2sj3yLgHJ3BgHx3/wG:y2SHknmWIPXp/WLs2LgHUHxIG
MD5:	F258EE92116E3D3CB66BD45939D47A91
SHA1:	3A7DBE7D9FBA0BF2EE32F7E6BAF256F83CAED1E0
SHA-256:	C02A43192D3DDA23A92D3AE98D9C100C9314607069B0043C22FAA5E25DA6CED1
SHA-512:	A361348C09A951C227B8F15573497F9208A80C5236A7EC1E4BAE8DCB604E5FC779D40BC44D1286B5593F4E5CDEFEC802374D88B929461CC5DFBBC6C2C1791564
Malicious:	false
Preview:	.PNG........IHDR..............,.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-07T22:31:50-07:00" xmp:ModifyDate="2018-03-17T20:27:27-06:00" xmp:MetadataDate="2018-03-17T20:27:27-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:580a37b3-e87f-4654-8ba6-2bafd5c60e3b" xmpMM:DocumentID="adobe:docid:photoshop:6195fd05-1ab2-3149-9b0c-38f24c63e9e2"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Dissconect16Masked.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1790
Entropy (8bit):	6.085739740396218
Encrypted:	false
SSDEEP:	48:T22/6164knA9WIPX5/c0ea5iIsczO3tgHJ3eaTHxQpw:y2SHknmWIPX5/Zi+UgHnHxQpw
MD5:	B1303D9FCC7C5C1C5BBF754CBADE7555
SHA1:	9B9F741312516FB8713BE43083A4EF9FEF6B76DF
SHA-256:	C87C3908689E3AE6FC48906F998FA364C659A3205A608441D021B76E01106D53
SHA-512:	7CFFE2B6393F9BE3E7A55622C04342460EB479996E729170254E628AC76D7456CBC2D3ED91E511CFA4041B75C3FB643A0330CC82285FF86A92B110C5150931E2
Malicious:	false
Preview:	.PNG........IHDR..............,.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-07T22:31:50-07:00" xmp:ModifyDate="2018-03-17T20:29:10-06:00" xmp:MetadataDate="2018-03-17T20:29:10-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:ddbdac7c-6b6a-4e72-a014-8e75d0811ed8" xmpMM:DocumentID="adobe:docid:photoshop:8338f344-edcd-aa4f-b950-562e72a778da"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Dissconect32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 33, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	303
Entropy (8bit):	6.445579520514436
Encrypted:	false
SSDEEP:	3:yionv//thPl3dlw54m/v5/zzzzzzzzzzzzzmq89PFlVPVF0l2MoCkRc92JbGS/cp:6v/lhPa5xkq89PC4R5bFHbpi/w+G9lup
MD5:	85A61AAEC69B867808883A67B62DD627
SHA1:	7EAC339A2238C24B01D726DE61F6BF4012D82405
SHA-256:	D113B369AF616E9CF68F9526F787C1A62DDFDC3F2F98657801073AB4DC20E9D2
SHA-512:	4F8667EA629A286C21423E19AC834D8FD585CA2DA8DB3BC9842DE4C6A0F720BF7507CCB8BE04B2BAA5BFA0FCF6BBAEF4F18017DFD814C11467B6207147865603
Malicious:	false
Preview:	.PNG........IHDR... ...!.......Yc...3PLTE....L2.L2.L2.L2.L2.L2.L2.L2.L2.L2.L2.L2.L2.L2.L2.L2.......tRNS....P@.p....`0 ~yEc....IDAT8..... ..)U......XS'..=.^.6.....r.F.b..)Bw...\|.....=..R....;...d+...69.R.=............l-8.....=..C.\|....c.9K.._!X.z-.....w...M..........Z:)w.T.0....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Existingtem16.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2142
Entropy (8bit):	6.274068403575219
Encrypted:	false
SSDEEP:	48:T22/6L64knA9WIPz/c0UG3zknAa538aDHJ3WlHV3UG3uHxtiIIHl5T:y2SJknmWIPz/2qk1HklH2FHxUIQlp
MD5:	EECC244B1923033C6F50252920892808
SHA1:	77CD7C63D70BCD7193DA3417933B546A5167F27D
SHA-256:	0862977CAC8DC816D6EAAC85AA874047D16D44C838D1AE275059246AB9FCE443
SHA-512:	4FF73C110480F5AF61B386238E538836C279623A260A325560CAAA7E8F95AC12D6917D54E24ED358C667E4951DC69BD0BF32C733CB06AC57E0E8870734D7E2A3
Malicious:	false
Preview:	.PNG........IHDR..............,.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-16T17:14:05-06:00" xmp:ModifyDate="2018-03-20T15:37:33-06:00" xmp:MetadataDate="2018-03-20T15:37:33-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:7516d4fb-d80f-47f5-b864-bd04a5bcd877" xmpMM:DocumentID="adobe:docid:photoshop:f9b3209a-9193-0a47-8ead-2079517698ea"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Existingtem16Mask.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2097
Entropy (8bit):	6.227400451608429
Encrypted:	false
SSDEEP:	48:T22/6L64knA9WIPF/c0ktAa538aDHJ3WlHV3jHxDMeTt2xMbTW+tu:y2SJknmWIPF/abHklHJHxXtyCu
MD5:	59008E3B6E4A0C9EEC2812FA7EDF0B8A
SHA1:	859E25BDC3969044B78B293B593599C7D49D9D37
SHA-256:	D0547E37FDEDD5029D347CB5C90B5A779F9CFF0D08A3FC3D2BCFD87F29F00372
SHA-512:	B0BA08C788557C44EE2534D8893EF4EF4B1CC149481637E8E068B98373AF58397B71D64251F29D20FF42B94C2122FB4E52997562B91EEA1660AB7B8FC8F98312
Malicious:	false
Preview:	.PNG........IHDR..............,.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-16T17:14:05-06:00" xmp:ModifyDate="2018-03-20T15:38:06-06:00" xmp:MetadataDate="2018-03-20T15:38:06-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:12aff1cf-8efb-47e0-a057-6e0bd853fda2" xmpMM:DocumentID="adobe:docid:photoshop:88761de1-2940-4143-9745-9d6ae13ac782"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Existingtem32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 33, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2176
Entropy (8bit):	6.642134958832128
Encrypted:	false
SSDEEP:	48:90/6164knA9WIPZ/c0WUDCfn14Aa538aDHJ3WlHxFlDuMnzCWJ94:90SHknmWIPZ/QU2v1cHklHxFliQzCZ
MD5:	D4B6224AFAB311DFB77D92B44CCE175A
SHA1:	06D9EEA8D95AEEDA28EFFDBF79A9B29243807BA2
SHA-256:	E0530150EB93D986FC45F851806608EC6E31A73E39AAF3F6EFBE30A2986F7622
SHA-512:	06B44AD1D5D3A1C0234406F76F3BB852F4EB02C6E247290C4EA6BDFE84A73AE8320F2E7178E484F5F46AF05DCFD91B7BF3E6F63109F6DDF710EECE575005EF9E
Malicious:	false
Preview:	.PNG........IHDR... ...!......&.Q....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-16T17:14:05-06:00" xmp:ModifyDate="2018-03-20T15:36:02-06:00" xmp:MetadataDate="2018-03-20T15:36:02-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:59eb0d1b-49d8-408a-9190-0e95bebeb7ee" xmpMM:DocumentID="adobe:docid:photoshop:142fb08a-d244-6944-bc58-2bde2bc21fe7"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Export32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 33, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.382414384983311
Encrypted:	false
SSDEEP:	24:zlJ2H9Y3dVZyWVFYlhLGlvJk4QcWG0oJWYX:zCH9Y3zZyeIIlvm4Tl5WYX
MD5:	46FA64009564864B3D28F0143927F126
SHA1:	677F6D6D4BE20D35E3F4CC8610807815348DC549
SHA-256:	4BCA838D909BED2802C91424D9FD33529FFCA7ACF063BB3F7B95979353D3026E
SHA-512:	E35752A18D7F59FB3AF7D392DF8BD073E94A0516C1144B2B25EC8542269EF198655934155410403C3214285772B5182DD3B6D140F07436D25B610C37FDDF14AB
Malicious:	false
Preview:	.PNG........IHDR... ...!.......Yc....PLTE......;z.M..M..;z.h.....wvz..............nor...;z....;z.;z.f.....M..M........;z....;z.M..Ut........opt........................}}.........;z.......\|{....;z...............nor......Kx..............M.....M.................nor;z.........}.....h..Z..r.............................FtRNS.p....=.........@........h@00 ..........................pppdLL@@<0.......xIDAT8...S.0...Z-U...lp...%.% .....3\|/.........z.\.R.0.`..d....y.H..{.\=f..h4......M....R.>..!.0[..yL..8..B.j.0...C`?D..})o_.J...........).A.J..0...p'c_X.:....t<.C....`..U..>b.y.y.q4...K....<mI3&c..N9..#.W.......f`.!@...z..6..;C.j5...@...H1..G.(,...y....U!......PG.Alg3.\v].r.z.:`..0W.FG`B..!.....;l..'...F..........S...O.......N_..Pm......48....F.].....N...o...B]a.Z....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Folder32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 33, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	194
Entropy (8bit):	5.750074522946211
Encrypted:	false
SSDEEP:	3:yionv//thPl3p1Rgpm/V5tx5BGwSbYG/obS+H/MY8xxiVakZFph/nDbZm41g4gnH:6v/lhPByIjfnEYfSuEOrh/nDbZZgnOOp
MD5:	8136EE7D96B387E8BFECDE59F5315C64
SHA1:	E69ABCB38FDE3838CB99EF3F5A0162E8B7D06EB5
SHA-256:	281F7350686683425821A0AE1046A3AD7C641EE17C17B5D35C5F96032C89EFE7
SHA-512:	7899371F319B4E4796D9B2026F3530FC891164EE3C777D526DBC704FF431351B22EB1B1DE778F53D834BAE93106B859F657D84D21144072B7B95A99B92A9CA14
Malicious:	false
Preview:	.PNG........IHDR... ...!.....J..b...'PLTE....c.w-.w-.w-.w-.w-.w-.c.c.w-.c.w-.v.#....tRNS.@@...........L...?IDAT(.c .0........ 8.$r.......R.......A.8.M@....v..Q.................x.....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Linear16.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	332
Entropy (8bit):	6.699639358665104
Encrypted:	false
SSDEEP:	6:6v/lhPfQ6KPTc6o6GVxuJKebHgKEUrEFzsuk6p0G1kv7UWkIpvmlNCVrXTp:6v/75iTc2Gi6Xsmp0XkIplJ
MD5:	F641190027531171FC02B1280E1CB5C3
SHA1:	5FF9C58D7C880C8715ADE58322A9DE36ECA89631
SHA-256:	9E0A06BC0C3A8C326DE7D1F93AAB00372063358BC4329873C94FE01D779CDA4C
SHA-512:	18984D452E824E10E5D5615587601F5875C6EBE77E337FFFF605A28B5D06B8AC3935CBBB8CADD73EBE87F39CFB84D7D7B4639C7F4E2C7CFD6F167CE9F85C4891
Malicious:	false
Preview:	.PNG........IHDR.............(-.S...ZPLTE...8~.9z.9z.9z.8z.9z.9z.9z.9z.8z.7x.8y.:y.8x.9z.8y.9z.4\|.9z.9z.8z.8z.=..:}.B..;..?..>..:\|..9 .....tRNS......K!.3.^@.\|h..22......IDAT..U.Y.. .D..f..t.$...Y@...ai.%[.......q=.Ag*B.W.{}:.T`...v.vk.R.,(&.m..K..E\.L.......s..-1.%E9:...".......}....h.".r.....).C.@f.....6i..f....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Linear16Masked.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1725
Entropy (8bit):	5.96323308807406
Encrypted:	false
SSDEEP:	48:b/6164knA9WIPb/c09JJ/c3g3w3SHJ39VHxi2Ef:bSHknmWIPb/vJJ03J3SHbVHxD+
MD5:	C15E33ED3A97E3446036721223F997BC
SHA1:	458D51D0500A80289C53355A9EA0DEAA19227361
SHA-256:	5AFA187A626957CBCE41CB20E82A05A967AE7C38449BCA8E003325A8E2663E14
SHA-512:	7E37F10FD1B74E67194754C2E5D0F5FA7854C81436A72775014A4EEBE02B43B3FB63F140D70C7D11D6E16D612C4089B3775661CF4BB76E1D85189BCE3ABC5C17
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-07T22:45:42-07:00" xmp:ModifyDate="2018-03-17T23:45:31-06:00" xmp:MetadataDate="2018-03-17T23:45:31-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:33812ce5-32e4-4b87-8b1d-00946727b433" xmpMM:DocumentID="adobe:docid:photoshop:4e66e7f2-cf37-5741-9b39-5aadf4f933e1"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Linear32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 32, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.954320523250208
Encrypted:	false
SSDEEP:	3:yionv//thPl3SOX/GfTtYYYYYb3SRbsic/bQfrW4Zll/sOPgRsgIyjspfgTnFpJ6:6v/lhPfuUCtsiCEDW4bl/s2ayyBdYVp
MD5:	A036D4683E99337966144F42CF49FEE3
SHA1:	70B964BC50C2953C5E5A319D2EE9F7ECFCAA2DDB
SHA-256:	922EBE9F5C2DDF6479189FAE4BE8008868A93DAA49CA38AC18826A1B244565A2
SHA-512:	5BF9B8282AB72213C3879469B46A4B0CA164489F4F4C0721082DE61B44765B1F71D56F78A8B072AA472F9FECD6D7BA9EF28D0C7C43E1CE287AFD8632782C4BD6
Malicious:	false
Preview:	.PNG........IHDR... ... ......Tg.....PLTE...9z.9z.9z.9z.9z.9z.9z.9z.EO\F....tRNS.....`.)=.....gIDAT(.c......T.`.h.@.F.....FAA...6 ......4.H..........h4...C..a..0y4...E...CA(....$.......@.$..(hx....J....$....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Link16.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	280
Entropy (8bit):	6.85991143715917
Encrypted:	false
SSDEEP:	6:6v/lhP+HHW9jU6VjjxGgCfwWfh3h/bUETinAhZqKXUz00bhB0bG+csGAljp:6v/7GHHWlUKHxGgWw8bUETU8qKXUzie8
MD5:	3301C6FAA433D187D4C21930B5B721D6
SHA1:	2C6BB14BE180A7F74A6FCD08161D58A2394FB5D1
SHA-256:	9B5BDD7D665FD1B8B955F6151D624BBF63C94260E64F7FBCEFD3C8833E8D2423
SHA-512:	5F1521F5EBE8F797685689424A0A7A9CE814B85D090338280F12979DAD2923C8E6A7E9EA9FC130ACFED70B5EB702EE0BE24D17A66777917886552CEAE4869400
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs.........{:.d....IDAT8......0.E_PR.....2B.H.7..8.n..l.#d.....#Kgd,B".......e.9.D..-.].=P&..5...N.....t..U.g.\|..[B6ir....Axu....F..`..,%.m..v"<O.l.Q..8kTV4.J;........(......5..?.i..UK...........H....*p.B.C..0.....x..$9X........IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Link16Masked.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	270
Entropy (8bit):	6.824705215319485
Encrypted:	false
SSDEEP:	6:6v/lhP+HHo9jR4YniL+nQWaoYu3j87Wu5p7mqa4cvPkTcLllbp:6v/7GHHolRiKnQWP8Su5pivkTcRz
MD5:	66E61D0BFB0031EA35DA64720DD43144
SHA1:	3A9224F74A99A3F5C64D839EC184B2B5A8ACA1A7
SHA-256:	3633580FCF62062FE869BB4B9C6BA1BFBF33898F44AE25A85B3039604A99AA24
SHA-512:	F375326119417D37DAF40179742629317F00960D17DCEF57920CACDCF92F2166EE4B3F039509713D5AEE4FC163624F2D21202B17AB27E5B4529252FD56C4A916
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs.........{:.d....IDAT8......0.D..t.F`.....R6....l.#0BG....r.4Ji....D......-Q.o...K.....suf...tp.8n.........g...M.Xp0U=J:.qp..p-u.c..;.^w i....D3k..........!^E.@.#..?L.M....".5....w.ZOwd....2..7....].($..c.A..y.C....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Link32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	401
Entropy (8bit):	7.230676165412484
Encrypted:	false
SSDEEP:	12:6v/7iYAio3qQ/c/RqxccA8Lhh3ckYuYBD76uD:2y3m5FUCk5O+uD
MD5:	153FDB70B5A69ABF06E9F4758E4A7F4D
SHA1:	C25756D6D4F354242C310B4454F5B14DCF46E1EE
SHA-256:	D3A81318EB5960CE7FD22FF374BCEA10440249E17F257A5A306CA2677B807BA7
SHA-512:	965AF4651FB05231942279D75C51882117639432B1C3CE1D56F4C020762A762FF0AFC2479855B71F4D5D2315DB97143CBC0D96A5F35FD94057BC5011F226E043
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....pHYs...%...%......CIDATX...M.0...E.....}S.......q.@.....:.....(a.>.Er$....V...Kbg4.2.....cN\.j....(m+.@W.y..H. .?.....3..@.....8%......g%0...w.0&....{....'.B....B\|...B@i.......-.}A....o.S.>.....".....}x.zar..)nD.U...R......q6...(....!..J..}..@........$=..9.r....p../..H..Z........m....X..B`.a..}.....n....1[..P2.r..}.zC.un"..c..\|._..5.s....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\NewItem16.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1938
Entropy (8bit):	6.338971764650906
Encrypted:	false
SSDEEP:	48:T22/6164knA9WIP5/c0DsXu4KHj3+HdHJ3DFHx93tt+:y2SHknmWIP5/QuJHKHdH3Hx93z+
MD5:	5FFF83504DF13357423583E4BE8E41BA
SHA1:	65BB4AB5623DAD9C13B45BD3227D8A504C5FB87C
SHA-256:	6DFB45F35E153030CA07085F796E7E6249D5858441CF2C3F425674BDF2554836
SHA-512:	365D13339970A84AC571B6C747FA7B5D2D442BB8D1901689C3963C57641232CF865F8980C0AC1754341656DFD75859E72989E12AF522FD8DFEA97F0E04845FAB
Malicious:	false
Preview:	.PNG........IHDR..............,.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-16T17:14:05-06:00" xmp:ModifyDate="2018-03-18T02:20:35-06:00" xmp:MetadataDate="2018-03-18T02:20:35-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:0e1d0706-79c2-4a6b-ba26-a185ef6dc368" xmpMM:DocumentID="adobe:docid:photoshop:7f390c49-6d6a-1e46-a622-6f9430ab6cd7"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\NewItem16Masked.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1892
Entropy (8bit):	6.292442732465406
Encrypted:	false
SSDEEP:	48:T22/6164knA9WIPV/c0SsE1Bx1SP31HJ3SsE1mHxTeTt2xMbTW+tu:y2SHknmWIPV/k1Bx1mHw1mHxutyCu
MD5:	DE8424D71291F615A56F9EEEE7AD7DB5
SHA1:	8D358587D07F709120C4878CA5CFD8423E418745
SHA-256:	730F79896D8D22B7A1C51C33F0D238EEA0653AA92C0E2AEAB87C5753894814C3
SHA-512:	2D826F61027172C3017294896305482BF12D7D13D65663890B103F479CC4B366959B9D34653C5EFDE0F68EB925ECECEFF650D9CBA5EDEC232C9E908D2300F0F5
Malicious:	false
Preview:	.PNG........IHDR..............,.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-16T17:14:05-06:00" xmp:ModifyDate="2018-03-18T02:18:52-06:00" xmp:MetadataDate="2018-03-18T02:18:52-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:06d10ddb-bcef-46e8-a437-4a47010ace32" xmpMM:DocumentID="adobe:docid:photoshop:162b1031-6618-6448-8d22-32a8d8dc0942"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\NewItem32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 33, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	357
Entropy (8bit):	6.647866556630499
Encrypted:	false
SSDEEP:	6:6v/lhPa5x055555555555554WktPAP/BJQJiK+Jdsh1W2y8D9PW7JaBoYpq6awwx:6v/7/t/wJi1JyW2bmJoqzJx
MD5:	3273F609B6E7CC01BA15708F7D06AE8A
SHA1:	72F9D5DC3F298A4F3823086A96F8FCAFB967D09D
SHA-256:	F7FE09308889F7F7BE4EF6246534B6B92B84FC96D9612C218EA4939B1A3F39F8
SHA-512:	B9A689FF3943EEDE237C07E5097DA639AA1C0B3D6DD3E9B0ACE5AD0A6BF5D23759E98EF0BBDF6FED03EE07AA89B50BFB351F068EC308DDB8B51CFA961599E125
Malicious:	false
Preview:	.PNG........IHDR... ...!.......Yc...3PLTE...................................................\|..C....tRNS.@.....p.0...`P...G.....IDAT8..K.. .D....o.......tQ.....B6wb...#..&....a..K.IX..:..-...\Q....he...w..*....t.p^.f.H~k.......q...P.<.r....Ex........^....Pz..r.J(...<.P.@..!~..O.....5;.tt9Gs.....NUB.z1.U...y.0XO.v..kY..\n...z...['........IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\NewSection32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 33, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.668393357271831
Encrypted:	false
SSDEEP:	3:yionv//thPl3p1RbpmcHl6IddddddIaNSfvFS4N6xR0rhuU26291+B2ENZ6YnlVp:6v/lhPBKcF6Z6SfQ4b5I91BENLbp
MD5:	2F9E9FCF432F3AA39A5F83E39957C30C
SHA1:	8795F02CB3E3EBDAC27BEAADE63703F2DC125CAB
SHA-256:	2F6F007436D39FD18C2014D790928C9300FC7799FC9382CAF1C572A9F26DC704
SHA-512:	3FAC20FCD4F34DE85B2D2E5C0DD881F62AB198706AF4F59DB884BD0A30C44FA26E3ACF948444E485550058851195AFD7C2078C40EB5B2DEE9CDB602CF00064D2
Malicious:	false
Preview:	.PNG........IHDR... ...!.....J..b....PLTE...K..K..K..K..K..K..K..K..K..........tRNS..@.`.0 ........OIDAT(.c..........t...@..9.... . .8!,..(00P$.........P.(....%0YP.U`".EE.dc.0a`.......IK....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\OnOffGreen16.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	428
Entropy (8bit):	7.273961907217273
Encrypted:	false
SSDEEP:	12:6v/7gLrIJD1tMibLWYKCkvc0vF82rf+61Yk:fUJD1uYKFc0N82rf+6qk
MD5:	B7DB1680CDDCBDAFB762D04D59FFA4C2
SHA1:	5D2DE4F4DB06ADE007C9B5339D59B95D9FBDCDD9
SHA-256:	BA4473BA943477041699E577768EC8B948F6569DF6FABDE44B84EA70BC00D8CA
SHA-512:	D2623C8E5536D16C93EC31917BB986D455EE2455248348AF1E5C9BB2E1F9040D713F9F50BA4F250DFC2029F80DF1CAD96F6CD1CB5D7E738859F1C594203638A6
Malicious:	false
Preview:	.PNG........IHDR................a....sBIT....\|.d....cIDAT8....K.Q.........U.L&.d+k"(......._04.*.. .6.0.,........t.:.}.....{.}.(L%....s ....y..x.~ Y.UY.X...KZ.#?..{..df.&....Z.&.d.j..s......m........$...m.lWlw.=`.v.b...B..r.q.Bx..@9.G..y&#.@.yM.1....p.X......E..R..i....x........[./..m....18.:...R.......3.d..T..l70w..b.2.#.,.\|.8GA....}.[+!N..`.....U..W.&.5....^_...3.Lf.bz..P.N.Z...y"AG9?]...?N..........IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\OnOffGreen32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1295
Entropy (8bit):	7.770723010238438
Encrypted:	false
SSDEEP:	24:cgbS/FeOKZV7/TH3XeL7zG6CipXTOa9qB3zbAZUIXmMhF37DFl:cg20OKfrXeL7zGipaaozbiUIXmMhVL
MD5:	447D203EEE1553439D5ACE2D2F641326
SHA1:	75CE7C02548AF63A08212D1E37E2624D92128B0F
SHA-256:	650A137615E1ED8062DA8104B82C21D860FA5523FF6AD5266F14FA90ADCDD20E
SHA-512:	2E9AB585EF1FC91FB97054098CB03EF9393B0B6ED095BA7B01C8C18E015236E2BE488F4EB36AC032FAB2C3BD3996A6B705E93908EC4EEB1DE59957DCE074FEFA
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....sBIT....\|.d.....IDATX...O.W..?.i.... EZ`S.,0.!.'QY.6.$.....,.op.g...s..fq.%cB............v.5..Z...s.....T1;/.<..9..}.........O..o]%vg&...0M.$bq........t.......@..kE.=O...j...m.<....i..b..T....N. .D.FD2.S.@D2D..`...m.nx...!..o}%.......~.H. G.+^.....L../Z\|...;..l..`.9W. p..A........E.,U..qKr...s....+..u.z.........I./.O...o].G.Wf..'".O...`..;...c.n.69e/Q......=.."..D........]...".%U....j...'.K.Q.........is..H.w.............(mZ...p\|...H!~M..N.1.V.HNI.A..l..f......l./.`....g./.i.;..=#..k.....e8s....^I....f<.K..>Um..0Dd...<P.....=...g.P.`<...N.&....=3\.......YG...: ...'...;...t$wNz......../#"....+"$...G.!2s..!....2n....M..g.7...\|..Y..n.E......=i.(.....p9....&A..,....(.....T.....M.14m.A..<..P...e..ILFCn_..x....<U~.....T......h.S...N.........zT..:...v;..../l....KA....lN.@D...gS..Cxp....3\..77.T.....N..'.E.m...r.5.V!S....k...v......zHQ3...p9.2.]."..x.z(....c.....86...."R*.q..i.q..s:1\|g.....:ua.jDU[Q.a.^x_..g.o\i...

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\OnOffRed16.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	563
Entropy (8bit):	7.473071049560961
Encrypted:	false
SSDEEP:	12:6v/7iif1wp/hlpyIOo8+gjOKoSD0ZrtTK0FEMezjIFG4v+Ttx:e1wnmIFlgjboS4ZxT5CjIo1z
MD5:	B44D529BDB5CE238511437CE35851A25
SHA1:	94CF76EE815F53193FDA96FA44181C61475BD084
SHA-256:	502FC15C5091BE285CBC8383BF9A372E7CC8B2125313BD9169B4B13C0DF20996
SHA-512:	A714E457E745218D835BEA5721B83569FB0380354D789272460D9B8AEAEB8C7267643E7F75B9F10F4AD642DCECEC4FFD679F926F1D4420A25EE5C946CC447659
Malicious:	false
Preview:	.PNG........IHDR................a....sBIT....\|.d.....IDAT8....k.Q.....l..P.B...4.n..tr..:X..I...3.. ..pj!.!t..n.1k<..`%....}..C..$....\|......M...l.............a..~....g..>..;"2f..%.=0...FC..L....@D...sa.2. .l.@+.Fz.Vx@. \|...\....$Y"@J.yis;\..e..........Z5rX.....0..r.d.RUz....:Jfum.......T....Hq.^.8?.u]G.@...o.j...:.8?...D..@+.0h5...K.....J......Y{...xX\.)....A..M..\h........'...4...Zv..r..M..].~[.8...JU...p4h5..0.>......~$....p*...U....;..Kc.....Fi...........7.&<C.......!.l3so&...l...tK....y.._..........w..._.M..E.....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\OnOffRed32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1264
Entropy (8bit):	7.748318960468759
Encrypted:	false
SSDEEP:	24:4un/9IXGgKJjKyZOwulvJeGQBjAk8NVJn9FbFF7KOTg:4u/uXGgKsyCeGgjAkEPbr2Wg
MD5:	2C7A231A7251BDA3EB75AFBD033DE93D
SHA1:	427F4C58F706AD5F1FE05CDE4A456B97268C3CAE
SHA-256:	DC2F827D5B6240506FEBE3AD6EECB3DC7912426E9A73AB11F114198E0BB0BCDC
SHA-512:	07CE449672E56B6DAF99AEBB2660E81CA377AB91771FD70A49F0A7D7B701DF507DDB752FE25E7447ACB8412EDE47FEB714A73FC62DA8E34CFBA7C07112671FB6
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....sBIT....\|.d.....IDATX..MLTW....y....Ea@Q..!&M.D:.`.61!M.6..vCHjh..1MLX.t.B...D.wu.....$M.b.m...A:..:..wO....:_...M.}...{.9....6.......U......h..{.....J.Ih.#K&.v.o...~......h%...QOC0..0.p..9../A(.......h.a"zFD...s'.....DT............A....D.%..;-....D.=.7......@@.....Z........sWum.h>........d..../`>{L...#?...c.).......K.N..D.........G&./..Dbq>7...W...h....Ei.)gZ..R..Tru%.J).'Qi.)g..Aa..d!.....h....t..........O.......@.=..x ...e..5..#.^.Is.4.G...p...j;{..A..K.w...~..[B..1.....Q.l.HT]..$!...G..fR..3.5W....h..4x7...../=y.:6........i...L....K.w....=Z...U ....V..Zt...N..P....K.4.......K...P.......kj.].Y.CV......nyx...{Nc......i4..5+..........(([2-25!X)+.WQ..".2.J..j..e3.......U.@.8q.....m..e...W...(.....n....".WQ..?...$..;.Y.Tz........@tv.x.s.1...`..D.G...^.l.lf6.=.. ...#.c...u.ze{.\.k..\]a...rmuK.*.;...Q....L,.....e..(9v.......U'..R........v..qe{.\..+..^...L...yG.....b""..k.#..,#.&3/.p{,#.&..........X)..a.{....

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Page16.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2105
Entropy (8bit):	6.60264355890893
Encrypted:	false
SSDEEP:	48:b/6164knA9WIPu/c0tL4MO3cMhHJ3sHx4qp6bxy:bSHknmWIPu/bYH+Hx3V
MD5:	931AA34215795E4D5A7F70AE95E3F018
SHA1:	12A3CBBF34429808630E185E2ABD2F58CEA53D35
SHA-256:	2B448D1DA5405CB20EAB8A7BC8D46EF7716573FCFFE5A39B12ADE9E2584E5E50
SHA-512:	A38C3E73D73548B8330BC793A7340B0073FB2A354C008D6C1306F7B99203796B2E53CD4DC8A98C2AD2DA62D44A227E5B516563BC59C8BE434AD540BD10B550C1
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-07T22:31:48-07:00" xmp:ModifyDate="2018-03-18T02:07:16-06:00" xmp:MetadataDate="2018-03-18T02:07:16-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:fb43030c-2066-4a80-966d-c83ee38f68fe" xmpMM:DocumentID="adobe:docid:photoshop:17884821-e4a0-484e-9854-56dfd9c8ee0e"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Page16Masked.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1942
Entropy (8bit):	5.924389546553608
Encrypted:	false
SSDEEP:	48:b/6L64knA9WIP2/c0qtSE4MO3cMhHJ3sHV3qtXHxQ:bSJknmWIP2/wS9H+HwXHxQ
MD5:	5900DE6C90B8379C953A14AABA39C3A9
SHA1:	0A1E1FA34406CD84D8C0D95491D9F97F108277E4
SHA-256:	A7B9A9508A749E5C0274CE07DCB0213C8A64214B65566C1587F927445437D947
SHA-512:	8691E16BE93B19528036F009722339187A6ED57D1351D7F2F9A8D21740CF46FCC947ABBD6089D85AF3C77D766EDAF21465D70F58D833F41E1FBEB76F9029FDDA
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-07T22:31:48-07:00" xmp:ModifyDate="2018-03-18T02:07:49-06:00" xmp:MetadataDate="2018-03-18T02:07:49-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:e2a283f9-c3ac-4417-9db9-e102781a2851" xmpMM:DocumentID="adobe:docid:photoshop:e5cf27cc-61d0-144c-a709-98f6e4b1ff20"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Page32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 32, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	361
Entropy (8bit):	7.019587217873892
Encrypted:	false
SSDEEP:	6:6v/lhPkme0Lrv0XIWssnxexLBFSBD0XQkGgLeF0m6pTFUhDx2QdThuzgzqmJLup:6v/7sme0LD10kx1FUKOlZsZWx2Qug+my
MD5:	5C5C8465E6A63D4F5516CE82CA7AE1AB
SHA1:	BE36712A6B82D23F2267B85DF1F6A9D465E991AE
SHA-256:	4EF16AEF80CF993404BD9C7A2F76892C57CC9114F5693AD9F3377B01424B14CB
SHA-512:	E97B6E27D4927416233AFA4F421D173C570453869C6D5D5877CDDC73A7BB7E09C16FA4643CB859D3C251026A89487413380514C6A2F7B95B04D090FC8015CB36
Malicious:	false
Preview:	.PNG........IHDR... ... .....D......lPLTE...stwxy\|qruqrvyy}pqt...mormid....m..........\|x$x..s....s........@~.2\|...~sok..........h...........tz.....Al.....tRNS.......o,......IDAT8...I..0.DQT0.4...}..=...OH#.oZ...f.s.U2.\.q\|...f.....". B.". ...E....>..?..y..........C.\[....*..d......9......_1.........8.v....sL.7......._..?A....5w.Gsz......L......IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\RemoveItem32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 33, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	336
Entropy (8bit):	6.5881036394912975
Encrypted:	false
SSDEEP:	6:6v/lhPa5ApTxxte9toYnsXl0S7OKjmrvuS7810ccNwVp:6v/7rzYSlL7O4mrWEw7
MD5:	7C0E466272FBA7E9E1E11DEDCFB50832
SHA1:	BAA6E906A80919F20D050335D705609E5300EEF1
SHA-256:	DDA0B5F91290202DD7197D01AE4AABE0394C44A45481E3FA33CBE5E3B58A96EE
SHA-512:	45085C13F00228CCA8769FAD8B55E8B621C2DCA219B460A827D78A0A121AB5672DDFD72D1BF5754CA438E129EA3AA5075FA21455E3C8EDBE5F5B0903E52A1A75
Malicious:	false
Preview:	.PNG........IHDR... ...!.......Yc...BPLTE....L2.L2.L2.L2.L2.L2.L2.L2..L2.L2.L2.L2.L2..L2.L2.L2....wW.cC..j.....tRNS..@..pP.....0..(.......IDAT8..... ....("j7..WW...h....]....4.8k...8..d.P'.a..7?b.+/.3v....a...\`u. ..>.k...;.)X(0H........0=..6XK...].v....rK..........{)?.;v...S?..Gu..].W.:.m...%.6..........p5....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Segment16.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	342
Entropy (8bit):	6.788223358005407
Encrypted:	false
SSDEEP:	6:6v/lhPfdoPUcGFYJE1nnnSMi6KDSBvmhERZsDbWw9zatElQtkc6D6ju9xFWcfmTv:6v/7CPU3iJE8d6zBvFRAbv93l3caiupu
MD5:	8A2986F6FE9D680650EA90E49BF8B335
SHA1:	A46F691FF0FC0F048F80CDBC6F02F2E8B52952C7
SHA-256:	9248587B486EDC341FF85FCB94A9519A3F467718752DC5923F9853808960CA47
SHA-512:	302E9AFDE47E5208572E1BA5283A061F0036D6C296A85C291AA6AB0921B20ED95D61292DFA924571C8BF40E09D1F08190DDEB7FA3829C88CEFCF645BD5B924E3
Malicious:	false
Preview:	.PNG........IHDR.............(-.S...WPLTE.....\|.e.c.`.c.c.c.c.c.c.c.c.d.c.c.a.e.c.b.d.d.d..n..q..i.e..h.d........tRNS.........f.3@.j2#.].xx..K.....IDAT..].... .D.R.j.{Am..;.R....dBF.f.20*....\|.).FH.xp....M.lk...u3.z........U.Q..^....e 0..Q..&zB>...T'KW.F..:.:....Qr..-...1..-..9.)N..j.^Q...oO.Z..8C.#.s.:....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Segment16Masked.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1754
Entropy (8bit):	6.013117737970307
Encrypted:	false
SSDEEP:	48:b/6164knA9WIPv/c0SiCJ3ObHJ3wHx85HMQ3:bSHknmWIPv/c1IbHmHxAD
MD5:	0DE21FEDDB8190CE34F37E8AC0152432
SHA1:	4D49060B7EDB259F9E5813EEC8F12638B1692AA4
SHA-256:	74C8180FF6E3BE310BCCA25CE43B9971FEDFA444A0839B4DB0B0FA4A280767E6
SHA-512:	2D838BBA3F1175FB382EE6D14F1058E417B767681B759AA5C2D8BD0DF6B174908EDCBC081D963AFDBD8D65FED8581D302DA08D95BCEA01B4605137DD7B151667
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-07T22:45:42-07:00" xmp:ModifyDate="2018-03-18T01:50:12-06:00" xmp:MetadataDate="2018-03-18T01:50:12-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:94807383-d4d0-4cfb-8d70-6bc0a69cd2e9" xmpMM:DocumentID="adobe:docid:photoshop:6902313f-6f94-d942-b140-2a04f4da66ee"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Segment_32x32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 32, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	234
Entropy (8bit):	5.9252939293801035
Encrypted:	false
SSDEEP:	6:6v/lhPf8nnnnnn4fK/lM4VaXu7RXC1mgOZbG/N7Lp:6v/7sxM4VkeREV7l
MD5:	A2004091CE9BB4B30BA2A2CE564CEFC9
SHA1:	CDCA30BEF020A228BD5A97E24C3D7303BDC6C417
SHA-256:	77703398A156885EA0792F658F20A7F839A7F9D5BF2FAE928DD43284AEA0CBE1
SHA-512:	08E10C48DF2507F5357F651F27E0CE6B89BD4AA7568836258A211420597741E51D28D6B634A475027ED749CDD87C8EA6AD6CB163D7B8CEB25BA5C652267ABF0F
Malicious:	false
Preview:	.PNG........IHDR... ... ......Tg.....PLTE....c.c.c.c.c.c.c.cA@......tRNS........9......vIDAT(.c......06cGG.H P..D....K I...@.....0C.......0=.t$........-P%.M`.....!.`.T...+.. . ..J.#...JZ....".t4..)..#q......F...{.....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\SelectTableRow_16x16.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	567
Entropy (8bit):	7.459501231794498
Encrypted:	false
SSDEEP:	12:6v/7AH1pLTYLCVrqfGRFTjMij0Ljeigqc6g2VO9WCkB1ng1Uzg5cT2:TTLTpceRFvMij+eigq6KBC14g562
MD5:	3E02AA6FF1DDEE4247DAAA7BB99A8E56
SHA1:	8B38C134DA573715EF4B10CFFD8023E63BFE1521
SHA-256:	D801891DC798C52C2EBF4600AB8CCB2E9BBAAC4F61CB1AE872616F8B8AA22C64
SHA-512:	0C1B02B1D1F4D7C02690739B00F15465402B10E21886309E099792A81E7EC3086C7CB1703435F7540260D8A632260DE7B183E61478204B2EBA1BF36E0A4F60EB
Malicious:	false
Preview:	.PNG........IHDR................a....tEXtTitle.SelectTableRow;Table;&.W.....IDATx^..?k.Q...OG....#..../..v6b.J...h.. Xh...l..C.`...$.Ac.A.!..y...{q......<.p.s..K...+..&.-.B..{O?,.:f.FB.B...^.....k.H...N.\|"..-..P.I........1..w.....PM".A.Wce.3CJ..0A.6..#S......0,..me_.&.R....w......B.........?......3.a.y<..J..?......W.A$w.`..y..U&.[.DS..Xuaq.9..y...:..yK.\u\|...o.q....Q...S...._..{.XT.v.2...p .t! .z)"....e...I...wI.....M.\|.I..&a......?.D1i.yd..t.`~.37...D..a..6...\h.a.R..W..D{....f.9.....<Z]._..D..D..I..\8'b..........r.s...`W.>.0.P....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Settings16.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 17, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	457
Entropy (8bit):	6.831150346968064
Encrypted:	false
SSDEEP:	12:6v/7KWp/XisYD7OPh8R9rihm6JA6lYHTMnC0BKVc:TcXEnOWRgJA6lYHT0CWKW
MD5:	07926D94FE5634C5BA7707F844B0999B
SHA1:	D85664CEB0AB160DB89E2B5FF622C95FCC788E53
SHA-256:	3BDBC2E878FA09B8C1278B3CCE0CE361CFE450ABB904FFE03B5C0FC7D6684E62
SHA-512:	E3F0E4E4F70E9D5A7C6D069B1C62F2013BB24DD04E636F6756046A38899E8C48330F091F0C4692C519E8B1158E0F93C58E7ED3C8BB2970979C633ABF4D8E468C
Malicious:	false
Preview:	.PNG........IHDR..............q......PLTE...@s.9z.:s.8z.9z.9y.8z.8z.9y.9z.8y.9z.9z.9z.8z.9y.9z.8z.8{.9z.8z.8z.7y.9y.9z.8z.9z.9y.9x.8z.9{.9z.8{.8{.:{.9z.8y.9{.;..;}.9z.:\|.<..=..C..B..>...M.....'tRNS....n.....#.........{r1..\LG..vjbR6...-....IDAT..E...1.D.'..;....d...;..<.t....#...x'.@.....d]WQ.\|^.Z..T...rU..D..{"......K...........Cv...bJ.^.!`id....Z...NN\|.H..)a..a......l...."s....n8L....gv...#....i{K.OU...m..N.e...oV0.^x.......J....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Table_32x32.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 64 x 52, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	671
Entropy (8bit):	7.55139668496343
Encrypted:	false
SSDEEP:	12:6v/70cW9xncrwoRbJnBSdXQMGLoPOdoO9bHCSutSA9M46pA0Bpx:B9NroRbJBoXtGMOOndtSA956pA0Tx
MD5:	210F9DEF9A71EDF64101C2A0B807A6C6
SHA1:	6AB63D95A5F22C25B5D51CFE00598A330DB0CEB4
SHA-256:	439012068479612B0A3745BB7EF91B84553E2EDD9FFEFE2B20886F7C2CF0AA28
SHA-512:	E035B6BEC2B14B64CF743DC409A27597444837C58AA86A66AD2F931B3F10612DE72ECEF515786390B1FE2AB1E78D0AD802513A8B925C7BFD26A843BE298F0095
Malicious:	false
Preview:	.PNG........IHDR...@...4.....M.......sRGB........YIDATh..Z;N.1...s..@...H..R.Pq.$N....h(.h(@J..-.Pp..j.B..6..'k.ca......\|.'......\.k....k....9..R.-!\|..F!...l..b\:.P"lLN...6.b..a...i...l.I...?6...M.iW.2.I....F..F...`.2..32c...V.V&....l...BW.....W$........=8..x.Vv..U..{!..........v..dZtu.k.P..$=9....v"..K..c.i.`tMv..Xt`j........]`;.)....w..mo`.I......U`...U...$v...p`..#.B.A..>.E&...&..] ..g..y@..........l.$...W.f.g..L.[.}.j/.aC<....4..X...\|5.....Bh....w..<q.H..O.P....\|6J...}.<l8........#....P*....7...._( ....u....,g....\|nx...~.G@5.B.TZ.@...{].uC..6...Nrb......j...R...R_..8....."...#f."Ec.."...i-..A.......PZ.......>.M..E....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\Thumbs.db (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	6.565276157607337
Encrypted:	false
SSDEEP:	384:2powxeodL7odDmo0SowCF4ogxbKqXod1UoCqTQ9agowpowSjH8owQNbodKowaow:Gow8odvodDmo0SowCF4oghKqXod1UopI
MD5:	8B4674B7F9B418E35288ADAB66147327
SHA1:	AF049C90DF7AB9575DC979D0DB818705B8B325D9
SHA-256:	DDCEDE41DD7BD3A4ABA7D26F1A2A7FBF021C640711CAD07513E713C66E208EEF
SHA-512:	96F855A396258AF1DB40A5BBEA5878339BE0D0949950263D919A448FDDD9E51CBDADD11EEAB9CE5EAF4FA27F86937C87FAE8EB9C59A8EC7786D0F97CF7716BE3
Malicious:	false
Preview:	......................>....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...........................................!......."...#...$...%.......................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\company.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 5, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	289
Entropy (8bit):	6.905693432240191
Encrypted:	false
SSDEEP:	6:6v/lhPatBllki8upqPO6sR2lTKeWHN5Ns+LXflHu6Mivdl2+uMnUbvGfsPbz+ODr:6v/7OX+i80qPObRxBNs6fdl2R+UPX+M7
MD5:	58ADBBD174D106C32180F0BD977311E3
SHA1:	94E2FAFBC260EAE38AD52A2A3829FE7BB9B69CB3
SHA-256:	6550B899E7A55F020372CB878AD63286C3BE1C579B45ABB653D927A6E547198E
SHA-512:	1132904A3D19939F25D80FF6B0A66F9FC17E88B5328CDC86C95291DA6EAA10A7B6F9DAB5E7544EBD8E212BD4B2FBE6373E116CACF624921EEFD8B9D1B6007CAE
Malicious:	false
Preview:	.PNG........IHDR.............L.lI....pHYs...m...m..\......IDAT..}.J.q.....(./..DdqI...l.....0.a. 3.,.. ... ,.M...6}..q....r8.9..'+.B....1z..A.j.....wA.j..9.xM.y..;...b.........a......AVm..."a..@'...W...'..K..s..B1~^..'J.U.}....../..7..w.^.XO.2......V0.x.2....D6.jg....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-09FJ8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 33, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2176
Entropy (8bit):	6.642134958832128
Encrypted:	false
SSDEEP:	48:90/6164knA9WIPZ/c0WUDCfn14Aa538aDHJ3WlHxFlDuMnzCWJ94:90SHknmWIPZ/QU2v1cHklHxFliQzCZ
MD5:	D4B6224AFAB311DFB77D92B44CCE175A
SHA1:	06D9EEA8D95AEEDA28EFFDBF79A9B29243807BA2
SHA-256:	E0530150EB93D986FC45F851806608EC6E31A73E39AAF3F6EFBE30A2986F7622
SHA-512:	06B44AD1D5D3A1C0234406F76F3BB852F4EB02C6E247290C4EA6BDFE84A73AE8320F2E7178E484F5F46AF05DCFD91B7BF3E6F63109F6DDF710EECE575005EF9E
Malicious:	false
Preview:	.PNG........IHDR... ...!......&.Q....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-16T17:14:05-06:00" xmp:ModifyDate="2018-03-20T15:36:02-06:00" xmp:MetadataDate="2018-03-20T15:36:02-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:59eb0d1b-49d8-408a-9190-0e95bebeb7ee" xmpMM:DocumentID="adobe:docid:photoshop:142fb08a-d244-6944-bc58-2bde2bc21fe7"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-0AD7Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 32, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	234
Entropy (8bit):	5.9252939293801035
Encrypted:	false
SSDEEP:	6:6v/lhPf8nnnnnn4fK/lM4VaXu7RXC1mgOZbG/N7Lp:6v/7sxM4VkeREV7l
MD5:	A2004091CE9BB4B30BA2A2CE564CEFC9
SHA1:	CDCA30BEF020A228BD5A97E24C3D7303BDC6C417
SHA-256:	77703398A156885EA0792F658F20A7F839A7F9D5BF2FAE928DD43284AEA0CBE1
SHA-512:	08E10C48DF2507F5357F651F27E0CE6B89BD4AA7568836258A211420597741E51D28D6B634A475027ED749CDD87C8EA6AD6CB163D7B8CEB25BA5C652267ABF0F
Malicious:	false
Preview:	.PNG........IHDR... ... ......Tg.....PLTE....c.c.c.c.c.c.c.cA@......tRNS........9......vIDAT(.c......06cGG.H P..D....K I...@.....0C.......0=.t$........-P%.M`.....!.`.T...+.. . ..J.#...JZ....".t4..)..#q......F...{.....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-1RE9S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 33, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	357
Entropy (8bit):	6.647866556630499
Encrypted:	false
SSDEEP:	6:6v/lhPa5x055555555555554WktPAP/BJQJiK+Jdsh1W2y8D9PW7JaBoYpq6awwx:6v/7/t/wJi1JyW2bmJoqzJx
MD5:	3273F609B6E7CC01BA15708F7D06AE8A
SHA1:	72F9D5DC3F298A4F3823086A96F8FCAFB967D09D
SHA-256:	F7FE09308889F7F7BE4EF6246534B6B92B84FC96D9612C218EA4939B1A3F39F8
SHA-512:	B9A689FF3943EEDE237C07E5097DA639AA1C0B3D6DD3E9B0ACE5AD0A6BF5D23759E98EF0BBDF6FED03EE07AA89B50BFB351F068EC308DDB8B51CFA961599E125
Malicious:	false
Preview:	.PNG........IHDR... ...!.......Yc...3PLTE...................................................\|..C....tRNS.@.....p.0...`P...G.....IDAT8..K.. .D....o.......tQ.....B6wb...#..&....a..K.IX..:..-...\Q....he...w..*....t.p^.f.H~k.......q...P.<.r....Ex........^....Pz..r.J(...<.P.@..!~..O.....5;.tt9Gs.....NUB.z1.U...y.0XO.v..kY..\n...z...['........IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-23EAC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	351
Entropy (8bit):	6.625026950484395
Encrypted:	false
SSDEEP:	6:6v/lhPfMcRg6raoxu8vDOopIefrCy854vHtK62Jr5D0SBSgi8v2E0Q4oXhp:6v/7365oxvrfeb6HtFwrG8JplXP
MD5:	07B7383C7FC9AEC7EE67FF9A7FF2231F
SHA1:	A579C86EB16277C229844DB5AB4AD34CF21F8808
SHA-256:	6A6D153B8B6A42590E8E9545F8815C044D0310A50649F2FB9ADFCA48A1894665
SHA-512:	DA644CAA67E315E9ACEEE48168B827589D3785641ED1B21809BF941335A966D48DA053065093F251C1431E23F7CBE6A95407731D1923A5047AEC0FBF0183D430
Malicious:	false
Preview:	.PNG........IHDR.............(-.S...fPLTE...K..N..N..N..N..M..N..M..N..N..O..N..N..M..K..Q..M..N..N..Q..M..N..N..N..N..N..N..O..N..S..P..U..R..".......tRNS......"....{OE>(..]X)....ol>*XCqE....IDAT..U....0.D)............h+.$s.....u..8.2...........""5.#.u,.I.I..$....j.L...$.....p[.)..%.=q..._y.X....E.^...Y?.3..`.%........E...@.[...,....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-23HB6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1892
Entropy (8bit):	6.292442732465406
Encrypted:	false
SSDEEP:	48:T22/6164knA9WIPV/c0SsE1Bx1SP31HJ3SsE1mHxTeTt2xMbTW+tu:y2SHknmWIPV/k1Bx1mHw1mHxutyCu
MD5:	DE8424D71291F615A56F9EEEE7AD7DB5
SHA1:	8D358587D07F709120C4878CA5CFD8423E418745
SHA-256:	730F79896D8D22B7A1C51C33F0D238EEA0653AA92C0E2AEAB87C5753894814C3
SHA-512:	2D826F61027172C3017294896305482BF12D7D13D65663890B103F479CC4B366959B9D34653C5EFDE0F68EB925ECECEFF650D9CBA5EDEC232C9E908D2300F0F5
Malicious:	false
Preview:	.PNG........IHDR..............,.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-16T17:14:05-06:00" xmp:ModifyDate="2018-03-18T02:18:52-06:00" xmp:MetadataDate="2018-03-18T02:18:52-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:06d10ddb-bcef-46e8-a437-4a47010ace32" xmpMM:DocumentID="adobe:docid:photoshop:162b1031-6618-6448-8d22-32a8d8dc0942"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-2LTQN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 17, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	287
Entropy (8bit):	6.620902485562652
Encrypted:	false
SSDEEP:	6:6v/lhPOtWp/yc10qrdxbvHirRWJFkrG5k5MVRJ90smgwClfftJyFKuSNOqFoup:6v/7KWp/ZprXziVWJ2GxysmgwAfVJW1w
MD5:	D7D994882D2AB71D7AEAF448383A3799
SHA1:	F4E258621CA08A1416B1FD13DDD2B29F92FB2B2E
SHA-256:	F6CCCA28A1CF39CE5FEB7D74F4560494DCA6F9FA6ACB17EF11939671E083CA27
SHA-512:	57CDC58790823E9092359027E00565350ADED90053F5743CA933F90D05FBDF5C464FAECB80D54AC3D17E4545A24014DF960BB6103766505BCD9ED8930A2FBEE6
Malicious:	false
Preview:	.PNG........IHDR..............q.....BPLTE...K..J..K.~K..K..K..K..K..L..I.zK..K..L..K.~J..L..J..K..L..O..N..1.U,....tRNS..G...#....ka@0:......zIDAT...I.. ..e6..3.....&.....S...tj..e[b\...#....}7L.2Aw!..?o.. iw&.X0.+A(.....A...g..F.[....`N.m2.:Kc..(.7g...t.......p...T>.....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-2ROFF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2105
Entropy (8bit):	6.60264355890893
Encrypted:	false
SSDEEP:	48:b/6164knA9WIPu/c0tL4MO3cMhHJ3sHx4qp6bxy:bSHknmWIPu/bYH+Hx3V
MD5:	931AA34215795E4D5A7F70AE95E3F018
SHA1:	12A3CBBF34429808630E185E2ABD2F58CEA53D35
SHA-256:	2B448D1DA5405CB20EAB8A7BC8D46EF7716573FCFFE5A39B12ADE9E2584E5E50
SHA-512:	A38C3E73D73548B8330BC793A7340B0073FB2A354C008D6C1306F7B99203796B2E53CD4DC8A98C2AD2DA62D44A227E5B516563BC59C8BE434AD540BD10B550C1
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-07T22:31:48-07:00" xmp:ModifyDate="2018-03-18T02:07:16-06:00" xmp:MetadataDate="2018-03-18T02:07:16-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:fb43030c-2066-4a80-966d-c83ee38f68fe" xmpMM:DocumentID="adobe:docid:photoshop:17884821-e4a0-484e-9854-56dfd9c8ee0e"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-4L2C3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1938
Entropy (8bit):	6.338971764650906
Encrypted:	false
SSDEEP:	48:T22/6164knA9WIP5/c0DsXu4KHj3+HdHJ3DFHx93tt+:y2SHknmWIP5/QuJHKHdH3Hx93z+
MD5:	5FFF83504DF13357423583E4BE8E41BA
SHA1:	65BB4AB5623DAD9C13B45BD3227D8A504C5FB87C
SHA-256:	6DFB45F35E153030CA07085F796E7E6249D5858441CF2C3F425674BDF2554836
SHA-512:	365D13339970A84AC571B6C747FA7B5D2D442BB8D1901689C3963C57641232CF865F8980C0AC1754341656DFD75859E72989E12AF522FD8DFEA97F0E04845FAB
Malicious:	false
Preview:	.PNG........IHDR..............,.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-16T17:14:05-06:00" xmp:ModifyDate="2018-03-18T02:20:35-06:00" xmp:MetadataDate="2018-03-18T02:20:35-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:0e1d0706-79c2-4a6b-ba26-a185ef6dc368" xmpMM:DocumentID="adobe:docid:photoshop:7f390c49-6d6a-1e46-a622-6f9430ab6cd7"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-5LC4V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	332
Entropy (8bit):	6.699639358665104
Encrypted:	false
SSDEEP:	6:6v/lhPfQ6KPTc6o6GVxuJKebHgKEUrEFzsuk6p0G1kv7UWkIpvmlNCVrXTp:6v/75iTc2Gi6Xsmp0XkIplJ
MD5:	F641190027531171FC02B1280E1CB5C3
SHA1:	5FF9C58D7C880C8715ADE58322A9DE36ECA89631
SHA-256:	9E0A06BC0C3A8C326DE7D1F93AAB00372063358BC4329873C94FE01D779CDA4C
SHA-512:	18984D452E824E10E5D5615587601F5875C6EBE77E337FFFF605A28B5D06B8AC3935CBBB8CADD73EBE87F39CFB84D7D7B4639C7F4E2C7CFD6F167CE9F85C4891
Malicious:	false
Preview:	.PNG........IHDR.............(-.S...ZPLTE...8~.9z.9z.9z.8z.9z.9z.9z.9z.8z.7x.8y.:y.8x.9z.8y.9z.4\|.9z.9z.8z.8z.=..:}.B..;..?..>..:\|..9 .....tRNS......K!.3.^@.\|h..22......IDAT..U.Y.. .D..f..t.$...Y@...ai.%[.......q=.Ag*B.W.{}:.T`...v.vk.R.,(&.m..K..E\.L.......s..-1.%E9:...".......}....h.".r.....).C.@f.....6i..f....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-5PTUQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1837
Entropy (8bit):	6.216679916294268
Encrypted:	false
SSDEEP:	48:T22/6164knA9WIPXp/c0Bum2sj3yLgHJ3BgHx3/wG:y2SHknmWIPXp/WLs2LgHUHxIG
MD5:	F258EE92116E3D3CB66BD45939D47A91
SHA1:	3A7DBE7D9FBA0BF2EE32F7E6BAF256F83CAED1E0
SHA-256:	C02A43192D3DDA23A92D3AE98D9C100C9314607069B0043C22FAA5E25DA6CED1
SHA-512:	A361348C09A951C227B8F15573497F9208A80C5236A7EC1E4BAE8DCB604E5FC779D40BC44D1286B5593F4E5CDEFEC802374D88B929461CC5DFBBC6C2C1791564
Malicious:	false
Preview:	.PNG........IHDR..............,.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-07T22:31:50-07:00" xmp:ModifyDate="2018-03-17T20:27:27-06:00" xmp:MetadataDate="2018-03-17T20:27:27-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:580a37b3-e87f-4654-8ba6-2bafd5c60e3b" xmpMM:DocumentID="adobe:docid:photoshop:6195fd05-1ab2-3149-9b0c-38f24c63e9e2"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-6FEFQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 17, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	457
Entropy (8bit):	6.831150346968064
Encrypted:	false
SSDEEP:	12:6v/7KWp/XisYD7OPh8R9rihm6JA6lYHTMnC0BKVc:TcXEnOWRgJA6lYHT0CWKW
MD5:	07926D94FE5634C5BA7707F844B0999B
SHA1:	D85664CEB0AB160DB89E2B5FF622C95FCC788E53
SHA-256:	3BDBC2E878FA09B8C1278B3CCE0CE361CFE450ABB904FFE03B5C0FC7D6684E62
SHA-512:	E3F0E4E4F70E9D5A7C6D069B1C62F2013BB24DD04E636F6756046A38899E8C48330F091F0C4692C519E8B1158E0F93C58E7ED3C8BB2970979C633ABF4D8E468C
Malicious:	false
Preview:	.PNG........IHDR..............q......PLTE...@s.9z.:s.8z.9z.9y.8z.8z.9y.9z.8y.9z.9z.9z.8z.9y.9z.8z.8{.9z.8z.8z.7y.9y.9z.8z.9z.9y.9x.8z.9{.9z.8{.8{.:{.9z.8y.9{.;..;}.9z.:\|.<..=..C..B..>...M.....'tRNS....n.....#.........{r1..\LG..vjbR6...-....IDAT..E...1.D.'..;....d...;..<.t....#...x'.@.....d]WQ.\|^.Z..T...rU..D..{"......K...........Cv...bJ.^.!`id....Z...NN\|.H..)a..a......l...."s....n8L....gv...#....i{K.OU...m..N.e...oV0.^x.......J....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-6IK5B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1264
Entropy (8bit):	7.748318960468759
Encrypted:	false
SSDEEP:	24:4un/9IXGgKJjKyZOwulvJeGQBjAk8NVJn9FbFF7KOTg:4u/uXGgKsyCeGgjAkEPbr2Wg
MD5:	2C7A231A7251BDA3EB75AFBD033DE93D
SHA1:	427F4C58F706AD5F1FE05CDE4A456B97268C3CAE
SHA-256:	DC2F827D5B6240506FEBE3AD6EECB3DC7912426E9A73AB11F114198E0BB0BCDC
SHA-512:	07CE449672E56B6DAF99AEBB2660E81CA377AB91771FD70A49F0A7D7B701DF507DDB752FE25E7447ACB8412EDE47FEB714A73FC62DA8E34CFBA7C07112671FB6
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....sBIT....\|.d.....IDATX..MLTW....y....Ea@Q..!&M.D:.`.61!M.6..vCHjh..1MLX.t.B...D.wu.....$M.b.m...A:..:..wO....:_...M.}...{.9....6.......U......h..{.....J.Ih.#K&.v.o...~......h%...QOC0..0.p..9../A(.......h.a"zFD...s'.....DT............A....D.%..;-....D.=.7......@@.....Z........sWum.h>........d..../`>{L...#?...c.).......K.N..D.........G&./..Dbq>7...W...h....Ei.)gZ..R..Tru%.J).'Qi.)g..Aa..d!.....h....t..........O.......@.=..x ...e..5..#.^.Is.4.G...p...j;{..A..K.w...~..[B..1.....Q.l.HT]..$!...G..fR..3.5W....h..4x7...../=y.:6........i...L....K.w....=Z...U ....V..Zt...N..P....K.4.......K...P.......kj.].Y.CV......nyx...{Nc......i4..5+..........(([2-25!X)+.WQ..".2.J..j..e3.......U.@.8q.....m..e...W...(.....n....".WQ..?...$..;.Y.Tz........@tv.x.s.1...`..D.G...^.l.lf6.=.. ...#.c...u.ze{.\.k..\]a...rmuK.*.;...Q....L,.....e..(9v.......U'..R........v..qe{.\..+..^...L...yG.....b""..k.#..,#.&3/.p{,#.&..........X)..a.{....

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-6KMLG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1809
Entropy (8bit):	6.121699074958754
Encrypted:	false
SSDEEP:	48:b/6164knA9WIPB/c0IxXi3+HJ3mHxmIBzb7:bSHknmWIPB/KxnHcHxHBzn
MD5:	41B75EA6BC156FC0BDBD55021C82D746
SHA1:	846DB02DEA007DC24A438372472907A3AC53FEF1
SHA-256:	DC3192375833257340AA60F90F7D86DDA89B2AEED87308DE2E0C57396788A5D4
SHA-512:	34BE2547D60B0514CADD7CD1C75B7A49635FF161AB73333A1E504F8BC6E4DB7E0CB5EB75740696FD0CCB935FD5213B583C13A7B2C0FEF49669A617316441FD1C
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-19T10:24:20-06:00" xmp:ModifyDate="2018-03-20T15:45:23-06:00" xmp:MetadataDate="2018-03-20T15:45:23-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:7eed3c55-c2c2-4ff2-afd2-d4449b40bfc2" xmpMM:DocumentID="adobe:docid:photoshop:a3ed23ba-5859-ea45-801c-b1f3cd76a776"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-7GSLN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1754
Entropy (8bit):	6.013117737970307
Encrypted:	false
SSDEEP:	48:b/6164knA9WIPv/c0SiCJ3ObHJ3wHx85HMQ3:bSHknmWIPv/c1IbHmHxAD
MD5:	0DE21FEDDB8190CE34F37E8AC0152432
SHA1:	4D49060B7EDB259F9E5813EEC8F12638B1692AA4
SHA-256:	74C8180FF6E3BE310BCCA25CE43B9971FEDFA444A0839B4DB0B0FA4A280767E6
SHA-512:	2D838BBA3F1175FB382EE6D14F1058E417B767681B759AA5C2D8BD0DF6B174908EDCBC081D963AFDBD8D65FED8581D302DA08D95BCEA01B4605137DD7B151667
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-07T22:45:42-07:00" xmp:ModifyDate="2018-03-18T01:50:12-06:00" xmp:MetadataDate="2018-03-18T01:50:12-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:94807383-d4d0-4cfb-8d70-6bc0a69cd2e9" xmpMM:DocumentID="adobe:docid:photoshop:6902313f-6f94-d942-b140-2a04f4da66ee"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-81E6B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 33, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	303
Entropy (8bit):	6.445579520514436
Encrypted:	false
SSDEEP:	3:yionv//thPl3dlw54m/v5/zzzzzzzzzzzzzmq89PFlVPVF0l2MoCkRc92JbGS/cp:6v/lhPa5xkq89PC4R5bFHbpi/w+G9lup
MD5:	85A61AAEC69B867808883A67B62DD627
SHA1:	7EAC339A2238C24B01D726DE61F6BF4012D82405
SHA-256:	D113B369AF616E9CF68F9526F787C1A62DDFDC3F2F98657801073AB4DC20E9D2
SHA-512:	4F8667EA629A286C21423E19AC834D8FD585CA2DA8DB3BC9842DE4C6A0F720BF7507CCB8BE04B2BAA5BFA0FCF6BBAEF4F18017DFD814C11467B6207147865603
Malicious:	false
Preview:	.PNG........IHDR... ...!.......Yc...3PLTE....L2.L2.L2.L2.L2.L2.L2.L2.L2.L2.L2.L2.L2.L2.L2.L2.......tRNS....P@.p....`0 ~yEc....IDAT8..... ..)U......XS'..=.^.6.....r.F.b..)Bw...\|.....=..R....;...d+...69.R.=............l-8.....=..C.\|....c.9K.._!X.z-.....w...M..........Z:)w.T.0....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-8C1JK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 33, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.668393357271831
Encrypted:	false
SSDEEP:	3:yionv//thPl3p1RbpmcHl6IddddddIaNSfvFS4N6xR0rhuU26291+B2ENZ6YnlVp:6v/lhPBKcF6Z6SfQ4b5I91BENLbp
MD5:	2F9E9FCF432F3AA39A5F83E39957C30C
SHA1:	8795F02CB3E3EBDAC27BEAADE63703F2DC125CAB
SHA-256:	2F6F007436D39FD18C2014D790928C9300FC7799FC9382CAF1C572A9F26DC704
SHA-512:	3FAC20FCD4F34DE85B2D2E5C0DD881F62AB198706AF4F59DB884BD0A30C44FA26E3ACF948444E485550058851195AFD7C2078C40EB5B2DEE9CDB602CF00064D2
Malicious:	false
Preview:	.PNG........IHDR... ...!.....J..b....PLTE...K..K..K..K..K..K..K..K..K..........tRNS..@.`.0 ........OIDAT(.c..........t...@..9.... . .8!,..(00P$.........P.(....%0YP.U`".EE.dc.0a`.......IK....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-8H59B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 32, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	225
Entropy (8bit):	5.814136933093717
Encrypted:	false
SSDEEP:	6:6v/lhPjcF6hps//SDRj/l7ZJXSglYiNMp:6v/7QF6h+CDt/fJLYV
MD5:	5D42D43ED875DDCF476EBE77F708A50B
SHA1:	D1A95AFAC93A357E2596B2AA217CA781D27EF56F
SHA-256:	3D8607B72889C8085E8A38285330EA7F885D3A782AB515595E7521E13542019B
SHA-512:	A6F71B28FDD9D57C60B684B9687129DF7AAEB4E788102B6A309E9F4EF4421283F91064C55EB592D31180CF49849A8462CBE2A30E7D9F513CCFBD21097943ACFE
Malicious:	false
Preview:	.PNG........IHDR... ... ......Tg....'PLTE...K..K..K..K..K..K..K..K..K..K..K..K...2OQ....tRNS.@... ...`0...L...]IDAT(.c..Q...Us.2....s...k$..3@p8.! s.....>`.c.....A(.II....P.....3(..H.`.........4.x`....@...;..........IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-C5EL6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	428
Entropy (8bit):	7.273961907217273
Encrypted:	false
SSDEEP:	12:6v/7gLrIJD1tMibLWYKCkvc0vF82rf+61Yk:fUJD1uYKFc0N82rf+6qk
MD5:	B7DB1680CDDCBDAFB762D04D59FFA4C2
SHA1:	5D2DE4F4DB06ADE007C9B5339D59B95D9FBDCDD9
SHA-256:	BA4473BA943477041699E577768EC8B948F6569DF6FABDE44B84EA70BC00D8CA
SHA-512:	D2623C8E5536D16C93EC31917BB986D455EE2455248348AF1E5C9BB2E1F9040D713F9F50BA4F250DFC2029F80DF1CAD96F6CD1CB5D7E738859F1C594203638A6
Malicious:	false
Preview:	.PNG........IHDR................a....sBIT....\|.d....cIDAT8....K.Q.........U.L&.d+k"(......._04.*.. .6.0.,........t.:.}.....{.}.(L%....s ....y..x.~ Y.UY.X...KZ.#?..{..df.&....Z.&.d.j..s......m........$...m.lWlw.=`.v.b...B..r.q.Bx..@9.G..y&#.@.yM.1....p.X......E..R..i....x........[./..m....18.:...R.......3.d..T..l70w..b.2.#.,.\|.8GA....}.[+!N..`.....U..W.&.5....^_...3.Lf.bz..P.N.Z...y"AG9?]...?N..........IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-COFCQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1725
Entropy (8bit):	5.96323308807406
Encrypted:	false
SSDEEP:	48:b/6164knA9WIPb/c09JJ/c3g3w3SHJ39VHxi2Ef:bSHknmWIPb/vJJ03J3SHbVHxD+
MD5:	C15E33ED3A97E3446036721223F997BC
SHA1:	458D51D0500A80289C53355A9EA0DEAA19227361
SHA-256:	5AFA187A626957CBCE41CB20E82A05A967AE7C38449BCA8E003325A8E2663E14
SHA-512:	7E37F10FD1B74E67194754C2E5D0F5FA7854C81436A72775014A4EEBE02B43B3FB63F140D70C7D11D6E16D612C4089B3775661CF4BB76E1D85189BCE3ABC5C17
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-07T22:45:42-07:00" xmp:ModifyDate="2018-03-17T23:45:31-06:00" xmp:MetadataDate="2018-03-17T23:45:31-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:33812ce5-32e4-4b87-8b1d-00946727b433" xmpMM:DocumentID="adobe:docid:photoshop:4e66e7f2-cf37-5741-9b39-5aadf4f933e1"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-DGOT9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1942
Entropy (8bit):	5.924389546553608
Encrypted:	false
SSDEEP:	48:b/6L64knA9WIP2/c0qtSE4MO3cMhHJ3sHV3qtXHxQ:bSJknmWIP2/wS9H+HwXHxQ
MD5:	5900DE6C90B8379C953A14AABA39C3A9
SHA1:	0A1E1FA34406CD84D8C0D95491D9F97F108277E4
SHA-256:	A7B9A9508A749E5C0274CE07DCB0213C8A64214B65566C1587F927445437D947
SHA-512:	8691E16BE93B19528036F009722339187A6ED57D1351D7F2F9A8D21740CF46FCC947ABBD6089D85AF3C77D766EDAF21465D70F58D833F41E1FBEB76F9029FDDA
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-07T22:31:48-07:00" xmp:ModifyDate="2018-03-18T02:07:49-06:00" xmp:MetadataDate="2018-03-18T02:07:49-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:e2a283f9-c3ac-4417-9db9-e102781a2851" xmpMM:DocumentID="adobe:docid:photoshop:e5cf27cc-61d0-144c-a709-98f6e4b1ff20"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-EP5VO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	342
Entropy (8bit):	6.788223358005407
Encrypted:	false
SSDEEP:	6:6v/lhPfdoPUcGFYJE1nnnSMi6KDSBvmhERZsDbWw9zatElQtkc6D6ju9xFWcfmTv:6v/7CPU3iJE8d6zBvFRAbv93l3caiupu
MD5:	8A2986F6FE9D680650EA90E49BF8B335
SHA1:	A46F691FF0FC0F048F80CDBC6F02F2E8B52952C7
SHA-256:	9248587B486EDC341FF85FCB94A9519A3F467718752DC5923F9853808960CA47
SHA-512:	302E9AFDE47E5208572E1BA5283A061F0036D6C296A85C291AA6AB0921B20ED95D61292DFA924571C8BF40E09D1F08190DDEB7FA3829C88CEFCF645BD5B924E3
Malicious:	false
Preview:	.PNG........IHDR.............(-.S...WPLTE.....\|.e.c.`.c.c.c.c.c.c.c.c.d.c.c.a.e.c.b.d.d.d..n..q..i.e..h.d........tRNS.........f.3@.j2#.].xx..K.....IDAT..].... .D.R.j.{Am..;.R....dBF.f.20*....\|.).FH.xp....M.lk...u3.z........U.Q..^....e 0..Q..&zB>...T'KW.F..:.:....Qr..-...1..-..9.)N..j.^Q...oO.Z..8C.#.s.:....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-F1PAJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 32, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	361
Entropy (8bit):	7.019587217873892
Encrypted:	false
SSDEEP:	6:6v/lhPkme0Lrv0XIWssnxexLBFSBD0XQkGgLeF0m6pTFUhDx2QdThuzgzqmJLup:6v/7sme0LD10kx1FUKOlZsZWx2Qug+my
MD5:	5C5C8465E6A63D4F5516CE82CA7AE1AB
SHA1:	BE36712A6B82D23F2267B85DF1F6A9D465E991AE
SHA-256:	4EF16AEF80CF993404BD9C7A2F76892C57CC9114F5693AD9F3377B01424B14CB
SHA-512:	E97B6E27D4927416233AFA4F421D173C570453869C6D5D5877CDDC73A7BB7E09C16FA4643CB859D3C251026A89487413380514C6A2F7B95B04D090FC8015CB36
Malicious:	false
Preview:	.PNG........IHDR... ... .....D......lPLTE...stwxy\|qruqrvyy}pqt...mormid....m..........\|x$x..s....s........@~.2\|...~sok..........h...........tz.....Al.....tRNS.......o,......IDAT8...I..0.DQT0.4...}..=...OH#.oZ...f.s.U2.\.q\|...f.....". B.". ...E....>..?..y..........C.\[....*..d......9......_1.........8.v....sL.7......._..?A....5w.Gsz......L......IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-FMOH8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2097
Entropy (8bit):	6.227400451608429
Encrypted:	false
SSDEEP:	48:T22/6L64knA9WIPF/c0ktAa538aDHJ3WlHV3jHxDMeTt2xMbTW+tu:y2SJknmWIPF/abHklHJHxXtyCu
MD5:	59008E3B6E4A0C9EEC2812FA7EDF0B8A
SHA1:	859E25BDC3969044B78B293B593599C7D49D9D37
SHA-256:	D0547E37FDEDD5029D347CB5C90B5A779F9CFF0D08A3FC3D2BCFD87F29F00372
SHA-512:	B0BA08C788557C44EE2534D8893EF4EF4B1CC149481637E8E068B98373AF58397B71D64251F29D20FF42B94C2122FB4E52997562B91EEA1660AB7B8FC8F98312
Malicious:	false
Preview:	.PNG........IHDR..............,.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-16T17:14:05-06:00" xmp:ModifyDate="2018-03-20T15:38:06-06:00" xmp:MetadataDate="2018-03-20T15:38:06-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:12aff1cf-8efb-47e0-a057-6e0bd853fda2" xmpMM:DocumentID="adobe:docid:photoshop:88761de1-2940-4143-9745-9d6ae13ac782"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-H7A9E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	401
Entropy (8bit):	7.230676165412484
Encrypted:	false
SSDEEP:	12:6v/7iYAio3qQ/c/RqxccA8Lhh3ckYuYBD76uD:2y3m5FUCk5O+uD
MD5:	153FDB70B5A69ABF06E9F4758E4A7F4D
SHA1:	C25756D6D4F354242C310B4454F5B14DCF46E1EE
SHA-256:	D3A81318EB5960CE7FD22FF374BCEA10440249E17F257A5A306CA2677B807BA7
SHA-512:	965AF4651FB05231942279D75C51882117639432B1C3CE1D56F4C020762A762FF0AFC2479855B71F4D5D2315DB97143CBC0D96A5F35FD94057BC5011F226E043
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....pHYs...%...%......CIDATX...M.0...E.....}S.......q.@.....:.....(a.>.Er$....V...Kbg4.2.....cN\.j....(m+.@W.y..H. .?.....3..@.....8%......g%0...w.0&....{....'.B....B\|...B@i.......-.}A....o.S.>.....".....}x.zar..)nD.U...R......q6...(....!..J..}..@........$=..9.r....p../..H..Z........m....X..B`.a..}.....n....1[..P2.r..}.zC.un"..c..\|._..5.s....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-HB3TI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1792
Entropy (8bit):	6.095121493546184
Encrypted:	false
SSDEEP:	48:T22/6164knA9WIPFU2/c0ukuPN3bXHJ3rYHxNpA3YG:y2SHknmWIPh/YkSHGHxLA3YG
MD5:	CA790A9DC95904856F5D196FD74BF859
SHA1:	BF0879C506B753527F61FEAEBDBD6DBA6BD59E1C
SHA-256:	67FC4B33BE3793AF869BCCA522F41DD5BC1D8B6D7BD4399AE27312BE6F273BA4
SHA-512:	C7BB47207A61BCD55BDA523E55F696C62E390DE5F3B17FD6C3F031D8C96F9B55EBFC53C0EECFCCFC9C57E69CCA9AC025C73E1653ED6F9B3B448D787753C6C1A2
Malicious:	false
Preview:	.PNG........IHDR..............,.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-07T22:45:42-07:00" xmp:ModifyDate="2018-03-17T20:35:10-06:00" xmp:MetadataDate="2018-03-17T20:35:10-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:bd996b5c-b3a8-4c1f-8e80-21c55c28c1d7" xmpMM:DocumentID="adobe:docid:photoshop:1e3a3057-8645-1b47-9d2f-356e5665ec2a"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-HLJRS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1904
Entropy (8bit):	6.298460953131784
Encrypted:	false
SSDEEP:	48:T22/6164knA9WIPH/c0WWSFM3UHJ3WdHxX6FXuEI:y2SHknmWIPH/hS9HKHxZ
MD5:	16A9CBA7DEA487EB54C2D16DEE54B038
SHA1:	4878397AD1E949B618B1CB8C2CEB88C971966B73
SHA-256:	ED66DCF1920160D069C5F5CE45661BB66DEC4471281B6DB41CBBA82B8D6BD2FF
SHA-512:	6CAC51B6AD8413E8C3507DCCCA6F632FDFA992F19013962286B255C068726A3475DD153CB2B5423509E72474DFD2A62B7A3E1159B562C0A286C6972D79585DAE
Malicious:	false
Preview:	.PNG........IHDR..............,.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-07T22:45:44-07:00" xmp:ModifyDate="2018-03-17T20:36:37-06:00" xmp:MetadataDate="2018-03-17T20:36:37-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:aed13df8-a84e-4202-9161-f1326676e901" xmpMM:DocumentID="adobe:docid:photoshop:1b23bebd-447b-2a42-8eab-11da176d059a"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-I31K1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 33, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	303
Entropy (8bit):	6.438978860448429
Encrypted:	false
SSDEEP:	6:6v/lhPa5xcF6ZOvk9PC4R5bFHbpi/w+G9lup:6v/73F6ZvjNfHc
MD5:	E5A5891A6F8614EFC31B26CEB19B8CE1
SHA1:	90BB1EFA5185F5A57A204F2BE460871DBE7956D7
SHA-256:	A8055E15253AB262D74DF54A566847FB5841E2425749D6524A220CC7BDB78878
SHA-512:	8A11DCD113E15D806B5C9FAABCE5B73A441C8C464544C2DE831706D7B22A2423F0A013A6A746BC0A10DDB66C1889BCA67E761412898769B2553292B4337F78AB
Malicious:	false
Preview:	.PNG........IHDR... ...!.......Yc...3PLTE...K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K....<....tRNS....P@.p....`0 ~yEc....IDAT8..... ..)U......XS'..=.^.6.....r.F.b..)Bw...\|.....=..R....;...d+...69.R.=............l-8.....=..C.\|....c.9K.._!X.z-.....w...M..........Z:)w.T.0....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-J0RFM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	270
Entropy (8bit):	6.824705215319485
Encrypted:	false
SSDEEP:	6:6v/lhP+HHo9jR4YniL+nQWaoYu3j87Wu5p7mqa4cvPkTcLllbp:6v/7GHHolRiKnQWP8Su5pivkTcRz
MD5:	66E61D0BFB0031EA35DA64720DD43144
SHA1:	3A9224F74A99A3F5C64D839EC184B2B5A8ACA1A7
SHA-256:	3633580FCF62062FE869BB4B9C6BA1BFBF33898F44AE25A85B3039604A99AA24
SHA-512:	F375326119417D37DAF40179742629317F00960D17DCEF57920CACDCF92F2166EE4B3F039509713D5AEE4FC163624F2D21202B17AB27E5B4529252FD56C4A916
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs.........{:.d....IDAT8......0.D..t.F`.....R6....l.#0BG....r.4Ji....D......-Q.o...K.....suf...tp.8n.........g...M.Xp0U=J:.qp..p-u.c..;.^w i....D3k..........!^E.@.#..?L.M....".5....w.ZOwd....2..7....].($..c.A..y.C....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-J8R2D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	280
Entropy (8bit):	6.85991143715917
Encrypted:	false
SSDEEP:	6:6v/lhP+HHW9jU6VjjxGgCfwWfh3h/bUETinAhZqKXUz00bhB0bG+csGAljp:6v/7GHHWlUKHxGgWw8bUETU8qKXUzie8
MD5:	3301C6FAA433D187D4C21930B5B721D6
SHA1:	2C6BB14BE180A7F74A6FCD08161D58A2394FB5D1
SHA-256:	9B5BDD7D665FD1B8B955F6151D624BBF63C94260E64F7FBCEFD3C8833E8D2423
SHA-512:	5F1521F5EBE8F797685689424A0A7A9CE814B85D090338280F12979DAD2923C8E6A7E9EA9FC130ACFED70B5EB702EE0BE24D17A66777917886552CEAE4869400
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs.........{:.d....IDAT8......0.E_PR.....2B.H.7..8.n..l.#d.....#Kgd,B".......e.9.D..-.].=P&..5...N.....t..U.g.\|..[B6ir....Axu....F..`..,%.m..v"<O.l.Q..8kTV4.J;........(......5..?.i..UK...........H....*p.B.C..0.....x..$9X........IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-JDFT0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 64 x 52, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	671
Entropy (8bit):	7.55139668496343
Encrypted:	false
SSDEEP:	12:6v/70cW9xncrwoRbJnBSdXQMGLoPOdoO9bHCSutSA9M46pA0Bpx:B9NroRbJBoXtGMOOndtSA956pA0Tx
MD5:	210F9DEF9A71EDF64101C2A0B807A6C6
SHA1:	6AB63D95A5F22C25B5D51CFE00598A330DB0CEB4
SHA-256:	439012068479612B0A3745BB7EF91B84553E2EDD9FFEFE2B20886F7C2CF0AA28
SHA-512:	E035B6BEC2B14B64CF743DC409A27597444837C58AA86A66AD2F931B3F10612DE72ECEF515786390B1FE2AB1E78D0AD802513A8B925C7BFD26A843BE298F0095
Malicious:	false
Preview:	.PNG........IHDR...@...4.....M.......sRGB........YIDATh..Z;N.1...s..@...H..R.Pq.$N....h(.h(@J..-.Pp..j.B..6..'k.ca......\|.'......\.k....k....9..R.-!\|..F!...l..b\:.P"lLN...6.b..a...i...l.I...?6...M.iW.2.I....F..F...`.2..32c...V.V&....l...BW.....W$........=8..x.Vv..U..{!..........v..dZtu.k.P..$=9....v"..K..c.i.`tMv..Xt`j........]`;.)....w..mo`.I......U`...U...$v...p`..#.B.A..>.E&...&..] ..g..y@..........l.$...W.f.g..L.[.}.j/.aC<....4..X...\|5.....Bh....w..<q.H..O.P....\|6J...}.<l8........#....P*....7...._( ....u....,g....\|nx...~.G@5.B.TZ.@...{].uC..6...Nrb......j...R...R_..8....."...#f."Ec.."...i-..A.......PZ.......>.M..E....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-KC6JP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	563
Entropy (8bit):	7.473071049560961
Encrypted:	false
SSDEEP:	12:6v/7iif1wp/hlpyIOo8+gjOKoSD0ZrtTK0FEMezjIFG4v+Ttx:e1wnmIFlgjboS4ZxT5CjIo1z
MD5:	B44D529BDB5CE238511437CE35851A25
SHA1:	94CF76EE815F53193FDA96FA44181C61475BD084
SHA-256:	502FC15C5091BE285CBC8383BF9A372E7CC8B2125313BD9169B4B13C0DF20996
SHA-512:	A714E457E745218D835BEA5721B83569FB0380354D789272460D9B8AEAEB8C7267643E7F75B9F10F4AD642DCECEC4FFD679F926F1D4420A25EE5C946CC447659
Malicious:	false
Preview:	.PNG........IHDR................a....sBIT....\|.d.....IDAT8....k.Q.....l..P.B...4.n..tr..:X..I...3.. ..pj!.!t..n.1k<..`%....}..C..$....\|......M...l.............a..~....g..>..;"2f..%.=0...FC..L....@D...sa.2. .l.@+.Fz.Vx@. \|...\....$Y"@J.yis;\..e..........Z5rX.....0..r.d.RUz....:Jfum.......T....Hq.^.8?.u]G.@...o.j...:.8?...D..@+.0h5...K.....J......Y{...xX\.)....A..M..\h........'...4...Zv..r..M..].~[.8...JU...p4h5..0.>......~$....p*...U....;..Kc.....Fi...........7.&<C.......!.l3so&...l...tK....y.._..........w..._.M..E.....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-L53NE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	567
Entropy (8bit):	7.459501231794498
Encrypted:	false
SSDEEP:	12:6v/7AH1pLTYLCVrqfGRFTjMij0Ljeigqc6g2VO9WCkB1ng1Uzg5cT2:TTLTpceRFvMij+eigq6KBC14g562
MD5:	3E02AA6FF1DDEE4247DAAA7BB99A8E56
SHA1:	8B38C134DA573715EF4B10CFFD8023E63BFE1521
SHA-256:	D801891DC798C52C2EBF4600AB8CCB2E9BBAAC4F61CB1AE872616F8B8AA22C64
SHA-512:	0C1B02B1D1F4D7C02690739B00F15465402B10E21886309E099792A81E7EC3086C7CB1703435F7540260D8A632260DE7B183E61478204B2EBA1BF36E0A4F60EB
Malicious:	false
Preview:	.PNG........IHDR................a....tEXtTitle.SelectTableRow;Table;&.W.....IDATx^..?k.Q...OG....#..../..v6b.J...h.. Xh...l..C.`...$.Ac.A.!..y...{q......<.p.s..K...+..&.-.B..{O?,.:f.FB.B...^.....k.H...N.\|"..-..P.I........1..w.....PM".A.Wce.3CJ..0A.6..#S......0,..me_.&.R....w......B.........?......3.a.y<..J..?......W.A$w.`..y..U&.[.DS..Xuaq.9..y...:..yK.\u\|...o.q....Q...S...._..{.XT.v.2...p .t! .z)"....e...I...wI.....M.\|.I..&a......?.D1i.yd..t.`~.37...D..a..6...\h.a.R..W..D{....f.9.....<Z]._..D..D..I..\8'b..........r.s...`W.>.0.P....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-LGTHJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	321
Entropy (8bit):	6.637815540440772
Encrypted:	false
SSDEEP:	6:6v/lhPfdq7P3lDugQbMRpsNvMQfwFDfvxiJ/LaSUT4ILTscSN65nqVJo7ZgWtljp:6v/703lDlOMRpab4RvmFHwnqVJo99
MD5:	664765B9044D8808CFDB44F6429085F7
SHA1:	87E6AACAA9271FB39341672AD84BA7E555123D51
SHA-256:	70EABE6BAF081337B71437113B5E98BC00CA2EFD73F7A155BBEA025A6C3E7D3C
SHA-512:	5F6BB28E0E406CD968495388021E981F720B355660B234042E968DFACB072FE4D5B35B6675E3F0D3078C67248BA8C71B2FA6D370E4232652F74FBC0F680E4A3B
Malicious:	false
Preview:	.PNG........IHDR.............(-.S...WPLTE...J..J.~P.qK..K.~K..J..J..H..L..J..J..L..J..K..L..J..L..L.~L..I..K..Q..P..L..R..X..N..4..A....tRNS.....{.H&....@/..N.oa.x+......IDAT...I.. .E.O'=j..1._gJL.1..0.......r.F1@q."MB.;.].Z.~.l.].d.Y6.v.I....t......].4~...h...\.c&.1:.M\|......}F.0..Hi....}..X..'.....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-M52N4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1876
Entropy (8bit):	6.263164842550989
Encrypted:	false
SSDEEP:	48:b/6164knA9WIPv/c0lVWGYJ3EbHJ3XHxc+szot:bSHknmWIPv/rA+H1Hxc+Qot
MD5:	C95787BA8873B1BD891BA9FF9E49F661
SHA1:	0CC76240D24254A7433932384B5D31A1356D18E9
SHA-256:	1094801DC0733B0A2FE73CA1904E3031A81BD48538FDE2C6B36DA79555F02BB8
SHA-512:	BE3C0F42B6B39B7AC5C64832B73F0609633684B83ADD4E631C498828A6580690B782F403337F2A0480D693D9142ED41E568A3956A9BF89766F0EF2824F85ADB4
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-07T22:45:42-07:00" xmp:ModifyDate="2018-03-17T20:31:24-06:00" xmp:MetadataDate="2018-03-17T20:31:24-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:72b218eb-3f71-4352-a1a8-8ba26cafe6bf" xmpMM:DocumentID="adobe:docid:photoshop:bc5e16d2-774f-904d-b3b4-1e112485ea6e"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-MGI5L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 33, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	194
Entropy (8bit):	5.750074522946211
Encrypted:	false
SSDEEP:	3:yionv//thPl3p1Rgpm/V5tx5BGwSbYG/obS+H/MY8xxiVakZFph/nDbZm41g4gnH:6v/lhPByIjfnEYfSuEOrh/nDbZZgnOOp
MD5:	8136EE7D96B387E8BFECDE59F5315C64
SHA1:	E69ABCB38FDE3838CB99EF3F5A0162E8B7D06EB5
SHA-256:	281F7350686683425821A0AE1046A3AD7C641EE17C17B5D35C5F96032C89EFE7
SHA-512:	7899371F319B4E4796D9B2026F3530FC891164EE3C777D526DBC704FF431351B22EB1B1DE778F53D834BAE93106B859F657D84D21144072B7B95A99B92A9CA14
Malicious:	false
Preview:	.PNG........IHDR... ...!.....J..b...'PLTE....c.w-.w-.w-.w-.w-.w-.c.c.w-.c.w-.v.#....tRNS.@@...........L...?IDAT(.c .0........ 8.$r.......R.......A.8.M@....v..Q.................x.....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-MGQDK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 17, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	402
Entropy (8bit):	6.726116681992308
Encrypted:	false
SSDEEP:	12:6v/7KWp/IWc5LHkBRMIHg/W8l5iDDp8MuN/2qpEmE:TcIFLuRLgO8lYDKvN/2qpEmE
MD5:	155B5079B1FF000689E919663170A0A7
SHA1:	240C2E70CC6B170CBD3B68672758EFDAEE6FA70A
SHA-256:	E0EFD47EA00494B084AF462852387CB26178562A502F5FDFE0A7CC3B24E418BB
SHA-512:	7F3D4B70692F4C2E85ECDE3CCABB889B90677E8E5C9473837D04361B7F85841B6FE5735CF0DF190275699A917C0F71CCD65DF3052208F8FB73095CB6175F88E1
Malicious:	false
Preview:	.PNG........IHDR..............q.....xPLTE...4y.>}.<y.<y.<y.<y.<y.<z.<y.<y.<y.=z.8t.<y.<y.<y.<y.>w.<y.<x.<y.<y.;y.;x.:z.<y.;y.<y.={.=w.;y.=z.;{.=}.A..<z.?..C..A..3....."tRNS.......)......g....o`.$.SKJG8..z.....IDAT..M....0..1.8.;C...... ..?.*...=.=.Jw c.U.IB....\|t...c..,^.....0.k...e.19d....Wy'.b..&...I.{...Z..i..ttw..y........r.l.M7....V..Q...p0.....;Q.....8'..............IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-MIOV4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	6.565276157607337
Encrypted:	false
SSDEEP:	384:2powxeodL7odDmo0SowCF4ogxbKqXod1UoCqTQ9agowpowSjH8owQNbodKowaow:Gow8odvodDmo0SowCF4oghKqXod1UopI
MD5:	8B4674B7F9B418E35288ADAB66147327
SHA1:	AF049C90DF7AB9575DC979D0DB818705B8B325D9
SHA-256:	DDCEDE41DD7BD3A4ABA7D26F1A2A7FBF021C640711CAD07513E713C66E208EEF
SHA-512:	96F855A396258AF1DB40A5BBEA5878339BE0D0949950263D919A448FDDD9E51CBDADD11EEAB9CE5EAF4FA27F86937C87FAE8EB9C59A8EC7786D0F97CF7716BE3
Malicious:	false
Preview:	......................>....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...........................................!......."...#...$...%.......................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-NIO2T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1295
Entropy (8bit):	7.770723010238438
Encrypted:	false
SSDEEP:	24:cgbS/FeOKZV7/TH3XeL7zG6CipXTOa9qB3zbAZUIXmMhF37DFl:cg20OKfrXeL7zGipaaozbiUIXmMhVL
MD5:	447D203EEE1553439D5ACE2D2F641326
SHA1:	75CE7C02548AF63A08212D1E37E2624D92128B0F
SHA-256:	650A137615E1ED8062DA8104B82C21D860FA5523FF6AD5266F14FA90ADCDD20E
SHA-512:	2E9AB585EF1FC91FB97054098CB03EF9393B0B6ED095BA7B01C8C18E015236E2BE488F4EB36AC032FAB2C3BD3996A6B705E93908EC4EEB1DE59957DCE074FEFA
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....sBIT....\|.d.....IDATX...O.W..?.i.... EZ`S.,0.!.'QY.6.$.....,.op.g...s..fq.%cB............v.5..Z...s.....T1;/.<..9..}.........O..o]%vg&...0M.$bq........t.......@..kE.=O...j...m.<....i..b..T....N. .D.FD2.S.@D2D..`...m.nx...!..o}%.......~.H. G.+^.....L../Z\|...;..l..`.9W. p..A........E.,U..qKr...s....+..u.z.........I./.O...o].G.Wf..'".O...`..;...c.n.69e/Q......=.."..D........]...".%U....j...'.K.Q.........is..H.w.............(mZ...p\|...H!~M..N.1.V.HNI.A..l..f......l./.`....g./.i.;..=#..k.....e8s....^I....f<.K..>Um..0Dd...<P.....=...g.P.`<...N.&....=3\.......YG...: ...'...;...t$wNz......../#"....+"$...G.!2s..!....2n....M..g.7...\|..Y..n.E......=i.(.....p9....&A..,....(.....T.....M.14m.A..<..P...e..ILFCn_..x....<U~.....T......h.S...N.........zT..:...v;..../l....KA....lN.@D...gS..Cxp....3\..77.T.....N..'.E.m...r.5.V!S....k...v......zHQ3...p9.2.]."..x.z(....c.....86...."R*.q..i.q..s:1\|g.....:ua.jDU[Q.a.^x_..g.o\i...

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-NOMOR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1797
Entropy (8bit):	6.118552677990541
Encrypted:	false
SSDEEP:	48:b/6164knA9WIP7/c0+7wM4Cj3EHJ3+BxHxkzQU6C:bSHknmWIP7/wVgHOxHxkzQU6C
MD5:	2D097363E8063DC242BD9D471BB6E47F
SHA1:	89338A735FD6247D3F400316E94F253511935D84
SHA-256:	990B51E86B5D462A9EBFBA23443DE5D14FE873BC60C6BD9E5059C3074E58C61C
SHA-512:	499E22642B494C8E07E662DD8B96FF4C1D2417F286391CB3F1FDA80DDB374A9AE8EE7EF5F5799A87D4080821AF379DD53AE7073FB873A379063106C347C3CD81
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-07T22:45:42-07:00" xmp:ModifyDate="2018-03-17T20:33:59-06:00" xmp:MetadataDate="2018-03-17T20:33:59-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:c89fcff2-65f7-402d-9f63-1a5fe4a96b3b" xmpMM:DocumentID="adobe:docid:photoshop:622488e6-6ee7-f546-a057-5661f4a78c37"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-ON7P7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 5, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	289
Entropy (8bit):	6.905693432240191
Encrypted:	false
SSDEEP:	6:6v/lhPatBllki8upqPO6sR2lTKeWHN5Ns+LXflHu6Mivdl2+uMnUbvGfsPbz+ODr:6v/7OX+i80qPObRxBNs6fdl2R+UPX+M7
MD5:	58ADBBD174D106C32180F0BD977311E3
SHA1:	94E2FAFBC260EAE38AD52A2A3829FE7BB9B69CB3
SHA-256:	6550B899E7A55F020372CB878AD63286C3BE1C579B45ABB653D927A6E547198E
SHA-512:	1132904A3D19939F25D80FF6B0A66F9FC17E88B5328CDC86C95291DA6EAA10A7B6F9DAB5E7544EBD8E212BD4B2FBE6373E116CACF624921EEFD8B9D1B6007CAE
Malicious:	false
Preview:	.PNG........IHDR.............L.lI....pHYs...m...m..\......IDAT..}.J.q.....(./..DdqI...l.....0.a. 3.,.. ... ,.M...6}..q....r8.9..'+.B....1z..A.j.....wA.j..9.xM.y..;...b.........a......AVm..."a..@'...W...'..K..s..B1~^..'J.U.}....../..7..w.^.XO.2......V0.x.2....D6.jg....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-PIEC6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 32, 4-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.954320523250208
Encrypted:	false
SSDEEP:	3:yionv//thPl3SOX/GfTtYYYYYb3SRbsic/bQfrW4Zll/sOPgRsgIyjspfgTnFpJ6:6v/lhPfuUCtsiCEDW4bl/s2ayyBdYVp
MD5:	A036D4683E99337966144F42CF49FEE3
SHA1:	70B964BC50C2953C5E5A319D2EE9F7ECFCAA2DDB
SHA-256:	922EBE9F5C2DDF6479189FAE4BE8008868A93DAA49CA38AC18826A1B244565A2
SHA-512:	5BF9B8282AB72213C3879469B46A4B0CA164489F4F4C0721082DE61B44765B1F71D56F78A8B072AA472F9FECD6D7BA9EF28D0C7C43E1CE287AFD8632782C4BD6
Malicious:	false
Preview:	.PNG........IHDR... ... ......Tg.....PLTE...9z.9z.9z.9z.9z.9z.9z.9z.EO\F....tRNS.....`.)=.....gIDAT(.c......T.`.h.@.F.....FAA...6 ......4.H..........h4...C..a..0y4...E...CA(....$.......@.$..(hx....J....$....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-S81C1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 32, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	317
Entropy (8bit):	6.469720428177924
Encrypted:	false
SSDEEP:	6:6v/lhPkdHLENWT7StLzzu5s4pc+AB3u2FbPZym7fvSp:6v/7s5LBgR4SzB3u+97fvY
MD5:	4E1D61CC18B8C86B6C21BCC12E37F3B4
SHA1:	DEA5EC41836C6B9663D9A2EA930CF9B02174CEC9
SHA-256:	AEE86801ADB09FF1E063A56A824F4C1BBF39EE044AAF8010F9D0B7E30D06191B
SHA-512:	C6BA961AB1F43C38FDB231779DC10F8950E37C5D0E1FD2F36548BCBF2381E8F4D27681F005C9B2463808BF9809860171F4133D053B4096C5574B9A47C1B4EB76
Malicious:	false
Preview:	.PNG........IHDR... ... .....D......3PLTE...N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..g..$....tRNS....0.@.`...p. PS.......IDAT8..... .DI!......:LDah....-,... ...A..............g.e.....2.....'C.R;.~..$..'.\'..K..e.<.\.{..p.IC\|...q;q1..aT.[......`..h......j.T..=..6..........i..N...@..G..^<....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-T2QPE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 33, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.382414384983311
Encrypted:	false
SSDEEP:	24:zlJ2H9Y3dVZyWVFYlhLGlvJk4QcWG0oJWYX:zCH9Y3zZyeIIlvm4Tl5WYX
MD5:	46FA64009564864B3D28F0143927F126
SHA1:	677F6D6D4BE20D35E3F4CC8610807815348DC549
SHA-256:	4BCA838D909BED2802C91424D9FD33529FFCA7ACF063BB3F7B95979353D3026E
SHA-512:	E35752A18D7F59FB3AF7D392DF8BD073E94A0516C1144B2B25EC8542269EF198655934155410403C3214285772B5182DD3B6D140F07436D25B610C37FDDF14AB
Malicious:	false
Preview:	.PNG........IHDR... ...!.......Yc....PLTE......;z.M..M..;z.h.....wvz..............nor...;z....;z.;z.f.....M..M........;z....;z.M..Ut........opt........................}}.........;z.......\|{....;z...............nor......Kx..............M.....M.................nor;z.........}.....h..Z..r.............................FtRNS.p....=.........@........h@00 ..........................pppdLL@@<0.......xIDAT8...S.0...Z-U...lp...%.% .....3\|/.........z.\.R.0.`..d....y.H..{.\=f..h4......M....R.>..!.0[..yL..8..B.j.0...C`?D..})o_.J...........).A.J..0...p'c_X.:....t<.C....`..U..>b.y.y.q4...K....<mI3&c..N9..#.W.......f`.!@...z..6..;C.j5...@...H1..G.(,...y....U!......PG.Alg3.\v].r.z.:`..0W.FG`B..!.....;l..'...F..........S...O.......N_..Pm......48....F.].....N...o...B]a.Z....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-TERUB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	466
Entropy (8bit):	7.286341270669228
Encrypted:	false
SSDEEP:	12:6v/7cGY6r5Bb7wfY7UfFGlvDRo/tthEMS9FiU9SLOJ+N9:Qrf7wYUIhRoFEM8F3wzj
MD5:	F9D98CB5EB4906725E0AD522775D0024
SHA1:	5928F054E584034EAAF2630739D5A672C1CA3162
SHA-256:	FF77989EC8AF2D1767F4F70ACF9F98959A3E80AFD9BF86099B6C52176E7E8F33
SHA-512:	D310F844264C61ABA4078875F861DAF99E0302E9EA28CEE54CDC1F0A949F3E619420BD17BF4FE078CBCB6CEC596074371BB0A433A9BFE79F4F407F70C6152659
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs...w...w..<......IDAT8..SKN.A.}........>.@.S.Y....7...D..111&FX..z.Q...1.W......../.L..{......... ...#.&.....(.`fg....N....c:.b.....":.p...cf.>.c'/...QAE`........B..h.....z.gf.......m.......^.#a]C.....L...<q.3..G...s..........f.V..P...2=m..z.K...g....+1d"IT...n?)1.,....V..=.....7.....7X..=.#Y0cz..#....jo..Y.?.^.>..$"z.....9(3..@j_.tQ......,.,j".....~.\.i.Iiy..B8...., .........oe....n..(......IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-UEQMD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 32 x 33, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	336
Entropy (8bit):	6.5881036394912975
Encrypted:	false
SSDEEP:	6:6v/lhPa5ApTxxte9toYnsXl0S7OKjmrvuS7810ccNwVp:6v/7rzYSlL7O4mrWEw7
MD5:	7C0E466272FBA7E9E1E11DEDCFB50832
SHA1:	BAA6E906A80919F20D050335D705609E5300EEF1
SHA-256:	DDA0B5F91290202DD7197D01AE4AABE0394C44A45481E3FA33CBE5E3B58A96EE
SHA-512:	45085C13F00228CCA8769FAD8B55E8B621C2DCA219B460A827D78A0A121AB5672DDFD72D1BF5754CA438E129EA3AA5075FA21455E3C8EDBE5F5B0903E52A1A75
Malicious:	false
Preview:	.PNG........IHDR... ...!.......Yc...BPLTE....L2.L2.L2.L2.L2.L2.L2.L2..L2.L2.L2.L2.L2..L2.L2.L2....wW.cC..j.....tRNS..@..pP.....0..(.......IDAT8..... ....("j7..WW...h....]....4.8k...8..d.P'.a..7?b.+/.3v....a...\`u. ..>.k...;.)X(0H........0=..6XK...].v....rK..........{)?.;v...S?..Gu..].W.:.m...%.6..........p5....IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-UL5G1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1790
Entropy (8bit):	6.085739740396218
Encrypted:	false
SSDEEP:	48:T22/6164knA9WIPX5/c0ea5iIsczO3tgHJ3eaTHxQpw:y2SHknmWIPX5/Zi+UgHnHxQpw
MD5:	B1303D9FCC7C5C1C5BBF754CBADE7555
SHA1:	9B9F741312516FB8713BE43083A4EF9FEF6B76DF
SHA-256:	C87C3908689E3AE6FC48906F998FA364C659A3205A608441D021B76E01106D53
SHA-512:	7CFFE2B6393F9BE3E7A55622C04342460EB479996E729170254E628AC76D7456CBC2D3ED91E511CFA4041B75C3FB643A0330CC82285FF86A92B110C5150931E2
Malicious:	false
Preview:	.PNG........IHDR..............,.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-07T22:31:50-07:00" xmp:ModifyDate="2018-03-17T20:29:10-06:00" xmp:MetadataDate="2018-03-17T20:29:10-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:ddbdac7c-6b6a-4e72-a014-8e75d0811ed8" xmpMM:DocumentID="adobe:docid:photoshop:8338f344-edcd-aa4f-b950-562e72a778da"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\is-VRGN4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2142
Entropy (8bit):	6.274068403575219
Encrypted:	false
SSDEEP:	48:T22/6L64knA9WIPz/c0UG3zknAa538aDHJ3WlHV3UG3uHxtiIIHl5T:y2SJknmWIPz/2qk1HklH2FHxUIQlp
MD5:	EECC244B1923033C6F50252920892808
SHA1:	77CD7C63D70BCD7193DA3417933B546A5167F27D
SHA-256:	0862977CAC8DC816D6EAAC85AA874047D16D44C838D1AE275059246AB9FCE443
SHA-512:	4FF73C110480F5AF61B386238E538836C279623A260A325560CAAA7E8F95AC12D6917D54E24ED358C667E4951DC69BD0BF32C733CB06AC57E0E8870734D7E2A3
Malicious:	false
Preview:	.PNG........IHDR..............,.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-16T17:14:05-06:00" xmp:ModifyDate="2018-03-20T15:37:33-06:00" xmp:MetadataDate="2018-03-20T15:37:33-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:7516d4fb-d80f-47f5-b864-bd04a5bcd877" xmpMM:DocumentID="adobe:docid:photoshop:f9b3209a-9193-0a47-8ead-2079517698ea"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\logo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	466
Entropy (8bit):	7.286341270669228
Encrypted:	false
SSDEEP:	12:6v/7cGY6r5Bb7wfY7UfFGlvDRo/tthEMS9FiU9SLOJ+N9:Qrf7wYUIhRoFEM8F3wzj
MD5:	F9D98CB5EB4906725E0AD522775D0024
SHA1:	5928F054E584034EAAF2630739D5A672C1CA3162
SHA-256:	FF77989EC8AF2D1767F4F70ACF9F98959A3E80AFD9BF86099B6C52176E7E8F33
SHA-512:	D310F844264C61ABA4078875F861DAF99E0302E9EA28CEE54CDC1F0A949F3E619420BD17BF4FE078CBCB6CEC596074371BB0A433A9BFE79F4F407F70C6152659
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs...w...w..<......IDAT8..SKN.A.}........>.@.S.Y....7...D..111&FX..z.Q...1.W......../.L..{......... ...#.&.....(.`fg....N....c:.b.....":.p...cf.>.c'/...QAE`........B..h.....z.gf.......m.......^.#a]C.....L...<q.3..G...s..........f.V..P...2=m..z.K...g....+1d"IT...n?)1.,....V..=.....7.....7X..=.#Y0cz..#....jo..Y.?.^.>..$"z.....9(3..@j_.tQ......,.,j".....~.\.i.Iiy..B8...., .........oe....n..(......IEND.B`.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\Resources\onoff16Mask.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1809
Entropy (8bit):	6.121699074958754
Encrypted:	false
SSDEEP:	48:b/6164knA9WIPB/c0IxXi3+HJ3mHxmIBzb7:bSHknmWIPB/KxnHcHxHBzn
MD5:	41B75EA6BC156FC0BDBD55021C82D746
SHA1:	846DB02DEA007DC24A438372472907A3AC53FEF1
SHA-256:	DC3192375833257340AA60F90F7D86DDA89B2AEED87308DE2E0C57396788A5D4
SHA-512:	34BE2547D60B0514CADD7CD1C75B7A49635FF161AB73333A1E504F8BC6E4DB7E0CB5EB75740696FD0CCB935FD5213B583C13A7B2C0FEF49669A617316441FD1C
Malicious:	false
Preview:	.PNG........IHDR................a....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)" xmp:CreateDate="2018-03-19T10:24:20-06:00" xmp:ModifyDate="2018-03-20T15:45:23-06:00" xmp:MetadataDate="2018-03-20T15:45:23-06:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:7eed3c55-c2c2-4ff2-afd2-d4449b40bfc2" xmpMM:DocumentID="adobe:docid:photoshop:a3ed23ba-5859-ea45-801c-b1f3cd76a776"

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.Data.v17.2.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	167152
Entropy (8bit):	4.618628874526295
Encrypted:	false
SSDEEP:	3072:Neada19TrYgEAA3WUgMVHC0TnDchz/5Lga3rCvm0C/RsFUbpL8a6:FS9u3WU1C0TnDcPga3rCvm0C/Ji
MD5:	E0D00A2D37471837C77D131E2496D042
SHA1:	DF49F6DAFB913D22C455D540DFD9AE3F0369081D
SHA-256:	36984503761E668A577A68BA4748625EBE350889C760BA4E0A79BD133686E49E
SHA-512:	E8A7DA93B8FB35000FAC34EDA11E10E464063F50176EA45CF078AAA4AFB115C7FD7C86F52D8CABE596BE0802039B385CEB1D82D0A3A33F4B2C9DA0390AFDABC3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...O..Z...........!.....l.............. ........@.. ....................................@.....................................O....................v............................................................... ............... ..H............text....k... ...l.................. ..`.rsrc................n..............@..@.reloc...............t..............@..B........................H........................ ..e..P ......................................T.n..c..V..0.....2...Q......B.0.`...[!..p.Q?.4....../,..k.%.x.#.z.L..).2.[ ...[J...w.qG........=.4.n.....W\|..fmG.r..6.X...W.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.....1...N...b...W>.....$.z..A...T.....j-I.[...I$o......J.&.'.o.............J.4......D.>01.QA..

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.Pdf.v17.2.Core.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14064
Entropy (8bit):	5.938631439635863
Encrypted:	false
SSDEEP:	96:Vj5laCTvdoYlfsZXMDX86RUwkLre6C6ViRqSRw++3w63+eu9sGbrY4fltA3jBHRB:VPtF3Y9HRzSTzWLv7qF4nYe+PjPP8d
MD5:	4798B91987968D54C5B90AE4A343E59A
SHA1:	E47BE984C2C061B43E13B598FED25335DDE02395
SHA-256:	5155ED01BA11EBFF2C1DDA287257C08544D95A867582D52175759BFDC28DF449
SHA-512:	AD5984C20B06B4604F17F52E6E32BA1D60B77206D839C7B0EDE114FF3850F4267A47363A55475EF3581A4D120F3A0B089F8EAA7918D038AE16E8757F63DE9106
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._..Z...........!................N4... ...@....@.. ....................................@..................................3..O....@............... .......`....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................04......H......../..t............ ......P ......................................8.j.`.-.....I!Q...d.0...vT+0Z.f.6..!.....X.1y.R.....H ....I.Z.i.B%.q.......M.0.$.R..S.....~}......{.B.N..'C.;...l.KDq..!...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP..y.3..1B.................`....B.goY.........c..N...j..'.c..N..M>l.....U.....X...r.R.&.-.>

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.Printing.v17.2.Core.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	72944
Entropy (8bit):	4.646925378702204
Encrypted:	false
SSDEEP:	768:KNQiSEjIoAmABPlmgV5vGi47o1GrWkKhYVrtQMpy/8oLkdaqQPR:KNQlEUoA+wZkoYVtYAaT
MD5:	A50B5C84F3B363FCA5123B9BE202C6CB
SHA1:	83348E4319E8321A3C1021BEB10FF430780C2E78
SHA-256:	4716702EC2F405D87A5DAF9B03F813B9118C926691397554FC595BA9AD21DF44
SHA-512:	D6B27BB2CDE7D77001AC3ADC1EF86F7BC91AC0DBF82C6926FCA8746B56661643136D846D0814C882282529A6693D4CA007FD7EFC37A7F49930F69C6B184E0777
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..Z...........!..................... ... ....... .......................`............@.................................<...O.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................p.......H...........@............ ..+...P ........................................).T..M)t. .a...../......n..8^>._..G.gTK.........&8B8.i&[,.V./U}."(..)....t.7.,.+.....d`.&n...p.]V....~.z..l}.. hNx.9.'..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.....M>..M>..M>...7.'...P1....K....%.. 7.....'.q..R...a.H..`..s..Bst..-...\H..<.. .........

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.Sparkline.v17.2.Core.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12016
Entropy (8bit):	6.036374190948797
Encrypted:	false
SSDEEP:	192:sE2QQVHFAnbCmahOn+RtzkTzWLv7qF4nYe+PjP0h6C189/:x2QgAnbCmahO+RtzkmreqnYPLYvS5
MD5:	4E4FA6D36FAC724B7D1EEC319247C8DA
SHA1:	5DD4D4B1A69B189ADB2FBB37B85DF94ECC6E4D64
SHA-256:	7D1C19A13F4409069F14E5EBF42E5238E144C04E4403A19DF70CE0EE34DF1AB4
SHA-512:	6966003923322A7B9FF9CC9852185BF11065946B555C7C7B7DA1DBE6FD3502FBCDC21A34E74874371062BD2D4DF73210B9ADE19FD559020AD1A3B6B2BCF1C89C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Y..Z...........!.................+... ...@....@.. ....................................@..................................+..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......,'............... ..Z...P ......................................c.H~.U.p...U./Kcv4.h...~......e..V.ooQ[M....t..u.M.......$I5ke.=9..A......l.Z..D...a..e.u..!.\|..K.......6 ..\|9:....R....a...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADPEi..F..:.kp.......9...u...4S.p.a.r.k.l.i.n.e.S.t.r.i.n.g.I.d...v.i.e.w.A.r.e.a.....2S.p.a.r.k.l.i.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.Utils.v17.2.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26352
Entropy (8bit):	5.389826723460064
Encrypted:	false
SSDEEP:	768:ZuSrFj17S4XXfz354fgo8VbFPlX9YqYMumUdGaqba:FFj1/YqYMumQGa1
MD5:	B05B24CAAC522182C50A780DE4211FC9
SHA1:	35B18B126ECB8E4E6ABFBE6E8F78A1E6FF1434BD
SHA-256:	C46039BF496DA91F63A7A99F9AE357AFDA3DCA1F6DD4CA95C893EFCF7D999A4D
SHA-512:	ACDF09AF85DEF49A2CDE7BBE0D6F395A704EBC3D92FC21A89DD03444155C63C92CD43C7F85FDAAFEF65196345AE4821D01FDBF6FA80E421460740A93DF64E0E3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\|..Z...........!.....F...........e... ........@.. ....................................@..................................d..S....................P............................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............N..............@..B.................d......H........_............... ..(?..P .......................................n/..{....u.i...#.Lj....'A......\..Aq.....I....*.E..Dv\....W.W.].L...i.Ii..q.\.F.i.5e%.U..Y....$......t...{u...B..F}...Y.M!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....].......PADPADP8Z...k..2h......@J...m.....?E...g...M....\.....'......_....c.M.....=4. ...L....e..(.[...

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.XtraEditors.v17.2.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	109296
Entropy (8bit):	4.993476216116185
Encrypted:	false
SSDEEP:	3072:lYzb8bblFH9v9DjFbtxnS5JYcomUvjAd+au:Ozb8bpFH9ljFbt58UvF
MD5:	A5AEA5D3BF9F921BD9B554C92CB092F8
SHA1:	2DCD115FD14A0BEB5FD227FD6984487D506C562A
SHA-256:	F3EDB5B29C119819DFA1D3251D202EDEA1C80F86D28090E3AA52422186517F2C
SHA-512:	9764357FE46C48F381527781BC44E9FD878ABC8B22FD452F4A519BB549919E095B20DAFD04FFACA542B4866D856ED2C4E2194B455021223B7DBB43DC618D36E4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z...........!..................... ........... ....................................@.....................................S.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H....... ................ ..P...P ......................................I-..@...sQ.c.e.a....rT{i..q..?.......c0M.w..{.S..w...B........g....*A.g9.x6e....$,........Z..t.7.......`.....+E.W.s$....M..R..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.....;#..'c......E..w@L2.].L................W...z...8........b.t.A.d.d...T.e.x.t......b.t.I.n.s.e.r.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.XtraLayout.v17.2.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17136
Entropy (8bit):	5.719744542402921
Encrypted:	false
SSDEEP:	384:3se9XuFlCIqFgd5nb5PD0yZmreqnYPLIi:ZXuF1qFgd5nV1UaqE
MD5:	D408DB7BEE95C26F7D7959F6129F0699
SHA1:	A8652C00C67B94365E24ED3DA82280D7486DBA1D
SHA-256:	2873E9931F5D595C0D4A99CD3FAF99545D7AD2479F2430CEC55B712C6FDC637D
SHA-512:	D14D9C16D59D6B28D3B34497444D34E10B84802EEEF4FD3AD6B3B12B52CC218FA52698A1AA38F63891A794D602BD04EA3E4C8812939E89AF4D97DEA40EF2D87D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z...........!....."...........@... ...`....@.. ....................................@.................................<@..O....`...............,............................................................... ............... ..H............text.... ... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B................p@......H........;..h............ ......P ..........................................@<)L..TZ....8...].H..B.t\|.p.....+.........n.s..j.....^..S.....=b\|...[.....a....+2..g......m..T.E#..I.....)..L................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....A.......PADPADP .......,=.LO3.*?....q...U.;.V...u..g.....g6..........v....]..K%.YX..Vg..[E.(s...+.....s.....

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\DevExpress.XtraTreeList.v17.2.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18160
Entropy (8bit):	5.692930704669643
Encrypted:	false
SSDEEP:	384:VGvKKE7ZNx8XisuZ+eMWDnUZmreqnYPLUvTl:VlKE7ZNx8Xi1UmAUaqlZ
MD5:	EA1B8E2496ED5C089D722439B17F4BA1
SHA1:	570290D70B266AF76997035473813CD69B7AE287
SHA-256:	07A70A2EC756FDAE0AE83C2AB7EBDD4434B38EB8353866448F10F4E2A61F6887
SHA-512:	DA7884D5E762A3B6775300C04AA77DBB611A1BF5196BBF882F0938A28E143B583DB3726A8AC5E94153B096E904627CE95BDB91B0F54E01DA9819C7B47247C87C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z...........!.....&...........D... ...`....@.. ....................................@..................................D..S....`...............0............................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H........?............... ......P ......................................2.e$Z..}._.%f\..TQ.rP..V.#...U.o^YU.....}..D..".......A"G.3......?..K...nA}d$<..-..{_..58...9E.R>z......y.....N.....[..LOs...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....2.......PADPADP..I=...v..u?@..d-.A.X..............i.... ..O4..P4.jX4.....Q......R.....6...MV.........V....`..

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-2UQDK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26352
Entropy (8bit):	5.389826723460064
Encrypted:	false
SSDEEP:	768:ZuSrFj17S4XXfz354fgo8VbFPlX9YqYMumUdGaqba:FFj1/YqYMumQGa1
MD5:	B05B24CAAC522182C50A780DE4211FC9
SHA1:	35B18B126ECB8E4E6ABFBE6E8F78A1E6FF1434BD
SHA-256:	C46039BF496DA91F63A7A99F9AE357AFDA3DCA1F6DD4CA95C893EFCF7D999A4D
SHA-512:	ACDF09AF85DEF49A2CDE7BBE0D6F395A704EBC3D92FC21A89DD03444155C63C92CD43C7F85FDAAFEF65196345AE4821D01FDBF6FA80E421460740A93DF64E0E3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\|..Z...........!.....F...........e... ........@.. ....................................@..................................d..S....................P............................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............N..............@..B.................d......H........_............... ..(?..P .......................................n/..{....u.i...#.Lj....'A......\..Aq.....I....*.E..Dv\....W.W.].L...i.Ii..q.\.F.i.5e%.U..Y....$......t...{u...B..F}...Y.M!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....].......PADPADP8Z...k..2h......@J...m.....?E...g...M....\.....'......_....c.M.....=4. ...L....e..(.[...

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-38AFE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12016
Entropy (8bit):	6.036374190948797
Encrypted:	false
SSDEEP:	192:sE2QQVHFAnbCmahOn+RtzkTzWLv7qF4nYe+PjP0h6C189/:x2QgAnbCmahO+RtzkmreqnYPLYvS5
MD5:	4E4FA6D36FAC724B7D1EEC319247C8DA
SHA1:	5DD4D4B1A69B189ADB2FBB37B85DF94ECC6E4D64
SHA-256:	7D1C19A13F4409069F14E5EBF42E5238E144C04E4403A19DF70CE0EE34DF1AB4
SHA-512:	6966003923322A7B9FF9CC9852185BF11065946B555C7C7B7DA1DBE6FD3502FBCDC21A34E74874371062BD2D4DF73210B9ADE19FD559020AD1A3B6B2BCF1C89C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Y..Z...........!.................+... ...@....@.. ....................................@..................................+..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......,'............... ..Z...P ......................................c.H~.U.p...U./Kcv4.h...~......e..V.ooQ[M....t..u.M.......$I5ke.=9..A......l.Z..D...a..e.u..!.\|..K.......6 ..\|9:....R....a...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADPEi..F..:.kp.......9...u...4S.p.a.r.k.l.i.n.e.S.t.r.i.n.g.I.d...v.i.e.w.A.r.e.a.....2S.p.a.r.k.l.i.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-CD3K2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	72944
Entropy (8bit):	4.646925378702204
Encrypted:	false
SSDEEP:	768:KNQiSEjIoAmABPlmgV5vGi47o1GrWkKhYVrtQMpy/8oLkdaqQPR:KNQlEUoA+wZkoYVtYAaT
MD5:	A50B5C84F3B363FCA5123B9BE202C6CB
SHA1:	83348E4319E8321A3C1021BEB10FF430780C2E78
SHA-256:	4716702EC2F405D87A5DAF9B03F813B9118C926691397554FC595BA9AD21DF44
SHA-512:	D6B27BB2CDE7D77001AC3ADC1EF86F7BC91AC0DBF82C6926FCA8746B56661643136D846D0814C882282529A6693D4CA007FD7EFC37A7F49930F69C6B184E0777
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..Z...........!..................... ... ....... .......................`............@.................................<...O.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................p.......H...........@............ ..+...P ........................................).T..M)t. .a...../......n..8^>._..G.gTK.........&8B8.i&[,.V./U}."(..)....t.7.,.+.....d`.&n...p.]V....~.z..l}.. hNx.9.'..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.....M>..M>..M>...7.'...P1....K....%.. 7.....'.q..R...a.H..`..s..Bst..-...\H..<.. .........

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-GH56H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18160
Entropy (8bit):	5.692930704669643
Encrypted:	false
SSDEEP:	384:VGvKKE7ZNx8XisuZ+eMWDnUZmreqnYPLUvTl:VlKE7ZNx8Xi1UmAUaqlZ
MD5:	EA1B8E2496ED5C089D722439B17F4BA1
SHA1:	570290D70B266AF76997035473813CD69B7AE287
SHA-256:	07A70A2EC756FDAE0AE83C2AB7EBDD4434B38EB8353866448F10F4E2A61F6887
SHA-512:	DA7884D5E762A3B6775300C04AA77DBB611A1BF5196BBF882F0938A28E143B583DB3726A8AC5E94153B096E904627CE95BDB91B0F54E01DA9819C7B47247C87C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z...........!.....&...........D... ...`....@.. ....................................@..................................D..S....`...............0............................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H........?............... ......P ......................................2.e$Z..}._.%f\..TQ.rP..V.#...U.o^YU.....}..D..".......A"G.3......?..K...nA}d$<..-..{_..58...9E.R>z......y.....N.....[..LOs...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....2.......PADPADP..I=...v..u?@..d-.A.X..............i.... ..O4..P4.jX4.....Q......R.....6...MV.........V....`..

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-KF882.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17136
Entropy (8bit):	5.719744542402921
Encrypted:	false
SSDEEP:	384:3se9XuFlCIqFgd5nb5PD0yZmreqnYPLIi:ZXuF1qFgd5nV1UaqE
MD5:	D408DB7BEE95C26F7D7959F6129F0699
SHA1:	A8652C00C67B94365E24ED3DA82280D7486DBA1D
SHA-256:	2873E9931F5D595C0D4A99CD3FAF99545D7AD2479F2430CEC55B712C6FDC637D
SHA-512:	D14D9C16D59D6B28D3B34497444D34E10B84802EEEF4FD3AD6B3B12B52CC218FA52698A1AA38F63891A794D602BD04EA3E4C8812939E89AF4D97DEA40EF2D87D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z...........!....."...........@... ...`....@.. ....................................@.................................<@..O....`...............,............................................................... ............... ..H............text.... ... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B................p@......H........;..h............ ......P ..........................................@<)L..TZ....8...].H..B.t\|.p.....+.........n.s..j.....^..S.....=b\|...[.....a....+2..g......m..T.E#..I.....)..L................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....A.......PADPADP .......,=.LO3.*?....q...U.;.V...u..g.....g6..........v....]..K%.YX..Vg..[E.(s...+.....s.....

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-LNG1S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	167152
Entropy (8bit):	4.618628874526295
Encrypted:	false
SSDEEP:	3072:Neada19TrYgEAA3WUgMVHC0TnDchz/5Lga3rCvm0C/RsFUbpL8a6:FS9u3WU1C0TnDcPga3rCvm0C/Ji
MD5:	E0D00A2D37471837C77D131E2496D042
SHA1:	DF49F6DAFB913D22C455D540DFD9AE3F0369081D
SHA-256:	36984503761E668A577A68BA4748625EBE350889C760BA4E0A79BD133686E49E
SHA-512:	E8A7DA93B8FB35000FAC34EDA11E10E464063F50176EA45CF078AAA4AFB115C7FD7C86F52D8CABE596BE0802039B385CEB1D82D0A3A33F4B2C9DA0390AFDABC3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...O..Z...........!.....l.............. ........@.. ....................................@.....................................O....................v............................................................... ............... ..H............text....k... ...l.................. ..`.rsrc................n..............@..@.reloc...............t..............@..B........................H........................ ..e..P ......................................T.n..c..V..0.....2...Q......B.0.`...[!..p.Q?.4....../,..k.%.x.#.z.L..).2.[ ...[J...w.qG........=.4.n.....W\|..fmG.r..6.X...W.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.....1...N...b...W>.....$.z..A...T.....j-I.[...I$o......J.&.'.o.............J.4......D.>01.QA..

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-R6F91.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14064
Entropy (8bit):	5.938631439635863
Encrypted:	false
SSDEEP:	96:Vj5laCTvdoYlfsZXMDX86RUwkLre6C6ViRqSRw++3w63+eu9sGbrY4fltA3jBHRB:VPtF3Y9HRzSTzWLv7qF4nYe+PjPP8d
MD5:	4798B91987968D54C5B90AE4A343E59A
SHA1:	E47BE984C2C061B43E13B598FED25335DDE02395
SHA-256:	5155ED01BA11EBFF2C1DDA287257C08544D95A867582D52175759BFDC28DF449
SHA-512:	AD5984C20B06B4604F17F52E6E32BA1D60B77206D839C7B0EDE114FF3850F4267A47363A55475EF3581A4D120F3A0B089F8EAA7918D038AE16E8757F63DE9106
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._..Z...........!................N4... ...@....@.. ....................................@..................................3..O....@............... .......`....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................04......H......../..t............ ......P ......................................8.j.`.-.....I!Q...d.0...vT+0Z.f.6..!.....X.1y.R.....H ....I.Z.i.B%.q.......M.0.$.R..S.....~}......{.B.N..'C.;...l.KDq..!...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP..y.3..1B.................`....B.goY.........c..N...j..'.c..N..M>l.....U.....X...r.R.&.-.>

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\de\is-RKMEQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	109296
Entropy (8bit):	4.993476216116185
Encrypted:	false
SSDEEP:	3072:lYzb8bblFH9v9DjFbtxnS5JYcomUvjAd+au:Ozb8bpFH9ljFbt58UvF
MD5:	A5AEA5D3BF9F921BD9B554C92CB092F8
SHA1:	2DCD115FD14A0BEB5FD227FD6984487D506C562A
SHA-256:	F3EDB5B29C119819DFA1D3251D202EDEA1C80F86D28090E3AA52422186517F2C
SHA-512:	9764357FE46C48F381527781BC44E9FD878ABC8B22FD452F4A519BB549919E095B20DAFD04FFACA542B4866D856ED2C4E2194B455021223B7DBB43DC618D36E4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z...........!..................... ........... ....................................@.....................................S.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H....... ................ ..P...P ......................................I-..@...sQ.c.e.a....rT{i..q..?.......c0M.w..{.S..w...B........g....*A.g9.x6e....$,........Z..t.7.......`.....+E.W.s$....M..R..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.....;#..'c......E..w@L2.].L................W...z...8........b.t.A.d.d...T.e.x.t......b.t.I.n.s.e.r.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\en\PsSwift_Excel.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.771491318418213
Encrypted:	false
SSDEEP:	48:6sQZOaH8PsZRt1qH819S9mWSpLgClt4+ioyvWGZ8+xf4plZoVkg1QK:mNwc19+XGFlt7gWGZCUi
MD5:	81A0C117BCD8A9266D935A467C19B67E
SHA1:	896E75B7A0CD3272B129C4A7BF32FAFC0A73F8B1
SHA-256:	C43E7DC44DFDD471F0CC9EC04D823938E69468F39A24D8D1C72AC9E3B5F3648A
SHA-512:	91F1395AE4733D3B83AEDA47ED7AA88952CEE3B748433DC72620531D7A6E19097E50791350C044B0A4B47E2CA71297B4B1C9E53C5EB5D0945AB6D18A8888511E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.[...........!.................+... ...@....... ....................................@..................................*..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......\|'..\...........P ..+...........................................'..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet..............DevExpress.Utils.ImageCollectionStreamer, DevExpress.Utils.v17.2, Version=17.2.3.0, Culture=neutral, PublicKeyToken=b88d1754d700e49aP..Py....{...:i.m.g.L.i.s.t.T.i.t.l.e.I.m.a.g.e...I.m.a.g.e.S.t.r.e.a.m.....@......................ZD

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\en\is-4KI03.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.771491318418213
Encrypted:	false
SSDEEP:	48:6sQZOaH8PsZRt1qH819S9mWSpLgClt4+ioyvWGZ8+xf4plZoVkg1QK:mNwc19+XGFlt7gWGZCUi
MD5:	81A0C117BCD8A9266D935A467C19B67E
SHA1:	896E75B7A0CD3272B129C4A7BF32FAFC0A73F8B1
SHA-256:	C43E7DC44DFDD471F0CC9EC04D823938E69468F39A24D8D1C72AC9E3B5F3648A
SHA-512:	91F1395AE4733D3B83AEDA47ED7AA88952CEE3B748433DC72620531D7A6E19097E50791350C044B0A4B47E2CA71297B4B1C9E53C5EB5D0945AB6D18A8888511E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.[...........!.................+... ...@....... ....................................@..................................*..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......\|'..\...........P ..+...........................................'..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet..............DevExpress.Utils.ImageCollectionStreamer, DevExpress.Utils.v17.2, Version=17.2.3.0, Culture=neutral, PublicKeyToken=b88d1754d700e49aP..Py....{...:i.m.g.L.i.s.t.T.i.t.l.e.I.m.a.g.e...I.m.a.g.e.S.t.r.e.a.m.....@......................ZD

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.Data.v17.2.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	164592
Entropy (8bit):	4.6308559595304
Encrypted:	false
SSDEEP:	3072:YB2i/nr3Yolmu/D9LoWaTfFMQk6JcIu5FREd2lRtiwfHfNOzenfFfIlailFaO:M/upFMQk6Jc15FREd2lRtm
MD5:	4833D464F5388A6D966E2664144D1DE1
SHA1:	A5B16C5C7546FC1DB7E0F9518BF970CA3E05238D
SHA-256:	C8A7A1ABF2E4E809EB4F78D344C8B3C7B892DACB4F112C551E0605D876951783
SHA-512:	820D586A238CC2E32462E5F2EB516242FF8855D4AA4B6F003ECBF9D0827690D0027005D0E5F8E0CEFD8FF575B41BC0B6605B075AD026B672FE1E963809AB7806
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...O..Z...........!.....b............... ........@.. ....................................@.....................................K....................l............................................................... ............... ..H............text....a... ...b.................. ..`.rsrc................d..............@..@.reloc...............j..............@..B........................H.......0{............... ..^Z..P ......................................{gV.q....P....oM.Qe..Q...i[@...U..(...1...oG....y..=......._T..8R..r0.9.q>F.S.x..&X.b.;......~.+6....6...N......r>.3i.FF.Y.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.....1...N...b...W>.....$.z..A...T.....j-I.[...I$o......J.&.'.o.............J.4......D.>01.QA..

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.Pdf.v17.2.Core.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20208
Entropy (8bit):	5.67473846817961
Encrypted:	false
SSDEEP:	384:eWNB9aOmsiJkHv8y1nB2B4jyRxzjmreqnYPL0:b9aOms55BinbKaqf
MD5:	B5F4631CF6D2ADD94A209B0581259EEE
SHA1:	0171FB9F818C2A4A880B4B2DA9BBC004E4E3BC85
SHA-256:	ABFF1627290DDD74523444B156E7C3C5A255EF1FE0A61BEED48C7F31D12932E3
SHA-512:	57C760806CE25E934A91A1901401B4021F3B9A5CB274B87146A4467AAAF707E2CD31287A94121B4B91A0099C62351C00B18AB37AAEDBAD89BB7EC900833E8C05
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._..Z...........!.................K... ...`....@.. ....................................@..................................K..S....`...............8............................................................... ............... ..H............text....,... ...................... ..`.rsrc........`.......0..............@..@.reloc...............6..............@..B.................K......H.......4G..t............ ..c&..P .......................................4T.f$rI....-b(..s...}..D<"....f.+.0.5.N).d._......l.x{Be.1\|.."V..,...d....9..1.L'ktV.L..R...['.L..A.c...>.y.u^G..vV..^A9.._&.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....@.......PADPADPV...=....<....y.3.........Py..U...y......V^...j................B.7..c..P.goY...+..

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.Printing.v17.2.Core.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	73456
Entropy (8bit):	4.671651181180588
Encrypted:	false
SSDEEP:	768:GNkRHQ1u3PAfzGSmer1jYVKJ171UX+gF2fyS8oLk4aqZ:GNUHQ1u30BX2u9xRaG
MD5:	B16BBB95A9CE6DE3EE07E5E0CCD1B6C1
SHA1:	E7747E000B6BA6AC3B4CE22995F51B989FD66CF5
SHA-256:	EF37644135BF298B811A3B50A3D6086B4E3E8E02AFE8EB23BC93C2F77E75BC3F
SHA-512:	F40406C3D358F953BB02A7F8B8552A48DE7D747AC2A4A1A157E1CE2C06C919BA49A468BC07431F10F111382CD737264BE9CF89072B9269AD767420E1448DA31D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..Z...........!..................... ... ....... .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......p...@............ ......P ........................................`....m..z..:2.(...<.@.M.L.. ...A$.s......+.....h........>w.,....m:z..{...,..C.g.....u1/....O=.('9./.}(1....o..".8D>.U................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.....M>..M>..M>...7.'...P1....K....%.. 7.....'.q..R...a.H..*`..s..Bst.....-...\H..<.. ......

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.Sparkline.v17.2.Core.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14576
Entropy (8bit):	5.887442913402521
Encrypted:	false
SSDEEP:	192:ThffWrtieb5AFA/bDDozhOniRtzATzWLv7qF4nYe+PjPWt6q:ThXreb5UA/bDD2hOiRtzAmreqnYPLWtB
MD5:	DBE7381FE167FF83563226771F0A0FC1
SHA1:	F6D22F7E360F47A8E003A4D0AFB3FB9FEAB4DF3E
SHA-256:	4FF5865AEC8B801B9AD61377EDA0A9C4FD7701EC43936D02D3480D715F14838E
SHA-512:	AE65A10DD89811CEDFB57E0918CC39DC05F3C50CA5F9038C3036C6BBA5D440C9A6390674AE9532C78CACEA12B5597A326E4498196BD4D27A3C92B833486F94CF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Y..Z...........!................^7... ...@....@.. ....................................@..................................7..W....@...............".......`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B................@7......H........2............... ......P ........................................8.5..P...p..Z8.S..9.1..H.._.x.`...&.......Gw%Tl..T$.!.}.Wa...?.......<...]D....i...5.R..J....+.:...0<...s.Vw.j..................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADPEi..F..8.E:.kp...........9.......4S.p.a.r.k.l.i.n.e.S.t.r.i.n.g.I.d...v.i.e.w.A.r.e.a.....2S.p.a.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.Utils.v17.2.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26352
Entropy (8bit):	5.363637713200812
Encrypted:	false
SSDEEP:	768:ufFb6xKPXS3N/h43P0+k02wlW3Yg/lpG11aqpP:ufFbGYg/ls1aaP
MD5:	F192437AFAAD4FC5CBEAA3785029966A
SHA1:	26F082A990AA023B118EA29751A76042C440403F
SHA-256:	D4CE887DBA0AC112EBAE603F039DDB182242DD038F9623BA549CAF7C4194DC84
SHA-512:	DD10F2E8D64D6A8E6C1E058BB518103FE1B6163F6F9FEC175DFD9239C3151B8FB3F1B15AFACA33A1C7829865CD7D66DA0E7BAA55BF3635872DC51CC59F7F323C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\|..Z...........!.....F..........^d... ........@.. ....................................@..................................d..K....................P............................................................... ............... ..H............text...dD... ...F.................. ..`.rsrc................H..............@..@.reloc...............N..............@..B................@d......H.......P_............... ...>..P ......................................g..h..ms.......e0L.$..w.`.X...':(.N.c.t.].....).9.9.m4..*a......_.VqJ....5'.+5..7....5.............p8.....'h.U.M...]..n00.._!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....^.......PADPADP8Z...k..2h......@J...m.....?E...g...M....\.....'......_....c.M.....=4.... ...L....e..(.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.XtraEditors.v17.2.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	94448
Entropy (8bit):	5.013770469019705
Encrypted:	false
SSDEEP:	1536:hXF/KeCOjNGvBJlBoygy22RWjey2FnL3BaQ:ieCOjNaJlBoygypN3BaQ
MD5:	3889AB383A0754CC1E0D997F0171CC57
SHA1:	99F66748F09623D818D88E0D4FFCB53DC47F3073
SHA-256:	32926C6905CA3B8FDA98CB895FE83FFC19EE53373EA265464FABB46D7619D345
SHA-512:	40F6D1035173BC74C88F79C35053EA9205EFFA4897933E3FBBEFE15E7DB05EF01D13CAF5559B2DFB2C6E7ADAB09B98E93AEFB96C3A9EE4A812DBB02B09CF7545
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z...........!.....P...........n... ........... ....................................@.................................Dn..W....................Z............................................................... ............... ..H............text....N... ...P.................. ..`.rsrc................R..............@..@.reloc...............X..............@..B.................n......H........g............... ...F..P .........................................faR..P...r`E..&.Ad.GS......z!.}.*..2..{.d.7.i.....1.BR`..,?}T.H.X./.G.o.G...8_.....@l.....nk...P..4....Edc.?6c.K.~.;....A.`..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.....;#..'c......E..w@L2.].L................W...z...8........b.t.A.d.d...T.e.x.t......b.t.I.n.s.e.r.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.XtraLayout.v17.2.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17136
Entropy (8bit):	5.7561658346133955
Encrypted:	false
SSDEEP:	192:7NL9dPSSRl3pu9/T2MLaVrVxVZVPVX9CsLWrK+jVuybTzWLv7qF4nYe+PjPRYc:7NLjSS4ldQZTbdhyOCUybmreqnYPLj
MD5:	14F1B3AA4F65709B0159D0244C29ACF2
SHA1:	C74D62B626646DB76C8B1AA6B8F71219DDC82906
SHA-256:	C1E6083F8F22D13155C7B1A313A0E3CA901D9B022D67388FB38B27761D99B8D6
SHA-512:	33292E07603B1D918CAD737C8BE2FB094F789589DD03B357BFBA0A31BF211711459D4D0192F1FE096AECC648B652D2BC9C9C2C0C70D358985BCCFBADDB53A605
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z...........!....."...........@... ...`....@.. ....................................@..................................@..O....`...............,............................................................... ............... ..H............text.... ... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B.................@......H.......4<..h............ ..c...P ......................................^..{_7.'.Li....... g;[.......~5)..\|...#\|..H.v.?4.{r..0.z....#.J..Ev}..C..w.s.72..o...3.9._f.......Bw{.v..Z.1.-..\.....fd.._..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....A.......PADPADP ......LO3.*?....q...U.;.V...u..g.....g6..........v....]..K%.YX..Vg..[E.(s...+.......);..H...

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\DevExpress.XtraTreeList.v17.2.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19184
Entropy (8bit):	5.682156967470004
Encrypted:	false
SSDEEP:	384:x21cK0GTXvk4uGrCXw39nwqBwqEwqHwqwwqLfNsnU/mreqnYPLILpW:o1cK0GTXcx+9DP+aqzQ
MD5:	3DBF31201066FC074909808CB1B91F3F
SHA1:	3AB0B0548D0AB7131080625DD60F087951F249F5
SHA-256:	DED07EAAC0E6F41D12F2F6D5B88E12C0F594946F368A757AB6012494D557B23F
SHA-512:	B9092F9B2D45EC974AC96237C61FB6180036FE8D5732E41FCCF592EB79CD04876300FF4AFAF43B35BD30FEAB6FBE7AD81A1A374859CF438BC3666337D53C305C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z...........!................G... ...`....@.. ....................................@..................................G..K....`...............4............................................................... ............... ..H............text....(... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................G......H........B............... ...!..P ......................................L9gG......)q....v.]x......W..."@...e!.l.K...k.<S..G!T.:h.kt....{..+.%K_xa..e....9.\..#jt..#.L...F9......vpHm*}..J.<...R.Nm................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....0.......PADPADPI=...d-.A.X..............i.... ..O4..P4.jX4.....Q......R.....6...MV.........V....`.....9;.m._.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-03RG0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14576
Entropy (8bit):	5.887442913402521
Encrypted:	false
SSDEEP:	192:ThffWrtieb5AFA/bDDozhOniRtzATzWLv7qF4nYe+PjPWt6q:ThXreb5UA/bDD2hOiRtzAmreqnYPLWtB
MD5:	DBE7381FE167FF83563226771F0A0FC1
SHA1:	F6D22F7E360F47A8E003A4D0AFB3FB9FEAB4DF3E
SHA-256:	4FF5865AEC8B801B9AD61377EDA0A9C4FD7701EC43936D02D3480D715F14838E
SHA-512:	AE65A10DD89811CEDFB57E0918CC39DC05F3C50CA5F9038C3036C6BBA5D440C9A6390674AE9532C78CACEA12B5597A326E4498196BD4D27A3C92B833486F94CF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Y..Z...........!................^7... ...@....@.. ....................................@..................................7..W....@...............".......`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B................@7......H........2............... ......P ........................................8.5..P...p..Z8.S..9.1..H.._.x.`...&.......Gw%Tl..T$.!.}.Wa...?.......<...]D....i...5.R..J....+.:...0<...s.Vw.j..................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADPEi..F..8.E:.kp...........9.......4S.p.a.r.k.l.i.n.e.S.t.r.i.n.g.I.d...v.i.e.w.A.r.e.a.....2S.p.a.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-1G665.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	164592
Entropy (8bit):	4.6308559595304
Encrypted:	false
SSDEEP:	3072:YB2i/nr3Yolmu/D9LoWaTfFMQk6JcIu5FREd2lRtiwfHfNOzenfFfIlailFaO:M/upFMQk6Jc15FREd2lRtm
MD5:	4833D464F5388A6D966E2664144D1DE1
SHA1:	A5B16C5C7546FC1DB7E0F9518BF970CA3E05238D
SHA-256:	C8A7A1ABF2E4E809EB4F78D344C8B3C7B892DACB4F112C551E0605D876951783
SHA-512:	820D586A238CC2E32462E5F2EB516242FF8855D4AA4B6F003ECBF9D0827690D0027005D0E5F8E0CEFD8FF575B41BC0B6605B075AD026B672FE1E963809AB7806
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...O..Z...........!.....b............... ........@.. ....................................@.....................................K....................l............................................................... ............... ..H............text....a... ...b.................. ..`.rsrc................d..............@..@.reloc...............j..............@..B........................H.......0{............... ..^Z..P ......................................{gV.q....P....oM.Qe..Q...i[@...U..(...1...oG....y..=......._T..8R..r0.9.q>F.S.x..&X.b.;......~.+6....6...N......r>.3i.FF.Y.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.....1...N...b...W>.....$.z..A...T.....j-I.[...I$o......J.&.'.o.............J.4......D.>01.QA..

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-6IN84.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19184
Entropy (8bit):	5.682156967470004
Encrypted:	false
SSDEEP:	384:x21cK0GTXvk4uGrCXw39nwqBwqEwqHwqwwqLfNsnU/mreqnYPLILpW:o1cK0GTXcx+9DP+aqzQ
MD5:	3DBF31201066FC074909808CB1B91F3F
SHA1:	3AB0B0548D0AB7131080625DD60F087951F249F5
SHA-256:	DED07EAAC0E6F41D12F2F6D5B88E12C0F594946F368A757AB6012494D557B23F
SHA-512:	B9092F9B2D45EC974AC96237C61FB6180036FE8D5732E41FCCF592EB79CD04876300FF4AFAF43B35BD30FEAB6FBE7AD81A1A374859CF438BC3666337D53C305C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z...........!................G... ...`....@.. ....................................@..................................G..K....`...............4............................................................... ............... ..H............text....(... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................G......H........B............... ...!..P ......................................L9gG......)q....v.]x......W..."@...e!.l.K...k.<S..G!T.:h.kt....{..+.%K_xa..e....9.\..#jt..#.L...F9......vpHm*}..J.<...R.Nm................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....0.......PADPADPI=...d-.A.X..............i.... ..O4..P4.jX4.....Q......R.....6...MV.........V....`.....9;.m._.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-9TO3L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20208
Entropy (8bit):	5.67473846817961
Encrypted:	false
SSDEEP:	384:eWNB9aOmsiJkHv8y1nB2B4jyRxzjmreqnYPL0:b9aOms55BinbKaqf
MD5:	B5F4631CF6D2ADD94A209B0581259EEE
SHA1:	0171FB9F818C2A4A880B4B2DA9BBC004E4E3BC85
SHA-256:	ABFF1627290DDD74523444B156E7C3C5A255EF1FE0A61BEED48C7F31D12932E3
SHA-512:	57C760806CE25E934A91A1901401B4021F3B9A5CB274B87146A4467AAAF707E2CD31287A94121B4B91A0099C62351C00B18AB37AAEDBAD89BB7EC900833E8C05
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._..Z...........!.................K... ...`....@.. ....................................@..................................K..S....`...............8............................................................... ............... ..H............text....,... ...................... ..`.rsrc........`.......0..............@..@.reloc...............6..............@..B.................K......H.......4G..t............ ..c&..P .......................................4T.f$rI....-b(..s...}..D<"....f.+.0.5.N).d._......l.x{Be.1\|.."V..,...d....9..1.L'ktV.L..R...['.L..A.c...>.y.u^G..vV..^A9.._&.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....@.......PADPADPV...=....<....y.3.........Py..U...y......V^...j................B.7..c..P.goY...+..

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-C5VI4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17136
Entropy (8bit):	5.7561658346133955
Encrypted:	false
SSDEEP:	192:7NL9dPSSRl3pu9/T2MLaVrVxVZVPVX9CsLWrK+jVuybTzWLv7qF4nYe+PjPRYc:7NLjSS4ldQZTbdhyOCUybmreqnYPLj
MD5:	14F1B3AA4F65709B0159D0244C29ACF2
SHA1:	C74D62B626646DB76C8B1AA6B8F71219DDC82906
SHA-256:	C1E6083F8F22D13155C7B1A313A0E3CA901D9B022D67388FB38B27761D99B8D6
SHA-512:	33292E07603B1D918CAD737C8BE2FB094F789589DD03B357BFBA0A31BF211711459D4D0192F1FE096AECC648B652D2BC9C9C2C0C70D358985BCCFBADDB53A605
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z...........!....."...........@... ...`....@.. ....................................@..................................@..O....`...............,............................................................... ............... ..H............text.... ... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B.................@......H.......4<..h............ ..c...P ......................................^..{_7.'.Li....... g;[.......~5)..\|...#\|..H.v.?4.{r..0.z....#.J..Ev}..C..w.s.72..o...3.9._f.......Bw{.v..Z.1.-..\.....fd.._..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....A.......PADPADP ......LO3.*?....q...U.;.V...u..g.....g6..........v....]..K%.YX..Vg..[E.(s...+.......);..H...

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-CPQJG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	73456
Entropy (8bit):	4.671651181180588
Encrypted:	false
SSDEEP:	768:GNkRHQ1u3PAfzGSmer1jYVKJ171UX+gF2fyS8oLk4aqZ:GNUHQ1u30BX2u9xRaG
MD5:	B16BBB95A9CE6DE3EE07E5E0CCD1B6C1
SHA1:	E7747E000B6BA6AC3B4CE22995F51B989FD66CF5
SHA-256:	EF37644135BF298B811A3B50A3D6086B4E3E8E02AFE8EB23BC93C2F77E75BC3F
SHA-512:	F40406C3D358F953BB02A7F8B8552A48DE7D747AC2A4A1A157E1CE2C06C919BA49A468BC07431F10F111382CD737264BE9CF89072B9269AD767420E1448DA31D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..Z...........!..................... ... ....... .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......p...@............ ......P ........................................`....m..z..:2.(...<.@.M.L.. ...A$.s......+.....h........>w.,....m:z..{...,..C.g.....u1/....O=.('9./.}(1....o..".8D>.U................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.....M>..M>..M>...7.'...P1....K....%.. 7.....'.q..R...a.H..*`..s..Bst.....-...\H..<.. ......

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-EVE0N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26352
Entropy (8bit):	5.363637713200812
Encrypted:	false
SSDEEP:	768:ufFb6xKPXS3N/h43P0+k02wlW3Yg/lpG11aqpP:ufFbGYg/ls1aaP
MD5:	F192437AFAAD4FC5CBEAA3785029966A
SHA1:	26F082A990AA023B118EA29751A76042C440403F
SHA-256:	D4CE887DBA0AC112EBAE603F039DDB182242DD038F9623BA549CAF7C4194DC84
SHA-512:	DD10F2E8D64D6A8E6C1E058BB518103FE1B6163F6F9FEC175DFD9239C3151B8FB3F1B15AFACA33A1C7829865CD7D66DA0E7BAA55BF3635872DC51CC59F7F323C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\|..Z...........!.....F..........^d... ........@.. ....................................@..................................d..K....................P............................................................... ............... ..H............text...dD... ...F.................. ..`.rsrc................H..............@..@.reloc...............N..............@..B................@d......H.......P_............... ...>..P ......................................g..h..ms.......e0L.$..w.`.X...':(.N.c.t.].....).9.9.m4..*a......_.VqJ....5'.+5..7....5.............p8.....'h.U.M...]..n00.._!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....^.......PADPADP8Z...k..2h......@J...m.....?E...g...M....\.....'......_....c.M.....=4.... ...L....e..(.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\es\is-L2OVJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	94448
Entropy (8bit):	5.013770469019705
Encrypted:	false
SSDEEP:	1536:hXF/KeCOjNGvBJlBoygy22RWjey2FnL3BaQ:ieCOjNaJlBoygypN3BaQ
MD5:	3889AB383A0754CC1E0D997F0171CC57
SHA1:	99F66748F09623D818D88E0D4FFCB53DC47F3073
SHA-256:	32926C6905CA3B8FDA98CB895FE83FFC19EE53373EA265464FABB46D7619D345
SHA-512:	40F6D1035173BC74C88F79C35053EA9205EFFA4897933E3FBBEFE15E7DB05EF01D13CAF5559B2DFB2C6E7ADAB09B98E93AEFB96C3A9EE4A812DBB02B09CF7545
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z...........!.....P...........n... ........... ....................................@.................................Dn..W....................Z............................................................... ............... ..H............text....N... ...P.................. ..`.rsrc................R..............@..@.reloc...............X..............@..B.................n......H........g............... ...F..P .........................................faR..P...r`E..&.Ad.GS......z!.}.*..2..{.d.7.i.....1.BR`..,?}T.H.X./.G.o.G...8_.....@l.....nk...P..4....Edc.?6c.K.~.;....A.`..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.....;#..'c......E..w@L2.].L................W...z...8........b.t.A.d.d...T.e.x.t......b.t.I.n.s.e.r.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-1UH2S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (8100)
Category:	dropped
Size (bytes):	9884
Entropy (8bit):	6.059363818458377
Encrypted:	false
SSDEEP:	192:fNsFzeso5l2xT/nABpKoVzk/B/nABbbf+sfwgvGbAK3GrdsdFA:VsFir2tqHYZTsIgvOAdsdG
MD5:	21585E6A3E5E998909B3D14EE8124BB7
SHA1:	FDDA369E6FD4EBD4D0202F7DAC64E121C9C5F225
SHA-256:	9867F1EB0D9F6AE7E160A11F2884A2AA869F4666A104CE3A9B2D944683CE8952
SHA-512:	CEF8E0BCDC9C3101236308302D5228E683D36C9FD4294AE5C09E3CBCFDEDD8043DCE74DA399FEC8E797AD1BB5C76E967DDEC186238321B39CF85055A033614D5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.<asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xrml="urn:mpeg:mpeg21:2003:01-REL-R-NS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">. <assemblyIdentity name="PsSwift_Excel.vsto" version="1.0.0.0" publicKeyToken="521392d9a4d6ce82" language="neutral" processorArchitecture="msil" xmlns="urn:schemas-microsoft-com:asm.v1" />. <description asmv2:publisher="PsSwift_Excel" asmv2:product="PsSwift_Excel" xmlns="urn:schemas-microsoft-com:asm.v1" />. <deployment install="false" />. <compatibleFrameworks xmlns="urn:schemas-microsoft-com:clicko

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-3TOPV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1443568
Entropy (8bit):	6.142835984889151
Encrypted:	false
SSDEEP:	24576:lrsvXhpPGc3LrmikEAMgiAizeTMCf+re/8kwC1POTlYPxdJ2e:+93LrmikEAMgiAiz97TlmR
MD5:	80B7395EA425C09C25C2FBF721B0DDFE
SHA1:	FE2D6AF07AA49A19365A11E3D72D12EB5C9A6875
SHA-256:	89350F4964340601773B160476E19214553D6FA3E177BA7244833CB186B5F168
SHA-512:	A80CBE9350E8B5A76E6DA60B6C14B97BA16984D77066CA4615C39F4EEDE1179AE40340201491FFB463C2DB1E5EC2B7E2A0390BEB7210BF2EF80033BD0570F41D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z...........!..................... ... ....... .......................`............@.....................................O.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........hH..........pY...`..P ..........................................\.Q...)...g.&:...E.....y^.9..j.}"B.a.o.b..,.d....Du,;...K....BZ.My..9.(.orm.L5..M...m...h.9....:P{..\|f-B...Ep..19.pO.........0..............(1.....(,.......0...............(,.....(....Q.{....oj...,..uO...,......(6...Q.P(...+6.{.....o]......0..!........(<.........;....o4...((...o........0.."........(<.........;....o4...((....o....B.(G....oZ........0..#.........(-......(0...-..o....*.Q..

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-453AR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2906864
Entropy (8bit):	6.1304802211075815
Encrypted:	false
SSDEEP:	49152:BOMYXWO56WVCCguWl65E18ca36JMgsEpgSm:BdYmq+0KI
MD5:	CC3160FFAC3F03E36E65CFCCFD43444F
SHA1:	EEB7AE7EADDD43303266FACED404F9206D887338
SHA-256:	676C6CA18045724C69A17D4F189979173555401E9FC1B3E62204C4DA783364CB
SHA-512:	5E6D38FECBFA4071DC9769CCFC8E104FF0CF537DD5B36DD15C3D052182562C78E272837224D245D6E0F25AB615ADCCBB759F13A5662D272311D85E654436A5AF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\..Z...........!.....:,.........~X,.. ...`,...... ........................,...........@.................................,X,.O....`,..............D,.......,......V,.............................................. ............... ..H............text....8,.. ...:,................. ..`.rsrc........`,......<,.............@..@.reloc........,......B,.............@..B................`X,.....H...........@...........0.......P .......................................q...S..../....Q$..x.EIU.Mms..^..\|...0.M.".3.6....'.,9....t...I.i.x%KL..`.............`m.3.E...m.a(.>.)z.q......o..a..l.[J..%&...s....&...sL...&...sf...&...s_..."..s....&...s......s......(K...,..0(....sL...z.r...poM...,..1(....sL...z..{....:.(......}......{...."..}......:.(O.....(.....^../.r...p.3(....sP...z..{....:.(......}......{...."..}......{...."..}......{...."..}......{...

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-B71FA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6003440
Entropy (8bit):	6.336301207421368
Encrypted:	false
SSDEEP:	49152:uNnm/IpxW91bWdkU7YtHqkSYVK/sp46tIZv34GhDfsJx27:uNyn1bxOY8kpVt1Wvpj
MD5:	0FD285B929989BC0600351331CBDE8E5
SHA1:	FCBDE267826F8C4D15E27D487E4CB819B552A8C5
SHA-256:	43AA1A815C6CF21797166E07101F6C73635A48DF81F528121E10825F97BC4B8E
SHA-512:	4DD22BE44290E15507863D028C5EE4404282104BD76934A6F047187D6A5A87DDCEED601B1A46BE778453F62B03D86D0E6B1D6EFD7F54BA8623FF320442246AEC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z...........!.....z[...........[.. ....[...... ........................[...........@.................................\.[.O.....[...............[.......[.....$.[.............................................. ............... ..H............text....x[.. ...z[................. ..`.rsrc.........[......\|[.............@..@.reloc........[.......[.............@..B..................[.....H.......8h/...,..........M......P ......................................H}.e.g.P../.W2"....<.'o..7.....a.........R.^...3..\RvxtM)h6...........GF..s....{^El.>.B$.Fo.i.d_3....ji....fO/D\|x........]"..(....n.(A....u....,...t....}....J.(B....oC...u....:.(B.....oD.....0..F........(E....+..o....t......o5....(F...,......o....-....u......,..o`................1.......0...........u......-.s......(B....oG...*....0..@........(E....+..o....t......u....,......o....-....u......,

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-C6KMG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27648
Entropy (8bit):	5.543669788173604
Encrypted:	false
SSDEEP:	384:Uba88nxJ70U6EJEKQ4WPQTI0yjXFhKJrWVTn4cNO9MFRvfmGSzi51tkNzo7vm:Um77/tTIfj4WbO9MFH5INMT
MD5:	9CAB294A1475FFB98EFE67EB5B1F1F06
SHA1:	26C65EF417A51748DEEEBA1B10905C983963389E
SHA-256:	56503E0AAF9852070F1D4647A46509E5C1A8CC42DCA8195241A4EFC43FFA17A0
SHA-512:	50C8D965AAB5C7DF621F44CE9EE4F5CF58C9B227B6B56FCFEDDBEBEED182B81DF07EB216FA9580DC3C7FDF679A5CDAD2C65AB74417927650CFD7D14299CD5FAF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.[.........." ..0..d..........J.... ........... ....................................`.....................................O.................................................................................... ............... ..H............text...Pc... ...d.................. ..`.rsrc................f..............@..@.reloc...............j..............@..B................,.......H......../...R...........................................................0.. ........(.....(.............o....(......{....N..}.....r...po@.....{...."..}......{....N..}.....r...po@.....{....N..}.....r...po@.......0..)........{.........(....t......\|......(...+...3.....0..)........{.........(....t......\|......(...+...3...{....N..}.....r/..po@.....{....N..}.....r=..po@.....{....N..}.....rG..po@.....{....N..}.....rc..po@.....{....N..}.....ro..po@.....{....N..

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-EI8K0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37376
Entropy (8bit):	5.841941000132943
Encrypted:	false
SSDEEP:	768:G9yjr9Fk8tojuXNFsxmgKmOgOYZXGS9QXyqZE6hA:62ZlSMNycgLEyAG
MD5:	1B68623BFA702CA4C79782ADED128698
SHA1:	6BBF365A994173204070CDDA493775496129617C
SHA-256:	B2D968A981B0354D80B1B4BEA35053A7CA24D1CE2B933CC7D555989532DE1370
SHA-512:	5B5F1B21D3BCDB1A9BF8B3CF96FEE3A7E381596FB860237B6C8CF5CEB4D0353F22C6CB9845AEE5F0121447FF5CDDC552E625A396EB1A5CD7F535682D3B3D2E9D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.[.........." ..0.................. ........... ....................................`.................................T...O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......48...l..........................................................V.(......}......}....Z.o....-...o....().....{...."..}......{......{....2.(....o......0..K.......~m...-$..+...(.........(....(....( ....m...~m...{!...~m....(....o....o"...2.(....o....Z.(....o....r...poT...Z.(....o....r...poT...Z.(....o....r...poT......(....o.....(....~#...~#....~#...~#...oi...(".....(....-...(....o$......1...s%...(...+..(....o....,..(....o....o....r!..po'....2.r+..p($...*

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-FKT70.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (8071)
Category:	dropped
Size (bytes):	48907
Entropy (8bit):	5.497931853993181
Encrypted:	false
SSDEEP:	768:4U5tUelzqErhM59Yyid3jo6LDxMuWy0o1mUtBIKLC/Or2U8g5o2/0oJzZMKOTQhP:5lzqErhM59Yyid3jo6LDxMuWy0o1mUtr
MD5:	963A390F88484467C1B4A7EDE6DD9578
SHA1:	75CECE1ACD16C1C3105D0D029A2EA445BEC909E9
SHA-256:	68248E949D12F5F56D8BB393D9C6742756C43308010A26863A103F0432A79AF2
SHA-512:	9283476526DC883832BDD2A40FA5F292E68B06CD65A70641E2D060D37FC1F45F5DA67BF8FBC32C4F6DC2EBEBB646F75A62B62BC036900280D805EB3EFCE347ED
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.<asmv1:assembly xsi:schemaLocation="urn:schemas-microsoft-com:asm.v1 assembly.adaptive.xsd" manifestVersion="1.0" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns="urn:schemas-microsoft-com:asm.v2" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:co.v1="urn:schemas-microsoft-com:clickonce.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:co.v2="urn:schemas-microsoft-com:clickonce.v2">. <asmv1:assemblyIdentity name="PsSwift_Excel.dll" version="1.0.0.0" publicKeyToken="521392d9a4d6ce82" language="neutral" processorArchitecture="msil" type="win32" />. <description xmlns="urn:schemas-microsoft-com:asm.v1">PsSwift_Excel</description>. <application />. <entryPoint>. <co.v1:customHostSpecified />. </entryPoint>. <trustInfo>. <security>. <applicationRequestMinimum>. <PermissionSet Unrestricted="true" ID="Custom" S

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-H8F7U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	42496
Entropy (8bit):	5.749504408019078
Encrypted:	false
SSDEEP:	768:E8klfUNLujPMxdrrQFqh/cndhwbvTw3PUHs8bKKQq77yqMvWMDn3FaVWg/:EDsujkxDcdw7w3T8byqMyB
MD5:	3ACCD239468934329EE8B919C55554C5
SHA1:	AB333512299A4BA32A134DBEB98616289C4963F2
SHA-256:	9F8C516D3A8B819678915B4059538CDDB549BD9B3D446988A50E1D6319A56C8B
SHA-512:	006FB57442043ED787E6F72E13CB54C6562F3B515577C5616629765264E65B49FEE213CF29D7E77DBB5C30AA5473E28253B36771D2F493F48A777D67D465F933
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.[.........." ..0................. ........... ....................................`.....................................O.......x...........................P................................................ ............... ..H............text........ ...................... ..`.rsrc...x...........................@..@.reloc..............................@..B........................H........<...\|.............`...........................................:.(......}......0..)........{.........( ...t......\|......(...+...3.....0..)........{.........("...t......\|......(...+...3.b.{....%-.&..s#...o$...N..}.....r...po......{...."..}......{......{...."..}......{...."..}......{...."..}......{....-.~%....{....r...pr...po,.....{....-.~%....{....r!..pr...po,.....{....-.~%....(....%-.&..(....o8...o.....(&...~....%-.&~......}...s'...%.....(...+..

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-J8M7F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	5.722661457182719
Encrypted:	false
SSDEEP:	768:VIZR+FMStbMSttX2ulN7HNM5mHe0Gf0K6iD1:QR+FMSBrt57pNGf0KT
MD5:	9F6033AC4D0F4522672094B65C8D360D
SHA1:	651EF691F096BA7CA57369A370F1CCD1785674F8
SHA-256:	509D771F9DDC757A8F812C2EEB100604635DD3AC44E321CA16B8A4FD2CBFDD76
SHA-512:	3E10C8139C8FE752BD6AD4E1DE1673D93D5EA72EE45A988673E268C28AA0EDA87D56C410F3D86F3D19C0CFE859C81AF20D3E23A3EA3B0280FC0F4F16071FAFF0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.[...........!..0..\...........{... ........... ....................................`.................................T{..O....................................z............................................... ............... ..H............text....[... ...\.................. ..`.rsrc................^..............@..@.reloc...............b..............@..B.................{......H........,...L..........dy................................................(....V.(......(......(......{...."..}......{...."..}....2.s....o....^.(.....(....s....o.......0...........(.....r...ps....(....(....t....}.....rK..ps....(....(....t$...}......(....oD...}.....(....oF.......~....~....~....~....~....~....~....~....~....~....~....~....~....~....oB...}......(....oP...o@...oL.....(....V.(......(......(......{...."..}......{...."..}......{......{......{......

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-LF9SO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	89328
Entropy (8bit):	5.936010072096629
Encrypted:	false
SSDEEP:	1536:eovLCaWmC9Evc8ww+3qkgT2mJDcDyQW+v/HFey290ywmizNaiI:pmaWmC9EvfF+3qkCgbv/HFz290ywNJab
MD5:	3413FE6B192A55D1BCD6160822B33A4B
SHA1:	D9E184656F4EB8A564182AE00F798424EBE08AF1
SHA-256:	257A4E440A1961BC7867165573585043A5FE4C785A977A0EF9B64DF1045C5638
SHA-512:	364106E044D0133E4565E60FAEC0AFFA8D091ACEA7458C35A1677AD88EC8F311764ABC3675B48144E660A6A6922FAD24811C19559F20269A38876B7C4BE250D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Y..Z...........!.....<...........Z... ...`....... ....................................@.................................pZ..K....`...............F..............8Y............................................... ............... ..H............text....:... ...<.................. ..`.rsrc........`.......>..............@..@.reloc...............D..............@..B.................Z......H.......t................p...&..P ...........................................<.7....g.]s.F..A.8S/...ii..S...X...:.B.{g._.P.0....7..6#H....Mk8...5....H.$....e.f.,YF;...:.:...m..[8..w...Y.\|...7..,...oy...2.-...ox.......0..)........{.........(&...t......\|......(...+...3.....0..)........{.........((...t......\|......(...+...3.J.{.....{....()...J.{.....{....(.....{....~.{.........}.....{....-..(......{....~.{.........}.....{....-..(......{....^.{.........}....

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-M0JQ2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	145920
Entropy (8bit):	6.284366835672585
Encrypted:	false
SSDEEP:	3072:QiM8e1v6VEEJ6BrihSXAk7DFLdXeEeXSJd4dH08IICZkoWq4VaWD9UZ:QGe1v6VEEbSDddISJd4dHyZSy
MD5:	647B60EF82811B042243740BF933B904
SHA1:	C151058512D5375282CF79AF591DEA8AA0E3BCC6
SHA-256:	D31EA960A571DED3BC521C6D9A277E4D480618D279AC0B621237C6C4016472E8
SHA-512:	F36503D82DAC1BD06DBDAB309F9DAAA75CE57357A6DB4ED12DC20A70821BEAE18D52355B1BFDB6F978CEDD4A872B6A5791524D4292C3849A928024B27248D802
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.[.........." ..0..2...........Q... ...`....... ....................................`.................................@Q..O....`...............................P............................................... ............... ..H............text....1... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B................tQ......H...........................p.............................................{...."..}........0...........:.....{......_o!....{......_o!....{.....o!....{.....o!....{......_o!....{.....o!....{......._o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o!.......0...........{.....o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o!....{.....o

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-OF3B7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2029296
Entropy (8bit):	6.091141632740869
Encrypted:	false
SSDEEP:	24576:Q4TYimb7TXGhyCMuezlX1gSW3g/BZ5fzbtkMJZ:QuEtZ/tk6Z
MD5:	B7EB4804E39CDE56725BDC96414FDC9F
SHA1:	7786C42E2BBC2C61038CF4401AFBB6D681671C4B
SHA-256:	BBC36CCFE902FEAC3AE66509F35276DAD195D76217BACD070C9107EAC7E37A7E
SHA-512:	CD8E1BA05FDE0CD889FDA5FB51BD051CED009A757A42689FE9C2F8265F43F5F4F887AC56E008CA20007240C5AABB5EF2A5E98405CF1F150003254994ED0C8726
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z...........!................>.... ........... .......................@............@.....................................K............................ ....................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................ .......H.......P{..hw..............5...P ........................................o..w.i..DQ...Y.m}I"...f..sk\..50.9.A{....2..4.V...Jg.R(H..QE^C!x.D..<...)..J.....W.jIqi..^.F+A...4{^W.5.y).....n.3..b".....{...."..}......{...."..}......{...."..}....2.{....o......{...."..}......{...."..}......{...."..}....:..}.....(.......}.....r...p}.....(.....s....}....2.(....ug..."..(......{...."..}......{...."..}......0..[........(.....o....t....o......(....o.....+..o....t

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-P9DH3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4678384
Entropy (8bit):	7.420107443856783
Encrypted:	false
SSDEEP:	49152:HPtHZT11v2pAeyATtVhPiY13pxT2VbqWmUZrW4MWoczQWunpe2Kqo:1R2pyY1ZpubDZCxWzQWunptKF
MD5:	37CE7703F14C2E2A01A596057EC3B0E4
SHA1:	A3C9BED6D4E02C86903322793E25535BCC4DC3B1
SHA-256:	12D2A9AEDCFF881B25CD70ED7C822330F096E7DA1FCA0ED4CDE82108D4F03ED2
SHA-512:	D0F5036299D2D2225A423E8F69BC43FB6A03F4F6DDFD3187414A04E9B61D098A250511DB6B4DA6164F8EB55AE1A50D8437B290B28D740EE43834DD34AFB8A76B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W..Z...........!.....BG..........`G.. ....G...... ........................G...........@.................................``G.K.....G.8............LG.......G.....(_G.............................................. ............... ..H............text....@G.. ...BG................. ..`.rsrc...8.....G......DG.............@..@.reloc........G......JG.............@..B.................`G.....H........QD.P.................@.P .........................................B6....Fc.[`.X.Z1...HG..;....y4...k.....j{..P<VD!.6.qDkeT....Z.B.{m..D.HZ.......%..C.C.g......x)V}@....O.4...)C{e\|..i._...(.....s....}.....s....}.....s....}.....s....}.....s....}......{.....o....-...{.....o....(.......0..k...........(.....o......(......(.........(......(....,..(....-....~....(......(....-...3.....(....(......(.......(....f..{.....{.....{....(........0............sX......}.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-PAU3O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	653824
Entropy (8bit):	5.911899312502532
Encrypted:	false
SSDEEP:	12288:WvS56CuBAXYxeeNvWHc3oY2osSeBTdb+:K07SAIxOhAVeBTdS
MD5:	F33CBE589B769956284868104686CC2D
SHA1:	2FB0BE100DE03680FC4309C9FA5A29E69397A980
SHA-256:	973FD70CE48E5AC433A101B42871680C51E2FEBA2AEEC3D400DEA4115AF3A278
SHA-512:	FFD65F6487BC71C967ABCF90A666080C67B8DB010D5282D2060C9D87A9828519A14F5D3A6FE76D81E1D3251C2104A2E9E6186AF0EFFD5F331B1342682811EBF4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....K............" ..0.................. ... ....... .......................`.......M....`.....................................O.... ..T....................@..........8............................................ ............... ..H............text........ ...................... ..`.rsrc...T.... ......................@..@.reloc.......@......................@..B........................H.......Hj......................\.........................................{...."..}......($...:.($.....}...."..(%.....(......{ ..."..} .....{!..."..}!.....{"..."..}".....{#..."..}#.....{$..."..}$.....{...>..}.....(......{+...>..}+.....(......{%..."..}%.....0...........{&......(....-....(....6..s....}&....0...........{'......(....-....(....6..s....}'....0...........{(......(....-....(....6..s....}(....0...........{)......(....-....(....*6..s..

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-QSKEV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10894576
Entropy (8bit):	7.2837073232040055
Encrypted:	false
SSDEEP:	98304:lUIhpD5Y2WAOfraPMJI/83OJCpC3JPM52zZZaAgbbXI/ox4LPv:lBhpD5Y2WAOfraPPCpiJPMPDbbYw4LPv
MD5:	42D84BF7B26528B8277F33F66D1146D9
SHA1:	0EF927BFE101A71B63B99A58C8D9D74F01B17F9E
SHA-256:	AD0A16A479E9664C6C822C219DD6ECF59F1A5B742EFA0596A815CA7B085EF472
SHA-512:	E39D6679A48DB965B389905D790287D665AA08A7C005929C4DE47FCEDD1A3B46EB78DF2B5E1FC3479C40C36AB68CCFE2DE847E95C8F307FA306B1C553AE67E3B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..Z...........!.................;... ...@....... ....................................@..................................;..S....@..h............&.......`......P:............................................... ............... ..H............text........ ...................... ..`.rsrc...h....@......................@..@.reloc.......`.......$..............@..B.................;......H........`..x.%.........8.....m.P ......................................j.+.]..vh8c.]ox/2..s..%]...x..2wc..I..!n....m.9IN.0.......?R.8}r.:~....~.-.F...U^m....K..,.........fU="o4:.Z.....].+s.@,..0.....................(.......}.....(.......}......}......}......}......}.....0...........................(......0........................(.......}.....(......}......}......}..........(......{......{....R.{....,..{.......j..{....>..}......}......{......{....*n.{....

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-S1QUV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32664
Entropy (8bit):	6.067183560016906
Encrypted:	false
SSDEEP:	384:RWw7k8otmBsHC+w4TEn4jo+qMzEeBoOR/VEPY+GQ4A4agQS6Lc7DQWgyxmYi/Tjr:AwJTwYB4E5n/xe5ar/Mi2jpvc7H
MD5:	090635087D067BCEF8056D5751F2D0C4
SHA1:	0AD9C2B6C79A3327D138819ED0435D18EE9AAC78
SHA-256:	8CB09317C326E9B0F83C337EAE7CCDEAAD3E45E5DA3603E1EBC90C5A06AD1702
SHA-512:	41F3075E362710FFCEB088623967A795E58E632BB48B237A38AB2BB443B06900BC3C9A77CEB3B9379AFEF5BE0C2F90BDE8161B2A3264F0C7DD089BA569403DDC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#..K...........!.....X..........nv... ........... ..............................,x....@..................................v..O.......d............h..............tu............................................... ............... ..H............text...tV... ...X.................. ..`.rsrc...d............Z..............@..@.reloc...............f..............@..B................Pv......H....... &..TO..................P .......................................2...B..5....vO{:R.G.._(P%+.....\|cn.A..@.E.#.....w.....?o......."[......6...\|..z...:,.L.......A..\|.T^k.A....R-...N.......(/............o~...}......{....op...}......{....v.{....ox.....o....u.........2.{....ov...2.{....ow...2.{....ox...6.{.....or...6.{.....os...6.{.....ot...6.{.....ou...2.{....on...2.{....oe...2.{....of...2.{....oo...2.{....ok...2.{....oi...2.{....oj...*2.{....om...

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-S2ENC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6393584
Entropy (8bit):	6.38882007185756
Encrypted:	false
SSDEEP:	49152:Hn1LAb4DEh1c2BO1zjOqsD5WL1S1dFw9jO6XXzGRdovRHYpfLC4qh6AQ/hiq9PUJ:H1L5EhuCO1zjyWL1S1dFAjO6XaCr
MD5:	46C5A5DB4CF39CA54BB80FEBA2DA3E3D
SHA1:	D6F0F7C8AC55AA8AADBE8758A72E1E1376DAE6F3
SHA-256:	5713342030339805894F61B2FA8B276B676549C12D77136C4D5AA216EE5EC828
SHA-512:	FCF21A2BB030353BCFDA0D3F98C813375D075EB15D8AFDA35C355BDC35D804BCACEECB159EEB21F4E62DA075AA1976E3085716F552CE956BEDB43EFFE8510E3D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...G..Z...........!.....na...........a.. ....a...... ........................a...........@...................................a.S.....a.X............xa.......a.....p.a.............................................. ............... ..H............text....ma.. ...na................. ..`.rsrc...X.....a......pa.............@..@.reloc........a......va.............@..B..................a.....H........M9.p>(.............M.#.P ......................................j.j..f'8{......!.-...73..%......a..t=..+"..EF..EJ.oa&.k..L....}x....,.j......]n.x!.....Ma.+u0....../_.~..x...=..W8...)`..(.....s....z....(......6.......(......0...........s....}t....s....}u....(......}p.....}q.....}r......}s....(....s....}v....,(..,...r...po....-..{v...r...p.s....o......,\..o.....+>.o.......(....,..{v.....(......(....o....+..{v.....(....o....&.o[...-....,..o!....*...........

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\is-VD39V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4263152
Entropy (8bit):	6.510018353229873
Encrypted:	false
SSDEEP:	49152:q848JdwidmwOhp/tPmmcL8gxegZHO1Ee+hxYbnQURe5PN+3m+o7Hn6ajZZ6n3ZCM:Y9Nn5DXgxlZWt
MD5:	6C35010320D7B3DF8090617EF7B4F172
SHA1:	2FE8FE54A530AA66D753841FA2B9C94DB70CB1A7
SHA-256:	8A86C1CF664DB65C7C6F06D3FC236B35474ED2810F5EAD18A7AABDF28B4A979B
SHA-512:	F308858A93F747F9A88C50BEF4885E1ADCF431AAF0966336B6727A51798AE29A259F30703A487CC860AC5D34181C9F048BA3590B7F220D64FEE073DC7F3FA262
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...g..Z...........!......@.........N.A.. ... A...... .......................`A...........@...................................A.W.... A...............@......@A.......A.............................................. ............... ..H............text...T.@.. ....@................. ..`.rsrc........ A.......@.............@..@.reloc.......@A.......@.............@..B................0.A.....H.......0....#!.........8.......P .........................................!g...$2.....@..2.b...._.{t.&.P.u.0.\|-.".xJ.^:.E.......9...Ne...<P..J_....S..K.tW.S.6..J/ .".uq..[.EP..3.t..y.....V$\|.....J.0..-........,..o....,..o....o[....o.7...(.7.....o.......{....2.{....tw...."..(.H.."..}.......(....2.(....ux...j.(....-.~.....(....o....Z.(....-...(....o......u}...,...t}...oz@...o.....u)...,...t)....o.........(.....(....ty...r...p.{(.....(....o......"..o...."

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.Data.v17.2.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	168176
Entropy (8bit):	5.0551974504950685
Encrypted:	false
SSDEEP:	3072:caa7FY7YdvkRWLByhPvRig4lvzmww3/d7gzoiUGzffFPhas:WDkRdJMlvzmwwBgzoiUGzffh
MD5:	1086063A08EE97717B9FEE29F9D20926
SHA1:	F72878A2869C0BBD2FF65DE27FD3F9963DC47C79
SHA-256:	BA3A7467F55CF6FC4D67C6E16B597512902B824DA929EF253DA088790A34C125
SHA-512:	13849E3A84D5E5F83D09B2694BF6A2B5B9173BE2F4A79CF78575DA38FC2208EAEF388766570D53B31B0F476FE187F9E36F6B94269D0E60C2CF2DEE5BA7E8151F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...O..Z...........!.....p.............. ........@.. ....................................@.....................................O....................z............................................................... ............... ..H............text....o... ...p.................. ..`.rsrc................r..............@..@.reloc...............x..............@..B........................H........................ ...h..P ......................................./.htq.4.k9.IWRg...;..JT....\|U...hO..@.V..FM.?.....tR.4....W.......R.d..E..=...Q....+....JW...OA"y........=...9..(P\|.5.TV,Y.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.....1...N...b...W>.....$.z..A...T.....j-I.[...I$o......J.&.'.o.............J.4......D.>01.QA..

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.Pdf.v17.2.Core.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10992
Entropy (8bit):	6.167589003226755
Encrypted:	false
SSDEEP:	96:fOPOA5Q/R0zh6ltAxHhBHazR50ATz3GLvYoB6hbWCInvzz2dqxSG7+4EQej7DbRd:SOgQYBHaz7TzWLv7qF4nYe+PjPVYZnQ
MD5:	B75D140CDF0BCDA5C4F9C843E575CB91
SHA1:	1CE8E5AB23B487BDCAC5ABE539D9868096367251
SHA-256:	DA6AC78FDB5505BA0BA32B48B68C14A1ECB3AFF8BA8DAB243C81570445E4B3D5
SHA-512:	3947857EA8AFFA9E652D0F2EA504651B4519246BD2867F6B92F11033DF8630B393E0580388B694FD4B933DCD11A8D27CDB6D97A08FB71853CBA17373DADB57F5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._..Z...........!.................(... ...@....@.. ....................................@..................................'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......H#..t............ ..w...P .......................................%..o}...P.P*.@O.;.4v....V5...B.9j..f..z...$;.'......Z..6z...,^....Tq...B.k`.='..T._u..M..G.n..'z....]....^i}..q2......-.s..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.1B.....`....X.........K.......8...FP.d.f.C.o.r.e.S.t.r.i.n.g.I.d...D.e.f.a.u.l.t.D.o.c.u.m.e.n.t.N

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.Printing.v17.2.Core.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70384
Entropy (8bit):	4.925947286914142
Encrypted:	false
SSDEEP:	768:YgWNTN07K72OKzZrCbeK2BYb/qp7yFWBOFdy6IQO8oLkDaqaJJ:YgWNu7K72QEPBOF1I/Ca1JJ
MD5:	1699C00E3792347C3FB74856CE0F7501
SHA1:	41F2A60E02A3D89CFDBAA5473F32A315316A5D4B
SHA-256:	8EAED6D88BC208CA0C756EB581C96643EC39A0E54AB7F3A418A44B37925B81E7
SHA-512:	64BECEDA4E9DE382802836BFA4873A6E0631EACBC7FEF03A9816578A57C10180F6DAFDA9E095A1C2568C1B92B048D436314F9E834296709CE07119D5252AEDB0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..Z...........!................n.... ... ....... .......................`............@.....................................S.... .......................@....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................P.......H...........@............ ......P ......................................;..c....._`.{.5.c<.Q..z..]." Z.pQ.a.Y...O..!....H.;.o2..........%....Y?..v.._...-......q..J.......1....v.s.g.X.j=..c\|I}...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.....M>..M>..M>...7.'...P1....K....%.. 7..a.*`..s..Bst..-...<.. .........26.n.N...N.@.......

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.Sparkline.v17.2.Core.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10992
Entropy (8bit):	6.250864368288643
Encrypted:	false
SSDEEP:	192:aY0qFAnbkALhOncRtzfTzWLv7qF4nYe+PjPs3o:aYBAnbkALhOcRtzfmreqnYPLAo
MD5:	70EA31F60DCE260F23072CF870AC9272
SHA1:	68BE15039C9BD4A5577AA299782237D72EFF08E4
SHA-256:	6BF943BF59BBA826E33EF2CEE8FDC3A840E8EDC8C6C3E4CAFFF20FA7E0241E08
SHA-512:	B94BEE54592939BC81C41735C2A8A5211CD7FFA0502131B88FE262FC40952BEAD935206CB1796A9AB51535DD239187D45B79B3398FBE8A58943B3F797A0D2A22
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Y..Z...........!................^)... ...@....@.. ....................................@..................................)..S....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@)......H........$............... ......P ............................................D....r...d..Q.3g..5..>j.?K..K.[w............q...EGZ..I...C..+%r....3f....6.l.Q...p.......?...r....e.........@(ph.C...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADPEi..F..:.kp.......9...u...4S.p.a.r.k.l.i.n.e.S.t.r.i.n.g.I.d...v.i.e.w.A.r.e.a.....2S.p.a.r.k.l.i.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.Utils.v17.2.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33008
Entropy (8bit):	5.8760116762498695
Encrypted:	false
SSDEEP:	768:KFAIDEJXs5gQ044QALPnG1lwAY0hE4lAyAOwnKaqn:KFA8Y0hIy2Kao
MD5:	BD9685DFF07F59534072CC434054C134
SHA1:	E283EBAE02C3AB8102B287D481FD6F238ACB0957
SHA-256:	E5F51155EDF032AC874CB897B68ECBBF4FED88755E3B0E2FC9794C7EEC7CE6B7
SHA-512:	CF9BD2A6E3F5914D2C0760684BC8FB8698285AFB02500CFBDC0411703768E1F864AEC6BE738B1AD11FC5AD18B1B5D07955DECBB15B85E88385D455C0D307F92C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\|..Z...........!.....`..........>~... ........@.. ....................................@..................................}..K....................j............................................................... ............... ..H............text...D^... ...`.................. ..`.rsrc................b..............@..@.reloc...............h..............@..B................ ~......H.......0y............... .._X..P ......................................y.M'E..>..R.(8}."&.._x.)K.d.._Q..OJ..%.&.+xS..O]-X.U..%v=.\|.i...`8....0oUzN.....I..7....y.pcxq......._0..T..r].3J......X.!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....^.......PADPADP8Z...k..2h......@J...m.....?E...g...M....\.....'......_....c.M.....=4.... ...L....e..(.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.XtraEditors.v17.2.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	120048
Entropy (8bit):	5.5314088875334395
Encrypted:	false
SSDEEP:	1536:Aon35QNOf7pxJlTOZOu7/5XCKwVKJG8jlpSLnaW:N35tDpxJlTOZOu7/mIjlpSLnaW
MD5:	75C13BE697922709362A4149F05F42D4
SHA1:	CE89E5F90D3473AFA5CB66617D120838B9D20B4E
SHA-256:	D4A9E95C591FFEDEDA1B9CE422C8C959750023040217080628041EE4CDEB4C67
SHA-512:	4087A6A36CA317BD7FCD2D233D2F06335209762A8285522EF093A0E14686B69138F3544791A4F39A5FB11B3F1AFC86ADD4A15154B33ADEB8164079997407C152
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z...........!..................... ........... ....................... ............@.................................\...O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H...........l............ ......P ....................................../3+S.....s.(.H.e9..L)Y........+P49:.f..4.cQ...ZHF..Cpd..O..@8I...b... \....nO.........;J..V...X..A..Tj...[..>.3@.....]L.[..J...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP....(7...P./.P...G...T.@u........I...........<.......I...Db.e.A.p.p.e.a.r.a.n.c.e.s...P.r.o.p.e.r

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.XtraLayout.v17.2.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17136
Entropy (8bit):	5.938684404320048
Encrypted:	false
SSDEEP:	192:qTJ9CnRuPTrzLgViVjVvVkVXNlHBKjVqyHTzWLv7qF4nYe+PjPIS:YPCEnHKYx9u38jQyHmreqnYPLv
MD5:	EB1BA4D6A07AD15F944DE88A4C3F51F4
SHA1:	3B0A40093C215BF40620CA950DBAB4A18C7C6803
SHA-256:	974B020099727D3D68150BCD74E5ED0DDDA5D7434DDA0220265B63A9612A4FD3
SHA-512:	60C44F543911758BFCBED792FC8867E396F90AC23557C449AA46AF62C28293F078F0A8056A77B22727A4768835ACDA7B6FD151481051B40B9F90D9A68FBD0E5D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z...........!....."...........@... ...`....@.. ....................................@..................................@..K....`...............,............................................................... ............... ..H............text....!... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B.................@......H.......H<..h............ ..x...P .......................................@O#v.P......O..........\|h....D.......-q.o.08c.x....?.=y4. #G....%.Q@.BW.d..U...6x.^.W......./..D....M.Jo%.z>.1.U9..L.\|..t..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....=.......PADPADP ......LO3.?....q...U.;.V...u..g.....g6..........v....]..K%.YX..Vg..[E.(s...+.......);..H...

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\DevExpress.XtraTreeList.v17.2.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18160
Entropy (8bit):	5.8739895518650895
Encrypted:	false
SSDEEP:	192:DO21r6pp9/xi6xR/aaJtYD7mneQdLTun3nU4TzWLv7qF4nYe+PjPQZl7:S21mppFxXjfJtQ6Ru3nU4mreqnYPLQH
MD5:	EBA67B8B9C6C4B3EAE9C6B2C2B9699DB
SHA1:	752BA97653EBCA18F809E05037CF2A23FFCE439F
SHA-256:	CEFB619E2EADF6304274E6DC97BE54B951C342E6CED4E10D69F7BF56CBCBB9E8
SHA-512:	58DDADF9E9EB07445A7765020CA0833E0E43A3E68EE6BF471AC7EB899A8E8E458D0B62162F80478C3E5CAB31BCBAFD2066E27880A7F740C04C569746833D9307
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z...........!.....&...........D... ...`....@.. ....................................@.................................\|D..O....`...............0............................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H........?............... ......P .......................................t$.[.qx.E%Z.G6y..Ww...]-v.....Ao.YZN.Fd..Px..@..~*&...]p....I?.j.~.....m..]n.}..q....[r.V3..-.....I..n]Bve...hr..0.8j6Z..................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....0.......PADPADPI=...d-.A.X..............i.... ..O4..P4.jX4.....Q......R.....6...MV.........V....`.....9;.m._.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-2G38J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10992
Entropy (8bit):	6.167589003226755
Encrypted:	false
SSDEEP:	96:fOPOA5Q/R0zh6ltAxHhBHazR50ATz3GLvYoB6hbWCInvzz2dqxSG7+4EQej7DbRd:SOgQYBHaz7TzWLv7qF4nYe+PjPVYZnQ
MD5:	B75D140CDF0BCDA5C4F9C843E575CB91
SHA1:	1CE8E5AB23B487BDCAC5ABE539D9868096367251
SHA-256:	DA6AC78FDB5505BA0BA32B48B68C14A1ECB3AFF8BA8DAB243C81570445E4B3D5
SHA-512:	3947857EA8AFFA9E652D0F2EA504651B4519246BD2867F6B92F11033DF8630B393E0580388B694FD4B933DCD11A8D27CDB6D97A08FB71853CBA17373DADB57F5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._..Z...........!.................(... ...@....@.. ....................................@..................................'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......H#..t............ ..w...P .......................................%..o}...P.P*.@O.;.4v....V5...B.9j..f..z...$;.'......Z..6z...,^....Tq...B.k`.='..T._u..M..G.n..'z....]....^i}..q2......-.s..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.1B.....`....X.........K.......8...FP.d.f.C.o.r.e.S.t.r.i.n.g.I.d...D.e.f.a.u.l.t.D.o.c.u.m.e.n.t.N

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-7A7VE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	120048
Entropy (8bit):	5.5314088875334395
Encrypted:	false
SSDEEP:	1536:Aon35QNOf7pxJlTOZOu7/5XCKwVKJG8jlpSLnaW:N35tDpxJlTOZOu7/mIjlpSLnaW
MD5:	75C13BE697922709362A4149F05F42D4
SHA1:	CE89E5F90D3473AFA5CB66617D120838B9D20B4E
SHA-256:	D4A9E95C591FFEDEDA1B9CE422C8C959750023040217080628041EE4CDEB4C67
SHA-512:	4087A6A36CA317BD7FCD2D233D2F06335209762A8285522EF093A0E14686B69138F3544791A4F39A5FB11B3F1AFC86ADD4A15154B33ADEB8164079997407C152
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z...........!..................... ........... ....................... ............@.................................\...O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H...........l............ ......P ....................................../3+S.....s.(.H.e9..L)Y........+P49:.f..4.cQ...ZHF..Cpd..O..@8I...b... \....nO.........;J..V...X..A..Tj...[..>.3@.....]L.[..J...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP....(7...P./.P...G...T.@u........I...........<.......I...Db.e.A.p.p.e.a.r.a.n.c.e.s...P.r.o.p.e.r

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-BGR7A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17136
Entropy (8bit):	5.938684404320048
Encrypted:	false
SSDEEP:	192:qTJ9CnRuPTrzLgViVjVvVkVXNlHBKjVqyHTzWLv7qF4nYe+PjPIS:YPCEnHKYx9u38jQyHmreqnYPLv
MD5:	EB1BA4D6A07AD15F944DE88A4C3F51F4
SHA1:	3B0A40093C215BF40620CA950DBAB4A18C7C6803
SHA-256:	974B020099727D3D68150BCD74E5ED0DDDA5D7434DDA0220265B63A9612A4FD3
SHA-512:	60C44F543911758BFCBED792FC8867E396F90AC23557C449AA46AF62C28293F078F0A8056A77B22727A4768835ACDA7B6FD151481051B40B9F90D9A68FBD0E5D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z...........!....."...........@... ...`....@.. ....................................@..................................@..K....`...............,............................................................... ............... ..H............text....!... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B.................@......H.......H<..h............ ..x...P .......................................@O#v.P......O..........\|h....D.......-q.o.08c.x....?.=y4. #G....%.Q@.BW.d..U...6x.^.W......./..D....M.Jo%.z>.1.U9..L.\|..t..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....=.......PADPADP ......LO3.?....q...U.;.V...u..g.....g6..........v....]..K%.YX..Vg..[E.(s...+.......);..H...

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-H37KB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	168176
Entropy (8bit):	5.0551974504950685
Encrypted:	false
SSDEEP:	3072:caa7FY7YdvkRWLByhPvRig4lvzmww3/d7gzoiUGzffFPhas:WDkRdJMlvzmwwBgzoiUGzffh
MD5:	1086063A08EE97717B9FEE29F9D20926
SHA1:	F72878A2869C0BBD2FF65DE27FD3F9963DC47C79
SHA-256:	BA3A7467F55CF6FC4D67C6E16B597512902B824DA929EF253DA088790A34C125
SHA-512:	13849E3A84D5E5F83D09B2694BF6A2B5B9173BE2F4A79CF78575DA38FC2208EAEF388766570D53B31B0F476FE187F9E36F6B94269D0E60C2CF2DEE5BA7E8151F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...O..Z...........!.....p.............. ........@.. ....................................@.....................................O....................z............................................................... ............... ..H............text....o... ...p.................. ..`.rsrc................r..............@..@.reloc...............x..............@..B........................H........................ ...h..P ......................................./.htq.4.k9.IWRg...;..JT....\|U...hO..@.V..FM.?.....tR.4....W.......R.d..E..=...Q....+....JW...OA"y........=...9..(P\|.5.TV,Y.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.....1...N...b...W>.....$.z..A...T.....j-I.[...I$o......J.&.'.o.............J.4......D.>01.QA..

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-LCN76.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10992
Entropy (8bit):	6.250864368288643
Encrypted:	false
SSDEEP:	192:aY0qFAnbkALhOncRtzfTzWLv7qF4nYe+PjPs3o:aYBAnbkALhOcRtzfmreqnYPLAo
MD5:	70EA31F60DCE260F23072CF870AC9272
SHA1:	68BE15039C9BD4A5577AA299782237D72EFF08E4
SHA-256:	6BF943BF59BBA826E33EF2CEE8FDC3A840E8EDC8C6C3E4CAFFF20FA7E0241E08
SHA-512:	B94BEE54592939BC81C41735C2A8A5211CD7FFA0502131B88FE262FC40952BEAD935206CB1796A9AB51535DD239187D45B79B3398FBE8A58943B3F797A0D2A22
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Y..Z...........!................^)... ...@....@.. ....................................@..................................)..S....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@)......H........$............... ......P ............................................D....r...d..Q.3g..5..>j.?K..K.[w............q...EGZ..I...C..+%r....3f....6.l.Q...p.......?...r....e.........@(ph.C...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADPEi..F..:.kp.......9...u...4S.p.a.r.k.l.i.n.e.S.t.r.i.n.g.I.d...v.i.e.w.A.r.e.a.....2S.p.a.r.k.l.i.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-NC4QM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33008
Entropy (8bit):	5.8760116762498695
Encrypted:	false
SSDEEP:	768:KFAIDEJXs5gQ044QALPnG1lwAY0hE4lAyAOwnKaqn:KFA8Y0hIy2Kao
MD5:	BD9685DFF07F59534072CC434054C134
SHA1:	E283EBAE02C3AB8102B287D481FD6F238ACB0957
SHA-256:	E5F51155EDF032AC874CB897B68ECBBF4FED88755E3B0E2FC9794C7EEC7CE6B7
SHA-512:	CF9BD2A6E3F5914D2C0760684BC8FB8698285AFB02500CFBDC0411703768E1F864AEC6BE738B1AD11FC5AD18B1B5D07955DECBB15B85E88385D455C0D307F92C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\|..Z...........!.....`..........>~... ........@.. ....................................@..................................}..K....................j............................................................... ............... ..H............text...D^... ...`.................. ..`.rsrc................b..............@..@.reloc...............h..............@..B................ ~......H.......0y............... .._X..P ......................................y.M'E..>..R.(8}."&.._x.)K.d.._Q..OJ..%.&.+xS..O]-X.U..%v=.\|.i...`8....0oUzN.....I..7....y.pcxq......._0..T..r].3J......X.!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....^.......PADPADP8Z...k..2h......@J...m.....?E...g...M....\.....'......_....c.M.....=4.... ...L....e..(.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-UJ625.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70384
Entropy (8bit):	4.925947286914142
Encrypted:	false
SSDEEP:	768:YgWNTN07K72OKzZrCbeK2BYb/qp7yFWBOFdy6IQO8oLkDaqaJJ:YgWNu7K72QEPBOF1I/Ca1JJ
MD5:	1699C00E3792347C3FB74856CE0F7501
SHA1:	41F2A60E02A3D89CFDBAA5473F32A315316A5D4B
SHA-256:	8EAED6D88BC208CA0C756EB581C96643EC39A0E54AB7F3A418A44B37925B81E7
SHA-512:	64BECEDA4E9DE382802836BFA4873A6E0631EACBC7FEF03A9816578A57C10180F6DAFDA9E095A1C2568C1B92B048D436314F9E834296709CE07119D5252AEDB0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..Z...........!................n.... ... ....... .......................`............@.....................................S.... .......................@....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................P.......H...........@............ ......P ......................................;..c....._`.{.5.c<.Q..z..]." Z.pQ.a.Y...O..!....H.;.o2..........%....Y?..v.._...-......q..J.......1....v.s.g.X.j=..c\|I}...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.....M>..M>..M>...7.'...P1....K....%.. 7..a.*`..s..Bst..-...<.. .........26.n.N...N.@.......

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ja\is-UQKVV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18160
Entropy (8bit):	5.8739895518650895
Encrypted:	false
SSDEEP:	192:DO21r6pp9/xi6xR/aaJtYD7mneQdLTun3nU4TzWLv7qF4nYe+PjPQZl7:S21mppFxXjfJtQ6Ru3nU4mreqnYPLQH
MD5:	EBA67B8B9C6C4B3EAE9C6B2C2B9699DB
SHA1:	752BA97653EBCA18F809E05037CF2A23FFCE439F
SHA-256:	CEFB619E2EADF6304274E6DC97BE54B951C342E6CED4E10D69F7BF56CBCBB9E8
SHA-512:	58DDADF9E9EB07445A7765020CA0833E0E43A3E68EE6BF471AC7EB899A8E8E458D0B62162F80478C3E5CAB31BCBAFD2066E27880A7F740C04C569746833D9307
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z...........!.....&...........D... ...`....@.. ....................................@.................................\|D..O....`...............0............................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H........?............... ......P .......................................t$.[.qx.E%Z.G6y..Ww...]-v.....Ao.YZN.Fd..Px..@..~*&...]p....I?.j.~.....m..]n.}..q....[r.V3..-.....I..n]Bve...hr..0.8j6Z..................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....0.......PADPADPI=...d-.A.X..............i.... ..O4..P4.jX4.....Q......R.....6...MV.........V....`.....9;.m._.

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ru\DevExpress.Data.v17.2.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	183536
Entropy (8bit):	4.9727715053516395
Encrypted:	false
SSDEEP:	3072:4lSfe7+XQqcKvY72nzAx7ScyHVBS7ZJJ7J7377RbytNYRMjknJjegokXam:pX+KABy1BS7ZJJ717RbytNYRMjGYM
MD5:	1C9B2D9A6A0FDB7EA0C0C6715AA62979
SHA1:	24C8FD56B3DD8E121136FF7B3D7019ADD254427B
SHA-256:	56E2F51DCD02C18586FF33418419F9789641BBFB6AFA1C8DBA2B1F7496AF84C8
SHA-512:	F05A06CC341690EF257EEF4E3F57586C7EA03F79F8D268A3DD22A78BFAF44794E79D89CF96C5365E9141DE45173D21D55281B6A40CABE5480E17AFF7EBE7D2A6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...O..Z...........!..................... ........@.. ....................... ............@.....................................S.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........................ ..E...P ......................................N4.q.;L.Fg..~od..........[..19....J#.n..s...#q.nX..K..wQl...."<...J....o.q .ns.?^...Q.._1...o5h....\..1..<_..r..&.....PL`.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.....1...N...b...W>.....$.z..A...T.....j-I.[...I$o......J.&.'.o.............J.4......D.>01.QA..

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ru\DevExpress.Pdf.v17.2.Core.resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26352
Entropy (8bit):	5.793770219187073
Encrypted:	false
SSDEEP:	384:xtZYJuaaiCeFIQkp783l6zc9Gs34e2ISTJxzEmreqnYPL+:GJhaiCeFIQkp783l6zcss34e2IQxaqx
MD5:	2821E8A341642113CA99222BDC40AD99
SHA1:	E579FFAEF4FAC9F7C031AC12BCAD3E445977C708
SHA-256:	BC135A7848298998782A6D42C746D6227489375B54252D5DB09601E7BDF39F3A
SHA-512:	8FBB51471E99BCA9B89D0C915CAC3F7CA904043D4536871ACD2C10F83D511DF03DE66A2C6E17DDB313109258567CEF769FB5BEA392C4EAF0E138DECC65356CC6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._..Z...........!.....F...........d... ........@.. ....................................@.................................Ld..O....................P............................................................... ............... ..H............text....D... ...F.................. ..`.rsrc................H..............@..@.reloc...............N..............@..B.................d......H........_..t............ ...?..P ......................................x#.].6M\|.v.&/..,.3~......Iv.A...[...nr.>..e..x~d.^S.y.+....aj.E..Ve..J..w...J.Z....m.{..k)9..k.-j..D.\|.j]T.;R.dJM1..i.?.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....O.......PADPADPV...=....<....y.3..1B.#.......%!......Py..U...a.$..y..................x.;.V^...Y......E..j..

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ru\is-9HNDC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26352
Entropy (8bit):	5.793770219187073
Encrypted:	false
SSDEEP:	384:xtZYJuaaiCeFIQkp783l6zc9Gs34e2ISTJxzEmreqnYPL+:GJhaiCeFIQkp783l6zcss34e2IQxaqx
MD5:	2821E8A341642113CA99222BDC40AD99
SHA1:	E579FFAEF4FAC9F7C031AC12BCAD3E445977C708
SHA-256:	BC135A7848298998782A6D42C746D6227489375B54252D5DB09601E7BDF39F3A
SHA-512:	8FBB51471E99BCA9B89D0C915CAC3F7CA904043D4536871ACD2C10F83D511DF03DE66A2C6E17DDB313109258567CEF769FB5BEA392C4EAF0E138DECC65356CC6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._..Z...........!.....F...........d... ........@.. ....................................@.................................Ld..O....................P............................................................... ............... ..H............text....D... ...F.................. ..`.rsrc................H..............@..@.reloc...............N..............@..B.................d......H........_..t............ ...?..P ......................................x#.].6M\|.v.&/..,.3~......Iv.A...[...nr.>..e..x~d.^S.y.+....aj.E..Ve..J..w...J.Z....m.{..k)9..k.-j..D.\|.j]T.;R.dJM1..i.?.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....O.......PADPADPV...=....<....y.3..1B.#.......%!......Py..U...a.$..y..................x.;.V^...Y......E..j..

C:\Program Files (x86)\PlanSwift11\Tools\SwiftExcel\ru\is-P0OB4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	183536
Entropy (8bit):	4.9727715053516395
Encrypted:	false
SSDEEP:	3072:4lSfe7+XQqcKvY72nzAx7ScyHVBS7ZJJ7J7377RbytNYRMjknJjegokXam:pX+KABy1BS7ZJJ717RbytNYRMjGYM
MD5:	1C9B2D9A6A0FDB7EA0C0C6715AA62979
SHA1:	24C8FD56B3DD8E121136FF7B3D7019ADD254427B
SHA-256:	56E2F51DCD02C18586FF33418419F9789641BBFB6AFA1C8DBA2B1F7496AF84C8
SHA-512:	F05A06CC341690EF257EEF4E3F57586C7EA03F79F8D268A3DD22A78BFAF44794E79D89CF96C5365E9141DE45173D21D55281B6A40CABE5480E17AFF7EBE7D2A6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...O..Z...........!..................... ........@.. ....................... ............@.....................................S.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........................ ..E...P ......................................N4.q.;L.Fg..~od..........[..19....J#.n..s...#q.nX..K..wQl...."<...J....o.q .ns.?^...Q.._1...o5h....\..1..<_..r..&.....PL`.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.....1...N...b...W>.....$.z..A...T.....j-I.[...I$o......J.&.'.o.............J.4......D.>01.QA..

C:\Program Files (x86)\PlanSwift11\is-RQBTG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	730277
Entropy (8bit):	6.52446999800072
Encrypted:	false
SSDEEP:	12288:0qIRz+f+ui8TrPO37fzH4A63RRwDNtuXUZERvDrNMRdT9Taslb0GtzCOpFyxyRw:ZIZg+uiirPO37fzH4A6haDzcUZEIdT9K
MD5:	EBFB4F815CDD360F89E34AE2A5822134
SHA1:	072B155DD4EAE396C457AE40133DAF7BC76DA0C6
SHA-256:	BD6532E8AB9FAF6D0C96CC41B29935ACA7E602C69E24045CBAF79A88D095184D
SHA-512:	14E4751C8221C4718816FF3376567A5073BAF307625A9CF61B39C96185D5F9A160DA1A0842FAF550B36B5DB63BE2F7C6ED3B047EC7239C2A81696B15BD5CE8D5
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.........................................@.......................................@......@..............................2&...........................................................@......................................................CODE.... ........................... ..`DATA....D...........................@...BSS......................................idata..2&.......(..................@....tls.........0...........................rdata.......@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\PlanSwift11\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	InnoSetup Log 64-bit PlanSwift, version 0x30, 537482 bytes, 878411\user, "C:\Program Files (x86)\PlanSwift11"
Category:	dropped
Size (bytes):	537482
Entropy (8bit):	5.313818852760421
Encrypted:	false
SSDEEP:	6144:3P0R+wL/zTllAezAqs1p9qg2Pb4ah9jfW4c5MGWkbvy0OMjH+oCVuwQO8Q:Q+wL/zTllAezAqs1p9K
MD5:	099384B0B9B6D0098642B9D8F8525A2F
SHA1:	89284B35964A5C544FD9C31FE6616184FA99CB96
SHA-256:	0C66EDFE94C3C06ECB1E79CACEBDDF9E0B52FC655D11C2998F253EF162784205
SHA-512:	5E35DA319F5548D82215FC21ED8F52EA92A650A784100CBAF32EFC5931E81E0CA49047CC648CBF47C77501062462104D289BD9A081B7080F73B9DA925FDB9A25
Malicious:	false
Preview:	Inno Setup Uninstall Log (b) 64-bit.............................dea351d9-e184-49ac-833f-c98a60d0ae27............................................................................................PlanSwift.......................................................................................................................0........3..%.................................................................................................................;..........B........B....878411.user"C:\Program Files (x86)\PlanSwift11...........(.*.... ...... .....IFPS....!...5....................................................................................................BOOLEAN.........................F....IDISPATCH..............TWIZARDPAGE....TWIZARDPAGE.........TCOMBOBOX....TCOMBOBOX.................................................................TLABEL....TLABEL.........TCONTROL....TCONTROL.........TCOMPONENT....TCOMPONENT.........TWINCONTROL....TWINCONTROL.........TNEWNOTEBOOKPAGE....TNEWNOTEBOOKPA

C:\Program Files (x86)\PlanSwift11\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	730277
Entropy (8bit):	6.52446999800072
Encrypted:	false
SSDEEP:	12288:0qIRz+f+ui8TrPO37fzH4A63RRwDNtuXUZERvDrNMRdT9Taslb0GtzCOpFyxyRw:ZIZg+uiirPO37fzH4A6haDzcUZEIdT9K
MD5:	EBFB4F815CDD360F89E34AE2A5822134
SHA1:	072B155DD4EAE396C457AE40133DAF7BC76DA0C6
SHA-256:	BD6532E8AB9FAF6D0C96CC41B29935ACA7E602C69E24045CBAF79A88D095184D
SHA-512:	14E4751C8221C4718816FF3376567A5073BAF307625A9CF61B39C96185D5F9A160DA1A0842FAF550B36B5DB63BE2F7C6ED3B047EC7239C2A81696B15BD5CE8D5
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.........................................@.......................................@......@..............................2&...........................................................@......................................................CODE.... ........................... ..`DATA....D...........................@...BSS......................................idata..2&.......(..................@....tls.........0...........................rdata.......@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlanSwift 11\PlanSwift 11.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Aug 28 19:40:46 2024, mtime=Wed Aug 28 19:40:48 2024, atime=Wed May 31 15:12:16 2023, length=15557072, window=hide
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	4.666735136554411
Encrypted:	false
SSDEEP:	24:8m1YJ3EWdOEgII/RyAwPUCW6dSxdPVUUthvqyFm:8m1YJUWdOxvwPjtdSxdPWgsyF
MD5:	FF7A55D3A2CE7D53F40A1385C2ECB3BC
SHA1:	90E82A5EB1CA3B5FF7F02025CC1131033099CB14
SHA-256:	8A7B819DBD64395875FB5AED72D91CC7B10234253B25CFE7DD9C7FFC5D3AF597
SHA-512:	BCB0487E5E6A11E8A046A801FF5C8369DE7B14456DC6170A380C9A5AF36489392F8D14257E2AB1F805B629EF0349469FADDAA1E5838CB3C3563747919D059F41
Malicious:	false
Preview:	L..................F.... ....u......L-......0..m....a...........................P.O. .:i.....+00.../C:\.....................1......Y....PROGRA~2.........O.I.Y......................V.....&'..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....`.1......Y....PLANSW~1..H.......Y...Y................................P.l.a.n.S.w.i.f.t.1.1.....h.2..a...V.. .PLANSW~1.EXE..L.......Y...Y.......C........................P.l.a.n.S.w.i.f.t...e.x.e......._...............-.......^....................C:\Program Files (x86)\PlanSwift11\PlanSwift.exe..?.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.P.l.a.n.S.w.i.f.t.1.1.\.P.l.a.n.S.w.i.f.t...e.x.e.".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.P.l.a.n.S.w.i.f.t.1.1.........*................@Z\|...K.J.........`.......X.......878411...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3

C:\ProgramData\mntemp

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:hY/2:hv
MD5:	37D2B00F6272B64D296428939809A5BE
SHA1:	CDE0A4B65953B7B303DB292275D446EFD948DB9B
SHA-256:	0DC5C2E4E446B6A171F65642309FDEDD9B305A2C5D6546BC92DF900141C9A180
SHA-512:	848188FB71CCFABEE54F63CA0E1B0BC9B3AB6138563F12EF4E093192172BB927F83170801DD419E4743366A659474E65B095CDB0F6A49B6379A7D052B68DE103
Malicious:	false
Preview:	(.....et\|.......

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	data
Category:	dropped
Size (bytes):	49120
Entropy (8bit):	0.0017331682157558962
Encrypted:	false
SSDEEP:	3:Ztt:T
MD5:	0392ADA071EB68355BED625D8F9695F3
SHA1:	777253141235B6C6AC92E17E297A1482E82252CC
SHA-256:	B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
SHA-512:	EF659EEFCAB16221783ECB258D19801A1FF063478698CF4FCE3C9F98059CA7B1D060B0449E6FD89D3B70439D9735FA1D50088568FF46C9927DE45808250AEC2E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSds18I[1].woff

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	Web Open Font Format, TrueType, length 17676, version 1.1
Category:	dropped
Size (bytes):	17676
Entropy (8bit):	7.973486142266244
Encrypted:	false
SSDEEP:	384:WHy+8wuNuphioYzcowKZb0m+DZwT1STYN5xL/0SOVZMzS1ibY:pXwuAoo/oTem+DY1aYN5d/fOUzjY
MD5:	6962D43A25F8E7CE4600C3F9DB7F3E54
SHA1:	042057CDA5EE7B2D765DFA4FE239AE89A377045A
SHA-256:	1933B21FF4E1AC6EEDEE7C02EF4D7F39F24FC3CDEC250BE8C088CD42403770BD
SHA-512:	ED776E0784BC78384BBF09C4B0B79FD6086EEF779C4A90A68C0D9546D0A3A597704B99FA8A698D40D481E3F4A0F07EC99FCF95312803C918A6D7BE452320FE63
Malicious:	false
Preview:	wOFF......E.......}d........................GDEF...0...U...t...pGPOS...........T.2..GSUB...l...V........OS/2.......Y...`\vv.cmap... .......b..u.glyf.........D..!.2head..;l...6...6..+.hhea..;....$...$.{..hmtx..;............(loca..>T...E...\....maxp..@........ .E..name..@....8....X.r.post..A...........y.x...!.Aa.....?..E"..h...$.F4.kw.~.[0WFfYJVYK6.DY(;.oqh..$.-.....C<...G......d...y.;...x..X..#I.....y........\|.....}..../..3....y.,k..4.....q......EuueufV.HF......H}.S_..&.....D;BHH.!...;..[.~.<.@..\...C..B+.;`?........R.............&H;............z>.u+.c!.>.X.}\.7T8 ....o....w......M.S....U.._.?2.......J{....J.g$.XR{.q....,!..q'7.w.O4.T./....n...z...D.H/.y..6......_.V..f.ec'.p..\.06F'.di..+\|.....c.,.e....p..^T..N.&<#F^~.c:..U.z.;.;.:.[.;...\|...E.Jq.7.O..-.....O(.'...o..1I...}w#...V....Fx...d~l.?.{..H.Je..d.K.<.0....yvs_,rgy=xkm.x.w.y.....E....5<._q...d.!nb/....mfy..k.V.:?#\|...,.B.U...C..T.F..@.6"oU...."7.......C.l..`~j..^q.4.<^Y*.w.y....d.....I..0..9.!o..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZklyds18I[1].woff

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	Web Open Font Format, TrueType, length 16956, version 1.1
Category:	dropped
Size (bytes):	16956
Entropy (8bit):	7.973670847064324
Encrypted:	false
SSDEEP:	384:2EZTIvJX/mkhGpX8A/qCM6YTmUojWS43a24OpqIYkNhQIHbY:2EZTIB/V+X8rCM64mi3h4WqWSI7Y
MD5:	86C1C707BA672DC4FB781B262B6E5C95
SHA1:	186AB3222DDBB983EBB74AF7C52F4544B9FFE0DA
SHA-256:	02E61C9ACF0F9858B9B3A28F3F5C0B25A8D1B1ED761C69ACE5145C4273AD7B1A
SHA-512:	9FBD60E97AE77030F072793DDE0F9C087401D24E619CF5C709B3466852D8B2F9A66526375016C9F9401D7DB207EB1695F2F960874111047044CBAF404D5A6E57
Malicious:	false
Preview:	wOFF......B<......\|l........................GDEF...0...U...t...pGPOS.......m...nw.SGSUB.......V........OS/2...P...Z...`]Aw.cmap...........b..u.glyf...T..)\..C.zU.Rhead..8....6...6..+.hhea..8....$...$.\|..hmtx..9....y.....,..loca..;....C...\....maxp..=........ .E..name..=....8....X.s_post..? ..........y.x...!.Aa.....?..E"..h...$.F4.kw.~.[0WFfYJVYK6.DY(;.oqh..$.-.....C<...G......d...y.;...x..A.dC.....u....m.c..]c-...$""...g.$XDd.A88m`a%.v...F.L.u.. }qy....8.....+....7...?_........n...,...c..}....M.P.L...Q...N<....r&....Np4.'.?..39.7...........)&.t..2.Z.1s.).c.G.8.E..(.b....J....f...'kO..F.]..F.....{.h(..n[#{.i....<.s...e.H.>.^?_..".b.l.2.Dy.m..[....i(........F.......x..9.J..C.+...2.E...\|.'../.9#.......z../.]....d.9.=...Wi.}!...d.5..[.+....4o.yRo....b.v.........~. ...O..h..D..w....N.....c.w.o.=.....X.+........h.L}.#.<>.l:...q.y&..b.=Z.(...tF.z.x....z...{....[....+..W.m#\|.......h..Ql..3.\|...n9B>v_D....o.s..bY....\|.S...b....\.'...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\bid-boss[1].jpg

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 600x420, components 3
Category:	dropped
Size (bytes):	11940
Entropy (8bit):	7.736671597245877
Encrypted:	false
SSDEEP:	192:oExVVHMa/+m7U61TQjI96lBZylHOUYeYzZkoMeUsuV41giliZJOM735G1Ph:oExPHJ/+m7jn9SBZoHTxYdkoMe1E4ayh
MD5:	34C4043EDC3938BBBFBC264A3530A858
SHA1:	4F3F1C222128FAA8321B1B11BE62A44163FE3CE4
SHA-256:	FEDC881A09CF0589B5B398B6CF3068545A461297D6CFF9E051F33CEC24D0BDD3
SHA-512:	FD7DC9941CA4D0B3AE48205A081BA8C4F9EB11D35CDCF5E3098983392B2810261CACE70BF30D4D1D05B67DCEEF44C9CA9872A29828C79EC86D00326FE87E4753
Malicious:	false
Preview:	......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}........X..".....!....5.............................................................................................................................................................................................................................................................................................................................................................................................................................0.y./.MkJ....M/.d.......^...nzd.M3.-.^^.^a..]k.\.@..}.v...l...B.J...\w'\smw).....................:....4.6Z...d.f....\|....i&......7?7w$..:3P-.A..H....W....u..y...P.,.H...t...n..uK..9.=3....#-7.O+...[.U.....j...'...-...Z~y.F..w....+...K.>.....]..+.<.M..oY..]n...............Y.0.=...!..;c9..s./_0?qwFd.Q.y....:3..K....)..Fv......K........?.K.R.G8...p].......G.a....9..F....mzqE......iz

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\jquery.fancybox.min[1].css

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	ASCII text, with very long lines (13841), with no line terminators
Category:	dropped
Size (bytes):	13841
Entropy (8bit):	5.0814679329266665
Encrypted:	false
SSDEEP:	192:SJ6Dc9I6oCqkC/wPCSJdg7Z394CevGgjaUQcw:SJKZbl/wPCF7Z0vGtjf
MD5:	0B8A5B13275298E7568EB7F0C40865D2
SHA1:	2E6A66987DBC7A57BBFD2655BCE166739B4BA426
SHA-256:	E72AC4DD95F7F11DB42EA03FD4CBE1DCA1C9586D47245E36AAD66546D1864601
SHA-512:	2A90C6754F3873B2D2594EB904BCA22DC5EA78ED7E06A61DDCDEEB7B925E662D2B46562D5482725EDB830629CA51E103594A5BC2D1DBBB81F17B848DA1743749
Malicious:	false
Preview:	body.compensate-for-scrollbar{overflow:hidden}.fancybox-active{height:auto}.fancybox-is-hidden{left:-9999px;margin:0;position:absolute!important;top:-9999px;visibility:hidden}.fancybox-container{-webkit-backface-visibility:hidden;height:100%;left:0;outline:none;position:fixed;-webkit-tap-highlight-color:transparent;top:0;-ms-touch-action:manipulation;touch-action:manipulation;-webkit-transform:translateZ(0);transform:translateZ(0);width:100%;z-index:99992}.fancybox-container *{box-sizing:border-box}.fancybox-bg,.fancybox-inner,.fancybox-outer,.fancybox-stage{bottom:0;left:0;position:absolute;right:0;top:0}.fancybox-outer{-webkit-overflow-scrolling:touch;overflow-y:auto}.fancybox-bg{background:#1e1e1e;opacity:0;transition-duration:inherit;transition-property:opacity;transition-timing-function:cubic-bezier(.47,0,.74,.71)}.fancybox-is-open .fancybox-bg{opacity:.9;transition-timing-function:cubic-bezier(.22,.61,.36,1)}.fancybox-caption,.fancybox-infobar,.fancybox-navigation .fancybox-butto

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk0ZjWVAexg[1].woff

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	Web Open Font Format, TrueType, length 23244, version 1.1
Category:	dropped
Size (bytes):	23244
Entropy (8bit):	7.977155301603726
Encrypted:	false
SSDEEP:	384:poDJz7UGB5EPrKuJwnKqaokDYrtY20WxScMDpZkp46ICNH6m3hIodtsQQT:pyJ3z2rKlBBW20eMDytwIiH
MD5:	4ECE1CF2A5A8C7ABC2B18C6F97349BC3
SHA1:	3699E452E17C87C7F75098456344F124395D2EB4
SHA-256:	1DD81D64ED58E9366B21DE68FF53EF09F9BA2DCE549D54F4FF40BA98424C2850
SHA-512:	0526B0CFE9FBDA320BB67925ECD4407227246669644701148139C66BC0C09A2311F101C2E0569482A66C1F10ED7A6AB008E97D4565376FA43441AB03EC33621C
Malicious:	false
Preview:	wOFF......Z........4........................GDEF.......f.....f..GPOS...........j ...GSUB...............yOS/2.......U...`u(.?STAT...(...B...V^.B.cmap...l.......@&I..cvt ...@.......8I.G.fpgm...,...........Zgasp...............#glyf......;...\....`head..O....6...6...ihhea..O@..."...$....hmtx..Od.......x....loca..R ...*...>...maxp..TL... ... ...]name..Tl...B....C.s\|post..U...........%prep..X....B......3)x...!.AQ...s...a....m..H.".+1..(..>......0..#.E..Y....'.S..M..\,.X.U.k....{.qt..qq.7w......i.......x.].s.]M..........W.m;./.m.m.m;y....QM....}...}.....Q..S.lU$n.]8..h....l....7.... ......@E4j....m". 6..K..V.y.C..c ...:.\..\|.GA....3.{....8..&.....M.f....M..go..C.u..1......~.............j.....N..].<2e./.........>.2..F\<.OV....N?..6^...MQ..y..(.........SX..X.Y.......vp.U.=.9j..JS....I...........M.5.\.L....!......d.]..%.A.QC O.].p..w...^..a..t.@.......g...j..M...T.O.....\|....<!......NPf.b..ij...)k...&..n2..&..3.&..3D^.B..L...]..t...>.A.h.-..4...8.A...u...I-.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsiH0B4gaVQ[1].woff

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	Web Open Font Format, TrueType, length 22940, version 1.1
Category:	dropped
Size (bytes):	22940
Entropy (8bit):	7.975220628606242
Encrypted:	false
SSDEEP:	384:zCcFBkvsUGB5KOaGiedwisOgUBvd/XqRKXGX+BHTWREgIgIOkqONzpg6SqNiq5/G:2oBkvszuOaGiBmZdywK+JTWREcI7g6Sr
MD5:	9C845091C3E04D05FABA9FA0A7DD3F87
SHA1:	87588C9A58A0E2069439E138FB09427A208BAF64
SHA-256:	D4964864E91E640A2B1008F4ECA62CB388DB555A4B1E86FAC028BA01D139DB97
SHA-512:	8D7804B5B4105FB671A5E5FD27543FAA297EF62A690FEAFEB8807878684DAA77324B189940445AFAF507EE1C16AC4503023E6CEF3ADE21F47B81FCC3EB38A0F2
Malicious:	false
Preview:	wOFF......Y.................................GDEF.......^...\|....GPOS.......y....3.~/GSUB...p.......h'X,.OS/2... ...S...`s3.STAT...t...D...Z^.@.cmap...........0$..Qcvt ............=?,.fpgm...@...........Zgasp...............#glyf...(..<{..Y...Thead..N....6...6.H..hhea..N........$.o.yhmtx..N........`'.OZloca..Q........2.}.`maxp..S.... ... ...Hname..S....3....8rk.post..T..........HJ.prep..W...........{.x......Q...}...@.2m.@."1 .F W.........,$TP..v.^.>.B.I...BCSheC;.:z..T.[.k.a..9.I....O..3.....x.U...dI.E_fDVc9.tM.m.m{m.m.mcl.z_....n.z...].....c.z..4..G......^...3.Bv..C. .....D..q.......b......Uh..;p......(d..q..}.6B.dQ.e.w(.'......^C.M.d..d.G..k.4a.1.LUO...l..l.6l.. ....c_Ry.{r..1..@.\|..7..1s.'.....@....h.&.g... .....`+."..l....<.=..z..m81.?.Cy....r...........?.......X......z(.wQ>]..>..8,..NJ.... .JS.4".J}R..!.JMR.T......T.Ts.C7...M....}.?....}L.....G..+."=GO...(=D..<...t.....K..s;m....f.....5_....-+...J~.....H.w.5. /.S..'w.Mr.\|.9.L....79E..#. Y$sd.L.Q2D

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\slick-theme[1].css

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	3145
Entropy (8bit):	4.842322330045504
Encrypted:	false
SSDEEP:	48:rnbVUBxX7wSLr2dc40BM3jyFjvsmNrCzqu/eBMThmn:DbVel7wSLs3jUvsmN+Tcn
MD5:	F9FABA678C4D6DCFDDE69E5B11B37A2E
SHA1:	81A434F94F2B1124F3232BB86F2944F82FB23AC0
SHA-256:	7ADAF08052C6A6A0F8A0D0055B4F191FD07389FE41C972B69573472B2ECB406A
SHA-512:	EA52D475E439BA178C15B5A6DC23F6EF5975E11B17D71B71F89E71DB27880E49220697954CD853AA28CC13B1A044A2A2EA10AAA2FC02A014E5441102DB433C32
Malicious:	false
Preview:	@charset 'UTF-8';./* Slider /..slick-loading .slick-list.{. background: #fff url('./ajax-loader.gif') center center no-repeat;.}../ Icons /.@font-face.{. font-family: 'slick';. font-weight: normal;. font-style: normal;.. src: url('./fonts/slick.eot');. src: url('./fonts/slick.eot?#iefix') format('embedded-opentype'), url('./fonts/slick.woff') format('woff'), url('./fonts/slick.ttf') format('truetype'), url('./fonts/slick.svg#slick') format('svg');.}./ Arrows */..slick-prev,..slick-next.{. font-size: 0;. line-height: 0;.. position: absolute;. top: 50%;.. display: block;.. width: 20px;. height: 20px;. padding: 0;. -webkit-transform: translate(0, -50%);. -ms-transform: translate(0, -50%);. transform: translate(0, -50%);.. cursor: pointer;.. color: transparent;. border: none;. outline: none;. background: transparent;.}..slick-prev:hover,..slick-prev:focus,..slick-next:hover,..slick-next:focus.{. color: transparent;.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7j[1].woff

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	Web Open Font Format, TrueType, length 18420, version 1.1
Category:	dropped
Size (bytes):	18420
Entropy (8bit):	7.9801654726785
Encrypted:	false
SSDEEP:	384:pgcwpGBgCaIyHICq7EKohb7qnIUg+6TeaHDDiF0jQHhNPei:pgPpGB3adoCq4b7qIUKxP80jQBh7
MD5:	9347E153F350E24BAF7EB7015BDBEFC2
SHA1:	69E29878C01BD3A702585D8F0F67EBB026B6A9F0
SHA-256:	69491B82A23A2C945E2B8D04DA984A3F8E4C944BE5200720332246B20C525B73
SHA-512:	9F82A88FF2F20A5B529AC09EF94EC0E5A8A138E286803EF6C001FE99952BF350C7423FDE757D499CAE2F9CBC49534C29398CDD43598AFCF9E403A95F38E221DB
Malicious:	false
Preview:	wOFF......G........l........................GDEF...0...T...n.@..GPOS.......J..'..0..GSUB............g)J@OS/2.......W...`[Ot.cmap...........b.Mu.glyf......)...C:.if.head..>....6...6....hhea..>.... ...$....hmtx..>....K......".loca..A4...I...d...maxp..C........ .I..name..C....)...fQ.l.post..D....)...4....x....Aa.F...?...Po.$.'.(..0.......=X+#.l$..$.L..r....V......<[....W...r.}...Ym.Qx...p#W....K.Lk..^.sr....LaffffffffZ^..+YEAm.....,.......73...C.d..w...'>.5>..m..;..........o..z.....I..#$.T<..IW<C......_..wj...._~..\......+....._c..h......4...A.]=K.>.k....E$..1.>.9.4#@..i......f{.f.......Sl+.o/.Bb..(X.^.{Kz...<.X..Y.....J.Jy.l..-Q.<@U]...c.=.m.GmQx...bL..J..[qQ-..lY.."...\|{..Q......}...q..y.lwY....m.....z.`9y......e...&........X"./b.....1...A.....!bt.8]"I.H.....zE'}.....0,z...L...XC1k..k.!.....C.+.XOD.@$.P..H......fS.K......W..U..7...\|....'.T..._3.o....bk2l'..gGz._.p.hu..s...81..bPv9.&N..."...9Md9.3..Z.L kN!...H.t...s..p.g.!....1.......(.~.j._.V.lS"kO

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdo[1].woff

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	Web Open Font Format, TrueType, length 18376, version 1.1
Category:	dropped
Size (bytes):	18376
Entropy (8bit):	7.978672685004035
Encrypted:	false
SSDEEP:	384:jKd1AyHjI1ICjclJB0dNYYQdjqb08Z8hGwq4ZPNPei:jqDIOCjclJeByW48Z8k4Nh7
MD5:	16C7CEE39A6AEEC17DE501E2E88671E2
SHA1:	9CD9A32688619DD303A7D81E89F0B26C979044BB
SHA-256:	ABA35C5F18296CFA1117F641EF65CB48A49F0E0B5C60DBF42615E07111D99E12
SHA-512:	29DF3A3C6EC54A9C54A7D52EB2CBF3AD41A24E1E803ACCA83CDF9A640FE48B80459D743D873C78D3F45F3BCC932F9B87E63F562844AC654E67CED823A4F7CD0B
Malicious:	false
Preview:	wOFF......G.................................GDEF...0...T...n.@..GPOS.......K..'..6._GSUB............g)J@OS/2.......S...`\.uycmap...........b.Mu.glyf......(...B..f..head..>h...6...6....hhea..>.... ...$....hmtx..>....D.....^.:loca..A....J...d};..maxp..CP....... .I..name..Cl...0...\|Soo+post..D....)...4....x....Aa.F...?...Po.$.'.(..0.......=X+#.l$..$.L..r....V......<[....W...r.}...Ym.Qx...t#9........=..0.,.1333333-33333C..6.M2s.\...W..z........{.rKj.TU..L...Q.$\|.._.V^..o}..../..3,...y:...H..u...Yj....j......3....yw..s...gx.4..\|.3.......% ........._S/..}...;'._.6....J}...7...V.@.=a..A6l.......1...........a.....l..=)9.DR.#V..6.f&...J.2.6i#`#.o...Ki#}...\|..h../-.]%...q6/..-l.w..?Q..(%g.}v.F.F..W~.a....8..>.........^...{>..>.u.K.....?.......}.Ow....8...!%fR'.i.-...v..C.(..f.6:E..D;].H.}......Y....X..E".b....b..c..b.H.\..y"..E+.Z...l..........o.u...R.}\|....#..I>..?..U.u.A-.....{t..Q.O..-.....E...^..`.9D.s.h.0Q..#8R...3.d..R@..,9..4.K......hh..E..."y..T..p.Sl...P.M..Kl

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\Planswift_May2017-style.min[1].css

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	ASCII text, with very long lines (38598), with no line terminators
Category:	dropped
Size (bytes):	38598
Entropy (8bit):	5.08328579978674
Encrypted:	false
SSDEEP:	384:JEYagfzFDwzb/rgf6gV0oY9jf4wqCTXIR1co8v++X1vjwbmUgkRvjm4gLFs4LEKZ:JEYag6HWzJRvjm4iX2FCma
MD5:	8D8EBD5B508AF85F7F54B86EA258CEC7
SHA1:	D72DA69DFFECC7D12410F86D2217DD2CB822EC60
SHA-256:	F9F057FFC488FCC1E9750DF331A62CC83FC9105024831911A5B57F6F471A4E40
SHA-512:	7F6266B2E098E95FFB11FBD87FD4244014EF85E8B3C88BB097B83E1ED9A6C44CFCC5F68ABC84575F74A1DDCA3FD150AA2A6A1C8EBA149A9F39660021451FE5C0
Malicious:	false
Preview:	@import url('//fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i');@import url('//fonts.googleapis.com/css?family=Source+Sans+Pro:200,300,400,400i,600,600i,700,700i,900,900i');@import url('//maxcdn.bootstrapcdn.com/font-awesome/4.6.3/css/font-awesome.min.css');@font-face{font-family:"ETmodules";font-style:normal;font-weight:normal;src:url("//cdn2.hubspot.net/hubfs/3116632/Planswift%20May2017/Fonts/modules%281%29.eot") format("embedded-opentype"),url("//cdn2.hubspot.net/hubfs/3116632/Planswift%20May2017/Fonts/modules%282%29.ttf") format("truetype"),url("//cdn2.hubspot.net/hubfs/3116632/Planswift%20May2017/Fonts/modules%281%29.woff") format("woff")}img{max-width:100%;height:auto;border:0;-ms-interpolation-mode:bicubic;vertical-align:bottom}img.alignRight,img.alignright{margin:0 0 5px 15px}img.alignLeft,img.alignleft{margin:0 15px 5px 0}.row-fluid [class*="span"]{min-height:1px}.hs-blog-social-share .hs-blog-social-share-list{margin:0;list-style:none !

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk5hkWVAexg[1].woff

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	Web Open Font Format, TrueType, length 23620, version 1.1
Category:	dropped
Size (bytes):	23620
Entropy (8bit):	7.978131777712052
Encrypted:	false
SSDEEP:	384:cmgmivcUGB5aa6ixBqijOgZqK/pfDGPKxs+M1EWDQqq+Rd+dT:cszOabGol9GPyK2ONRU
MD5:	EE63398DB961D58031CB73E0A8D1D63C
SHA1:	A8804ECF41630B1818FAD44FADA3A06A0267D526
SHA-256:	D9F40659A9A9774AAD109E066A2BDA284C75F70C1F9A8AC5F797D83667E36E85
SHA-512:	5EC113ED7ACB1ABBDCC5BF09550AF28BD7808E29FB7A7843F9B01B3A5A2C9B0E5D0CDED001E9C2078F04C13D473EE35619CE0BCBCF92A135D5AD66FE2F9A02D1
Malicious:	false
Preview:	wOFF......\D................................GDEF.......f.....f..GPOS....... .....z.FGSUB...............yOS/2.......U...`s4.STAT...`...B...V^.@.cmap...........@&I..cvt ...x.......8I.G.fpgm...d...........Zgasp...<...........#glyf...L..=<..[..k.head..P....6...6....hhea..P...."...$....hmtx..P........x..Brloca..S....&...>.\|.pmaxp..U.... ... ...]name..U....1....=.n.post..W(..........%prep..Z....B......3)x...!.AQ...s...a....m..H.".+1..(..>......0..#.E..Y....'.S..M..\,.X.U.k....{.qt..qq.7w......i.......x.UU..dI......777k...m.m.m.m.z.+._.....4......a...Y.......I.F-.o.~{.[....~....A.P..o.(.Z.j...].#OW%..aL.......C.. ..-...4..I..<;."!..Sv'.\.....c^..Zx.g.Ly.o....._............P\........e,~)DA03A....g.oe.m.VR.co{...9..{..FLD_.FA...'hvjc5..:...... .[...O.p.=.>...^FD.O.k...d..r{.xZ(\|..v.]...........{....;>.'.'.{....-...+.....@$h.Y..].qS.\....Bjo]-.'.)=......@..%.H......G\|.E.......'...m."...h;...=mg..6..mm[..%ma..f..mj....l..j}.(.NL/.1..t....(.....rZH.i...4.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWVAexg[1].woff

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	Web Open Font Format, TrueType, length 23564, version 1.1
Category:	dropped
Size (bytes):	23564
Entropy (8bit):	7.977578605209568
Encrypted:	false
SSDEEP:	384:353fLRhUGB5TmGq2ONLCk3DO7FIvTmb5C4k6lmRj97EKjqDFW6D7G+83C3xgsDT:353dhzv1RULCCCFIvTmbXkyOj97EHQGX
MD5:	E0F9C8C3FF2946B79336AFCC4391554F
SHA1:	5056908B87151D20C2E65C64DEBA93DA441D4F80
SHA-256:	9A8EE296FA9A1280E9198A8BC4914C822A6911C6C33355DFCEF6184EC84EF83A
SHA-512:	2E6FA677A6F28330775FC9F2882D775E410654D92EDCC2D7386449615C58FDE4B557E06EBFD040BE73ACB665FB70394C0BCEACAEEB6ED80F887B08CA3FCCB808
Malicious:	false
Preview:	wOFF......\........ ........................GDEF.......f.....f..GPOS............@0K@GSUB...............yOS/2.......U...`s...STAT...X...G...Z^.C1cmap...........@&I..cvt ...t.......8I.G.fpgm...`...........Zgasp...8...........#glyf...H..=...[f'...head..P`...6...6...hhea..P...."...$....hmtx..P........x;M>`loca..S....%...>.].fmaxp..U.... ... ...]name..U....!...\4.]xpost..V...........%prep..Y....B......3)x...!.AQ...s...a....m..H.".+1..(..>......0..#.E..Y....'.S..M..\,.X.U.k....{.qt..qq.7w......i.......x.UU..\K..;..scm^l.m..ol.m.m.vr.....u.kzgzE..E..T.L...k..E..!.o.U0..j..!.:...X...N.Hv..f..)nhph0E.G....;..(...).9.tdy..A.!TX.2E.'#.....']..c...1..q3.;..<........3.]....I..7.!/....`.`.`.`.`99R..O.C8.N.X.Cq).0..v.."ou..%......0)obIF...Y.L.J-.<e%.tP..2.ZZ.j.d..\.B.Mv..M.....s..6.r...R.Be1f.Xz.S...k.{.Im..j.h........ r<.<>..A5\.$....i.).../.u....>..I...J...5.....^$....D.........X.<=..vR...Yj.f..k......j...ii......hJ..&..i2..&.$6qM..I\|f...Gy..\|.o.e>k..y+.....t..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsg-1x4gaVQ[1].woff

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	Web Open Font Format, TrueType, length 22332, version 1.1
Category:	dropped
Size (bytes):	22332
Entropy (8bit):	7.977427559058015
Encrypted:	false
SSDEEP:	384:Yj8GWGexUGB5dUcKXmy3hkf/TiGNY0s8rE8qWM+3W6t063iig1r+34jXNQcgXuRG:G8LGexzRcpif7dNYEt06Sd1S34jXNQei
MD5:	C132B75443276419FD8C1C25DEAEBF28
SHA1:	53FCDCF3C135284A585689F98E0EA41ECBEF1DC5
SHA-256:	AD10E734C779C95DC5B34407165E6F1ED5D7D108CC6FC882D72C436CB83C131E
SHA-512:	67E13FC5149F746513602D0CABB3C7C33C5EB52D6E6B82A8C622A272230CCEB7C6B97199F8D7F7778470EBF256A873F57F4582563BFB0D4A04B3644D51428183
Malicious:	false
Preview:	wOFF......W<................................GDEF.......^...\|....GPOS.......N....3~77GSUB...D.......h'X,.OS/2.......S...`t...STAT...H...F...Z^.A.cmap...........0$..Qcvt ...\........=I,.fpgm...............Zgasp...............#glyf......:l..Y.!..head..Ll...6...6.=..hhea..L........$.c..hmtx..L....i...`..=Mloca..O0.......2....maxp..QL... ... ...Hname..Ql...'...`5.`.post..R..........HJ.prep..UL..........{.x......Q...}...@.2m.@."1 .F W.........,$TP..v.^.>.B.I...BCSheC;.:z..T.[.k.a..9.I....O..3.....x.=...%K.D...zfm.m.m.m.m.m.o.V..w...H..n(....Ua../].........ul....7i...[7....A.../4...A.V..U.V..@.1.tUR5...y...P.T\|..Q....Er...QyZA....P..xQ....l...b.@.........Z......._......f\>....I.i..";x..>.a.+..[...^K..(.....DndEz.t..h.p6..w...\...8o.8....(....]NDGD.&.2..(]M.+..VQ6t.ZC.um......@........mWysa..6.umu[...mA..f..mJ....mD....X..#...t.n.e:K.. ....+i1..4.F.P.O=.3....jSU*OAT..SN.Li)9%.....S i..\|5..K...5..E.is....N..5..B3...j..f..k.....ij.s...l.....k...&.Ij.&..k<.[7D.'.3.-.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgshZ1x4gaVQ[1].woff

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	Web Open Font Format, TrueType, length 22824, version 1.1
Category:	dropped
Size (bytes):	22824
Entropy (8bit):	7.976296095960795
Encrypted:	false
SSDEEP:	384:YusAGk3QUGB5Xw7NegTDUoNNWRFHxVyfhEBmUwKWpyM5R2qAQHGeNK199khmPY6A:rGkAzqegheRBxYaBmss5RFHG4K1DomXi
MD5:	E230B347F13E7FDD55F8AB7DF3C08919
SHA1:	4FD37BA4DB4894AD99FAFAF44C8D36480771F978
SHA-256:	A201FD199D0C4ADCEE5359F6A64BA3B67E905C6029E87C852B34B0CE7ED469AB
SHA-512:	51B6E32C3AB5C4AF1886068940F88D815DD32EB7130EB14B07BD8777692ACB300C6D20C48D312A8AC1B6D49056508A150E1BC5FEEE523F581FA35AA0E6248B0C
Malicious:	false
Preview:	wOFF......Y(................................GDEF.......^...\|....GPOS......._.....s.ZGSUB...T.......h'X,.OS/2.......S...`u'. STAT...X...F...Z^.B.cmap...........0$..Qcvt ...l........=O,.fpgm...(...........Zgasp...............#glyf......<...Zb8...head..N0...6...6....hhea..Nh... ...$...Ehmtx..N....\|...`..01loca..Q........2...Tmaxp..S$... ... ...Hname..SD...<....</nbpost..T..........HJ.prep..W8..........{.x......Q...}...@.2m.@."1 .F W.........,$TP..v.^.>.B.I...BCSheC;.:z..T.[.k.a..9.I....O..3.....x.U...,M..Ow..l.m.q..m.m....%....:.~.NgX.p...+&#..<r"..8+w%...]..u......+...`......3..@...+P.....WW..'q.L.P.N~..S.p.Rm..2.:.n....7p'.......5..Y............8Y.}..8.C.g......QR.2.Z....W.z.#XW..}....3.Fdb6Z.........u.6.J..p....Gj..o.:.......-...h.Eq....e.GMTFY.8~...k;..#..;t..[...J:l..v.%.#a@.......FI..f..a\|......{..Z...~.....x`N.a...y#...W.....]~._..Q..?..;Ck......B>.O.L^..y&O.<..J_o...%7.\.+ri.=....;.......?.g..>...mz...'.a..n...j...3%......\.N.i4...\.zRgjK

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\production.min[1].css

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65527), with no line terminators
Category:	dropped
Size (bytes):	219871
Entropy (8bit):	4.9497205189297855
Encrypted:	false
SSDEEP:	1536:iOVv7RpFFPd5FajPS0E9Ewn64K1YuriZZI9kI9KUUXcQgZU+6BIQCmW/98Wve9WU:iU64cG
MD5:	B61D04C58751D53F129523762A1C1D46
SHA1:	40BE36EA2F7D5142F10523EA7A1243CB4D53E81B
SHA-256:	42C8BB4139142AD873D9255E5ACADA1ECF411ED6159F3E7F9221D2EC67B085C2
SHA-512:	CF16D261DDC22550386A1A4A25691951080AD4B81256720C14C1F10CD0544134C17A937225450D287C2B6F7145755C0731B3EF20E05F0190FFB418531043D0B6
Malicious:	false
Preview:	@import url("https://cdnjs.cloudflare.com/ajax/libs/fancybox/3.5.2/jquery.fancybox.min.css");@import url("https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.8.0/slick-theme.css");@import url("https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.8.0/slick.min.css");@import url('https://fonts.googleapis.com/css?family=Open+Sans:400,400i,600\|Source+Sans+Pro:400,400i,600&display=swap');/*!Production. Framework . 2019 IMPACT Branding & Design LLC. ALL RIGHTS RESERVED.IMPACT Branding & Design LLC grants you a nonexclusive, nontransferable, limited right to access and use this installation of Production. Framework. By using this installation of Production. Framework, you agree not to modify, reverse engineer, disassemble, or decompile the Production. Framework or any portion thereof. Any unauthorized copying, reproduction, republishing, uploading, posting, distribution, transmission, display or other use of this material without the express written permission of IMPACT Brandi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\spaceFrame_700[1].jpg

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 700x467, components 3
Category:	dropped
Size (bytes):	111911
Entropy (8bit):	7.984613577326849
Encrypted:	false
SSDEEP:	3072:u+V8pRbzfnk2yAP9JRtglDNwBfkrZ2dY+:e/nkwyl5warZ2dl
MD5:	35EA09B72CCD6C321FDAD420E8333968
SHA1:	FD6962F03DBBA15CCF51A9D791F34BA0C9F31780
SHA-256:	A8AF8520D9588768893A61C784484191AA8C12E94E05D8852065F48CC28BA563
SHA-512:	D8CE2F3C102C71E427AC5A3854DA3173BA2EE684531BA2686FEE888C9BE40F301540AF9A5990C006B4CC83708994DEC39BA8476F53655AA5563F077E4263788B
Malicious:	false
Preview:	......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}..........."..........4.................................................................r.%..K\.#-kl.......$.>.@.m.9U...3~T...?Q...2......O.Q..:..OT-X..yA.f....\.m3.....S..!.;A....f.J.....4....?=.J...N.9....q.U..h.~.....:w......./+.S.B. pk.?.$W.U.\.R..1..[s.nho.\..1].4..{7......M.~.].o...X..t%.....$J...$HE.vat...$...S..!..02z&+5..?..J.j.n.(...3.*^....yt+..z.<..i-.a..S...Gr....P.\|...G..$U0J..=...(}E......$...H..;.....m.......D...o.M....h.y.:....T......@....%rE7d....\|..u.5[.....--H..8./wC....A=...7.a.LF.....l......=y....].)..i.F..t6.2!.T..,........%..d$.v.......>....2Y.....&.....PPZ!.R..S.1)W...C...'F.._.-/.......\|.R?...."K.e#.._3.^s....9.nGM..v'>2...r..........k......M.....U;QKl.a.A..".e.+..}...8..80t.\.e....c....V.\..O!rY...5.A........QT...k....>,....k..@6z..l.p.U.C...p.sZ..4......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7nsDQ[1].woff

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	Web Open Font Format, TrueType, length 17760, version 1.1
Category:	dropped
Size (bytes):	17760
Entropy (8bit):	7.974116668167733
Encrypted:	false
SSDEEP:	384:KnYrBoVkDFhg8pLfmjMMrM4XHxH5RSI+xbOmORs3AcKWmfOfQk0bY:uYrSIa81mT3fkI+ROReAcKNGfQkGY
MD5:	523320594E20962D4DAF8967587F0469
SHA1:	2F88DADF741946509A583C649BBD2F50388EC430
SHA-256:	C3707996403E76FC9139006D74A8E6080A22A33B0BF14AF054471983B2065600
SHA-512:	DF34668F3A6BDFA2EDD21A35C87D6A663AC8C8035DC55DD37A0F8AD5354B6BF26B25BDA7F6A173BC13A90A5D0C503977FF7088D42E0265BC0F41B95A6B6C824F
Malicious:	false
Preview:	wOFF......E`......}.........................GDEF...0...U...t...pGPOS...........b./..GSUB.......V........OS/2.......Z...`[Dtxcmap...8.......b..u.glyf.........D~..0<head..;....6...6..+.hhea..;....$...$.x..hmtx..<...........&Jloca..>....F...\.`.maxp..@........ .E..name..A....0....S.o.post..BD..........y.x...!.Aa.....?..E"..h...$.F4.kw.~.[0WFfYJVYK6.DY(;.oqh..$.-.....C<...G......d...y.;...x..X...F..C...affffff.........1\r..l_8...n.rz.)Sw.fO....I..G.@[..c.\g.M.A.C.<.0."..D..)......=x...r...=.:.#...C......0%..c...;t...'].C{..z;M.......H6..QhZ..9....o.....CX.......uX.......^...a.$..fS-d.~.y7s...s~.t........4.%....Y.JGV.l..k....,.&......HE..........p.TDB......[}...m..-G.qs..l..P...1..7.o..^.......].. .....wY..D.;..b.).Z._f..^..p.#...kQ\|.z.b....Wx.iv,pn`..\|.......z..../...,T....8. &X.....E,"0.g.......2R...5%A.]..P...c../.8+x.\|..\z.@.8.k...........*........c ....u.T<1.O...A...K,..........J..g....&.YY..g..'......E1.S..../...J....,qbX!..[..y_..C...Q..[.}]>WB...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZY4lCds18I[1].woff

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	Web Open Font Format, TrueType, length 17588, version 1.1
Category:	dropped
Size (bytes):	17588
Entropy (8bit):	7.974055724405644
Encrypted:	false
SSDEEP:	384:dpbBzvChDXPzWE8L/JrGA8i1q3/yiZebz+zR6+9rgh1ybY:dpb1axXLZsAtP36iAaVj9rghSY
MD5:	1E0D93D3EC6280E1ED9E09A8375320C5
SHA1:	984284846DA96715446A8137EE63696F5F731A59
SHA-256:	C2E00E851BAB10EA4E2ABBA933E77C06FE88B07D620F43CFB2BB33FFEB8C372D
SHA-512:	0BA46C3B8716BF6A23A81C076AC17721878FCF51217FB12266D5C3FE83C76E0FBACCE97A3CA5B3550D6AC0E4CDB4DFF673A50DA51D34834772704BECA06C34EF
Malicious:	false
Preview:	wOFF......D.......}l........................GDEF...0...U...t...pGPOS...........d.?.6GSUB...p...V........OS/2.......Y...`\.u.cmap...$.......b..u.glyf......=..C....vhead..;....6...6..+.hhea..;D...$...$.y..hmtx..;h..........!.loca..=....D...\.y.`maxp..@@....... .E..name..@\...:....[.u.post..A...........y.x...!.Aa.....?..E"..h...$.F4.kw.~.[0WFfYJVYK6.DY(;.oqh..$.-.....C<...G......d...y.;...x...l#I..?'v&4...3..333...y.....a`..y-.7...w..\d.E.{R..[>;....^......4T..n>..}.._...............B...\|.._....?:..'......w...+.#..`.r;..0..s.g?>{.z.......N...Q....[y7.A7.......P.y.3_..t...:TC....Q..wYw...P%.......~..p.<..S.Uk...3.CM.&....1..7.s.a.f..J..qU..5..sY..W;.B...AZ.........z)X..d......a.S.Z...o.[..B......i...2Ze.k...Lf.@..M..f.c...e..V.R;:.mg7o..z^...]..m..._Qi..N].V.A0.......V....f.z2S.8......Y....:A.,.h.K..^.+..9u.+.....Vy...w.U.j.....+]..]..:T..\|...:;z....O.jm......L.h.9~?]...yoW..n..zI.Q...J.q.(...E6........P....f.K4`.Zgi.I...U.@....C.jC..:?o...ij.^W....s=..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdo[1].woff

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	Web Open Font Format, TrueType, length 18388, version 1.1
Category:	dropped
Size (bytes):	18388
Entropy (8bit):	7.978459394608278
Encrypted:	false
SSDEEP:	384:aMK6Nr35IC0b16Hgj3UA4WR6d60R8e7/RsVhyUxUNPei:aM7NLKC0b1xEA4266SvFAhFxUh7
MD5:	F3B459211817AA6407394E8740B79F20
SHA1:	C474698B55E83B8EE8F117ED00E568883E6ADDA6
SHA-256:	BCC2A2ED72EB54C5EF727292D09633888028CE74FB90C492FC3010E2A1AB65FB
SHA-512:	DAF1874F222BC64F4CE0567C249710BEC735E90236FB4CA0260FBCEB0F5DB2369D791F2EE5F399C43640EF158F7AB496C637858E0E83142ABEEE5D984A74A27B
Malicious:	false
Preview:	wOFF......G........P........................GDEF...0...T...n.@..GPOS.......8..'.._..GSUB............g)J@OS/2...\|...U...`\.v.cmap...........b.Mu.glyf...x..(...C..VM.head..>p...6...6....hhea..>.... ...$....hmtx..>....F........loca..A....I...d...<maxp..C\....... .I..name..Cx.../...\|R.n.post..D....)...4....x....Aa.F...?...Po.$.'.(..0.......=X+#.l$..$.L..r....V......<[....W...r.}...Ym.Qx...p.I....F.9.b...p.......K..LYff&_.I.../.U9Y...w.....k.Z...Mk......=..&..........{.....9...\|..,.........H......Y.........RG.g?../._?..\|.7.~...5....ip.H.5$3...[.....M.....\.....@!.#...!..O.#.a`.f....m..m....V.}..E....6..Q.Mv5...f%kH$.Y..M.v/.].^%Y.....XI...U}....X..5.v......2.........y..[..Rr...+.)..gv..,.w76....[.d...Z.........i..o.....wc..!..'..Mw..!.r<..=...Q.h..i.!."C..Q..t.v.E#=..^Q..AR..n.E.c"`.KU.L.X..Y!R........i.,.<E..T...D.O.C<.....D'o.-dx.h...."........O.i......o.M.........<..V..>......b@.r.-.,.8D4s.h.0....!.s.....BR@...Yr..iB......8!4.4>O.W.V.8.W..f.I...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\6xKydSBYKcSV-LCoeQqfX1RYOo3iu4nwlxdo[1].woff

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	Web Open Font Format, TrueType, length 17496, version 1.1
Category:	modified
Size (bytes):	17496
Entropy (8bit):	7.977029261694205
Encrypted:	false
SSDEEP:	384:QNJKAXLIUICa9l4VxOmWtOANSbz2R7iCNexWT1uDl+glNPei:oKYLwCa9l43JWt74eRrNeY1uB1lh7
MD5:	5816BD8BD15AD791713D836355D7A6B8
SHA1:	ADEE2F8E96333D7D1C64083C24FF0019E73B1D98
SHA-256:	5139DA52B55B29BBA7AE2362A9AEA8DD93DA438F35C808D9C77D700616F8F599
SHA-512:	52ACDD2CBE9A2FBBCD55D4DD00EFB28ACF357117DDBB1FCD9A0DEA58CF87C361C138EEBBF1735EF543B526EC1DC8256DA67D56FA7C6C681F0C2AE41A68B18930
Malicious:	false
Preview:	wOFF......DX.......L........................GDEF...0...T...n.@..GPOS.......0..&.....GSUB............g)J@OS/2...t...T...`]Lw.cmap...........b.Mu.glyf...l..'...C6.VY.head..;....6...6.~..hhea..;L... ...$.}..hmtx..;l...'........loca..=....I...d....maxp..?........ .I..name..?....-...jQ.l.post..A,...)...4....x....Aa.F...?...Po.$.'.(..0.......=X+#.l$..$.L..r....V......<[....W...r.}...Ym.Qx..E.,.....i..a&..333333.1..z.0'ffv.3k..d..ff...N....d....K]...-.J.....J..C.>.#/.m.j..l.X.....e.,@.AFtP....)..)r.cet].r.%+.r.....V...&.U.\.ks E..R..g....jz...Q...'>?:5rr....z..)k.N...1...5V.?...t-^i..-.F}.w.h.,QV.o@.......ol.....'...VU.)...z.....I..........).\|..y..y.Gy..x.4.E7e..&..,."..`X...eFE.1...S.1-z...,.>..}l+jl'2. r.$..,J."....fo..I...M..p.}\.E.r%...fn....E...c..I......A..U..U....I.....i2N....'..K.o3(=#..e?J....U."J5_.A...X.w.}vS.xO..C..Ym...Z...z.D.b?...........*.u..z6..k+.....^.....C..$.-..........+[..^.[.ul.P.7k4l.....H)9./;...]...T9.".=n.P......S\...<..V6.....K5..B

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Whats%20New%20in%20PlanSwift %2011[1].png

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	PNG image data, 500 x 280, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	16955
Entropy (8bit):	7.965607876239436
Encrypted:	false
SSDEEP:	384:D+O7vJTJL0ChK/jycLy9nJbvzEQjH8iIZn18bN:f7v9JL9hK2cmJ3EXZn18bN
MD5:	1A8BD6F15E4F5D6AC0C61A268DDDC60F
SHA1:	511E1217C45555D27C8E8E5642051C4D4DB8C671
SHA-256:	84CC117EBAAED854A10BB5C6F8E0CEEC4895A47CC326820E9967AF66678DC3F3
SHA-512:	1BBF9ADE39FE6C7C3C32391B16681954FB43B0A7665EA0DE46889035173C569D9320FA787804626EEF024BD94AC78E8ED5C4FB30FF26C1131496ED97E310C953
Malicious:	false
Preview:	.PNG........IHDR................A....PLTE...m..T..nfd....a.o.....T.....;..k..i..{...........;........ned...lff.............a....U.....lfdlgd:..ngfe^]K...............b.jcbjdckede`_...gbbihe:..P...a.ha`mfd...U...c.:.....mfe......cc_...fec......ige`]\.[.T..{vu..........`.l..pllnji>........sonba_.....ied......@..S.....vsrf..N............c................<.........N.......j..................].\|yx....s.....L.....]YY.~~...D........}...........9............y.....U......]................H.........d...........`....7z....{zU...`.B...g....Q..I........e.......@..R.............._..e../\|.x..7~.\..+x.,u....p..$m.J..&r........o....v.....a.{..;.......l.......8............I...............~\|{u..N..n...`..h.......X.....2q.L..n..Z.....U.c...............n..N..n.....:........[.K{.U..i....v..g........_.<..>.IDATx..y\.w....P.lk.L&.....a........r{.+A.......\.z..j.z.]uQ.._.V.m.....Zk._.....~...g.@..Z...y..d......9.z.+...@...(.:..Bg.X......b.3P,t....@...(.:..Bg.X......b.3P,t....@...(

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\css[1].css

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1480
Entropy (8bit):	5.346213705900354
Encrypted:	false
SSDEEP:	24:5MY3QY7maEgOpa+5MOY7mah6BMOYUMmah6FcY3QY7a6JcOY7aUcOYUMaZW:SY3QEmaEgOpaPOEmaIqOxMmaI+Y3QEa2
MD5:	AC040CF17AB583FB399726D3B8F253FC
SHA1:	DB049D7AC8B104F39191ABC9F92A81EADE76AACD
SHA-256:	F9F01C5FCC5391BAB46EA6FE6E92A511DA43C6E129DF56FBF671057B906D2671
SHA-512:	BD780F785E22FA0C5982F740818B98A48355D8DB32B9C26DAE98AEC64A8CE4F1B65A13D08F4EA37C5698F7257754F1CB5CDF77D66303CAFBDA65A94891C040D8
Malicious:	false
Preview:	@font-face {. font-family: 'Open Sans';. font-style: italic;. font-weight: 400;. font-stretch: normal;. font-display: swap;. src: url(https://fonts.gstatic.com/s/opensans/v40/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWVAexg.woff) format('woff');.}.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. font-stretch: normal;. font-display: swap;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVQ.woff) format('woff');.}.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 600;. font-stretch: normal;. font-display: swap;. src: url(https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4gaVQ.woff) format('woff');.}.@font-face {. font-family: 'Source Sans Pro';. font-style: italic;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7nsD

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\font-awesome.min[1].css

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	ASCII text, with very long lines (28900)
Category:	dropped
Size (bytes):	29063
Entropy (8bit):	4.755267089852831
Encrypted:	false
SSDEEP:	384:Uu5yWeTUKW+KlkJ5de2UYDyVfwYUas8l8yQ/8dwwdG:flr+Klk3Yi+fwYUf8l8yQ/eC
MD5:	4083F5D376EB849A458CC790B53BA080
SHA1:	FB5B49426DEE7F1508500E698D1B3C6B04C8FCCE
SHA-256:	008A1D103902F15FDB1C191FCB1CE8954330E7B8DE43D09ABB08555BA609F420
SHA-512:	E2E1991E96C3962371880BFF43364DA3FC9BD85B405FEAA20DBEF2A415A211D2505FC3EE829F0CEA297949190DF2342B0CB5AC877AEB3C349745FDC3C0560CEA
Malicious:	false
Preview:	/!. Font Awesome 4.6.3 by @davegandy - http://fontawesome.io - @fontawesome. * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License). */@font-face{font-family:'FontAwesome';src:url('../fonts/fontawesome-webfont.eot?v=4.6.3');src:url('../fonts/fontawesome-webfont.eot?#iefix&v=4.6.3') format('embedded-opentype'),url('../fonts/fontawesome-webfont.woff2?v=4.6.3') format('woff2'),url('../fonts/fontawesome-webfont.woff?v=4.6.3') format('woff'),url('../fonts/fontawesome-webfont.ttf?v=4.6.3') format('truetype'),url('../fonts/fontawesome-webfont.svg?v=4.6.3#fontawesomeregular') format('svg');font-weight:normal;font-style:normal}.fa{display:inline-block;font:normal normal normal 14px/1 FontAwesome;font-size:inherit;text-rendering:auto;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.fa-lg{font-size:1.33333333em;line-height:.75em;vertical-align:-15%}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-fw{width:1.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0RkxhjWVAexg[1].woff

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	Web Open Font Format, TrueType, length 23520, version 1.1
Category:	dropped
Size (bytes):	23520
Entropy (8bit):	7.9770639423352705
Encrypted:	false
SSDEEP:	384:sytUGB5q1+QZP5GSKooGN9dID0AwBPOHB2I3iU2MM5E+zojVT:VzO1+QfGhoo6LOHd3kMYoB
MD5:	F51D0431E998EC5E15704A270E32A1B3
SHA1:	99A6A5BE9DEC2D1178A28BD74238FF86B2A8C19B
SHA-256:	A0B8A087D04850888B1556E5740A0D2F506EFCA32A0F93626911C87823460166
SHA-512:	E20009B97E244466EBF33621ECD6F40E09F7432C8DE6B9138A0D7842B5015D0BF4B5E52E2C56C159502AB5F3C6FC8511949F918083627EB95D159567A7CB88BD
Malicious:	false
Preview:	wOFF......[.................................GDEF.......f.....f..GPOS............c..GSUB...............yOS/2.......U...`t`..STAT...D...D...V^.A9cmap...........@&I..cvt ...\.......8I.G.fpgm...H...........Zgasp... ...........#glyf...0..<...[h^=.]head..P ...6...6...Chhea..PX..."...$....hmtx..P\|.......xa_3tloca..SD...&...>....maxp..Ul... ... ...]name..U....7....B.qHpost..V...........%prep..Y....B......3)x...!.AQ...s...a....m..H.".+1..(..>......0..#.E..Y....'.S..M..\,.X.U.k....{.qt..qq.7w......i.......x.U...$M.._Ue..w.q6.g.m.m.m.m[..VF...e...euMMG...?dA%...JT@@...Z .q.....a.v.hQ.C+... <....nY.]s.l.es...\|.....{8.i......w..@...@..........":...j.s.m.C...O\?y..~.r...3UVy...........m...U.%.y...IP...O....2>_.1..+.S"..3..Gv....[C....~...\|.B74@1dB.....;..........Y...C,...G;.A94..0<.....2..i{e:.^.?.....$..k..d..H...D..).':{.t.q.(....wRqG..2y..F\|.cd.+...A.\/\|..s....]...$VJ.$4^........~...pwO....>B$t...(;...=l'..6...s-[..%l!..f..l*.....6..l.,....;zA......:EGh..M......ESh....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0RkyFjWVAexg[1].woff

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	Web Open Font Format, TrueType, length 22952, version 1.1
Category:	dropped
Size (bytes):	22952
Entropy (8bit):	7.976177445055426
Encrypted:	false
SSDEEP:	384:RGyWOUGB5Q3VotmlWHAJiSENc0RYC2Bsk7mfKjhCwMI4nYe00MjWkTT:RttzGotmgHZSENclCWafKjhCBJgBjWy
MD5:	16A200C0D507D35C6317DF87EDA4E0F4
SHA1:	EFE09EAF2470173A3F83EA9051C645C822075582
SHA-256:	2DF829356F2F0380A7F6FD6F7FB81023FCA97DA4B04D216AA76F6419FFAA75E9
SHA-512:	1908F5EABDD6BECD1CB280616C2DAB8946C51EBE735EC141C00C1BF7B724989FA1D6DA53B52D270F7419BCA9B63EEEB7550F3D23A16125C7B0F32B7D7B988465
Malicious:	false
Preview:	wOFF......Y.................................GDEF.......f.....f..GPOS...........D...GSUB...............yOS/2.......U...`t..)STAT.......E...V^.A.cmap...X.......@&I..cvt ...,.......8I.G.fpgm...............Zgasp...............#glyf......;...[....3head..N....6...6...Zhhea..NL..."...$....hmtx..Np.......x..'[loca..Q....%...>..maxp..SD... ... ...]name..Sd...&....7yb.post..T...........%prep..Wd...B......3)x...!.AQ...s...a....m..H.".+1..(..>......0..#.E..Y....'.S..M..\,.X.U.k....{.qt..qq.7w......i.......x.]...$K..s..g.66.8.ms.m.m.m.}....xq.....:+.......YQ..`.@...]..m.as.m.^;.mQ.C+...@h(....e.v...e....@..r...\.!L..0...../....-..k).....9;:"r....q.cV..&rC.~s...9..`ow..<.W\|.w..Ox.O3V.V-V.V9V.U...w...B.#....Ad......,.....6.#.>..OP.6v.p..x....e...9Aa....4..Oa....app..F3Dd..j...=C...N...Gl..O.LGV...>v.N...G..... ......Jv.3..%.z.U!&"...I.\...".>u.o..k.f.8...8.^.......0.O.E...O...Y.?..r&`...&..hR..&..i"...g......zDw..].St.....Dkh.-.Y4...h...>.M.S.jEM...JT..SA.MY)=....:.gD..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\6xKydSBYKcSV-LCoeQqfX1RYOo3i94_wlxdo[1].woff

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	Web Open Font Format, TrueType, length 17760, version 1.1
Category:	dropped
Size (bytes):	17760
Entropy (8bit):	7.974796614722444
Encrypted:	false
SSDEEP:	384:C1DqtPZqppICgajSaS4HLsH2a2Gx+pf/od3IealKryHk1NPei:MqtRq8CgajSUsH2WwhKIeaAL1h7
MD5:	2D44E2732176F76AB9430960E9F5A7B1
SHA1:	61623C29256A722CCA695C4E49B43CAC840F3B8C
SHA-256:	0FEA5244BD4B34AE111313891623E65EEB21D5DCE3211EBC1EE3142B58D3182C
SHA-512:	30A8B8335604282F38B7980726FE3FE7410877BD050C4BEFDF6D41B630E3E50758934BAD92B999527A2CE1C6237E378D8EA63E81E8D336705C2D7418FF354D9F
Malicious:	false
Preview:	wOFF......E`................................GDEF...0...T...n.@..GPOS..........%.....GSUB............g)J@OS/2.......U...`Z.r@cmap...4.......b.Mu.glyf......(0..D<c.M.head..<....6...6....hhea..<@... ...$....hmtx..<`...8.....y+.loca..>....K...d....maxp..@........ .I..name..A....4....T.p.post..B4...)...4....x....Aa.F...?...Po.$.'.(..0.......=X+#.l$..$.L..r....V......<[....W...r.}...Ym.Qx...l#I...j...q<..80..w6..0,...i.............2X..-..h4.....z.k.q...]}...^.......).d..[....`...?...9\|...=p.#.... ...*j&.=..&..q.'.Q:I....?..'.A..~...F.8..~0Y.G.,:<S.x....]..=.....~..b.W...9..^R.(>.K...y..f.n.^......`@qL-..Y..#..=..aY........>8.n. .?F.0.......8.:..S#......&..Y.."ji.1....C....zX.,."....O$.+....,.9..1>..c.Q...H...$.....e?......I....p..p......[..v.;U..1..h;....R.V/...D!..c.0.....`.K..=.J.....8...J:....!.'..".A6.d..(..Y...#k6......Z?j.=Y..u...]M.j...o.J..(iN.....o....{P....B...7.........j...>n;0.z.K...k.\m..W.E}...[..wU.<.\|..2...eT..K.......i...:...>..}0,.\|!..).rl.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdo[1].woff

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	Web Open Font Format, TrueType, length 18340, version 1.1
Category:	dropped
Size (bytes):	18340
Entropy (8bit):	7.977892390236628
Encrypted:	false
SSDEEP:	384:OLn9sxABqz8aYICXSSDcxCxV5SAHd06oeb3PPD2lfBJOyHCNPei:ytMxBCXSSDQMSAW6T7PWBJOfh7
MD5:	3BCC787B94E90E45DCE32670AD2F3845
SHA1:	C0B5B3235A5FC0D7FD5639AE4D479622423C4AA3
SHA-256:	D40268EACF4E3F34EC8272B42364310EEF19D0B5067AA7F6D8B3C11A23A25243
SHA-512:	3E2BB1C128AE44B6F56C0465650388926CC60E59451B15DAABC31C83B231E6CE73CAC84B3B096BD07A5BAC2D0691C93A03F670A3EBC55C602D546113F0FE47AA
Malicious:	false
Preview:	wOFF......G........T........................GDEF...0...T...n.@..GPOS..........&..@GSUB... ........g)J@OS/2.......S...`Z.sIcmap...4.......b.Mu.glyf......)f..D...>.head..>@...6...6....hhea..>x... ...$....hmtx..>....E....."(.loca..@....J...d.k.}maxp..C,....... .I..name..CH.../...jQ.m.post..Dx...)...4....x....Aa.F...?...Po.$.'.(..0.......=X+#.l$..$.L..r....V......<[....W...r.}...Ym.Qx...p.F..?-..~.z.a.cff.33sa......0......{\|s.u..Rm.A....^.4..q.H.1..as&H\|..?.=?.l.]..[..v...&..H7...4...)2.9.I..sP...v[.#....a.]..........._.#...1.M..9r.yhp..r4....z..c.....Xlw..."v......q....\|Wv.......u..k....7.&Yq..8WZ.NDz.Rqs\.e.e.CQJv..uv.GWY..W}.s...H.R.).Q.e.~5h.\|m....~.\..{.U4.{PU.3..y.1....y7..q..C.J.w....\|\i9...+..A..'r.p*......,. ........@Q..&...$."M.h.K..-..vzE'...cHt3,z.....zV.1V...,b.".YU......H..h`-Qdm.a.1.\|M...:...%..D.?...o.&....wk.a.m..{.......q...!.9N.XF.8U.q...L1...M....<...<.p..o....Vb@.h.)..q....<.....7e.....fr..K...[.>.....E,..H.6 -.Tbso../..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\css[1].css

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2074
Entropy (8bit):	5.259443728313295
Encrypted:	false
SSDEEP:	48:CY3QL6yY3QxTwsY3QCwiNY3QMwIOJcOWakOL/OxTZOCzOMY:CYgLhYgxThYgCdNYgM1OJcOWjOL/OxTU
MD5:	E2694BEC336D6261F175DEB52E338100
SHA1:	1ADC45779C747CBC0DDFDCD477713BB99D14E6DD
SHA-256:	A531AF778D67E7F2432396372503A3502033FE43D34C62A04699C0092B7D2FAD
SHA-512:	5B316401F5398CAA3B833E0FE02767098644914AA9EFE2C35C013C6AB144440CBD5B01484827F485A1200CBF0834729FF78F48012F9CA3D590B2700125339536
Malicious:	false
Preview:	@font-face {. font-family: 'Source Sans Pro';. font-style: italic;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/sourcesanspro/v22/6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7nsDQ.woff) format('woff');.}.@font-face {. font-family: 'Source Sans Pro';. font-style: italic;. font-weight: 600;. src: url(https://fonts.gstatic.com/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZY4lCds18I.woff) format('woff');.}.@font-face {. font-family: 'Source Sans Pro';. font-style: italic;. font-weight: 700;. src: url(https://fonts.gstatic.com/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSds18I.woff) format('woff');.}.@font-face {. font-family: 'Source Sans Pro';. font-style: italic;. font-weight: 900;. src: url(https://fonts.gstatic.com/s/sourcesanspro/v22/6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZklyds18I.woff) format('woff');.}.@font-face {. font-family: 'Source Sans Pro';. font-style: normal;. font-weight: 200;. src: url(https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQ

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\css[2].css

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2445
Entropy (8bit):	5.4116266510824
Encrypted:	false
SSDEEP:	48:SY3Q1YWEgOpaqY3QEYWEgOpaPY3QxMYWEgOpaeY3QpYWEgOpa3Y3QwhYWEgOpagT:SYg1tJOJYgEtJOcYgxMtJOdYgptJOkYI
MD5:	61496D2603CC240AF4E31B7C2FE70B6B
SHA1:	311384E3560E68F568F061A03C0BD5F2A7CDE969
SHA-256:	E12E8CAEB0C7CFEA26F42F7996E2364F1AB023F7E9D63F7C55F4D06F6A9C9652
SHA-512:	640AC221B6E1C812947226775D8C535103798ADEA3851AE360E2300A75498D8EA69694B8B97286CBC058E9C06E195960A3F8650A3640CD398A46FBE48B1AA82B
Malicious:	false
Preview:	@font-face {. font-family: 'Open Sans';. font-style: italic;. font-weight: 300;. font-stretch: normal;. src: url(https://fonts.gstatic.com/s/opensans/v40/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk5hkWVAexg.woff) format('woff');.}.@font-face {. font-family: 'Open Sans';. font-style: italic;. font-weight: 400;. font-stretch: normal;. src: url(https://fonts.gstatic.com/s/opensans/v40/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0Rk8ZkWVAexg.woff) format('woff');.}.@font-face {. font-family: 'Open Sans';. font-style: italic;. font-weight: 600;. font-stretch: normal;. src: url(https://fonts.gstatic.com/s/opensans/v40/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0RkxhjWVAexg.woff) format('woff');.}.@font-face {. font-family: 'Open Sans';. font-style: italic;. font-weight: 700;. font-stretch: normal;. src: url(https://fonts.gstatic.com/s/opensans/v40/memQYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWq8tWZ0Pw86hd0RkyFjWVAexg.woff) format('woff');.}.@font-face {. f

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4gaVQ[1].woff

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	Web Open Font Format, TrueType, length 22836, version 1.1
Category:	dropped
Size (bytes):	22836
Entropy (8bit):	7.974937661794432
Encrypted:	false
SSDEEP:	384:R59te4lkDoUGB5tMFE3/nOJRyDUufVCZpPNFSMV7gHil6Mrcx1YgjOnpSbKGR:R59Bk0zJM+fO+UQ2N+CMMwx1Yg2pGR
MD5:	BBDD84B53CCCA9252A2EEC6DC1B3E7E7
SHA1:	4B997E961A6013FB67C28A1AFED5A6BCE371185A
SHA-256:	BF07D6A79FA4D9884810EC79B457DC2E4B583393B1EFE93621DCE64FCDAD59A0
SHA-512:	5749B11C29B62166788DF0AD07D109380151293FBEB6D23B000DA2A4D62268BE2FF09B76226A89AA4A9F9891738E6087EB84131C357B2D9E9F45CDCD0CE620FA
Malicious:	false
Preview:	wOFF......Y4................................GDEF.......^...\|....GPOS.......^.....[GSUB...T.......h'X,.OS/2.......S...`t_..STAT...X...G...Z^.AAcmap...........0$..Qcvt ...l........=D,.fpgm...(...........Zgasp...............#glyf......<...Y..C.6head..N0...6...6....hhea..Nh.......$.,.Dhmtx..N........`s\C.loca..Q........2...maxp..S4... ... ...Hname..ST...7....:Wn,post..T..........HJ.prep..WD..........{.x......Q...}...@.2m.@."1 .F W.........,$TP..v.^.>.B.I...BCSheC;.:z..T.[.k.a..9.I....O..3.....x.U...%;.EO.J...m.m.m.m..;.Ro...:.wW..P.B!...(T........4n.9.4iX............/h...e.v...e......e...H5...@(x...P....r!.WS .. .....]...~...........tx._.N(...........=>.#>...;....B4.a._i.....yL./........^...z(....y.....I.sz......{.......`~s.2;...5. .B!..i9.h...E.8.Dq..q~....d..s]R..^.....?=.pG........l-[..%l!..f..l*....86..`CY".}.w....>^..t...>.A.h.-....ESh...A..Q.jEM...JT..Q..e.P.JG)(.%.X....y....d.g.e.p.....2{.6...2K.<3.L2c.03..2{8]L;....:...`J."&..a2.4&..2.L....U~.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVQ[1].woff

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	Web Open Font Format, TrueType, length 22908, version 1.1
Category:	dropped
Size (bytes):	22908
Entropy (8bit):	7.975308901970441
Encrypted:	false
SSDEEP:	384:lJtXUkvsUGB5Vi5W5opnmoLmF+8tBhjzw1hcTxa2iXuup2sO6aBZRQ1eL1oYSbKi:BXUkvszZd9oLmznhjzw+xab+u3oBLQYU
MD5:	3408FCF92BE2FC1CCBCF3B6B5A8C6C71
SHA1:	1D48DA2C117877E6B718CBB0A9E6DA2E62FEC833
SHA-256:	377F3FDB92B81F0045C2E22DA66B40F00D432B6322581F19D6DD0EB7C245AFC6
SHA-512:	A5FA1D450193A96E58727EB4E1339D91607C720AA4FA059BB4413DB2001E98B8ADA8B37C94A0C89B1BFC816A0845A94371C685EBE86C09B5CE03E0F1E9B870FE
Malicious:	false
Preview:	wOFF......Y\|................................GDEF.......^...\|....GPOS............B.vGSUB...........h'X,.OS/2...4...S...`s..STAT.......H...^^.C9cmap...........0$..Qcvt ............=?,.fpgm...X...........Zgasp...0...........#glyf...@..<X..Y.vu..head..N....6...6./..hhea..N........$.V.Fhmtx..N....y...`N.J.loca..Ql.......2....maxp..S.... ... ...Hname..S....'...x7.c.post..T..........HJ.prep..W...........{.x......Q...}...@.2m.@."1 .F W.........,$TP..v.^.>.B.I...BCSheC;.:z..T.[.k.a..9.I....O..3.....x.=...\K.D..O....m.m;...m.m.5.....U............`..+S.....m.o.h....M...o.0... .......n.0..1.n....h^...T-,C/..!..\|,.....!..i..~.A4.Z....a.A..a.0_z..........2.b...\.,.tP........._..#..x).@8&.I......#.\|..V.(...A{..i.@.....A...Y..).^...d..dv..n.Mjv:O.....(.<.!..m..3!.\|.....Z*=.i<.p.k..od/..:.\.......L."@&.e.A.....v..gg.Iv..f..^...`[.&...a+.2..-`s.,6.Ma..x6..d}.(H.....O.MA7l..Dg....].....ZDsh.M.Q4..Q...v..Q..F.....\|..2Q.JF~..F.(.K._.yg^.G...c....9b...f.Yc....3.L1...3..1.L..1.L.S.T1.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\slick.min[1].css

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	ASCII text, with very long lines (1327)
Category:	dropped
Size (bytes):	1369
Entropy (8bit):	4.790302563475718
Encrypted:	false
SSDEEP:	24:4u/SZOZHEPJ/popJzwxI0kATpL4HNrreVx:4qTEJMJzyuKx
MD5:	6A62AD0F300504C583E7797C79C2D8AB
SHA1:	E6E4F113FC2D008516D21228DAC93BB6A2FCBB53
SHA-256:	50AD448A8A5720BF8A5617DB15AF31AE60163DE06331576F60C6244C012FFC72
SHA-512:	C879273F5FC0C11FB2C76E9C075CB4723BD050CBC46B63C5CEDD5CF4B952E29450E4D39364559B8418A0F97F46F5E616FFC9B4FF8397371F29C49EB3E7BC7477
Malicious:	false
Preview:	.slick-slider{position:relative;display:block;box-sizing:border-box;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;-webkit-touch-callout:none;-khtml-user-select:none;-ms-touch-action:pan-y;touch-action:pan-y;-webkit-tap-highlight-color:transparent}.slick-list{position:relative;display:block;overflow:hidden;margin:0;padding:0}.slick-list:focus{outline:0}.slick-list.dragging{cursor:pointer;cursor:hand}.slick-slider .slick-list,.slick-slider .slick-track{-webkit-transform:translate3d(0,0,0);-moz-transform:translate3d(0,0,0);-ms-transform:translate3d(0,0,0);-o-transform:translate3d(0,0,0);transform:translate3d(0,0,0)}.slick-track{position:relative;top:0;left:0;display:block;margin-left:auto;margin-right:auto}.slick-track:after,.slick-track:before{display:table;content:''}.slick-track:after{clear:both}.slick-loading .slick-track{visibility:hidden}.slick-slide{display:none;float:left;height:100%;min-height:1px}[dir=rtl] .slick-slide{float:right}.slick-sl

C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp

Download File

Process:	C:\Users\user\Desktop\ps11.0.0.129pro.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	718848
Entropy (8bit):	6.516324966510223
Encrypted:	false
SSDEEP:	12288:cqIRz+f+ui8TrPO37fzH4A63RRwDNtuXUZERvDrNMRdT9Taslb0GtzCOpFyxyR:hIZg+uiirPO37fzH4A6haDzcUZEIdT95
MD5:	5ED68C2D50F4232A83D39C41722BC908
SHA1:	EB1ABA1A0406C34FD9601E7C2E61FCAFD0376D7A
SHA-256:	DE17FCE3B4BC0E4B95D25EBFB98E6FB97098AA96153973CB16585793CA23901B
SHA-512:	006E8131A50C9D79E654AB9D6D5A2467A5230205D82F43C2E5CE49FF011D163ED01CCD2182D6B99C2BD1422B81C8E70DD187DA3118423BF1E359A7A42B109C1C
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.........................................@.......................................@......@..............................2&...........................................................@......................................................CODE.... ........................... ..`DATA....D...........................@...BSS......................................idata..2&.......(..................@....tls.........0...........................rdata.......@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-K4N7C.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~1A52.tmp

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	RIFF (little-endian) data, animated cursor
Category:	dropped
Size (bytes):	34500
Entropy (8bit):	2.8612946089094904
Encrypted:	false
SSDEEP:	192:5KEqRp0tCkjtkb+S7cCV+nZmOn/jBa/FoTxYRAxrFKUwPMy/2kP+WN:DqpkJkb+fC09/FYFo1YIrge0bN
MD5:	EC77B0BBB5787D44DEFA00E1157B3E92
SHA1:	D14948E77C78E3E6D175368DA67F3A4FD53B6B05
SHA-256:	2E22877D257CC2C7201ABFD0B458742EA431CF0B8C150A5F45D496E52FC8D7EE
SHA-512:	8876F42DC6BA97A00B47777FE1500556F35988ACAA145748D25E86F355614B483B6470881C0334E99B95CD5955270601CE85F3AE86D7CDC65E75FB32D0FB4D2A
Malicious:	false
Preview:	RIFF...ACONanih$...$........... ... ... ...............rate ...................................seq ...................................LIST4...framicon.......... ..............(... ...@..... ...................................................................................................................................................................................................................................................................................................................................................R...QM..QU..Q...............................................................................................................]...S...O...O...R...\...........................................................................................................^J..a...e...e...c...^l..............................................................................Q...Qu..R...QR.............._O=..f..f..J....`q..................................................................

C:\Users\user\AppData\Local\Temp\~1A62.tmp

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	RIFF (little-endian) data, animated cursor
Category:	dropped
Size (bytes):	34500
Entropy (8bit):	2.8482120151923307
Encrypted:	false
SSDEEP:	192:5+LrNbq9he3NdbHLzyEKTWlZLo+6ghxnIjLfT:5+nNbZ3LzqKnkKSLfT
MD5:	75B500A94DAE9DCFEFBB4FAE43F875AB
SHA1:	F0CC7F091520755DB825C60CEA4D27B565FE9F16
SHA-256:	0EF673D5007C9A7CAAB8AB21BC47BCED6E0686F41E792384C8FFCB46CC7AEEE8
SHA-512:	CA221E9E2354A56138B92CC180017D258FC735C4C5498E924AD328A929DC977175DFD3F0A22C8404D9FE74ABE07C8CA73322B8F4785359AAC19E873DE551E306
Malicious:	false
Preview:	RIFF...ACONanih$...$........... ... ... ...............rate ...................................seq ...................................LIST4...framicon.......... ..............(... ...@..... ..................................................................................................................................................................................................................................................................................................................................................H...H.M.H.U.H...............................................................................................................S...J...D...D...I..S...........................................................................................................U.J.V...Z...Z...X...U.l.............................................................................G...H.u.I...H.R.............W.O.~;..d..e..I..W.q..................................................................

C:\Users\user\AppData\Local\Temp\~1A63.tmp

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	RIFF (little-endian) data, animated cursor
Category:	dropped
Size (bytes):	34500
Entropy (8bit):	2.9195293404964455
Encrypted:	false
SSDEEP:	384:3803QQhlzNB05pn9uGgDZ4XBb0VC3dGvh:3zXzNeojgb0k8vh
MD5:	DBCA632B119F14D838313B11B1E52645
SHA1:	0F770400E3B09799DE4A799D4DD45FB105441C1B
SHA-256:	33C5916127FDE97B938D2294BD680681680A93638B8DB6B243FC8DA3BF237CF4
SHA-512:	670434D41E38892C732E28C40BFE21A6E1E08E482ADB3719EEA5183FEEE88CE47F82053956567954842E9F93D535E559E5EDC12BD3F88CA1F2F4370612F92A7F
Malicious:	false
Preview:	RIFF...ACONanih$...$........... ... ... ...............rate ...................................seq ...................................LIST4...framicon.......... ..............(... ...@..... ..................................................................................................................................................................................................................................................................................................................................................4...).M.'.U.4...............................................................................................................1...%...L...O......3............................................................................................................J.8...<...<...>....l.............................................................................4...$.u."...R.............+.OBb..m...m...Pp...+.q..................................................................

C:\Users\user\AppData\Local\Temp\~1A74.tmp

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	RIFF (little-endian) data, animated cursor
Category:	dropped
Size (bytes):	34500
Entropy (8bit):	2.8482120151923307
Encrypted:	false
SSDEEP:	192:5+LrNbq9he3NdbHLzyEKTWlZLo+6ghxnIjLfT:5+nNbZ3LzqKnkKSLfT
MD5:	75B500A94DAE9DCFEFBB4FAE43F875AB
SHA1:	F0CC7F091520755DB825C60CEA4D27B565FE9F16
SHA-256:	0EF673D5007C9A7CAAB8AB21BC47BCED6E0686F41E792384C8FFCB46CC7AEEE8
SHA-512:	CA221E9E2354A56138B92CC180017D258FC735C4C5498E924AD328A929DC977175DFD3F0A22C8404D9FE74ABE07C8CA73322B8F4785359AAC19E873DE551E306
Malicious:	false
Preview:	RIFF...ACONanih$...$........... ... ... ...............rate ...................................seq ...................................LIST4...framicon.......... ..............(... ...@..... ..................................................................................................................................................................................................................................................................................................................................................H...H.M.H.U.H...............................................................................................................S...J...D...D...I..S...........................................................................................................U.J.V...Z...Z...X...U.l.............................................................................G...H.u.I...H.R.............W.O.~;..d..e..I..W.q..................................................................

C:\Users\user\AppData\Local\Temp\~1A75.tmp

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	RIFF (little-endian) data, animated cursor
Category:	dropped
Size (bytes):	34500
Entropy (8bit):	2.8482120151923307
Encrypted:	false
SSDEEP:	192:5+LrNbq9he3NdbHLzyEKTWlZLo+6ghxnIjLfT:5+nNbZ3LzqKnkKSLfT
MD5:	75B500A94DAE9DCFEFBB4FAE43F875AB
SHA1:	F0CC7F091520755DB825C60CEA4D27B565FE9F16
SHA-256:	0EF673D5007C9A7CAAB8AB21BC47BCED6E0686F41E792384C8FFCB46CC7AEEE8
SHA-512:	CA221E9E2354A56138B92CC180017D258FC735C4C5498E924AD328A929DC977175DFD3F0A22C8404D9FE74ABE07C8CA73322B8F4785359AAC19E873DE551E306
Malicious:	false
Preview:	RIFF...ACONanih$...$........... ... ... ...............rate ...................................seq ...................................LIST4...framicon.......... ..............(... ...@..... ..................................................................................................................................................................................................................................................................................................................................................H...H.M.H.U.H...............................................................................................................S...J...D...D...I..S...........................................................................................................U.J.V...Z...Z...X...U.l.............................................................................G...H.u.I...H.R.............W.O.~;..d..e..I..W.q..................................................................

C:\Users\user\AppData\Local\Temp\~1A86.tmp

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	RIFF (little-endian) data, animated cursor
Category:	dropped
Size (bytes):	34500
Entropy (8bit):	2.9195293404964455
Encrypted:	false
SSDEEP:	384:3803QQhlzNB05pn9uGgDZ4XBb0VC3dGvh:3zXzNeojgb0k8vh
MD5:	DBCA632B119F14D838313B11B1E52645
SHA1:	0F770400E3B09799DE4A799D4DD45FB105441C1B
SHA-256:	33C5916127FDE97B938D2294BD680681680A93638B8DB6B243FC8DA3BF237CF4
SHA-512:	670434D41E38892C732E28C40BFE21A6E1E08E482ADB3719EEA5183FEEE88CE47F82053956567954842E9F93D535E559E5EDC12BD3F88CA1F2F4370612F92A7F
Malicious:	false
Preview:	RIFF...ACONanih$...$........... ... ... ...............rate ...................................seq ...................................LIST4...framicon.......... ..............(... ...@..... ..................................................................................................................................................................................................................................................................................................................................................4...).M.'.U.4...............................................................................................................1...%...L...O......3............................................................................................................J.8...<...<...>....l.............................................................................4...$.u."...R.............+.OBb..m...m...Pp...+.q..................................................................

C:\Users\user\AppData\Local\Temp\~1A87.tmp

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	RIFF (little-endian) data, animated cursor
Category:	dropped
Size (bytes):	34500
Entropy (8bit):	2.8612946089094904
Encrypted:	false
SSDEEP:	192:5KEqRp0tCkjtkb+S7cCV+nZmOn/jBa/FoTxYRAxrFKUwPMy/2kP+WN:DqpkJkb+fC09/FYFo1YIrge0bN
MD5:	EC77B0BBB5787D44DEFA00E1157B3E92
SHA1:	D14948E77C78E3E6D175368DA67F3A4FD53B6B05
SHA-256:	2E22877D257CC2C7201ABFD0B458742EA431CF0B8C150A5F45D496E52FC8D7EE
SHA-512:	8876F42DC6BA97A00B47777FE1500556F35988ACAA145748D25E86F355614B483B6470881C0334E99B95CD5955270601CE85F3AE86D7CDC65E75FB32D0FB4D2A
Malicious:	false
Preview:	RIFF...ACONanih$...$........... ... ... ...............rate ...................................seq ...................................LIST4...framicon.......... ..............(... ...@..... ...................................................................................................................................................................................................................................................................................................................................................R...QM..QU..Q...............................................................................................................]...S...O...O...R...\...........................................................................................................^J..a...e...e...c...^l..............................................................................Q...Qu..R...QR.............._O=..f..f..J....`q..................................................................

C:\Users\user\AppData\Local\Temp\~3EA3.tmp

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	RIFF (little-endian) data, animated cursor
Category:	dropped
Size (bytes):	34500
Entropy (8bit):	2.8612946089094904
Encrypted:	false
SSDEEP:	192:5KEqRp0tCkjtkb+S7cCV+nZmOn/jBa/FoTxYRAxrFKUwPMy/2kP+WN:DqpkJkb+fC09/FYFo1YIrge0bN
MD5:	EC77B0BBB5787D44DEFA00E1157B3E92
SHA1:	D14948E77C78E3E6D175368DA67F3A4FD53B6B05
SHA-256:	2E22877D257CC2C7201ABFD0B458742EA431CF0B8C150A5F45D496E52FC8D7EE
SHA-512:	8876F42DC6BA97A00B47777FE1500556F35988ACAA145748D25E86F355614B483B6470881C0334E99B95CD5955270601CE85F3AE86D7CDC65E75FB32D0FB4D2A
Malicious:	false
Preview:	RIFF...ACONanih$...$........... ... ... ...............rate ...................................seq ...................................LIST4...framicon.......... ..............(... ...@..... ...................................................................................................................................................................................................................................................................................................................................................R...QM..QU..Q...............................................................................................................]...S...O...O...R...\...........................................................................................................^J..a...e...e...c...^l..............................................................................Q...Qu..R...QR.............._O=..f..f..J....`q..................................................................

C:\Users\user\AppData\Local\Temp\~3EB3.tmp

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	RIFF (little-endian) data, animated cursor
Category:	dropped
Size (bytes):	34500
Entropy (8bit):	2.8482120151923307
Encrypted:	false
SSDEEP:	192:5+LrNbq9he3NdbHLzyEKTWlZLo+6ghxnIjLfT:5+nNbZ3LzqKnkKSLfT
MD5:	75B500A94DAE9DCFEFBB4FAE43F875AB
SHA1:	F0CC7F091520755DB825C60CEA4D27B565FE9F16
SHA-256:	0EF673D5007C9A7CAAB8AB21BC47BCED6E0686F41E792384C8FFCB46CC7AEEE8
SHA-512:	CA221E9E2354A56138B92CC180017D258FC735C4C5498E924AD328A929DC977175DFD3F0A22C8404D9FE74ABE07C8CA73322B8F4785359AAC19E873DE551E306
Malicious:	false
Preview:	RIFF...ACONanih$...$........... ... ... ...............rate ...................................seq ...................................LIST4...framicon.......... ..............(... ...@..... ..................................................................................................................................................................................................................................................................................................................................................H...H.M.H.U.H...............................................................................................................S...J...D...D...I..S...........................................................................................................U.J.V...Z...Z...X...U.l.............................................................................G...H.u.I...H.R.............W.O.~;..d..e..I..W.q..................................................................

C:\Users\user\AppData\Local\Temp\~3EB4.tmp

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	RIFF (little-endian) data, animated cursor
Category:	dropped
Size (bytes):	34500
Entropy (8bit):	2.9195293404964455
Encrypted:	false
SSDEEP:	384:3803QQhlzNB05pn9uGgDZ4XBb0VC3dGvh:3zXzNeojgb0k8vh
MD5:	DBCA632B119F14D838313B11B1E52645
SHA1:	0F770400E3B09799DE4A799D4DD45FB105441C1B
SHA-256:	33C5916127FDE97B938D2294BD680681680A93638B8DB6B243FC8DA3BF237CF4
SHA-512:	670434D41E38892C732E28C40BFE21A6E1E08E482ADB3719EEA5183FEEE88CE47F82053956567954842E9F93D535E559E5EDC12BD3F88CA1F2F4370612F92A7F
Malicious:	false
Preview:	RIFF...ACONanih$...$........... ... ... ...............rate ...................................seq ...................................LIST4...framicon.......... ..............(... ...@..... ..................................................................................................................................................................................................................................................................................................................................................4...).M.'.U.4...............................................................................................................1...%...L...O......3............................................................................................................J.8...<...<...>....l.............................................................................4...$.u."...R.............+.OBb..m...m...Pp...+.q..................................................................

C:\Users\user\AppData\Local\Temp\~3EC5.tmp

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	RIFF (little-endian) data, animated cursor
Category:	dropped
Size (bytes):	34500
Entropy (8bit):	2.8482120151923307
Encrypted:	false
SSDEEP:	192:5+LrNbq9he3NdbHLzyEKTWlZLo+6ghxnIjLfT:5+nNbZ3LzqKnkKSLfT
MD5:	75B500A94DAE9DCFEFBB4FAE43F875AB
SHA1:	F0CC7F091520755DB825C60CEA4D27B565FE9F16
SHA-256:	0EF673D5007C9A7CAAB8AB21BC47BCED6E0686F41E792384C8FFCB46CC7AEEE8
SHA-512:	CA221E9E2354A56138B92CC180017D258FC735C4C5498E924AD328A929DC977175DFD3F0A22C8404D9FE74ABE07C8CA73322B8F4785359AAC19E873DE551E306
Malicious:	false
Preview:	RIFF...ACONanih$...$........... ... ... ...............rate ...................................seq ...................................LIST4...framicon.......... ..............(... ...@..... ..................................................................................................................................................................................................................................................................................................................................................H...H.M.H.U.H...............................................................................................................S...J...D...D...I..S...........................................................................................................U.J.V...Z...Z...X...U.l.............................................................................G...H.u.I...H.R.............W.O.~;..d..e..I..W.q..................................................................

C:\Users\user\AppData\Local\Temp\~3EC6.tmp

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	RIFF (little-endian) data, animated cursor
Category:	dropped
Size (bytes):	34500
Entropy (8bit):	2.8482120151923307
Encrypted:	false
SSDEEP:	192:5+LrNbq9he3NdbHLzyEKTWlZLo+6ghxnIjLfT:5+nNbZ3LzqKnkKSLfT
MD5:	75B500A94DAE9DCFEFBB4FAE43F875AB
SHA1:	F0CC7F091520755DB825C60CEA4D27B565FE9F16
SHA-256:	0EF673D5007C9A7CAAB8AB21BC47BCED6E0686F41E792384C8FFCB46CC7AEEE8
SHA-512:	CA221E9E2354A56138B92CC180017D258FC735C4C5498E924AD328A929DC977175DFD3F0A22C8404D9FE74ABE07C8CA73322B8F4785359AAC19E873DE551E306
Malicious:	false
Preview:	RIFF...ACONanih$...$........... ... ... ...............rate ...................................seq ...................................LIST4...framicon.......... ..............(... ...@..... ..................................................................................................................................................................................................................................................................................................................................................H...H.M.H.U.H...............................................................................................................S...J...D...D...I..S...........................................................................................................U.J.V...Z...Z...X...U.l.............................................................................G...H.u.I...H.R.............W.O.~;..d..e..I..W.q..................................................................

C:\Users\user\AppData\Local\Temp\~3ED7.tmp

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	RIFF (little-endian) data, animated cursor
Category:	dropped
Size (bytes):	34500
Entropy (8bit):	2.9195293404964455
Encrypted:	false
SSDEEP:	384:3803QQhlzNB05pn9uGgDZ4XBb0VC3dGvh:3zXzNeojgb0k8vh
MD5:	DBCA632B119F14D838313B11B1E52645
SHA1:	0F770400E3B09799DE4A799D4DD45FB105441C1B
SHA-256:	33C5916127FDE97B938D2294BD680681680A93638B8DB6B243FC8DA3BF237CF4
SHA-512:	670434D41E38892C732E28C40BFE21A6E1E08E482ADB3719EEA5183FEEE88CE47F82053956567954842E9F93D535E559E5EDC12BD3F88CA1F2F4370612F92A7F
Malicious:	false
Preview:	RIFF...ACONanih$...$........... ... ... ...............rate ...................................seq ...................................LIST4...framicon.......... ..............(... ...@..... ..................................................................................................................................................................................................................................................................................................................................................4...).M.'.U.4...............................................................................................................1...%...L...O......3............................................................................................................J.8...<...<...>....l.............................................................................4...$.u."...R.............+.OBb..m...m...Pp...+.q..................................................................

C:\Users\user\AppData\Local\Temp\~3ED8.tmp

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	RIFF (little-endian) data, animated cursor
Category:	dropped
Size (bytes):	34500
Entropy (8bit):	2.8612946089094904
Encrypted:	false
SSDEEP:	192:5KEqRp0tCkjtkb+S7cCV+nZmOn/jBa/FoTxYRAxrFKUwPMy/2kP+WN:DqpkJkb+fC09/FYFo1YIrge0bN
MD5:	EC77B0BBB5787D44DEFA00E1157B3E92
SHA1:	D14948E77C78E3E6D175368DA67F3A4FD53B6B05
SHA-256:	2E22877D257CC2C7201ABFD0B458742EA431CF0B8C150A5F45D496E52FC8D7EE
SHA-512:	8876F42DC6BA97A00B47777FE1500556F35988ACAA145748D25E86F355614B483B6470881C0334E99B95CD5955270601CE85F3AE86D7CDC65E75FB32D0FB4D2A
Malicious:	false
Preview:	RIFF...ACONanih$...$........... ... ... ...............rate ...................................seq ...................................LIST4...framicon.......... ..............(... ...@..... ...................................................................................................................................................................................................................................................................................................................................................R...QM..QU..Q...............................................................................................................]...S...O...O...R...\...........................................................................................................^J..a...e...e...c...^l..............................................................................Q...Qu..R...QR.............._O=..f..f..J....`q..................................................................

C:\Users\user\AppData\Local\Temp\~9BC6.tmp

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	RIFF (little-endian) data, animated cursor
Category:	dropped
Size (bytes):	34500
Entropy (8bit):	2.8612946089094904
Encrypted:	false
SSDEEP:	192:5KEqRp0tCkjtkb+S7cCV+nZmOn/jBa/FoTxYRAxrFKUwPMy/2kP+WN:DqpkJkb+fC09/FYFo1YIrge0bN
MD5:	EC77B0BBB5787D44DEFA00E1157B3E92
SHA1:	D14948E77C78E3E6D175368DA67F3A4FD53B6B05
SHA-256:	2E22877D257CC2C7201ABFD0B458742EA431CF0B8C150A5F45D496E52FC8D7EE
SHA-512:	8876F42DC6BA97A00B47777FE1500556F35988ACAA145748D25E86F355614B483B6470881C0334E99B95CD5955270601CE85F3AE86D7CDC65E75FB32D0FB4D2A
Malicious:	false
Preview:	RIFF...ACONanih$...$........... ... ... ...............rate ...................................seq ...................................LIST4...framicon.......... ..............(... ...@..... ...................................................................................................................................................................................................................................................................................................................................................R...QM..QU..Q...............................................................................................................]...S...O...O...R...\...........................................................................................................^J..a...e...e...c...^l..............................................................................Q...Qu..R...QR.............._O=..f..f..J....`q..................................................................

C:\Users\user\AppData\Local\Temp\~9BD7.tmp

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	RIFF (little-endian) data, animated cursor
Category:	dropped
Size (bytes):	34500
Entropy (8bit):	2.8482120151923307
Encrypted:	false
SSDEEP:	192:5+LrNbq9he3NdbHLzyEKTWlZLo+6ghxnIjLfT:5+nNbZ3LzqKnkKSLfT
MD5:	75B500A94DAE9DCFEFBB4FAE43F875AB
SHA1:	F0CC7F091520755DB825C60CEA4D27B565FE9F16
SHA-256:	0EF673D5007C9A7CAAB8AB21BC47BCED6E0686F41E792384C8FFCB46CC7AEEE8
SHA-512:	CA221E9E2354A56138B92CC180017D258FC735C4C5498E924AD328A929DC977175DFD3F0A22C8404D9FE74ABE07C8CA73322B8F4785359AAC19E873DE551E306
Malicious:	false
Preview:	RIFF...ACONanih$...$........... ... ... ...............rate ...................................seq ...................................LIST4...framicon.......... ..............(... ...@..... ..................................................................................................................................................................................................................................................................................................................................................H...H.M.H.U.H...............................................................................................................S...J...D...D...I..S...........................................................................................................U.J.V...Z...Z...X...U.l.............................................................................G...H.u.I...H.R.............W.O.~;..d..e..I..W.q..................................................................

C:\Users\user\AppData\Local\Temp\~9BD8.tmp

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	RIFF (little-endian) data, animated cursor
Category:	dropped
Size (bytes):	34500
Entropy (8bit):	2.9195293404964455
Encrypted:	false
SSDEEP:	384:3803QQhlzNB05pn9uGgDZ4XBb0VC3dGvh:3zXzNeojgb0k8vh
MD5:	DBCA632B119F14D838313B11B1E52645
SHA1:	0F770400E3B09799DE4A799D4DD45FB105441C1B
SHA-256:	33C5916127FDE97B938D2294BD680681680A93638B8DB6B243FC8DA3BF237CF4
SHA-512:	670434D41E38892C732E28C40BFE21A6E1E08E482ADB3719EEA5183FEEE88CE47F82053956567954842E9F93D535E559E5EDC12BD3F88CA1F2F4370612F92A7F
Malicious:	false
Preview:	RIFF...ACONanih$...$........... ... ... ...............rate ...................................seq ...................................LIST4...framicon.......... ..............(... ...@..... ..................................................................................................................................................................................................................................................................................................................................................4...).M.'.U.4...............................................................................................................1...%...L...O......3............................................................................................................J.8...<...<...>....l.............................................................................4...$.u."...R.............+.OBb..m...m...Pp...+.q..................................................................

C:\Users\user\AppData\Local\Temp\~9BE9.tmp

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	RIFF (little-endian) data, animated cursor
Category:	dropped
Size (bytes):	34500
Entropy (8bit):	2.8482120151923307
Encrypted:	false
SSDEEP:	192:5+LrNbq9he3NdbHLzyEKTWlZLo+6ghxnIjLfT:5+nNbZ3LzqKnkKSLfT
MD5:	75B500A94DAE9DCFEFBB4FAE43F875AB
SHA1:	F0CC7F091520755DB825C60CEA4D27B565FE9F16
SHA-256:	0EF673D5007C9A7CAAB8AB21BC47BCED6E0686F41E792384C8FFCB46CC7AEEE8
SHA-512:	CA221E9E2354A56138B92CC180017D258FC735C4C5498E924AD328A929DC977175DFD3F0A22C8404D9FE74ABE07C8CA73322B8F4785359AAC19E873DE551E306
Malicious:	false
Preview:	RIFF...ACONanih$...$........... ... ... ...............rate ...................................seq ...................................LIST4...framicon.......... ..............(... ...@..... ..................................................................................................................................................................................................................................................................................................................................................H...H.M.H.U.H...............................................................................................................S...J...D...D...I..S...........................................................................................................U.J.V...Z...Z...X...U.l.............................................................................G...H.u.I...H.R.............W.O.~;..d..e..I..W.q..................................................................

C:\Users\user\AppData\Local\Temp\~9BEA.tmp

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	RIFF (little-endian) data, animated cursor
Category:	dropped
Size (bytes):	34500
Entropy (8bit):	2.8482120151923307
Encrypted:	false
SSDEEP:	192:5+LrNbq9he3NdbHLzyEKTWlZLo+6ghxnIjLfT:5+nNbZ3LzqKnkKSLfT
MD5:	75B500A94DAE9DCFEFBB4FAE43F875AB
SHA1:	F0CC7F091520755DB825C60CEA4D27B565FE9F16
SHA-256:	0EF673D5007C9A7CAAB8AB21BC47BCED6E0686F41E792384C8FFCB46CC7AEEE8
SHA-512:	CA221E9E2354A56138B92CC180017D258FC735C4C5498E924AD328A929DC977175DFD3F0A22C8404D9FE74ABE07C8CA73322B8F4785359AAC19E873DE551E306
Malicious:	false
Preview:	RIFF...ACONanih$...$........... ... ... ...............rate ...................................seq ...................................LIST4...framicon.......... ..............(... ...@..... ..................................................................................................................................................................................................................................................................................................................................................H...H.M.H.U.H...............................................................................................................S...J...D...D...I..S...........................................................................................................U.J.V...Z...Z...X...U.l.............................................................................G...H.u.I...H.R.............W.O.~;..d..e..I..W.q..................................................................

C:\Users\user\AppData\Local\Temp\~9BFA.tmp

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	RIFF (little-endian) data, animated cursor
Category:	dropped
Size (bytes):	34500
Entropy (8bit):	2.9195293404964455
Encrypted:	false
SSDEEP:	384:3803QQhlzNB05pn9uGgDZ4XBb0VC3dGvh:3zXzNeojgb0k8vh
MD5:	DBCA632B119F14D838313B11B1E52645
SHA1:	0F770400E3B09799DE4A799D4DD45FB105441C1B
SHA-256:	33C5916127FDE97B938D2294BD680681680A93638B8DB6B243FC8DA3BF237CF4
SHA-512:	670434D41E38892C732E28C40BFE21A6E1E08E482ADB3719EEA5183FEEE88CE47F82053956567954842E9F93D535E559E5EDC12BD3F88CA1F2F4370612F92A7F
Malicious:	false
Preview:	RIFF...ACONanih$...$........... ... ... ...............rate ...................................seq ...................................LIST4...framicon.......... ..............(... ...@..... ..................................................................................................................................................................................................................................................................................................................................................4...).M.'.U.4...............................................................................................................1...%...L...O......3............................................................................................................J.8...<...<...>....l.............................................................................4...$.u."...R.............+.OBb..m...m...Pp...+.q..................................................................

C:\Users\user\AppData\Local\Temp\~9C0B.tmp

Download File

Process:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
File Type:	RIFF (little-endian) data, animated cursor
Category:	dropped
Size (bytes):	34500
Entropy (8bit):	2.8612946089094904
Encrypted:	false
SSDEEP:	192:5KEqRp0tCkjtkb+S7cCV+nZmOn/jBa/FoTxYRAxrFKUwPMy/2kP+WN:DqpkJkb+fC09/FYFo1YIrge0bN
MD5:	EC77B0BBB5787D44DEFA00E1157B3E92
SHA1:	D14948E77C78E3E6D175368DA67F3A4FD53B6B05
SHA-256:	2E22877D257CC2C7201ABFD0B458742EA431CF0B8C150A5F45D496E52FC8D7EE
SHA-512:	8876F42DC6BA97A00B47777FE1500556F35988ACAA145748D25E86F355614B483B6470881C0334E99B95CD5955270601CE85F3AE86D7CDC65E75FB32D0FB4D2A
Malicious:	false
Preview:	RIFF...ACONanih$...$........... ... ... ...............rate ...................................seq ...................................LIST4...framicon.......... ..............(... ...@..... ...................................................................................................................................................................................................................................................................................................................................................R...QM..QU..Q...............................................................................................................]...S...O...O...R...\...........................................................................................................^J..a...e...e...c...^l..............................................................................Q...Qu..R...QR.............._O=..f..f..J....`q..................................................................

C:\Users\user\Desktop\PlanSwift 11.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Aug 28 19:40:46 2024, mtime=Wed Aug 28 19:41:07 2024, atime=Wed May 31 15:12:16 2023, length=15557072, window=hide
Category:	dropped
Size (bytes):	1106
Entropy (8bit):	4.6747491818797045
Encrypted:	false
SSDEEP:	24:8mWYJ3EWdOEgXI/RyAwPUCAdSxdPVUUthvqyFm:8mWYJUWdOevwPjAdSxdPWgsyF
MD5:	D3E277402167750BFA828E75E51DCEA6
SHA1:	28BB03FD2851654EE3EE33DDF6EF4BD5A3220F42
SHA-256:	463A76ED1233EE4F1C98CB5A77DDD4EB182FBFF2242B68813E302FF142632031
SHA-512:	3CAFADB970FCB9BD2AA6F72E922F157389669A2F0BBF4591718637952FA88236BC79A507DAA1BD4B325F0097C709A959D5E2BBEE5CCD9AA5775DDA5B4FE6129C
Malicious:	false
Preview:	L..................F.... ....u......$.....0..m....a...........................P.O. .:i.....+00.../C:\.....................1......Y....PROGRA~2.........O.I.Y......................V.....&'..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....`.1......Y....PLANSW~1..H.......Y...Y$...........................f...P.l.a.n.S.w.i.f.t.1.1.....h.2..a...V.. .PLANSW~1.EXE..L.......Y...Y.......C........................P.l.a.n.S.w.i.f.t...e.x.e......._...............-.......^....................C:\Program Files (x86)\PlanSwift11\PlanSwift.exe..6.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.P.l.a.n.S.w.i.f.t.1.1.\.P.l.a.n.S.w.i.f.t...e.x.e.".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.P.l.a.n.S.w.i.f.t.1.1.........*................@Z\|...K.J.........`.......X.......878411...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.999984844429525
TrID:	Win32 Executable (generic) a (10002005/4) 98.86% Inno Setup installer (109748/4) 1.08% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	ps11.0.0.129pro.exe
File size:	54'814'096 bytes
MD5:	fc13bc8b09702ec0ca1a48f7e9157380
SHA1:	3895eac6524ea439e1dc0e3c537a868f8b3f84af
SHA256:	c2a5572944067b561cb0d269b8975affb8253631278741130f621d6d7d39f9cd
SHA512:	2ce138aae7f5dd228b54918395f89f1b2d6cd837835dec9169482e4614e442fbe832ca617c5f6e58acf7e868676549e9bb1fd92032224aeb829eaefc646805a2
SSDEEP:	1572864:+8UFaAjqfUaK1ewS69L18nF72K/DflELeV06mC:IWfJWWFZDV5
TLSH:	83C73313B39CAFFEF902D1F4CB8CB848D1B4A527E174B016B569CA96936A1773093247
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x40aad0
Entrypoint Section:	CODE
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:	2fb819a19fe4dee5c03e8c6a79342f79

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	01/03/2023 00:00:00 28/02/2026 23:59:59
Subject Chain	CN="ConstructConnect, Inc.", O="ConstructConnect, Inc.", L=Cincinnati, S=Ohio, C=US
Version:	3
Thumbprint MD5:	586B3871E283983668E2AFCE9FD55F9B
Thumbprint SHA-1:	6F9296A617BDE8B5BBDD7CE3B48863D01A33DEFA
Thumbprint SHA-256:	7159CF6018A711D5EF3A3BFFB2BE9E5634B60A9346B3BE15A7BDE333770FA534
Serial:	0A9F66FA7F8798F17CF9F01CACCA424E

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFC4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-24h], eax
call 00007F4CD8E06FFBh
call 00007F4CD8E08202h
call 00007F4CD8E08569h
call 00007F4CD8E089BCh
call 00007F4CD8E0A95Bh
call 00007F4CD8E0D2F2h
call 00007F4CD8E0D459h
xor eax, eax
push ebp
push 0040B1A1h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 0040B16Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [0040D014h]
call 00007F4CD8E0DF2Bh
call 00007F4CD8E0DB16h
cmp byte ptr [0040C234h], 00000000h
je 00007F4CD8E0EA0Eh
call 00007F4CD8E0E028h
xor eax, eax
call 00007F4CD8E07CF1h
lea edx, dword ptr [ebp-10h]
xor eax, eax
call 00007F4CD8E0AF6Bh
mov edx, dword ptr [ebp-10h]
mov eax, 0040DE30h
call 00007F4CD8E07092h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [0040DE30h]
mov dl, 01h
mov eax, 00407840h
call 00007F4CD8E0B826h
mov dword ptr [0040DE34h], eax
xor edx, edx
push ebp
push 0040B122h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F4CD8E0DF86h
mov dword ptr [0040DE3Ch], eax
mov eax, dword ptr [0040DE3Ch]
cmp dword ptr [eax+0Ch], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe000	0x97c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x12000	0x2c00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x34453d0	0x11c0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x10000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0xa208	0xa400	49513e676dadfb3919c4b137dd7c6d66	False	0.5959413109756098	data	6.6016742350943245	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0xc000	0x250	0x400	0a7b48e75f6b6ef4a087528fee0d185c	False	0.30859375	data	2.771347682604831	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xd000	0xe94	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xe000	0x97c	0xa00	df5f31e62e05c787fd29eed7071bf556	False	0.41796875	data	4.486076246232586	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xf000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x10000	0x18	0x200	14dfa4128117e7f94fe2f8d7dea374a0	False	0.05078125	data	0.190488766434666	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x11000	0x920	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x12000	0x2c00	0x2c00	b520d4d57d6bb2631641bcab729029e5	False	0.33460582386363635	data	4.606450540099942	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x12354	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Dutch	Netherlands	0.5675675675675675
RT_ICON	0x1247c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Dutch	Netherlands	0.4486994219653179
RT_ICON	0x129e4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Dutch	Netherlands	0.4637096774193548
RT_ICON	0x12ccc	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	Dutch	Netherlands	0.3935018050541516
RT_STRING	0x13574	0x2f2	data			0.35543766578249336
RT_STRING	0x13868	0x30c	data			0.3871794871794872
RT_STRING	0x13b74	0x2ce	data			0.42618384401114207
RT_STRING	0x13e44	0x68	data			0.75
RT_STRING	0x13eac	0xb4	data			0.6277777777777778
RT_STRING	0x13f60	0xae	data			0.5344827586206896
RT_RCDATA	0x14010	0x2c	data			1.2045454545454546
RT_GROUP_ICON	0x1403c	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0x1407c	0x4f4	data	English	United States	0.2870662460567823
RT_MANIFEST	0x14570	0x62c	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4240506329113924

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
user32.dll	MessageBoxA
oleaut32.dll	VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA
kernel32.dll	WriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SizeofResource, SetLastError, SetFilePointer, SetErrorMode, SetEndOfFile, RemoveDirectoryA, ReadFile, LockResource, LoadResource, LoadLibraryA, IsDBCSLeadByte, GetWindowsDirectoryA, GetVersionExA, GetVersion, GetUserDefaultLangID, GetSystemInfo, GetSystemDirectoryA, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, GetACP, InterlockedExchange, FormatMessageA, FindResourceA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle
user32.dll	TranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA
comctl32.dll	InitCommonControls
advapi32.dll	AdjustTokenPrivileges

Possible Origin

Language of compilation system	Country where language is spoken	Map
Dutch	Netherlands
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 28, 2024 22:41:53.832798004 CEST	49740	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:53.832815886 CEST	443	49740	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:53.832920074 CEST	49740	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:53.835378885 CEST	49740	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:53.835391045 CEST	443	49740	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:54.684535980 CEST	443	49740	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:54.684614897 CEST	49740	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:54.698894024 CEST	49740	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:54.698906898 CEST	443	49740	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:54.699131012 CEST	49740	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:54.699135065 CEST	443	49740	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:54.699343920 CEST	49740	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:54.699347019 CEST	443	49740	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:54.699388981 CEST	443	49740	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:54.700576067 CEST	49740	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:54.700684071 CEST	443	49740	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:54.700709105 CEST	443	49740	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:54.700756073 CEST	49740	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:54.708921909 CEST	49740	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:54.708929062 CEST	443	49740	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:55.181196928 CEST	49741	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:55.181278944 CEST	443	49741	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:55.181372881 CEST	49741	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:55.185250044 CEST	49741	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:55.185287952 CEST	443	49741	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:55.787137985 CEST	443	49741	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:55.787235022 CEST	49741	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:55.809201002 CEST	49741	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:55.809242964 CEST	443	49741	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:55.809330940 CEST	49741	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:55.809341908 CEST	443	49741	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:55.809400082 CEST	49741	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:55.809408903 CEST	443	49741	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:55.809442997 CEST	443	49741	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:55.809748888 CEST	49741	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:55.809813023 CEST	49741	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:55.809840918 CEST	49741	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:55.809845924 CEST	443	49741	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:55.809859991 CEST	49741	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:55.809886932 CEST	443	49741	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:55.809894085 CEST	49741	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:55.856513023 CEST	443	49741	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:56.056282043 CEST	443	49741	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:56.056431055 CEST	443	49741	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:56.056520939 CEST	49741	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:56.056581020 CEST	49741	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:56.056610107 CEST	443	49741	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:56.231559038 CEST	49742	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:56.231610060 CEST	443	49742	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:56.231684923 CEST	49742	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:56.231794119 CEST	49742	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:56.231822014 CEST	443	49742	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:56.816647053 CEST	443	49742	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:56.816782951 CEST	49742	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:56.839752913 CEST	49742	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:56.839790106 CEST	443	49742	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:56.839917898 CEST	49742	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:56.839924097 CEST	443	49742	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:56.839975119 CEST	49742	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:56.839979887 CEST	443	49742	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:56.840023994 CEST	443	49742	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:56.840393066 CEST	49742	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:56.880534887 CEST	443	49742	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:57.109047890 CEST	443	49742	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:57.109108925 CEST	443	49742	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:57.112613916 CEST	49742	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:57.112870932 CEST	49742	443	192.168.2.4	18.144.71.249
Aug 28, 2024 22:41:57.112900972 CEST	443	49742	18.144.71.249	192.168.2.4
Aug 28, 2024 22:41:57.311686039 CEST	49743	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:57.311713934 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:57.311858892 CEST	49743	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:57.311959982 CEST	49743	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:57.311971903 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:57.777007103 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:57.777272940 CEST	49743	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:57.791601896 CEST	49743	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:57.791615009 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:57.791781902 CEST	49743	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:57.791785002 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:57.792329073 CEST	49743	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:57.792331934 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:57.792381048 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:57.792964935 CEST	49743	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:57.836500883 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.006860018 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.006947041 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.006987095 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.007025003 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.007056952 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.007088900 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.007191896 CEST	49743	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:58.007191896 CEST	49743	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:58.007201910 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.007222891 CEST	49743	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:58.007752895 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.007785082 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.007807016 CEST	49743	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:58.007814884 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.008465052 CEST	49743	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:58.011588097 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.074985027 CEST	49743	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:58.074990034 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.094033957 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.094070911 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.094095945 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.094124079 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.094151974 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.094228029 CEST	49743	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:58.094228029 CEST	49743	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:58.094237089 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.094260931 CEST	49743	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:58.094485044 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.094542980 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.094579935 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.094582081 CEST	49743	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:58.094590902 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.094620943 CEST	49743	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:58.094659090 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.094697952 CEST	49743	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:58.094702005 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.094736099 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.095449924 CEST	49743	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:58.095467091 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.095479965 CEST	49743	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:58.095484018 CEST	443	49743	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.843147039 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:58.843172073 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.843211889 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:58.843240023 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.843241930 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:58.843313932 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:58.870485067 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:58.870520115 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:58.870603085 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:58.870615959 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.336697102 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.336776018 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.351434946 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.351506948 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.390774965 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.390810013 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.391117096 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.391278028 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.391314983 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.391330957 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.391535044 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.391578913 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.395106077 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.395543098 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.440500021 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.440505028 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.533413887 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.533463955 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.533473969 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.533504009 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.533546925 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.533550978 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.533556938 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.533596039 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.533607006 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.533651114 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.533657074 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.533695936 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.533699989 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.533718109 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.533740044 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.533745050 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.533761978 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.533783913 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.533787966 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.533826113 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.539319038 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.539367914 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.539372921 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.539417982 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.546267033 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.546314001 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.546323061 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.546389103 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.546395063 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.546406031 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.546458006 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.546478033 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.546521902 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.546526909 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.546576977 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.546586990 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.546596050 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.546633959 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.547179937 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.547226906 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.551062107 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.551103115 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.551115036 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.551122904 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.551146030 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.551172972 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.551177025 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.551217079 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.623863935 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.623915911 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.623923063 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.623943090 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.623956919 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.623976946 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.623986006 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.623990059 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.624018908 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.624026060 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.624278069 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.624320030 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.624324083 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.624365091 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.624370098 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.624414921 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.624458075 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.624533892 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.624538898 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.624583960 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.625092030 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.625132084 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.625138998 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.625180960 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.625255108 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.625298977 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.625303030 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.625344992 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.625449896 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.625509977 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.625520945 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.625562906 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.626111984 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.626247883 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.626252890 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.626312017 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.626365900 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.626372099 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.626499891 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.626532078 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.626537085 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.626548052 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.626619101 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.636822939 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.636900902 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.636926889 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.636959076 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.636998892 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.637051105 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.637051105 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.637051105 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.637317896 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.637403011 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.637415886 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.637459993 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.637489080 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.637511969 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.637523890 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.637548923 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.637564898 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.637588024 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.637598038 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.637661934 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.638075113 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.638124943 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.638125896 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.638143063 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.638199091 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.638240099 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.638294935 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.638315916 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.638335943 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.638344049 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.638355017 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.638395071 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.638395071 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.638395071 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.638415098 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.638433933 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.638477087 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.639496088 CEST	49745	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.639538050 CEST	443	49745	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.641148090 CEST	49746	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.641204119 CEST	443	49746	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.641284943 CEST	49746	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.641504049 CEST	49746	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.641531944 CEST	443	49746	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.665996075 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.666048050 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.666053057 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.666064978 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.666109085 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.666138887 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.698611975 CEST	49749	443	192.168.2.4	104.18.11.207
Aug 28, 2024 22:41:59.698633909 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:41:59.698688030 CEST	49749	443	192.168.2.4	104.18.11.207
Aug 28, 2024 22:41:59.707055092 CEST	49749	443	192.168.2.4	104.18.11.207
Aug 28, 2024 22:41:59.707068920 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:41:59.709502935 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.709593058 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.709640026 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.709640026 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.709660053 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.709666967 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.709672928 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.709722042 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.709731102 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.709774971 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.710118055 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.710166931 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.710172892 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.710223913 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.710783005 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.710834980 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.710869074 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.710916042 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.711771965 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.711812973 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.711833000 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.711838007 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.711863041 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.711873055 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.711970091 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.712025881 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.712790012 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.712840080 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.712857008 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.712903023 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.713823080 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.713852882 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.713877916 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.713882923 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.713897943 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.714308023 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.754903078 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.754939079 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.754967928 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.754985094 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.754998922 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.755027056 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.798141956 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.798167944 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.798202991 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.798218012 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.798228979 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.798229933 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.798279047 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.798285007 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.798325062 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.798695087 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.798724890 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.798734903 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.798738956 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.798765898 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.798779964 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.799021959 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.799071074 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.799120903 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.799165964 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.799671888 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.799705029 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.799716949 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.799721956 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.799752951 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.799765110 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.800040960 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.800091982 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.800230980 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.800276041 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.800585032 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.800622940 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.800633907 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.800637007 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.800667048 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.800684929 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.800947905 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.801002979 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.801080942 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.801132917 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.801171064 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.801225901 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.802907944 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.802961111 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.803018093 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.803066015 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.803141117 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.803191900 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.803241968 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.803289890 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.803652048 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.803710938 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.803725004 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.803729057 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.803760052 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.803808928 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.803877115 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.803908110 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.803934097 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.803937912 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.803966045 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.803983927 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.843117952 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.843178034 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.843353033 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.843400002 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.886563063 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.886627913 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.886636019 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.886646032 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.886682987 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.887044907 CEST	49744	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.887054920 CEST	443	49744	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.888228893 CEST	49752	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.888305902 CEST	443	49752	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.888387918 CEST	49752	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.888842106 CEST	49752	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:41:59.888876915 CEST	443	49752	199.60.103.30	192.168.2.4
Aug 28, 2024 22:41:59.939693928 CEST	49753	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:41:59.939707994 CEST	443	49753	104.17.25.14	192.168.2.4
Aug 28, 2024 22:41:59.939785004 CEST	49753	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:41:59.939917088 CEST	49754	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:41:59.939929962 CEST	443	49754	104.17.25.14	192.168.2.4
Aug 28, 2024 22:41:59.940002918 CEST	49754	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:41:59.940263033 CEST	49753	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:41:59.940278053 CEST	443	49753	104.17.25.14	192.168.2.4
Aug 28, 2024 22:41:59.940694094 CEST	49754	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:41:59.940704107 CEST	443	49754	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.096667051 CEST	443	49746	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.096841097 CEST	49746	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.097196102 CEST	49746	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.097212076 CEST	443	49746	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.099050999 CEST	49746	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.099062920 CEST	443	49746	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.165110111 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.165193081 CEST	49749	443	192.168.2.4	104.18.11.207
Aug 28, 2024 22:42:00.169461966 CEST	49749	443	192.168.2.4	104.18.11.207
Aug 28, 2024 22:42:00.169471025 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.169715881 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.169770002 CEST	49749	443	192.168.2.4	104.18.11.207
Aug 28, 2024 22:42:00.170180082 CEST	49749	443	192.168.2.4	104.18.11.207
Aug 28, 2024 22:42:00.216506958 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.259773016 CEST	443	49746	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.259824038 CEST	49746	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.259835005 CEST	443	49746	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.259861946 CEST	443	49746	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.259892941 CEST	443	49746	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.259949923 CEST	49746	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.259958029 CEST	443	49746	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.260087013 CEST	49746	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.260094881 CEST	443	49746	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.260227919 CEST	49746	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.260252953 CEST	443	49746	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.260312080 CEST	443	49746	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.260353088 CEST	49746	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.260360003 CEST	443	49746	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.260401964 CEST	49746	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.260901928 CEST	443	49746	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.260948896 CEST	49746	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.264630079 CEST	443	49746	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.264735937 CEST	49746	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.264741898 CEST	443	49746	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.264940023 CEST	49746	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.297785997 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.297826052 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.297863007 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.297880888 CEST	49749	443	192.168.2.4	104.18.11.207
Aug 28, 2024 22:42:00.297894955 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.297908068 CEST	49749	443	192.168.2.4	104.18.11.207
Aug 28, 2024 22:42:00.297929049 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.297960997 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.297991037 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.298001051 CEST	49749	443	192.168.2.4	104.18.11.207
Aug 28, 2024 22:42:00.298007011 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.298036098 CEST	49749	443	192.168.2.4	104.18.11.207
Aug 28, 2024 22:42:00.298042059 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.298047066 CEST	49749	443	192.168.2.4	104.18.11.207
Aug 28, 2024 22:42:00.298051119 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.298077106 CEST	49749	443	192.168.2.4	104.18.11.207
Aug 28, 2024 22:42:00.298101902 CEST	49749	443	192.168.2.4	104.18.11.207
Aug 28, 2024 22:42:00.302498102 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.302551031 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.302628994 CEST	49749	443	192.168.2.4	104.18.11.207
Aug 28, 2024 22:42:00.302637100 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.302787066 CEST	49749	443	192.168.2.4	104.18.11.207
Aug 28, 2024 22:42:00.346328020 CEST	443	49746	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.346401930 CEST	443	49746	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.346446037 CEST	443	49746	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.346465111 CEST	49746	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.346575022 CEST	49746	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.346707106 CEST	49746	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.346728086 CEST	443	49746	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.347260952 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.347290993 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.347378969 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.347680092 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.347706079 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.364070892 CEST	443	49752	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.364142895 CEST	49752	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.365098953 CEST	49752	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.365112066 CEST	443	49752	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.369013071 CEST	49752	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.369023085 CEST	443	49752	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.382704973 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.382765055 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.382796049 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.382813931 CEST	49749	443	192.168.2.4	104.18.11.207
Aug 28, 2024 22:42:00.382836103 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.382852077 CEST	49749	443	192.168.2.4	104.18.11.207
Aug 28, 2024 22:42:00.383064985 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.383095026 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.383109093 CEST	49749	443	192.168.2.4	104.18.11.207
Aug 28, 2024 22:42:00.383121014 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.383147955 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.383157015 CEST	49749	443	192.168.2.4	104.18.11.207
Aug 28, 2024 22:42:00.383163929 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.383204937 CEST	49749	443	192.168.2.4	104.18.11.207
Aug 28, 2024 22:42:00.383892059 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.383955956 CEST	49749	443	192.168.2.4	104.18.11.207
Aug 28, 2024 22:42:00.383961916 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.383971930 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.384011030 CEST	49749	443	192.168.2.4	104.18.11.207
Aug 28, 2024 22:42:00.403541088 CEST	49749	443	192.168.2.4	104.18.11.207
Aug 28, 2024 22:42:00.403552055 CEST	443	49749	104.18.11.207	192.168.2.4
Aug 28, 2024 22:42:00.411717892 CEST	443	49753	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.411783934 CEST	49753	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:00.413801908 CEST	443	49754	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.413857937 CEST	49754	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:00.416950941 CEST	49753	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:00.416954994 CEST	443	49753	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.417172909 CEST	443	49753	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.417289019 CEST	49753	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:00.418011904 CEST	49753	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:00.419929028 CEST	49754	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:00.419933081 CEST	443	49754	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.420130968 CEST	443	49754	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.420232058 CEST	49754	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:00.421255112 CEST	49754	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:00.464503050 CEST	443	49753	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.468498945 CEST	443	49754	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.533652067 CEST	443	49752	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.533713102 CEST	49752	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.533720970 CEST	443	49752	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.533765078 CEST	443	49752	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.533770084 CEST	49752	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.533776999 CEST	443	49752	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.533816099 CEST	49752	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.533821106 CEST	443	49752	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.533854961 CEST	443	49752	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.533857107 CEST	49752	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.533864021 CEST	443	49752	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.533960104 CEST	49752	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.534358025 CEST	443	49752	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.534482956 CEST	49752	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.534488916 CEST	443	49752	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.534569025 CEST	49752	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.534698963 CEST	443	49752	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.534879923 CEST	443	49752	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.534914970 CEST	443	49752	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.534931898 CEST	49752	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.534951925 CEST	49752	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.535893917 CEST	49752	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.535901070 CEST	443	49752	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.761796951 CEST	443	49753	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.761842012 CEST	443	49753	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.761864901 CEST	49753	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:00.761873007 CEST	443	49753	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.761883020 CEST	49753	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:00.761912107 CEST	443	49753	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.761914015 CEST	49753	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:00.761920929 CEST	443	49753	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.762027025 CEST	49753	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:00.762032986 CEST	443	49753	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.762375116 CEST	443	49753	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.762409925 CEST	443	49753	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.762423038 CEST	49753	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:00.762428045 CEST	443	49753	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.762516975 CEST	49753	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:00.762521982 CEST	443	49753	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.763010025 CEST	49753	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:00.766555071 CEST	443	49753	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.766648054 CEST	49753	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:00.766652107 CEST	443	49753	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.766659975 CEST	443	49753	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.766706944 CEST	49753	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:00.767276049 CEST	49753	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:00.767281055 CEST	443	49753	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.767748117 CEST	49759	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:00.767756939 CEST	443	49759	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.767822027 CEST	49759	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:00.768115044 CEST	49759	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:00.768125057 CEST	443	49759	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.770895958 CEST	443	49754	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.770951986 CEST	49754	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:00.770956993 CEST	443	49754	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.771115065 CEST	443	49754	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.771178007 CEST	443	49754	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.771193027 CEST	49754	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:00.771229982 CEST	49754	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:00.773252010 CEST	49754	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:00.773256063 CEST	443	49754	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:00.886506081 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.887067080 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.919282913 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.919289112 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:00.921685934 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:00.921690941 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.072228909 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.072302103 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.072335958 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.072375059 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.072397947 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.072410107 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.072432995 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.072451115 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.072606087 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.072729111 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.073406935 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.073450089 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.073457956 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.073519945 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.077132940 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.077189922 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.077199936 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.077207088 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.077239990 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.077260971 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.165395021 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.165446997 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.165452957 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.165503979 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.165512085 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.165613890 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.165734053 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.165782928 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.165810108 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.165832996 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.165838957 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.165844917 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.165868998 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.165884972 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.166357040 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.166488886 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.166493893 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.166676998 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.166683912 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.166841984 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.166857958 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.166934013 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.166949987 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.166955948 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.166982889 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.166995049 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.167284966 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.167337894 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.167376995 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.167397976 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.167398930 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.167408943 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.167427063 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.167450905 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.168250084 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.168288946 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.168302059 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.168308020 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.168354034 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.168360949 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.168586969 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.220413923 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.220464945 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.265007019 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.265059948 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.265065908 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.265104055 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.265141964 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.265147924 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.265152931 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.265182018 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.265189886 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.265194893 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.265199900 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.265227079 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.265245914 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.265253067 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.265269995 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.265357018 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.265726089 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.265793085 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.265825033 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.265872002 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.266675949 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.266727924 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.266824007 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.266868114 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.266985893 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.267029047 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.267568111 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.267632961 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.267719984 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.267764091 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.268470049 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.268507004 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.268527031 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.268532991 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.268557072 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.268584967 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.268682957 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.268738031 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.269382954 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.269445896 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.270076990 CEST	443	49759	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:01.270139933 CEST	49759	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:01.270472050 CEST	49759	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:01.270478010 CEST	443	49759	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:01.272830009 CEST	49759	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:01.272835016 CEST	443	49759	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:01.353821993 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.353883982 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.353888988 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.353931904 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.354123116 CEST	49755	443	192.168.2.4	199.60.103.30
Aug 28, 2024 22:42:01.354130983 CEST	443	49755	199.60.103.30	192.168.2.4
Aug 28, 2024 22:42:01.621056080 CEST	443	49759	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:01.621108055 CEST	49759	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:01.621112108 CEST	443	49759	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:01.621124029 CEST	443	49759	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:01.621160030 CEST	49759	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:01.621172905 CEST	443	49759	104.17.25.14	192.168.2.4
Aug 28, 2024 22:42:01.621196032 CEST	49759	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:01.621222973 CEST	49759	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:01.621656895 CEST	49759	443	192.168.2.4	104.17.25.14
Aug 28, 2024 22:42:01.621664047 CEST	443	49759	104.17.25.14	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 28, 2024 22:41:53.795352936 CEST	54816	53	192.168.2.4	1.1.1.1
Aug 28, 2024 22:41:53.830765009 CEST	53	54816	1.1.1.1	192.168.2.4
Aug 28, 2024 22:41:57.131422997 CEST	51798	53	192.168.2.4	1.1.1.1
Aug 28, 2024 22:41:57.310945988 CEST	53	51798	1.1.1.1	192.168.2.4
Aug 28, 2024 22:41:59.683242083 CEST	64668	53	192.168.2.4	1.1.1.1
Aug 28, 2024 22:41:59.689754963 CEST	53	64668	1.1.1.1	192.168.2.4
Aug 28, 2024 22:41:59.923715115 CEST	64777	53	192.168.2.4	1.1.1.1
Aug 28, 2024 22:41:59.930620909 CEST	53	64777	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 28, 2024 22:41:53.795352936 CEST	192.168.2.4	1.1.1.1	0x6ec0	Standard query (0)	www.planswift.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:41:57.131422997 CEST	192.168.2.4	1.1.1.1	0x1c03	Standard query (0)	hub.planswift.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:41:59.683242083 CEST	192.168.2.4	1.1.1.1	0x51a7	Standard query (0)	maxcdn.bootstrapcdn.com	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:41:59.923715115 CEST	192.168.2.4	1.1.1.1	0x5d8d	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 28, 2024 22:41:53.830765009 CEST	1.1.1.1	192.168.2.4	0x6ec0	No error (0)	www.planswift.com		18.144.71.249	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:41:57.310945988 CEST	1.1.1.1	192.168.2.4	0x1c03	No error (0)	hub.planswift.com	2347101.group1.sites.hubspot.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 22:41:57.310945988 CEST	1.1.1.1	192.168.2.4	0x1c03	No error (0)	2347101.group1.sites.hubspot.net	group1.sites.hscoscdn00.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 28, 2024 22:41:57.310945988 CEST	1.1.1.1	192.168.2.4	0x1c03	No error (0)	group1.sites.hscoscdn00.net		199.60.103.30	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:41:57.310945988 CEST	1.1.1.1	192.168.2.4	0x1c03	No error (0)	group1.sites.hscoscdn00.net		199.60.103.226	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:41:59.689754963 CEST	1.1.1.1	192.168.2.4	0x51a7	No error (0)	maxcdn.bootstrapcdn.com		104.18.11.207	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:41:59.689754963 CEST	1.1.1.1	192.168.2.4	0x51a7	No error (0)	maxcdn.bootstrapcdn.com		104.18.10.207	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:41:59.930620909 CEST	1.1.1.1	192.168.2.4	0x5d8d	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Aug 28, 2024 22:41:59.930620909 CEST	1.1.1.1	192.168.2.4	0x5d8d	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.planswift.com

hub.planswift.com

maxcdn.bootstrapcdn.com

cdnjs.cloudflare.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49741	18.144.71.249	443	5888	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:41:55 UTC	154	OUT	POST /status/ HTTP/1.1 Content-Type: multipart/form-data; boundary=------------000001050802010608020008 Host: www.planswift.com Content-Length: 375
2024-08-28 20:41:55 UTC	87	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 30 30 30 30 30 31 30 35 30 38 30 32 30 31 30 36 30 38 30 32 30 30 30 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 0d 0a 0d 0a Data Ascii: --------------000001050802010608020008Content-Disposition: form-data; name="data"
2024-08-28 20:41:55 UTC	244	OUT	Data Raw: 61 64 64 68 6d 64 62 62 69 6c 69 6e 61 6e 6f 62 69 6f 70 62 68 6e 63 67 67 62 67 62 70 6d 68 69 63 6e 6a 66 6d 67 6b 6f 70 63 6f 6f 68 6b 63 62 63 6d 65 6a 6d 66 6b 62 70 6f 69 66 69 67 61 65 67 63 6d 6a 61 66 6c 70 6c 69 68 69 6d 70 63 6e 69 6c 66 64 6c 66 69 62 6e 61 68 70 66 62 69 69 6d 63 6b 64 6c 62 6a 67 63 66 70 69 61 65 6b 70 64 66 62 66 69 63 70 6b 64 68 6e 67 6d 64 70 6d 6a 64 67 69 69 68 69 67 68 69 6a 67 69 65 64 6f 6e 66 69 6d 61 64 61 6c 6a 65 6f 64 69 68 6b 6e 6e 6f 64 66 68 6c 61 69 63 65 64 6a 6d 6b 65 6f 6b 68 6e 6e 6e 66 61 6a 6d 67 6b 6d 6a 6d 6d 63 6b 68 62 64 64 6e 65 6d 6f 62 61 66 70 70 61 70 63 6a 6a 70 6d 64 69 61 69 68 64 6d 6e 6c 6c 6a 69 67 6a 6e 67 63 64 6d 66 68 68 6f 62 68 6e 6d 63 69 66 6c Data Ascii: addhmdbbilinanobiopbhncggbgbpmhicnjfmgkopcoohkcbcmejmfkbpoifigaegcmjaflplihimpcnilfdlfibnahpfbiimckdlbjgcfpiaekpdfbficpkdhngmdpmjdgiihighijgiedonfimadaljeodihknnodfhlaicedjmkeokhnnnfajmgkmjmmckhbddnemobafppapcjjpmdiaihdmnlljigjngcdmfhhobhnmcifl
2024-08-28 20:41:55 UTC	2	OUT	Data Raw: 0d 0a Data Ascii:
2024-08-28 20:41:55 UTC	42	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 30 30 30 30 30 31 30 35 30 38 30 32 30 31 30 36 30 38 30 32 30 30 30 38 2d 2d 0d 0a Data Ascii: --------------000001050802010608020008--
2024-08-28 20:41:56 UTC	263	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:41:54 GMT Server: Apache X-Powered-By: PHP/5.5.9-1ubuntu4.21 Cache-Control: max-age=2592000 Expires: Fri, 27 Sep 2024 20:41:54 GMT Vary: User-Agent Content-Length: 12 Connection: close Content-Type: text/html
2024-08-28 20:41:56 UTC	12	IN	Data Raw: 52 45 53 55 4c 54 3d 54 52 55 45 0a Data Ascii: RESULT=TRUE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49742	18.144.71.249	443	5888	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:41:56 UTC	364	OUT	GET /getting-started-viewer?licenseType=Viewer&edition=Professional&version=11.0.0.129& HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip Host: www.planswift.com
2024-08-28 20:41:57 UTC	364	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 28 Aug 2024 20:41:55 GMT Server: Apache Location: https://hub.planswift.com/getting-started-viewer?licenseType=Viewer&edition=Professional&version=11.0.0.129& Cache-Control: max-age=2592000 Expires: Fri, 27 Sep 2024 20:41:55 GMT Content-Length: 328 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-08-28 20:41:57 UTC	328	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 75 62 2e 70 6c 61 6e 73 77 69 66 74 2e 63 6f 6d 2f 67 65 74 74 69 6e 67 2d 73 74 61 72 74 65 64 2d 76 69 65 77 65 72 3f 6c 69 63 65 6e 73 65 54 79 70 65 3d 56 69 65 77 65 72 26 61 6d 70 3b 65 64 69 74 69 6f Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://hub.planswift.com/getting-started-viewer?licenseType=Viewer&editio

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49743	199.60.103.30	443	5888	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:41:57 UTC	364	OUT	GET /getting-started-viewer?licenseType=Viewer&edition=Professional&version=11.0.0.129& HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip Host: hub.planswift.com
2024-08-28 20:41:58 UTC	1318	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:41:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-store, no-cache, must-revalidate Last-Modified: Tue, 27 Aug 2024 00:08:13 GMT Link: </hs/hsstatic/cos-i18n/static-1.53/bundles/project.js>; rel=preload; as=script Strict-Transport-Security: max-age=31536000 Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: CT-45535632183,P-2347101,L-26579302320,W-1577943125483,W-1582317355899,W-1584039041720,W-1619544208046,W-1707932649488,CW-19235975964,CW-21621814999,CW-23959717279,E-23959717268,E-23959717269,E-23959717271,E-23959717273,E-23959717276,E-9927841831,PGS-ALL,SW-0 Referrer-Policy: no-referrer-when-downgrade X-HS-Cache-Config: BrowserCache-5s-EdgeCache-0s X-HS-Cache-Control: s-maxage=10800, max-age=0 X-HS-CF-Cache-Status: HIT X-HS-Content-Campaign-Id: 78641952-4343-4e94-b4b8-1a70ec13b0cc X-HS-Content-Id: 45535632183 X-HS-Hub-Id: 2347101 X-HS-Prerendered: two-phase;Tue, 27 Aug 2024 00:08:12 GMT Set-Cookie: __cf_bm=nFmJFGuY4.MIs3NTbQ4LKHUtpZYF9eNsbncK4aKjQA0-1724877717-1.0.1.1-z.yA7CXYuEVAIlAu.OMRsC7tU3BJcBnKCrdlQ8yuw9ha4FhthHo5ac7SHXwJCEZc6Pe1e5oeRFpiqQEB5kagJQ; path=/; expires=Wed, 28-Aug-24 21:11:57 GMT; domain=.hub.planswift.com; HttpOnly; Secure; SameSite=None
2024-08-28 20:41:58 UTC	558	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 73 4b 4b 54 4f 66 59 63 58 44 50 62 79 49 71 30 4b 53 42 54 46 4b 37 66 34 44 49 54 32 48 56 5a 59 37 6b 36 50 35 54 42 4e 6b 62 35 52 6a 38 4a 68 35 6b 30 63 57 52 55 4c 76 6c 39 59 43 4a 6a 62 59 71 35 38 56 59 56 77 4c 36 59 32 4b 25 32 42 43 4c 73 61 50 52 42 25 32 42 62 6c 67 46 6a 31 56 68 6e 25 32 46 67 25 32 42 39 6c 71 45 25 32 46 46 6a 64 44 66 25 32 42 75 36 54 45 38 31 31 38 73 4f 6a 38 6b 25 32 46 41 4c 64 41 39 70 4a 58 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sKKTOfYcXDPbyIq0KSBTFK7f4DIT2HVZY7k6P5TBNkb5Rj8Jh5k0cWRULvl9YCJjbYq58VYVwL6Y2K%2BCLsaPRB%2BblgFj1Vhn%2Fg%2B9lqE%2FFjdDf%2Bu6TE8118sOj8k%2FALdA9pJX"}],"group":"cf-nel","max_age":
2024-08-28 20:41:58 UTC	1369	IN	Data Raw: 37 35 34 34 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 6c 74 2d 69 65 39 20 6c 74 2d 69 65 38 20 6c 74 2d 69 65 37 22 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 6c 74 2d 69 65 39 20 6c 74 2d 69 65 38 22 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 20 20 20 20 20 20 20 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 6c 74 2d 69 65 39 22 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: 7544<!doctype html>...[if lt IE 7]> <html class="no-js lt-ie9 lt-ie8 lt-ie7" lang="en" > <![endif]-->...[if IE 7]> <html class="no-js lt-ie9 lt-ie8" lang="en" > <![endif]-->...[if IE 8]> <html class="no-js lt-ie9" lang="en" >
2024-08-28 20:41:58 UTC	1369	IN	Data Raw: 70 65 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 3a 30 70 78 20 30 70 78 20 30 70 78 20 30 70 78 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 30 70 78 20 30 70 78 20 30 70 78 7d 2e 68 73 2d 62 72 65 61 64 63 72 75 6d 62 2d 6d 65 6e 75 2d 69 74 65 6d 7b 66 6c 6f 61 74 3a 6c 65 66 74 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 20 30 70 78 20 31 30 70 78 20 31 30 70 78 7d 2e 68 73 2d 62 72 65 61 64 63 72 75 6d 62 2d 6d 65 6e 75 2d 64 69 76 69 64 65 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 27 e2 80 ba 27 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 30 70 78 7d 2e 68 73 2d 66 65 61 74 75 72 65 64 2d 69 6d 61 67 65 2d 6c 69 6e 6b 7b 62 6f 72 64 65 72 3a 30 7d 2e 68 73 2d 66 65 61 74 75 72 65 64 2d 69 6d 61 67 65 7b 66 6c 6f 61 74 3a 72 69 67 68 74 3b 6d 61 72 67 69 6e Data Ascii: pe:none;margin:0px 0px 0px 0px;padding:0px 0px 0px 0px}.hs-breadcrumb-menu-item{float:left;padding:10px 0px 10px 10px}.hs-breadcrumb-menu-divider:before{content:'';padding-left:10px}.hs-featured-image-link{border:0}.hs-featured-image{float:right;margin
2024-08-28 20:41:58 UTC	1369	IN	Data Raw: 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 73 29 5b 30 5d 2c 0a 6a 3d 64 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 73 29 2c 64 6c 3d 6c 21 3d 27 64 61 74 61 4c 61 79 65 72 27 3f 27 26 6c 3d 27 2b 6c 3a 27 27 3b 6a 2e 61 73 79 6e 63 3d 74 72 75 65 3b 6a 2e 73 72 63 3d 0a 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 6d 2e 6a 73 3f 69 64 3d 27 2b 69 2b 64 6c 3b 66 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 6a 2c 66 29 3b 0a 7d 29 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 2c 27 73 63 72 69 70 74 27 2c 27 64 61 74 61 4c 61 79 65 72 27 2c 27 47 54 4d 2d 4d 43 46 4e 48 34 27 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 21 2d 2d 20 45 6e 64 20 Data Ascii: .getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-MCFNH4');</script>... End
2024-08-28 20:41:58 UTC	1369	IN	Data Raw: 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 28 61 64 73 62 79 67 6f 6f 67 6c 65 20 3d 20 77 69 6e 64 6f 77 2e 61 64 73 62 79 67 6f 6f 67 6c 65 20 7c 7c 20 5b 5d 29 2e 70 75 73 68 28 7b 0a 20 20 20 20 67 6f 6f 67 6c 65 5f 61 64 5f 63 6c 69 65 6e 74 3a 20 22 63 61 2d 70 75 62 2d 37 33 32 38 33 33 32 32 37 32 30 32 34 31 34 32 22 2c 0a 20 20 20 20 65 6e 61 62 6c 65 5f 70 61 67 65 5f 6c 65 76 65 6c 5f 61 64 73 3a 20 74 72 75 65 0a 20 20 7d 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 21 2d 2d 20 45 6e 64 20 47 6f 6f 67 6c 65 20 41 64 53 65 6e 73 65 20 2d 2d 3e 0a 3c 21 2d 2d 20 4d 61 72 6b 65 74 6f 20 4d 75 6e 63 68 6b 69 6e 20 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 21 66 75 6e 63 74 69 Data Ascii: /script><script> (adsbygoogle = window.adsbygoogle \|\| []).push({ google_ad_client: "ca-pub-7328332272024142", enable_page_level_ads: true });</script>... End Google AdSense -->... Marketo Munchkin <script type="text/javascript">!functi
2024-08-28 20:41:58 UTC	1369	IN	Data Raw: 2f 39 39 32 37 38 34 31 38 33 31 2f 31 35 38 30 32 35 30 37 36 30 37 39 30 2f 43 75 73 74 6f 6d 2f 70 61 67 65 2f 50 6c 61 6e 73 77 69 66 74 5f 4d 61 79 32 30 31 37 2d 74 68 65 6d 65 2f 50 6c 61 6e 73 77 69 66 74 5f 4d 61 79 32 30 31 37 2d 73 74 79 6c 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 75 62 2e 70 6c 61 6e 73 77 69 66 74 2e 63 6f 6d 2f 68 73 2d 66 73 2f 68 75 62 2f 32 33 34 37 31 30 31 2f 68 75 62 5f 67 65 6e 65 72 61 74 65 64 2f 74 65 6d 70 6c 61 74 65 5f 61 73 73 65 74 73 2f 32 33 39 35 39 37 31 37 32 37 31 2f 31 35 38 30 32 35 30 37 36 31 37 38 35 2f 48 75 62 55 49 2d 50 6c 61 6e 53 77 69 66 74 2f 61 73 73 65 74 73 2f 70 72 6f 64 75 63 74 Data Ascii: /9927841831/1580250760790/Custom/page/Planswift_May2017-theme/Planswift_May2017-style.min.css"><link rel="stylesheet" href="https://hub.planswift.com/hs-fs/hub/2347101/hub_generated/template_assets/23959717271/1580250761785/HubUI-PlanSwift/assets/product
2024-08-28 20:41:58 UTC	1369	IN	Data Raw: 70 78 3b 0a 20 20 7d 0a 20 20 0a 20 20 0a 20 20 0a 20 20 61 2e 63 74 61 5f 62 75 74 74 6f 6e 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 34 36 70 78 21 69 6d 70 6f 72 74 61 6e 74 3b 20 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 3b 20 0a 20 20 7d 0a 20 20 0a 20 20 20 20 2e 68 65 72 6f 2d 73 6c 69 64 65 72 20 61 2e 62 74 6e 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 3a 20 30 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 39 70 78 20 34 32 70 78 20 31 36 70 78 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 7d 0a 20 20 0a 20 20 20 20 64 69 76 23 68 73 5f 63 6f 73 5f 77 72 61 70 70 65 72 5f 77 69 64 67 65 74 5f 31 35 37 37 39 34 33 31 32 35 34 38 33 20 7b 0a 20 20 20 20 64 69 73 70 Data Ascii: px; } a.cta_button { padding-bottom:46px!important; color: #fff!important; } .hero-slider a.btn { border: 0!important; padding: 19px 42px 16px!important; } div#hs_cos_wrapper_widget_1577943125483 { disp
2024-08-28 20:41:58 UTC	1369	IN	Data Raw: 66 6f 20 68 34 20 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 70 78 7d 0a 20 20 23 70 73 47 53 63 6f 6e 74 61 63 74 49 6e 66 6f 20 70 20 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 70 78 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 30 70 78 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 30 70 78 7d 0a 20 20 23 76 69 64 65 6f 54 75 74 49 6e 66 6f 20 3e 20 64 69 76 3a 6e 74 68 2d 63 68 69 6c 64 28 32 29 20 3e 20 64 69 76 3a 6e 74 68 2d 63 68 69 6c 64 28 31 29 20 3e 20 64 69 76 3a 6e 74 68 2d 63 68 69 6c 64 28 31 29 20 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 30 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 7d 0a 23 76 69 64 65 6f 54 75 74 49 6e 66 6f 2e 73 65 63 Data Ascii: fo h4 {margin-top:0px;margin-bottom:0px} #psGScontactInfo p {margin-top:0px;margin-bottom:0px;padding-top:0px;padding-bottom:0px} #videoTutInfo > div:nth-child(2) > div:nth-child(1) > div:nth-child(1) {padding-bottom: 0px !important}#videoTutInfo.sec
2024-08-28 20:41:58 UTC	1369	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 28 66 61 6c 73 65 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 61 63 63 6f 75 6e 74 49 44 20 3d 20 67 65 74 51 75 65 72 79 56 61 72 69 61 62 6c 65 28 27 61 63 63 6f 75 6e 74 49 44 27 29 3b 0a 20 20 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 61 63 63 6f 75 6e 74 49 44 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 76 69 73 69 74 6f 72 49 44 20 3d 20 67 65 74 51 75 65 72 79 56 61 72 69 61 62 6c 65 28 27 76 69 73 69 74 6f 72 49 44 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 61 70 69 6b 65 79 20 3d 20 27 41 50 2d 59 44 44 32 4e 5a 48 4f 4b 38 52 58 2d 32 27 3b 20 2f 2f 67 65 74 51 75 65 72 79 56 61 72 69 61 62 6c 65 28 27 61 70 69 6b Data Ascii: return(false); } var accountID = getQueryVariable('accountID'); console.log(accountID); var visitorID = getQueryVariable('visitorID'); var apikey = 'AP-YDD2NZHOK8RX-2'; //getQueryVariable('apik
2024-08-28 20:41:58 UTC	1369	IN	Data Raw: 73 2d 70 61 67 65 20 22 20 73 74 79 6c 65 3d 22 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 2d 63 6f 6e 74 61 69 6e 65 72 2d 77 72 61 70 70 65 72 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 2d 63 6f 6e 74 61 69 6e 65 72 20 63 6f 6e 74 61 69 6e 65 72 2d 66 6c 75 69 64 22 3e 0a 0a 0a 20 20 20 20 3c 2f 64 69 76 3e 3c 21 2d 2d 65 6e 64 20 68 65 61 64 65 72 20 2d 2d 3e 0a 3c 2f 64 69 76 3e 3c 21 2d 2d 65 6e 64 20 68 65 61 64 65 72 20 77 72 61 70 70 65 72 20 2d 2d 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 6f 64 79 2d 63 6f 6e 74 61 69 6e 65 72 2d 77 72 61 70 70 65 72 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 6f 64 79 2d 63 6f 6e 74 61 69 6e 65 72 20 63 6f 6e 74 61 69 6e 65 72 Data Ascii: s-page " style=""> <div class="header-container-wrapper"> <div class="header-container container-fluid"> </div>...end header --></div>...end header wrapper --><div class="body-container-wrapper"> <div class="body-container container

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49744	199.60.103.30	443	5888	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:41:59 UTC	333	OUT	GET /hs-fs/hub/2347101/hub_generated/template_assets/23959717271/1580250761785/HubUI-PlanSwift/assets/production.min.css HTTP/1.1 Accept: / Accept-Language: en-CH Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: hub.planswift.com Connection: Keep-Alive
2024-08-28 20:41:59 UTC	1366	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:41:59 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: close CF-Ray: 8ba72012899b5e82-EWR CF-Cache-Status: HIT Age: 2734 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000 ETag: W/"b61d04c58751d53f129523762a1c1d46" Last-Modified: Tue, 28 Jan 2020 22:32:42 GMT Strict-Transport-Security: max-age=31536000 Vary: origin, Accept-Encoding Via: 1.1 936f33bed45438343f0ef2adff442814.cloudfront.net (CloudFront) Access-Control-Allow-Credentials: false Content-Security-Policy: upgrade-insecure-requests Timing-Allow-Origin: hub.planswift.com X-Amz-Cf-Id: x6IiOYQ5hrV2bL_92cUNRoznK-umdaorAbgfgH5B0Rhkh2xbn5IFlw== X-Amz-Cf-Pop: IAD89-C1 x-amz-id-2: WEH8y1aoeVieQgnjy7yKzppUxNVF/mWFQYt5ydIUaZ1GkHwnCbufAlZY0j9n9A+FfZdyIhcgVxk= x-amz-request-id: KX0RHVFMFF0WMZSZ x-amz-version-id: .k8CqpZABrfSHCTYGwsJcXuNyIlfCVPU X-Cache: Miss from cloudfront x-envoy-upstream-service-time: 232 x-evy-trace-listener: listener_https x-evy-trace-route-configuration: listener_https/all x-evy-trace-route-service-name: envoyset-translator x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-656644bdb-ts7f8 x-evy-trace-virtual-host: all X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3 X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3
2024-08-28 20:41:59 UTC	916	IN	Data Raw: 78 2d 68 75 62 73 70 6f 74 2d 63 6f 72 72 65 6c 61 74 69 6f 6e 2d 69 64 3a 20 36 32 39 38 39 65 64 64 2d 36 66 33 38 2d 34 65 64 61 2d 61 34 66 35 2d 64 61 37 35 61 38 34 35 61 64 39 32 0d 0a 78 2d 72 65 71 75 65 73 74 2d 69 64 3a 20 36 32 39 38 39 65 64 64 2d 36 66 33 38 2d 34 65 64 61 2d 61 34 66 35 2d 64 61 37 35 61 38 34 35 61 64 39 32 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 5f 62 6d 3d 64 50 4c 57 59 44 65 4c 64 55 5a 4f 63 4a 72 35 6c 4f 56 66 70 30 35 49 61 6c 7a 67 41 33 46 63 79 41 4a 6f 47 46 42 6c 49 47 34 2d 31 37 32 34 38 37 37 37 31 39 2d 31 2e 30 2e 31 2e 31 2d 78 66 59 61 53 74 47 6d 33 65 57 75 4a 53 76 59 45 36 72 69 46 66 51 74 77 79 4c 69 53 37 4e 50 59 64 42 46 4e 69 54 37 67 30 31 42 33 61 4a 4d 35 4d 39 69 6f 70 49 61 Data Ascii: x-hubspot-correlation-id: 62989edd-6f38-4eda-a4f5-da75a845ad92x-request-id: 62989edd-6f38-4eda-a4f5-da75a845ad92Set-Cookie: __cf_bm=dPLWYDeLdUZOcJr5lOVfp05IalzgA3FcyAJoGFBlIG4-1724877719-1.0.1.1-xfYaStGm3eWuJSvYE6riFfQtwyLiS7NPYdBFNiT7g01B3aJM5M9iopIa
2024-08-28 20:41:59 UTC	1369	IN	Data Raw: 37 31 30 66 0d 0a 40 69 6d 70 6f 72 74 20 75 72 6c 28 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 66 61 6e 63 79 62 6f 78 2f 33 2e 35 2e 32 2f 6a 71 75 65 72 79 2e 66 61 6e 63 79 62 6f 78 2e 6d 69 6e 2e 63 73 73 22 29 3b 40 69 6d 70 6f 72 74 20 75 72 6c 28 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 73 6c 69 63 6b 2d 63 61 72 6f 75 73 65 6c 2f 31 2e 38 2e 30 2f 73 6c 69 63 6b 2d 74 68 65 6d 65 2e 63 73 73 22 29 3b 40 69 6d 70 6f 72 74 20 75 72 6c 28 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 73 6c 69 63 6b 2d 63 61 72 6f 75 73 65 Data Ascii: 710f@import url("https://cdnjs.cloudflare.com/ajax/libs/fancybox/3.5.2/jquery.fancybox.min.css");@import url("https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.8.0/slick-theme.css");@import url("https://cdnjs.cloudflare.com/ajax/libs/slick-carouse
2024-08-28 20:41:59 UTC	1369	IN	Data Raw: 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 36 30 70 78 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 36 30 70 78 7d 2e 67 72 69 64 20 2e 68 73 5f 63 6f 73 5f 77 72 61 70 70 65 72 5f 74 79 70 65 5f 63 75 73 74 6f 6d 5f 77 69 64 67 65 74 7b 66 6f 6e 74 2d 73 69 7a 65 3a 30 70 78 7d 2e 67 72 69 64 2e 68 61 72 64 2c 2e 67 72 69 64 2e 68 61 72 64 2d 2d 73 69 64 65 73 7b 77 69 64 74 68 3a 31 30 30 25 20 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 67 72 69 64 5f 5f 69 74 65 6d 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 6f 70 3b 6d 61 72 67 69 6e 2d 6c 65 Data Ascii: ox;box-sizing:border-box;padding-top:60px;padding-bottom:60px}.grid .hs_cos_wrapper_type_custom_widget{font-size:0px}.grid.hard,.grid.hard--sides{width:100% !important;max-width:100% !important}.grid__item{display:inline-block;vertical-align:top;margin-le
2024-08-28 20:41:59 UTC	1369	IN	Data Raw: 38 2e 31 36 36 36 36 38 25 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 66 69 76 65 2d 74 77 65 6c 66 74 68 73 2e 68 61 72 64 2d 2d 6c 65 66 74 2e 67 72 69 64 5f 5f 69 74 65 6d 2c 2e 66 69 76 65 2d 74 77 65 6c 66 74 68 73 2e 68 61 72 64 2d 2d 72 69 67 68 74 2e 67 72 69 64 5f 5f 69 74 65 6d 7b 77 69 64 74 68 3a 33 39 2e 39 31 36 36 36 38 25 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 66 69 76 65 2d 74 77 65 6c 66 74 68 73 2e 68 61 72 64 2e 67 72 69 64 5f 5f 69 74 65 6d 2c 2e 66 69 76 65 2d 74 77 65 6c 66 74 68 73 2e 68 61 72 64 2d 2d 73 69 64 65 73 2e 67 72 69 64 5f 5f 69 74 65 6d 7b 77 69 64 74 68 3a 34 31 2e 36 36 36 36 36 38 25 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 73 69 78 2d 74 77 65 6c 66 74 68 73 2e 67 72 69 64 5f 5f 69 74 65 6d 7b 77 69 64 74 68 3a 34 36 2e Data Ascii: 8.166668% !important}.five-twelfths.hard--left.grid__item,.five-twelfths.hard--right.grid__item{width:39.916668% !important}.five-twelfths.hard.grid__item,.five-twelfths.hard--sides.grid__item{width:41.666668% !important}.six-twelfths.grid__item{width:46.
2024-08-28 20:41:59 UTC	1369	IN	Data Raw: 74 77 65 6c 66 74 68 73 2e 68 61 72 64 2e 67 72 69 64 5f 5f 69 74 65 6d 2c 2e 74 65 6e 2d 74 77 65 6c 66 74 68 73 2e 68 61 72 64 2d 2d 73 69 64 65 73 2e 67 72 69 64 5f 5f 69 74 65 6d 7b 77 69 64 74 68 3a 38 33 2e 33 33 33 33 33 36 25 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 65 6c 65 76 65 6e 2d 74 77 65 6c 66 74 68 73 2e 67 72 69 64 5f 5f 69 74 65 6d 7b 77 69 64 74 68 3a 38 38 2e 31 36 36 36 36 34 25 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 65 6c 65 76 65 6e 2d 74 77 65 6c 66 74 68 73 2e 68 61 72 64 2d 2d 6c 65 66 74 2e 67 72 69 64 5f 5f 69 74 65 6d 2c 2e 65 6c 65 76 65 6e 2d 74 77 65 6c 66 74 68 73 2e 68 61 72 64 2d 2d 72 69 67 68 74 2e 67 72 69 64 5f 5f 69 74 65 6d 7b 77 69 64 74 68 3a 38 39 2e 39 31 36 36 36 34 25 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 65 Data Ascii: twelfths.hard.grid__item,.ten-twelfths.hard--sides.grid__item{width:83.333336% !important}.eleven-twelfths.grid__item{width:88.166664% !important}.eleven-twelfths.hard--left.grid__item,.eleven-twelfths.hard--right.grid__item{width:89.916664% !important}.e
2024-08-28 20:41:59 UTC	1369	IN	Data Raw: 5f 69 74 65 6d 7b 77 69 64 74 68 3a 32 33 2e 32 35 25 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6f 6e 65 2d 66 6f 75 72 74 68 2e 68 61 72 64 2e 67 72 69 64 5f 5f 69 74 65 6d 2c 2e 6f 6e 65 2d 66 6f 75 72 74 68 2e 68 61 72 64 2d 2d 73 69 64 65 73 2e 67 72 69 64 5f 5f 69 74 65 6d 7b 77 69 64 74 68 3a 32 35 25 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6f 6e 65 2d 66 69 66 74 68 2e 67 72 69 64 5f 5f 69 74 65 6d 7b 77 69 64 74 68 3a 31 36 2e 35 25 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6f 6e 65 2d 66 69 66 74 68 2e 68 61 72 64 2d 2d 6c 65 66 74 2e 67 72 69 64 5f 5f 69 74 65 6d 2c 2e 6f 6e 65 2d 66 69 66 74 68 2e 68 61 72 64 2d 2d 72 69 67 68 74 2e 67 72 69 64 5f 5f 69 74 65 6d 7b 77 69 64 74 68 3a 31 38 2e 32 35 25 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6f 6e 65 2d Data Ascii: _item{width:23.25% !important}.one-fourth.hard.grid__item,.one-fourth.hard--sides.grid__item{width:25% !important}.one-fifth.grid__item{width:16.5% !important}.one-fifth.hard--left.grid__item,.one-fifth.hard--right.grid__item{width:18.25% !important}.one-
2024-08-28 20:41:59 UTC	1369	IN	Data Raw: 73 2e 67 72 69 64 5f 5f 69 74 65 6d 7b 77 69 64 74 68 3a 32 35 25 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 64 65 73 6b 2d 66 6f 75 72 2d 74 77 65 6c 66 74 68 73 2e 67 72 69 64 5f 5f 69 74 65 6d 7b 77 69 64 74 68 3a 32 39 2e 38 33 33 33 33 34 25 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 64 65 73 6b 2d 66 6f 75 72 2d 74 77 65 6c 66 74 68 73 2e 68 61 72 64 2d 2d 6c 65 66 74 2e 67 72 69 64 5f 5f 69 74 65 6d 2c 2e 64 65 73 6b 2d 66 6f 75 72 2d 74 77 65 6c 66 74 68 73 2e 68 61 72 64 2d 2d 72 69 67 68 74 2e 67 72 69 64 5f 5f 69 74 65 6d 7b 77 69 64 74 68 3a 33 31 2e 35 38 33 33 33 34 25 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 64 65 73 6b 2d 66 6f 75 72 2d 74 77 65 6c 66 74 68 73 2e 68 61 72 64 2e 67 72 69 64 5f 5f 69 74 65 6d 2c 2e 64 65 73 6b 2d 66 6f 75 72 2d 74 77 Data Ascii: s.grid__item{width:25% !important}.desk-four-twelfths.grid__item{width:29.833334% !important}.desk-four-twelfths.hard--left.grid__item,.desk-four-twelfths.hard--right.grid__item{width:31.583334% !important}.desk-four-twelfths.hard.grid__item,.desk-four-tw
2024-08-28 20:41:59 UTC	1369	IN	Data Raw: 72 64 2d 2d 73 69 64 65 73 2e 67 72 69 64 5f 5f 69 74 65 6d 7b 77 69 64 74 68 3a 36 36 2e 36 36 36 36 36 34 25 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 64 65 73 6b 2d 6e 69 6e 65 2d 74 77 65 6c 66 74 68 73 2e 67 72 69 64 5f 5f 69 74 65 6d 7b 77 69 64 74 68 3a 37 31 2e 35 25 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 64 65 73 6b 2d 6e 69 6e 65 2d 74 77 65 6c 66 74 68 73 2e 68 61 72 64 2d 2d 6c 65 66 74 2e 67 72 69 64 5f 5f 69 74 65 6d 2c 2e 64 65 73 6b 2d 6e 69 6e 65 2d 74 77 65 6c 66 74 68 73 2e 68 61 72 64 2d 2d 72 69 67 68 74 2e 67 72 69 64 5f 5f 69 74 65 6d 7b 77 69 64 74 68 3a 37 33 2e 32 35 25 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 64 65 73 6b 2d 6e 69 6e 65 2d 74 77 65 6c 66 74 68 73 2e 68 61 72 64 2e 67 72 69 64 5f 5f 69 74 65 6d 2c 2e 64 65 73 6b 2d 6e Data Ascii: rd--sides.grid__item{width:66.666664% !important}.desk-nine-twelfths.grid__item{width:71.5% !important}.desk-nine-twelfths.hard--left.grid__item,.desk-nine-twelfths.hard--right.grid__item{width:73.25% !important}.desk-nine-twelfths.hard.grid__item,.desk-n
2024-08-28 20:41:59 UTC	1369	IN	Data Raw: 6d 7b 77 69 64 74 68 3a 31 30 30 25 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 64 65 73 6b 2d 6f 6e 65 2d 68 61 6c 66 2e 67 72 69 64 5f 5f 69 74 65 6d 7b 77 69 64 74 68 3a 34 36 2e 35 25 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 64 65 73 6b 2d 6f 6e 65 2d 68 61 6c 66 2e 68 61 72 64 2d 2d 6c 65 66 74 2e 67 72 69 64 5f 5f 69 74 65 6d 2c 2e 64 65 73 6b 2d 6f 6e 65 2d 68 61 6c 66 2e 68 61 72 64 2d 2d 72 69 67 68 74 2e 67 72 69 64 5f 5f 69 74 65 6d 7b 77 69 64 74 68 3a 34 38 2e 32 35 25 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 64 65 73 6b 2d 6f 6e 65 2d 68 61 6c 66 2e 68 61 72 64 2e 67 72 69 64 5f 5f 69 74 65 6d 2c 2e 64 65 73 6b 2d 6f 6e 65 2d 68 61 6c 66 2e 68 61 72 64 2d 2d 73 69 64 65 73 2e 67 72 69 64 5f 5f 69 74 65 6d 7b 77 69 64 74 68 3a 35 30 25 20 21 69 6d 70 Data Ascii: m{width:100% !important}.desk-one-half.grid__item{width:46.5% !important}.desk-one-half.hard--left.grid__item,.desk-one-half.hard--right.grid__item{width:48.25% !important}.desk-one-half.hard.grid__item,.desk-one-half.hard--sides.grid__item{width:50% !imp
2024-08-28 20:41:59 UTC	1369	IN	Data Raw: 2d 6f 6e 65 2d 74 77 65 6c 66 74 68 73 2e 68 61 72 64 2d 2d 6c 65 66 74 2e 67 72 69 64 5f 5f 69 74 65 6d 2c 2e 6c 61 70 2d 6f 6e 65 2d 74 77 65 6c 66 74 68 73 2e 68 61 72 64 2d 2d 72 69 67 68 74 2e 67 72 69 64 5f 5f 69 74 65 6d 7b 77 69 64 74 68 3a 36 2e 35 38 33 33 33 33 35 25 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6c 61 70 2d 6f 6e 65 2d 74 77 65 6c 66 74 68 73 2e 68 61 72 64 2e 67 72 69 64 5f 5f 69 74 65 6d 2c 2e 6c 61 70 2d 6f 6e 65 2d 74 77 65 6c 66 74 68 73 2e 68 61 72 64 2d 2d 73 69 64 65 73 2e 67 72 69 64 5f 5f 69 74 65 6d 7b 77 69 64 74 68 3a 38 2e 33 33 33 33 33 33 25 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6c 61 70 2d 74 77 6f 2d 74 77 65 6c 66 74 68 73 2e 67 72 69 64 5f 5f 69 74 65 6d 7b 77 69 64 74 68 3a 31 33 2e 31 36 36 36 36 37 25 20 21 69 Data Ascii: -one-twelfths.hard--left.grid__item,.lap-one-twelfths.hard--right.grid__item{width:6.5833335% !important}.lap-one-twelfths.hard.grid__item,.lap-one-twelfths.hard--sides.grid__item{width:8.333333% !important}.lap-two-twelfths.grid__item{width:13.166667% !i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49745	199.60.103.30	443	5888	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:41:59 UTC	358	OUT	GET /hs-fs/hub/2347101/hub_generated/template_assets/9927841831/1580250760790/Custom/page/Planswift_May2017-theme/Planswift_May2017-style.min.css HTTP/1.1 Accept: / Accept-Language: en-CH Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: hub.planswift.com Connection: Keep-Alive
2024-08-28 20:41:59 UTC	1317	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:41:59 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: close CF-Ray: 8ba72012881a42d8-EWR CF-Cache-Status: HIT Age: 2734 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900,s-maxage=31536000, max-age=31536000 ETag: W/"8d8ebd5b508af85f7f54b86ea258cec7" Last-Modified: Tue, 28 Jan 2020 22:32:41 GMT Strict-Transport-Security: max-age=31536000 Vary: origin, Accept-Encoding Via: 1.1 7c4bbd97f5be908e33f403c3794f629a.cloudfront.net (CloudFront) access-control-allow-credentials: false Content-Security-Policy: upgrade-insecure-requests Timing-Allow-Origin: hub.planswift.com x-amz-cf-id: gt8YMJxd2OL-OGDqQXX2ULutfIdgM-TyG-q0cktYQDLkDiwhbbzFCg== x-amz-cf-pop: IAD89-C1 x-amz-id-2: m6K1ypv+LFNpIzvdVIHX6Os3BMA74swpfoxcltKqTLIJknp+p7Un+nY2PQiPZ1z+RP973BG/P2c= x-amz-request-id: NB3N62FYMRC1KYW4 x-amz-version-id: vTLNXsTFeX0zRe8wXLh5hynLihgvNL8U x-cache: RefreshHit from cloudfront x-envoy-upstream-service-time: 143 x-evy-trace-listener: listener_https x-evy-trace-route-configuration: listener_https/all x-evy-trace-route-service-name: envoyset-translator x-evy-trace-served-by-pod: iad02/cms-hubfs-td/envoy-proxy-7849459c5c-bkstl x-evy-trace-virtual-host: all x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
2024-08-28 20:41:59 UTC	972	IN	Data Raw: 78 2d 68 73 2d 63 66 2d 6c 61 6d 62 64 61 2d 65 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 78 2d 68 75 62 73 70 6f 74 2d 63 6f 72 72 65 6c 61 74 69 6f 6e 2d 69 64 3a 20 32 61 38 36 65 65 36 36 2d 37 34 31 36 2d 34 31 37 66 2d 62 34 65 36 2d 62 62 33 35 35 31 61 39 34 37 39 38 0d 0a 78 2d 72 65 71 75 65 73 74 2d 69 64 3a 20 32 61 38 36 65 65 36 36 2d 37 34 31 36 2d 34 31 37 66 2d 62 34 65 36 2d 62 62 33 35 35 31 61 39 34 37 39 38 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 5f 62 6d 3d 73 43 37 62 7a 2e 35 67 51 6a 61 34 6b 74 32 72 4f 6a 4d 31 52 6f 64 52 4d 49 77 33 4d 44 6a 36 78 72 6b 6e 49 53 45 36 4c 50 6f 2d 31 37 32 34 38 37 37 37 31 39 2d 31 2e 30 2e 31 2e 31 2d Data Ascii: x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3x-hubspot-correlation-id: 2a86ee66-7416-417f-b4e6-bb3551a94798x-request-id: 2a86ee66-7416-417f-b4e6-bb3551a94798Set-Cookie: __cf_bm=sC7bz.5gQja4kt2rOjM1RodRMIw3MDj6xrknISE6LPo-1724877719-1.0.1.1-
2024-08-28 20:41:59 UTC	1369	IN	Data Raw: 36 61 30 33 0d 0a 40 69 6d 70 6f 72 74 20 75 72 6c 28 27 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 33 30 30 69 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 38 30 30 2c 38 30 30 69 27 29 3b 40 69 6d 70 6f 72 74 20 75 72 6c 28 27 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 53 6f 75 72 63 65 2b 53 61 6e 73 2b 50 72 6f 3a 32 30 30 2c 33 30 30 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 39 30 30 2c 39 30 30 69 27 29 3b 40 69 6d 70 6f 72 74 20 75 72 6c 28 27 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 Data Ascii: 6a03@import url('//fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i');@import url('//fonts.googleapis.com/css?family=Source+Sans+Pro:200,300,400,400i,600,600i,700,700i,900,900i');@import url('//maxcdn.bootstrapcdn.c
2024-08-28 20:41:59 UTC	1369	IN	Data Raw: 67 6e 3a 74 6f 70 20 21 69 6d 70 6f 72 74 61 6e 74 7d 23 72 65 63 61 70 74 63 68 61 5f 72 65 73 70 6f 6e 73 65 5f 66 69 65 6c 64 7b 77 69 64 74 68 3a 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 20 21 69 6d 70 6f 72 74 61 6e 74 7d 23 72 65 63 61 70 74 63 68 61 5f 74 61 62 6c 65 20 74 64 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 30 7d 2e 72 65 63 61 70 74 63 68 61 74 61 62 6c 65 20 23 72 65 63 61 70 74 63 68 61 5f 72 65 73 70 6f 6e 73 65 5f 66 69 65 6c 64 7b 6d 69 6e 2d 68 65 69 67 68 74 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 32 70 78 7d 40 6d 65 64 69 61 20 61 6c 6c 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 34 30 30 70 78 29 7b 23 63 61 70 74 63 68 61 5f 77 72 61 70 70 65 72 2c 23 Data Ascii: gn:top !important}#recaptcha_response_field{width:auto !important;display:inline-block !important}#recaptcha_table td{line-height:0}.recaptchatable #recaptcha_response_field{min-height:0;line-height:12px}@media all and (max-width:400px){#captcha_wrapper,#
2024-08-28 20:41:59 UTC	1369	IN	Data Raw: 65 64 20 69 66 72 61 6d 65 2c 2e 68 73 2d 72 65 73 70 6f 6e 73 69 76 65 2d 65 6d 62 65 64 20 6f 62 6a 65 63 74 2c 2e 68 73 2d 72 65 73 70 6f 6e 73 69 76 65 2d 65 6d 62 65 64 20 65 6d 62 65 64 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 62 6f 72 64 65 72 3a 30 7d 2e 68 73 2d 72 65 73 70 6f 6e 73 69 76 65 2d 65 6d 62 65 64 2e 68 73 2d 72 65 73 70 6f 6e 73 69 76 65 2d 65 6d 62 65 64 2d 69 6e 73 74 61 67 72 61 6d 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 30 70 78 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 31 36 2e 30 31 25 7d 2e 68 73 2d 72 65 73 70 6f 6e 73 69 76 65 2d 65 6d 62 65 64 2e 68 73 2d 72 65 73 70 6f 6e 73 69 76 65 2d 65 6d Data Ascii: ed iframe,.hs-responsive-embed object,.hs-responsive-embed embed{position:absolute;top:0;left:0;width:100%;height:100%;border:0}.hs-responsive-embed.hs-responsive-embed-instagram{padding-top:0px;padding-bottom:116.01%}.hs-responsive-embed.hs-responsive-em
2024-08-28 20:41:59 UTC	1369	IN	Data Raw: 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2e 68 73 2d 6d 65 6e 75 2d 77 72 61 70 70 65 72 2e 68 73 2d 6d 65 6e 75 2d 66 6c 6f 77 2d 68 6f 72 69 7a 6f 6e 74 61 6c 3e 75 6c 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 20 22 3b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 7d 2e 68 73 2d 6d 65 6e 75 2d 77 72 61 70 70 65 72 2e 68 73 2d 6d 65 6e 75 2d 66 6c 6f 77 2d 68 6f 72 69 7a 6f 6e 74 61 6c 3e 75 6c 3a 61 66 74 65 72 7b 63 6f 6e 74 65 6e 74 3a 22 20 22 3b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 3b 63 6c 65 61 72 3a 62 6f 74 68 7d 2e 68 73 2d 6d 65 6e 75 2d 77 72 61 70 70 65 72 2e 68 73 2d 6d 65 6e 75 2d 66 6c 6f 77 2d 68 6f 72 69 7a 6f 6e 74 61 6c 3e 75 6c 20 6c 69 2e 68 73 2d 6d 65 6e 75 2d 64 65 70 74 68 2d 31 7b 66 6c 6f 61 74 3a 6c Data Ascii: display:inline-block}.hs-menu-wrapper.hs-menu-flow-horizontal>ul:before{content:" ";display:table}.hs-menu-wrapper.hs-menu-flow-horizontal>ul:after{content:" ";display:table;clear:both}.hs-menu-wrapper.hs-menu-flow-horizontal>ul li.hs-menu-depth-1{float:l
2024-08-28 20:41:59 UTC	1369	IN	Data Raw: 75 2d 73 68 6f 77 2d 61 63 74 69 76 65 2d 62 72 61 6e 63 68 3e 75 6c 20 6c 69 2e 68 73 2d 69 74 65 6d 2d 68 61 73 2d 63 68 69 6c 64 72 65 6e 7b 70 6f 73 69 74 69 6f 6e 3a 73 74 61 74 69 63 7d 2e 68 73 2d 6d 65 6e 75 2d 77 72 61 70 70 65 72 2e 68 73 2d 6d 65 6e 75 2d 66 6c 6f 77 2d 68 6f 72 69 7a 6f 6e 74 61 6c 2e 68 73 2d 6d 65 6e 75 2d 73 68 6f 77 2d 61 63 74 69 76 65 2d 62 72 61 6e 63 68 3e 75 6c 20 6c 69 2e 68 73 2d 69 74 65 6d 2d 68 61 73 2d 63 68 69 6c 64 72 65 6e 20 75 6c 2e 68 73 2d 6d 65 6e 75 2d 63 68 69 6c 64 72 65 6e 2d 77 72 61 70 70 65 72 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 68 73 2d 6d 65 6e 75 2d 77 72 61 70 70 65 72 2e 68 73 2d 6d 65 6e 75 2d 66 6c 6f 77 2d 68 6f 72 69 7a 6f 6e 74 61 6c 2e 68 73 2d 6d 65 6e 75 2d 73 68 6f 77 2d 61 Data Ascii: u-show-active-branch>ul li.hs-item-has-children{position:static}.hs-menu-wrapper.hs-menu-flow-horizontal.hs-menu-show-active-branch>ul li.hs-item-has-children ul.hs-menu-children-wrapper{display:none}.hs-menu-wrapper.hs-menu-flow-horizontal.hs-menu-show-a
2024-08-28 20:41:59 UTC	1369	IN	Data Raw: 73 2d 6d 65 6e 75 2d 66 6c 6f 77 2d 76 65 72 74 69 63 61 6c 3e 75 6c 20 6c 69 2e 68 73 2d 69 74 65 6d 2d 68 61 73 2d 63 68 69 6c 64 72 65 6e 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 68 73 2d 6d 65 6e 75 2d 77 72 61 70 70 65 72 2e 68 73 2d 6d 65 6e 75 2d 66 6c 6f 77 2d 76 65 72 74 69 63 61 6c 2e 66 6c 79 6f 75 74 73 3e 75 6c 20 6c 69 2e 68 73 2d 69 74 65 6d 2d 68 61 73 2d 63 68 69 6c 64 72 65 6e 20 75 6c 2e 68 73 2d 6d 65 6e 75 2d 63 68 69 6c 64 72 65 6e 2d 77 72 61 70 70 65 72 7b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 3b 6f 70 61 63 69 74 79 3a 30 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 6f 70 61 63 69 74 79 20 2e 34 73 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 7a 2d 69 6e 64 65 78 3a 31 30 Data Ascii: s-menu-flow-vertical>ul li.hs-item-has-children{position:relative}.hs-menu-wrapper.hs-menu-flow-vertical.flyouts>ul li.hs-item-has-children ul.hs-menu-children-wrapper{visibility:hidden;opacity:0;-webkit-transition:opacity .4s;position:absolute;z-index:10
2024-08-28 20:41:59 UTC	1369	IN	Data Raw: 7a 6f 6e 74 61 6c 3e 75 6c 20 6c 69 2e 68 73 2d 69 74 65 6d 2d 68 61 73 2d 63 68 69 6c 64 72 65 6e 20 75 6c 2e 68 73 2d 6d 65 6e 75 2d 63 68 69 6c 64 72 65 6e 2d 77 72 61 70 70 65 72 7b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 6f 70 61 63 69 74 79 3a 31 20 21 69 6d 70 6f 72 74 61 6e 74 3b 70 6f 73 69 74 69 6f 6e 3a 73 74 61 74 69 63 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 68 73 2d 6d 65 6e 75 2d 77 72 61 70 70 65 72 2e 68 73 2d 6d 65 6e 75 2d 66 6c 6f 77 2d 68 6f 72 69 7a 6f 6e 74 61 6c 20 75 6c 20 75 6c 20 75 6c 7b 70 61 64 64 69 6e 67 3a 30 7d 2e 68 73 2d 6d 65 6e 75 2d 77 72 61 70 70 65 72 2e 68 73 2d 6d 65 6e 75 2d 66 6c 6f 77 2d 68 6f 72 69 7a 6f 6e 74 61 6c 3e 75 6c 20 6c 69 2e 68 73 2d 69 74 65 6d 2d Data Ascii: zontal>ul li.hs-item-has-children ul.hs-menu-children-wrapper{visibility:visible !important;opacity:1 !important;position:static !important}.hs-menu-wrapper.hs-menu-flow-horizontal ul ul ul{padding:0}.hs-menu-wrapper.hs-menu-flow-horizontal>ul li.hs-item-
2024-08-28 20:41:59 UTC	1369	IN	Data Raw: 75 74 68 6f 72 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 2e 68 73 2d 73 6f 63 69 61 6c 2d 74 77 69 74 74 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 22 2f 2f 73 74 61 74 69 63 2e 68 75 62 73 70 6f 74 2e 63 6f 6d 2f 66 69 6e 61 6c 2f 69 6d 67 2f 63 6f 6d 6d 6f 6e 2f 69 63 6f 6e 73 2f 73 6f 63 69 61 6c 2f 74 77 69 74 74 65 72 2d 32 34 78 32 34 2e 70 6e 67 22 29 7d 2e 68 73 2d 61 75 74 68 6f 72 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 73 20 61 2e 68 73 2d 61 75 74 68 6f 72 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 2e 68 73 2d 73 6f 63 69 61 6c 2d 67 6f 6f 67 6c 65 2d 70 6c 75 73 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 22 2f 2f 73 74 61 74 69 63 2e 68 75 62 73 70 6f 74 2e 63 6f 6d 2f 66 69 6e 61 6c 2f 69 6d 67 2f 63 6f 6d Data Ascii: uthor-social-link.hs-social-twitter{background-image:url("//static.hubspot.com/final/img/common/icons/social/twitter-24x24.png")}.hs-author-social-links a.hs-author-social-link.hs-social-google-plus{background-image:url("//static.hubspot.com/final/img/com
2024-08-28 20:41:59 UTC	1369	IN	Data Raw: 69 74 61 6c 69 7a 65 7d 2e 68 73 5f 63 6f 73 5f 66 6c 65 78 2d 73 6c 69 64 65 73 3a 61 66 74 65 72 7b 63 6f 6e 74 65 6e 74 3a 22 2e 22 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 30 3b 68 65 69 67 68 74 3a 30 7d 68 74 6d 6c 5b 78 6d 6c 6e 73 5d 20 2e 68 73 5f 63 6f 73 5f 66 6c 65 78 2d 73 6c 69 64 65 73 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2a 20 68 74 6d 6c 20 2e 68 73 5f 63 6f 73 5f 66 6c 65 78 2d 73 6c 69 64 65 73 7b 68 65 69 67 68 74 3a 31 25 7d 2e 68 73 5f 63 6f 73 5f 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 2d 6e 61 76 7b 2a 68 65 69 67 68 74 3a 30 7d 2e 68 73 5f 63 6f 73 5f 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 2d Data Ascii: italize}.hs_cos_flex-slides:after{content:".";display:block;clear:both;visibility:hidden;line-height:0;height:0}html[xmlns] .hs_cos_flex-slides{display:block}* html .hs_cos_flex-slides{height:1%}.hs_cos_flex-direction-nav{*height:0}.hs_cos_flex-direction-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49746	199.60.103.30	443	5888	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:42:00 UTC	359	OUT	GET /hs-fs/hubfs/PS%20-%20Getting%20Started/Whats%20New%20in%20PlanSwift%C2%AE%2011.png?width=500&name=Whats%20New%20in%20PlanSwift%C2%AE%2011.png HTTP/1.1 Accept: / Accept-Language: en-CH Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: hub.planswift.com Connection: Keep-Alive
2024-08-28 20:42:00 UTC	1250	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:42:00 GMT Content-Type: image/png Content-Length: 16955 Connection: close CF-Ray: 8ba7201719b643e3-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "cfoHZ-l9nODwd-pJzhWgZ_FNK_iQ6hd_SV2P5CaOb0DQ:2eebde4d2e46b2dfed4fcd0402bc5ef9" Last-Modified: Fri, 15 Jul 2022 14:20:12 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept Via: 1.1 05b3bdb53d1146d1176c185d2da0d530.cloudfront.net (CloudFront) cache-tag: F-79303452704,FD-26637824551,P-2347101,FLS-ALL cf-bgj: imgq:99,h2pri cf-resized: internal=ok/m q=0 n=166+33 c=1+32 v=2024.8.1 l=16955 f=false content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; upgrade-insecure-requests priority: u=4;i=?0,cf-chb=(37;u=2;i=?0 825;u=5;i=?0) Timing-Allow-Origin: d8fk70yj6xfhx.cloudfront.net x-content-type-options: nosniff Set-Cookie: __cf_bm=Fq32U5I2XsXHUG7WsSUSUcWJaItcYtUGxojtZcpu0nM-1724877720-1.0.1.1-td.i2LGP613LdQS5lvAqHMeo3wR0vNgg9RRg2T70NOGTvDX0T6vrBiz.eTw90Q64WpQ_._czEs8NtOek6zotTg; path=/; expires=Wed, 28-Aug-24 21:12:00 GMT; domain=.hub.planswift.com; HttpOnly; Secure; SameSite=None
2024-08-28 20:42:00 UTC	522	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 30 30 4b 63 4e 7a 6a 58 49 32 35 54 54 47 79 41 50 53 75 33 67 46 62 68 6d 70 38 4d 62 7a 70 54 57 32 7a 77 31 46 5a 56 36 33 43 48 75 41 41 78 63 47 45 79 69 35 4f 74 56 32 25 32 46 64 6b 6a 44 37 32 78 4d 4a 57 25 32 42 31 6d 66 4f 47 44 58 32 76 53 6c 75 6a 33 31 38 64 51 25 32 42 62 79 49 51 36 5a 62 39 68 71 55 74 48 6c 33 79 46 61 31 31 56 73 33 50 68 32 76 4c 32 45 49 45 62 55 47 57 25 32 46 78 61 6c 35 4b 6c 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=00KcNzjXI25TTGyAPSu3gFbhmp8MbzpTW2zw1FZV63CHuAAxcGEyi5OtV2%2FdkjD72xMJW%2B1mfOGDX2vSluj318dQ%2BbyIQ6Zb9hqUtHl3yFa11Vs3Ph2vL2EIEbUGW%2Fxal5Kl"}],"group":"cf-nel","max_age":604800
2024-08-28 20:42:00 UTC	966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 f4 00 00 01 18 08 03 00 00 00 9d 8e f4 41 00 00 03 00 50 4c 54 45 ff ff ff 6d c5 ff 54 bb ff 6e 66 64 fe fe ff 00 61 ba 6f c6 ff f8 fc ff 54 bb fe ff ff fe 3b a0 ea 6b c4 ff 69 c3 ff 7b cb ff c9 ea ff 8d d2 ff f9 f9 fa 3b a0 ec ff fe fe ff ff fc 6e 65 64 fe fe fd 6c 66 66 ff ff fd fe ff ff fe ff fe ff fe ff 00 61 b9 fe fd fd 55 bc fe ff fe fc 6c 66 64 6c 67 64 3a 9f e9 6e 67 66 65 5e 5d 4b b8 ff fe fc fd 9d d8 ff fe fd fb ff fd ff 00 62 bb 6a 63 62 6a 64 63 6b 65 64 65 60 5f fe fd ff 67 62 62 69 68 65 3a a0 e9 50 b7 fc 00 61 be 68 61 60 6d 66 64 fd fe ff 55 bc ff 00 63 bd 3a 9f eb fd fe fc 6d 66 65 f4 fc ff a2 9e 9e 63 63 5f fe ff fd 66 65 63 f1 ef ee f6 f5 f4 69 67 65 60 5d 5c 00 5b b5 54 bb fd 7b Data Ascii: PNGIHDRAPLTEmTnfdaoT;ki{;nedlffaUlfdlgd:ngfe^]Kbjcbjdckede`_gbbihe:Paha`mfdUc:mfecc_fecige`]\[T{
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 40 b1 d0 19 28 16 3a 03 c5 42 67 a0 58 e8 0c 14 0b 9d 81 62 a1 33 50 2c 74 06 8a 85 ce 40 b1 d0 19 28 16 3a 03 c5 42 67 a0 58 e8 0c 14 0b 9d 81 62 a1 33 50 2c 74 06 8a 85 ce 40 b1 d0 19 28 16 3a 03 c5 42 67 a0 58 e8 0c 14 0b 9d 81 62 a1 33 50 2c 74 06 8a 85 ce 40 b1 d0 19 28 16 3a 03 c5 42 67 a0 58 e8 0c 14 0b 9d 81 62 a1 33 50 2c 74 06 8a 85 ce 40 b1 d0 19 28 16 3a 03 c5 42 67 a0 58 e8 0c 14 0b 9d 81 62 a1 33 50 2c 74 06 8a 85 ce 40 b1 d0 19 28 16 3a 03 c5 42 67 a0 58 e8 0c 14 0b 9d 81 62 a1 33 50 2c 74 06 8a 85 ce 40 b1 d0 19 28 16 3a 03 c5 42 67 a0 58 e8 0c 14 0b 9d 81 62 a1 33 50 2c 74 06 8a 85 ce 40 b1 d0 19 28 16 3a 03 c5 42 67 a0 58 e8 0c 14 0b 9d 81 62 a1 33 50 2c 74 06 8a 85 ce 40 b1 d0 19 28 16 3a 03 c5 42 67 a0 58 e8 0c 14 0b 9d 81 62 a1 33 50 Data Ascii: @(:BgXb3P,t@(:BgXb3P,t@(:BgXb3P,t@(:BgXb3P,t@(:BgXb3P,t@(:BgXb3P,t@(:BgXb3P,t@(:BgXb3P,t@(:BgXb3P
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: bf 78 f3 f0 53 3e 3e 3e 3e a7 86 6f de bc 69 ad 47 b4 d5 2d 3b 40 f7 f0 70 80 0e b0 fa df 8b 17 4f 5c eb 11 dd ca 7c f4 e2 cd 9b 37 6f 7e a3 97 47 b4 47 d0 fc cd 8b 87 cf f4 f1 f1 99 39 7c f1 e6 f9 41 ff 7d c6 0e 27 0e d2 c2 bc 35 72 8b e2 b2 ea aa 41 8c 25 87 e4 e5 e5 2d 1f 8b b9 39 5c e4 9c e5 13 26 4c 58 5e 85 3b 46 da 39 21 68 e9 f2 5c 80 aa e5 79 13 26 84 94 02 94 84 4c 98 90 57 a3 e5 70 38 fc c4 09 6d ca 9b ad e6 73 38 fc d8 62 eb ef 90 39 4f 9e 26 78 be 96 de b3 4e af d7 eb 74 aa f0 f0 70 ba 8f 00 92 ba f5 2f 9b e4 15 d5 b0 63 35 46 88 a4 c2 4e 8f 86 7d f2 d7 86 86 86 bf 5e 05 2e bc 79 f6 82 e7 4c 4f cf be 9e af 7a 7a fe dd c7 67 d4 0f d1 36 ea 4e d0 a3 ff fc 97 3f da 1f e3 cc ff 8e 1f 3f 7d 74 5b ab eb e8 53 7d 7d 7c 4e 6d 5e eb d1 b5 d7 e2 51 3e Data Ascii: xS>>>>oiG-;@pO\\|7o~GG9\|A}'5rA%-9\&LX^;F9!h\y&LWp8ms8b9O&xNtp/c5FN}^.yLOzzg6N??}t[S}}\|Nm^Q>
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 79 33 7f c8 ef 2c 75 73 0f 0f 8f e8 e9 3e af 22 cc a3 e6 3f b4 ca 86 d4 fd bb 1f 66 7a f6 dd 64 a9 ac db a0 fb 8c 9f d8 ab f5 80 41 37 68 e8 2d 87 56 83 42 48 63 90 09 54 15 a0 c4 71 11 25 c2 30 0c 23 08 02 c3 71 bf 9a 54 6f 6f 99 b6 2e 81 6b 03 81 25 c7 69 7c 63 8b f5 7c be 76 79 db d3 80 82 44 15 87 af 9b 15 89 db 43 c7 71 52 09 0b e5 81 34 74 92 94 4a 51 d1 86 32 b3 5a 59 30 47 d5 96 91 b3 e7 2c 74 66 2c b2 57 87 3c 9e 0c 3a e6 22 ca c2 71 e7 f7 8f ab 84 88 46 5d aa b7 77 a7 c0 03 39 1c 79 6d 09 1c db 3f 49 e2 ef 9f 29 71 77 f7 77 77 1f 3a e9 dd 6d 04 15 e6 ea 34 c8 7b 8c f0 ef ef ef 2e 91 b4 4c da d7 93 68 6b 70 f1 08 1a 3d bd 2f 0a e7 7c 36 af 8d f6 70 82 de b5 1d f4 b2 19 a8 b2 e7 b9 38 88 5e dd 6a e9 37 d6 da 12 b0 88 fa 74 04 3d f3 c1 77 44 02 06 Data Ascii: y3,us>"?fzdA7h-VBHcTq%0#qToo.k%i\|c\|vyDCqR4tJQ2ZY0G,tf,W<:"qF]w9ym?I)qwww:m4{.Lhkp=/\|6p8^j7t=wD
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: bf db b5 a7 74 0e dd c3 02 dd dd ff ad 37 a5 3c 0c 70 28 d4 6b d0 8b eb eb ab d2 d5 8e 8d b1 7b 0c 55 71 be be 1c fd 2c cb b3 c9 ad 10 08 04 46 34 77 40 69 9c 26 50 15 4b 4f 19 82 e3 55 28 1b 2d 4f 86 f6 d0 01 46 26 09 f8 fc e7 06 fd 97 a9 f3 57 a4 55 38 34 5f d3 79 7b cb 9c 10 07 d3 91 bc 35 9c 0b 94 79 6b e4 c5 f5 b0 eb d6 20 c9 50 1a b8 44 e2 e8 e4 25 ee ee 99 83 d6 fd 1c 2f 34 64 e0 f6 6d d5 34 74 ff 7e fd 26 bd 8e 1e 9e 83 7b f7 08 7a 03 d5 c3 fa 7a 8e 76 2c d3 bb 5a a1 67 fc ef e2 99 7f 7f d5 b3 ad 35 65 bc 23 f4 99 13 7b b5 45 ef ad 96 ee 8e dc bb a5 1b 43 55 40 30 1f 65 16 f8 1c bd be 62 59 a4 2d 24 32 a4 cd 52 69 04 ba 8a 12 c0 c1 60 28 d1 09 04 ba 59 31 00 78 d3 1a 7d a0 4c 9d 47 fb f0 a6 73 02 19 1a ce 80 91 ae a0 b7 0f e4 7e 65 d0 71 98 57 11 Data Ascii: t7<p(k{Uq,F4w@i&PKOU(-OF&WU84_y{5yk PD%/4dm4t~&{zzv,Zg5e#{ECU@0ebY-$2Ri`(Y1x}LGs~eqW
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: ed 44 41 37 8d f5 1a 45 7b 77 d4 37 d2 a1 69 75 34 ca bb be 4a 5b 7a eb d6 41 a8 69 75 fc df 1f 11 ba 9f d4 a9 cd 11 87 c8 5a 54 63 d7 d4 59 7b 32 25 27 c9 f8 be fa 98 9c 59 3a be 6a f0 bc d6 06 b8 ea 74 35 27 58 17 b1 28 56 2d 10 c8 2a 5d 40 a7 7f bb 80 5e 8a 72 be ea c4 45 4f 11 d0 13 40 17 ba b9 5c 8c e3 90 9d 18 2e e3 07 06 76 0e 5d 15 3b 12 da c6 7d e0 94 49 2a fc f1 f8 ff b3 d3 7f 39 8b 5e f2 ff fe 79 b5 9c ab 30 60 76 d0 1b b6 97 29 78 43 7e 67 f5 d7 5d 3d a2 d7 de a0 0d 1d 8d 59 70 82 ee 49 43 7f a3 97 5d 86 75 2d dd 89 e2 51 a1 93 ed a0 0b eb 1b f5 36 4b 47 ca a9 d1 f3 7d 35 a5 8b d4 7c be 7c 19 e0 36 a3 24 53 f4 1c 8d a6 ba 40 2e 10 68 53 72 7f 01 74 f4 b6 70 34 be 8f 3f 13 6c 7b 3d 01 74 37 83 6b ea 50 10 1b 1a d5 81 67 6f 83 ae f6 2d 84 b6 a9 Data Ascii: DA7E{w7iu4J[zAiuZTcY{2%'Y:jt5'X(V-]@^rEO@\.v];}I9^y0`v)xC~g]=YpIC]u-Q6KG}5\|\|6$S@.hSrtp4?l{=t7kPgo-
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 8e d4 a3 71 c7 aa 10 b0 6f 20 ae d5 ca 64 f4 a8 55 5a 23 93 04 c1 34 74 bb 0e e9 dc b4 46 b9 2f 82 8e 24 2f 7e cc e9 be ed f5 34 a1 27 2c 8c 4b ed a8 6e de 06 5d 37 38 19 72 43 e8 3b 90 69 b4 8d b9 80 e3 5c e1 a5 f7 1a dc 25 16 33 f7 f7 77 0d 7d e8 d0 96 f7 76 81 d9 4c 1a da 41 27 e0 d8 9e f7 c6 db 46 92 fb 9c 9a 7e 23 da c6 1c 75 97 b2 4c 50 f1 1a 5d 4f 43 f3 4b 0c b7 12 f7 f4 39 35 7d e2 7f 77 8d 8e 1e 8f d6 2f 5e 8b da dd 46 0f a7 37 6e 0f fd 94 8f a4 61 d2 ba 37 15 38 e4 26 67 a9 f4 6a be 46 23 43 43 8b 35 2a 7d 4a 36 cd b6 95 2e 59 28 d7 e9 55 fa f4 5c d4 2f de 2e 5b 5a 2d 57 e9 55 7a 6d b3 43 6f bf d9 46 95 4a 65 2c b6 fe 5a 68 d4 e9 74 f2 0a b0 6f b9 26 c5 b9 79 71 6a 0e 3d 6e 59 66 4c 79 cc 49 80 ed f5 14 a1 37 6d 14 a4 3e bc 3c d7 0f ce 86 c8 62 Data Ascii: qo dUZ#4tF/$/~4',Kn]78rC;i\%3w}vLA'F~#uLP]OCK95}w/^F7na78&gjF#CC5*}J6.Y(U\/.[Z-WUzmCoFJe,Zhto&yqj=nYfLyI7m><b
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 43 a7 a6 5f bb 16 60 8c 1a 87 2c bd 6d c0 06 8e 93 09 64 eb 2e 4e f3 07 d9 dd 0d a0 e6 59 ba 4f 4e 6c fb f7 12 55 56 3a 78 07 09 8c 70 9e 36 c1 a2 87 41 77 3d 92 45 64 f7 36 e4 66 c5 69 9c 4b 70 6f 6f e7 31 e8 f2 9a 1c a8 9c 6c 9d 68 48 e6 ed d4 21 de db 3b ce 3b 2a 2f 12 8e ee 1f e4 5c a0 37 dc ba 0a 24 e9 86 f2 d4 ce d0 09 d7 d0 2d a5 bb 5f eb d6 75 da 9a 5c 68 ca 45 8d 79 f6 55 21 3a 01 2e 12 41 69 54 f8 b4 85 69 d0 3c 21 3d 7d 81 e5 55 8e 6c cb b6 70 a1 a7 65 da 4f 37 00 73 1a 5d 1b 4b 8b 45 9d 5a e9 37 41 08 e6 26 eb 4a dc fa 0a 00 98 73 7b 02 98 71 18 67 9c 45 6f 56 32 38 29 b1 38 06 d2 0a 6b 42 47 36 d1 de d6 7a 48 6b 36 36 a2 a9 ed ef 48 45 eb 8a 5c 3b 32 b9 91 f4 4b 57 a0 4b 74 ea 29 87 59 eb 96 1d 3b 90 c7 80 de d1 e8 25 b1 ad c3 00 06 11 29 a9 Data Ascii: C_`,md.NYONlUV:xp6Aw=Ed6fiKpoo1lhH!;;*/\7$-_u\hEyU!:.AiTi<!=}UlpeO7s]KEZ7A&Js{qgEoV28)8kBG6zHk66HE\;2KWKt)Y;%)
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 4b cf 5a 98 0b b8 34 37 4e 9b 8c 76 1e 97 1a 9a 0c a4 82 28 0c 9d 16 81 61 d8 ec a4 e2 9e f5 59 aa d9 f5 52 fa 8b 89 24 0d 5d 49 41 b2 2e 60 51 5b 03 ca 22 9d 60 0e 1a a4 5c 52 a1 db 08 25 93 b5 68 72 e8 05 b1 de 95 64 e4 1a 63 1e 34 11 0b d2 03 d0 e5 c5 16 2f ab 5b 56 97 6e ac 83 ba f0 59 25 40 70 71 48 50 10 c9 a1 e9 25 dc d6 a7 e1 f2 2b 0f 5c 69 07 1f 7f 40 fd f9 5a 6b 34 4f 52 4f cf 39 17 15 20 08 76 ae 73 b7 85 70 c1 a8 01 d8 5b 5b 9b 0b 28 09 0e 05 d7 f4 0f 83 1e 2c d0 25 66 43 fe c9 75 0d 12 f7 96 41 1f 6d c3 30 3f 3f bf f6 b3 84 5a af 5d 64 8e 8c 8c 2c 2f cf 6d c2 1d 16 23 8b b7 ab 01 e1 cb e5 29 91 98 82 84 ea a4 80 1c 48 a8 95 67 41 a3 bc b8 d5 f3 8d 8b 0a 58 d0 e6 21 b3 8c b5 40 91 24 1e 93 18 50 0a 05 e1 a1 f3 40 2a 5d 18 7e ae 19 a8 d2 8a 00 Data Ascii: KZ47Nv(aYR$]IA.`Q["`\R%hrdc4/[VnY%@pqHP%+\i@Zk4ORO9 vsp[[(,%fCuAm0??Z]d,/m#)HgAX!@$P@*]~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49749	104.18.11.207	443	5888	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:42:00 UTC	267	OUT	GET /font-awesome/4.6.3/css/font-awesome.min.css HTTP/1.1 Accept: / Accept-Language: en-CH Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: maxcdn.bootstrapcdn.com Connection: Keep-Alive
2024-08-28 20:42:00 UTC	917	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:42:00 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding CDN-PullZone: 252412 CDN-Uid: b1941f61-b576-4f40-80de-5677acb38f74 CDN-RequestCountryCode: DE CDN-EdgeStorageId: 632 CDN-EdgeStorageId: 617 CDN-EdgeStorageId: 617 Last-Modified: Mon, 25 Jan 2021 22:04:55 GMT CDN-CachedAt: 2021-06-08 21:31:13 CDN-RequestPullSuccess: True CDN-RequestPullCode: 200 Cache-Control: public, max-age=31919000 timing-allow-origin: * cross-origin-resource-policy: cross-origin access-control-allow-origin: * x-content-type-options: nosniff CDN-RequestId: 5bb5196854d77b3b0bd1d55200ac7249 CDN-Status: 200 CDN-Cache: HIT CF-Cache-Status: HIT Age: 14533747 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8ba720177d600f70-EWR alt-svc: h3=":443"; ma=86400
2024-08-28 20:42:00 UTC	452	IN	Data Raw: 37 31 38 37 0d 0a 2f 2a 21 0a 20 2a 20 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 34 2e 36 2e 33 20 62 79 20 40 64 61 76 65 67 61 6e 64 79 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 20 2d 20 40 66 6f 6e 74 61 77 65 73 6f 6d 65 0a 20 2a 20 20 4c 69 63 65 6e 73 65 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 2f 6c 69 63 65 6e 73 65 20 28 46 6f 6e 74 3a 20 53 49 4c 20 4f 46 4c 20 31 2e 31 2c 20 43 53 53 3a 20 4d 49 54 20 4c 69 63 65 6e 73 65 29 0a 20 2a 2f 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 46 6f 6e 74 41 77 65 73 6f 6d 65 27 3b 73 72 63 3a 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 65 6f 74 3f 76 3d 34 2e 36 Data Ascii: 7187/! Font Awesome 4.6.3 by @davegandy - http://fontawesome.io - @fontawesome * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License) */@font-face{font-family:'FontAwesome';src:url('../fonts/fontawesome-webfont.eot?v=4.6
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 76 3d 34 2e 36 2e 33 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 27 29 2c 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 74 74 66 3f 76 3d 34 2e 36 2e 33 27 29 20 66 6f 72 6d 61 74 28 27 74 72 75 65 74 79 70 65 27 29 2c 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 73 76 67 3f 76 3d 34 2e 36 2e 33 23 66 6f 6e 74 61 77 65 73 6f 6d 65 72 65 67 75 6c 61 72 27 29 20 66 6f 72 6d 61 74 28 27 73 76 67 27 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 7d 2e 66 61 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 66 6f 6e 74 3a 6e 6f 72 6d 61 6c 20 6e 6f 72 6d 61 6c 20 6e Data Ascii: v=4.6.3') format('woff'),url('../fonts/fontawesome-webfont.ttf?v=4.6.3') format('truetype'),url('../fonts/fontawesome-webfont.svg?v=4.6.3#fontawesomeregular') format('svg');font-weight:normal;font-style:normal}.fa{display:inline-block;font:normal normal n
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 7d 31 30 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 35 39 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 35 39 64 65 67 29 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 61 2d 73 70 69 6e 7b 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 7d 31 30 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 35 39 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 35 39 64 65 67 29 7d 7d 2e 66 61 2d 72 6f 74 61 74 65 2d 39 30 7b 2d 6d 73 2d 66 69 6c 74 65 72 3a 22 70 72 6f 67 Data Ascii: ansform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}.fa-rotate-90{-ms-filter:"prog
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 75 74 65 3b 6c 65 66 74 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 66 61 2d 73 74 61 63 6b 2d 31 78 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 69 6e 68 65 72 69 74 7d 2e 66 61 2d 73 74 61 63 6b 2d 32 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 65 6d 7d 2e 66 61 2d 69 6e 76 65 72 73 65 7b 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 66 61 2d 67 6c 61 73 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 30 30 22 7d 2e 66 61 2d 6d 75 73 69 63 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 30 31 22 7d 2e 66 61 2d 73 65 61 72 63 68 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 30 32 22 7d 2e 66 61 2d 65 6e 76 65 6c 6f 70 65 2d 6f 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c Data Ascii: ute;left:0;width:100%;text-align:center}.fa-stack-1x{line-height:inherit}.fa-stack-2x{font-size:2em}.fa-inverse{color:#fff}.fa-glass:before{content:"\f000"}.fa-music:before{content:"\f001"}.fa-search:before{content:"\f002"}.fa-envelope-o:before{content:"\
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 34 22 7d 2e 66 61 2d 68 65 61 64 70 68 6f 6e 65 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 35 22 7d 2e 66 61 2d 76 6f 6c 75 6d 65 2d 6f 66 66 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 36 22 7d 2e 66 61 2d 76 6f 6c 75 6d 65 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 37 22 7d 2e 66 61 2d 76 6f 6c 75 6d 65 2d 75 70 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 38 22 7d 2e 66 61 2d 71 72 63 6f 64 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 39 22 7d 2e 66 61 2d 62 61 72 63 6f 64 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 32 61 22 7d 2e 66 61 2d 74 61 67 3a 62 65 66 6f 72 65 7b 63 6f Data Ascii: {content:"\f024"}.fa-headphones:before{content:"\f025"}.fa-volume-off:before{content:"\f026"}.fa-volume-down:before{content:"\f027"}.fa-volume-up:before{content:"\f028"}.fa-qrcode:before{content:"\f029"}.fa-barcode:before{content:"\f02a"}.fa-tag:before{co
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 34 39 22 7d 2e 66 61 2d 62 61 63 6b 77 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 34 61 22 7d 2e 66 61 2d 70 6c 61 79 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 34 62 22 7d 2e 66 61 2d 70 61 75 73 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 34 63 22 7d 2e 66 61 2d 73 74 6f 70 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 34 64 22 7d 2e 66 61 2d 66 6f 72 77 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 34 65 22 7d 2e 66 61 2d 66 61 73 74 2d 66 6f 72 77 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 35 30 22 7d 2e 66 61 2d 73 74 65 70 2d 66 6f 72 77 61 72 64 3a 62 65 66 Data Ascii: ard:before{content:"\f049"}.fa-backward:before{content:"\f04a"}.fa-play:before{content:"\f04b"}.fa-pause:before{content:"\f04c"}.fa-stop:before{content:"\f04d"}.fa-forward:before{content:"\f04e"}.fa-fast-forward:before{content:"\f050"}.fa-step-forward:bef
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 30 22 7d 2e 66 61 2d 77 61 72 6e 69 6e 67 3a 62 65 66 6f 72 65 2c 2e 66 61 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 31 22 7d 2e 66 61 2d 70 6c 61 6e 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 32 22 7d 2e 66 61 2d 63 61 6c 65 6e 64 61 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 33 22 7d 2e 66 61 2d 72 61 6e 64 6f 6d 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 34 22 7d 2e 66 61 2d 63 6f 6d 6d 65 6e 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 35 22 7d 2e 66 61 2d 6d 61 67 6e 65 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 37 36 22 7d 2e 66 61 2d 63 68 65 76 72 6f 6e 2d 75 Data Ascii: 0"}.fa-warning:before,.fa-exclamation-triangle:before{content:"\f071"}.fa-plane:before{content:"\f072"}.fa-calendar:before{content:"\f073"}.fa-random:before{content:"\f074"}.fa-comment:before{content:"\f075"}.fa-magnet:before{content:"\f076"}.fa-chevron-u
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 71 75 61 72 65 2d 6f 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 39 36 22 7d 2e 66 61 2d 62 6f 6f 6b 6d 61 72 6b 2d 6f 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 39 37 22 7d 2e 66 61 2d 70 68 6f 6e 65 2d 73 71 75 61 72 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 39 38 22 7d 2e 66 61 2d 74 77 69 74 74 65 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 39 39 22 7d 2e 66 61 2d 66 61 63 65 62 6f 6f 6b 2d 66 3a 62 65 66 6f 72 65 2c 2e 66 61 2d 66 61 63 65 62 6f 6f 6b 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 39 61 22 7d 2e 66 61 2d 67 69 74 68 75 62 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 39 62 22 7d 2e 66 61 2d 75 6e 6c 6f 63 6b 3a 62 65 66 6f 72 65 7b 63 Data Ascii: quare-o:before{content:"\f096"}.fa-bookmark-o:before{content:"\f097"}.fa-phone-square:before{content:"\f098"}.fa-twitter:before{content:"\f099"}.fa-facebook-f:before,.fa-facebook:before{content:"\f09a"}.fa-github:before{content:"\f09b"}.fa-unlock:before{c
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 2d 6f 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 63 37 22 7d 2e 66 61 2d 73 71 75 61 72 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 63 38 22 7d 2e 66 61 2d 6e 61 76 69 63 6f 6e 3a 62 65 66 6f 72 65 2c 2e 66 61 2d 72 65 6f 72 64 65 72 3a 62 65 66 6f 72 65 2c 2e 66 61 2d 62 61 72 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 63 39 22 7d 2e 66 61 2d 6c 69 73 74 2d 75 6c 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 63 61 22 7d 2e 66 61 2d 6c 69 73 74 2d 6f 6c 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 63 62 22 7d 2e 66 61 2d 73 74 72 69 6b 65 74 68 72 6f 75 67 68 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 63 63 22 7d 2e 66 61 2d 75 6e 64 65 72 6c 69 6e 65 3a Data Ascii: -o:before{content:"\f0c7"}.fa-square:before{content:"\f0c8"}.fa-navicon:before,.fa-reorder:before,.fa-bars:before{content:"\f0c9"}.fa-list-ul:before{content:"\f0ca"}.fa-list-ol:before{content:"\f0cb"}.fa-strikethrough:before{content:"\f0cc"}.fa-underline:
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 65 66 6f 72 65 2c 2e 66 61 2d 63 6c 69 70 62 6f 61 72 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 65 61 22 7d 2e 66 61 2d 6c 69 67 68 74 62 75 6c 62 2d 6f 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 65 62 22 7d 2e 66 61 2d 65 78 63 68 61 6e 67 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 65 63 22 7d 2e 66 61 2d 63 6c 6f 75 64 2d 64 6f 77 6e 6c 6f 61 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 65 64 22 7d 2e 66 61 2d 63 6c 6f 75 64 2d 75 70 6c 6f 61 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 65 65 22 7d 2e 66 61 2d 75 73 65 72 2d 6d 64 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 30 66 30 22 7d 2e 66 61 2d 73 74 65 74 68 6f 73 63 6f 70 65 3a 62 65 66 6f Data Ascii: efore,.fa-clipboard:before{content:"\f0ea"}.fa-lightbulb-o:before{content:"\f0eb"}.fa-exchange:before{content:"\f0ec"}.fa-cloud-download:before{content:"\f0ed"}.fa-cloud-upload:before{content:"\f0ee"}.fa-user-md:before{content:"\f0f0"}.fa-stethoscope:befo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49752	199.60.103.30	443	5888	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:42:00 UTC	236	OUT	GET /hubfs/bid-boss.jpg HTTP/1.1 Accept: / Accept-Language: en-CH Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: hub.planswift.com Connection: Keep-Alive
2024-08-28 20:42:00 UTC	1358	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:42:00 GMT Content-Type: image/jpeg Content-Length: 11940 Connection: close CF-Ray: 8ba72018ce0c41f2-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 95835 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "ad942d77e27dbb892f4e7bfc45ca88c4" Last-Modified: Wed, 28 Feb 2024 16:28:12 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept Via: 1.1 1721c5705940b20c9d951889ca1932b6.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-158740573213,P-2347101,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: degrade=85, origSize=44599 Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-158740573213,P-2347101,FLS-ALL Timing-Allow-Origin: d8fk70yj6xfhx.cloudfront.net X-Amz-Cf-Id: m3WRKStY3RG6qesnUTUBNqCeILCq5_KjmWML6R3yB3BObQzs5inkUg== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: t5zswaMhpk2oAoRpYqNLF9VNDOPJxS3Pm+1jKpuNu986b/k3za53EPm+5VRcuiYc5X9TUTbgtm4= x-amz-meta-cache-tag: F-158740573213,P-2347101,FLS-ALL x-amz-meta-created-unix-time-millis: 1709137691022 x-amz-meta-index-tag: all x-amz-replication-status: COMPLETED x-amz-request-id: 20RD2HERGXKW19HJ x-amz-server-side-encryption: AES256 x-amz-storage-class: INTELLIGENT_TIERING x-amz-version-id: jq2ohsz1FO22rAAKd4dl7JvRhd4amaPI
2024-08-28 20:42:00 UTC	995	IN	Data Raw: 58 2d 43 61 63 68 65 3a 20 4d 69 73 73 20 66 72 6f 6d 20 63 6c 6f 75 64 66 72 6f 6e 74 0d 0a 58 2d 48 53 2d 41 6c 74 65 72 6e 61 74 65 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 58 2d 52 6f 62 6f 74 73 2d 54 61 67 3a 20 61 6c 6c 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 5f 62 6d 3d 46 4c 45 70 76 45 4b 59 79 49 6e 54 4e 69 48 6b 4b 34 73 44 33 77 34 42 65 4e 48 61 56 6a 66 50 71 31 56 4f 6b 7a 75 38 Data Ascii: X-Cache: Miss from cloudfrontX-HS-Alternate-Content-Type: text/plainX-HS-CF-Lambda: us-east-1.EnforceAclForReads 3X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3X-Robots-Tag: allSet-Cookie: __cf_bm=FLEpvEKYyInTNiHkK4sD3w4BeNHaVjfPq1VOkzu8
2024-08-28 20:42:00 UTC	385	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 84 00 05 05 05 05 05 05 05 06 06 05 08 08 07 08 08 0b 0a 09 09 0a 0b 11 0c 0d 0c 0d 0c 11 1a 10 13 10 10 13 10 1a 17 1b 16 15 16 1b 17 29 20 1c 1c 20 29 2f 27 25 27 2f 39 33 33 39 47 44 47 5d 5d 7d 01 05 05 05 05 05 05 05 06 06 05 08 08 07 08 08 0b 0a 09 09 0a 0b 11 0c 0d 0c 0d 0c 11 1a 10 13 10 10 13 10 1a 17 1b 16 15 16 1b 17 29 20 1c 1c 20 29 2f 27 25 27 2f 39 33 33 39 47 44 47 5d 5d 7d ff c2 00 11 08 01 a4 02 58 03 01 22 00 02 11 01 03 21 01 ff c4 00 35 00 01 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 07 08 05 06 09 04 03 02 01 01 01 00 03 01 01 01 00 00 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 a9 83 e8 bc d0 00 00 00 00 00 00 00 00 Data Ascii: JFIF) )/'%'/9339GDG]]}) )/'%'/9339GDG]]}X"!5
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 a6 d8 a7 99 2e 8e fb 30 da 79 ad 2f e2 a7 4d 6b 4a a5 8e da f5 4d 2f 8b 64 d6 fa d3 83 ab 92 c3 ab 94 5e ea b9 85 ed 1a 6e 7a 64 df b6 4d 33 07 2d dc 5e 5e ae 5e 61 Data Ascii: .0y/MkJM/d^nzdM3-^^^a
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 0f ff c4 00 37 10 00 02 02 03 00 01 02 03 06 03 05 09 00 00 00 00 04 05 03 06 01 02 07 00 08 13 11 12 14 10 15 16 36 37 50 18 20 30 35 40 55 56 a0 17 22 23 24 31 41 51 60 70 ff da 00 08 01 01 00 01 0c 00 ff 00 4f 7d 57 87 df 6d e9 b4 70 08 83 42 23 65 4c 11 b2 31 63 21 77 1c cf b3 f0 6d bf da f7 bf 0a b7 f6 bf 96 95 41 b2 5f d8 4a 0a 31 74 df 37 8e 71 68 e7 c4 0b 13 b1 63 c4 62 d4 ed 47 0f 11 22 56 5a 4e 3c b1 4b 04 b2 43 34 7b 47 2f ef 28 68 34 19 2b e9 66 9a 96 93 7d fd ff 00 4e bf f8 a4 f9 37 36 e4 17 35 bb cc 02 35 12 8d d4 f9 ec fc e6 cb b2 cf a8 d8 80 e8 5e a3 2b e8 2a 8a 14 3a 4e c3 62 af 16 7d ae 76 c7 4f f6 1b d8 fb 77 fc 9d b7 db c2 69 d5 07 1c e1 71 8c ea ea cd 2b b0 80 02 be 93 69 0c 00 a1 14 5f 38 c7 56 0b 9b 16 de Data Ascii: 767P 05@UV"#$1AQ`pO}WmpB#eL1c!wmA_J1t7qhcbG"VZN<KC4{G/(h4+f}N7655^+*:Nb}vOwiq+i_8V
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: fc 1f 3d 29 7e 66 b4 f9 75 e6 f5 5b e6 cb 76 7c 34 d3 67 4f 4f 3c ae 3d f4 db ee 82 b7 c5 9a fd 46 e6 c9 bd 99 4c 1b 4d a9 dd 30 fa cd fc 8b 64 90 fb b8 cc 9c eb b0 57 71 17 ce 3b 40 ab 5c c3 9f 73 d9 67 6e 10 7a 41 37 77 eb cb ad 10 e9 59 ae 91 ef af a5 73 2e 4b 69 a3 a4 0f fe 45 91 88 fd 3b d0 ab ee 41 6f 11 ad 48 97 bf f4 84 19 af cf 50 5e c6 12 4e 55 c9 79 0d ae ae 9e 11 30 29 bb d4 f8 45 2a 98 ec 57 a2 98 ce 72 7d 45 74 a4 4d 15 8b 54 4c 74 45 cb fb 2c 72 49 0e fa c9 1c 9b 69 b9 ac d9 32 db 4d 8e 60 41 3b 7f 52 39 24 87 7d 64 8e 4d b4 dc c6 cd 58 e3 4d 4d 66 51 38 fe ac 52 cb 0c 9a c9 14 9b 69 b9 ac 98 b2 db 4d 8e 60 41 3b 79 a6 fb c7 be bb e9 be 75 dc 97 6e 4c 83 03 94 dc c9 e1 f2 29 65 82 4d 64 8a 4d a3 dc c7 2e 18 69 ac 66 b5 2c 9d 3f f6 e5 2b a4 Data Ascii: =)~fu[v\|4gOO<=FLM0dWq;@\sgnzA7wYs.KiE;AoHP^NUy0)E*Wr}EtMTLtE,rIi2M`A;R9$}dMXMMfQ8RiM`A;yunL)eMdM.if,?+
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 34 ba 5c 7e af 64 89 b6 22 1c f3 3b d6 b6 3f c3 79 ae 11 f7 a5 97 98 5e 2a 3b 87 87 08 a4 87 48 f8 3f 54 df 25 e3 f0 be da e5 37 2f bd d8 07 28 85 95 d9 a7 d2 c9 ce 2e 55 46 0b 57 34 4b 26 84 3d e4 1d 0e b6 a3 2e 19 57 64 8c 3a c7 2b bd dc 01 cb 04 e8 b7 94 3a ef 08 6a e6 a1 6a 2a 71 0e 86 cc 58 b3 82 59 42 13 1f c9 3f ee 94 06 21 56 e9 57 96 f9 ce 34 6b 49 5c 85 7c b5 c6 c0 69 2e 0e e9 d6 e1 ab 35 1d 2a d9 de 19 2c 8c 52 bd b1 53 69 64 25 1a 73 c3 47 5a b1 08 a2 dd 5a 90 6d c6 b0 56 13 35 ab a2 bb b1 b1 ab 24 25 bd 70 b2 65 eb 96 1d f7 23 7d b6 78 1b 43 5f db 80 3e 90 6b ba fd 82 b5 28 d4 a7 e8 d3 ed 23 3f 2c cd 65 cd e6 91 82 e7 f8 0b 4d a3 59 a1 ec f8 34 b5 33 8c 03 d4 ce ec 95 6a 29 68 83 9c f5 ea ea 76 48 eb d7 64 32 ac 9b 2e 04 58 ee e7 c4 6b 69 a8 Data Ascii: 4\~d";?y^;H?T%7/(.UFW4K&=.Wd:+:jjqXYB?!VW4kI\\|i.5*,RSid%sGZZmV5$%pe#}xC_>k(#?,eMY43j)hvHd2.Xki
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 8b b7 f9 99 d5 af fe 5d 3d 1f 36 c7 f9 b9 e1 ee 7f e4 99 e0 bf 9c e2 83 2f 41 08 07 67 62 4b 95 1e 7e 67 d7 ed cb 61 62 8d db b5 47 1f d9 7b 94 e0 ad 57 87 c3 93 61 8e 51 48 9f 1b c7 8e e3 9e de 17 2a bf 28 a6 0b aa 3e d8 97 a1 9e 34 f0 d3 c5 db 70 4e f2 22 fa 2e d9 48 b7 03 7e 0a 7c d9 fe 0a 37 39 5a 98 af 54 95 e6 23 e2 bc 55 8a ee 37 db 21 b2 96 56 53 a6 ee 7a aa dc f7 fe bf 2e d6 78 5c 81 b7 9b 0f 26 1f 03 94 e7 78 64 1e f4 3b 6e 3d c7 b8 f4 7c db 1f e6 e5 f5 b2 65 f1 71 c8 fb 74 4a 6d b7 07 4c f5 a4 49 34 4d ff 00 51 91 f3 52 a8 25 11 ca 37 92 16 61 b6 e8 de a6 53 d9 86 51 29 5d 1f d6 52 29 9d 49 c3 15 92 3f bd dc 67 ce 95 f6 e3 f7 39 8e 7f 87 1c f0 c8 57 7f be 24 5e 19 42 04 ab 15 82 8c d0 cd 1a 0d 97 cd 77 e0 71 f7 72 b4 6c a4 33 7c 48 81 d4 e2 4a Data Ascii: ]=6/AgbK~gabG{WaQH*(>4pN".H~\|79ZT#U7!VSz.x\&xd;n=\|eqtJmLI4MQR%7aSQ)]R)I?g9W$^Bwqrl3\|HJ
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: b9 e9 17 1b f2 92 5c a5 46 4b 94 6c 69 cb d2 86 50 9d d2 44 c8 b5 a9 62 ae ac a1 0c ce 7b 2c 92 01 b9 8c 66 83 4f c6 c1 36 9c 82 34 95 06 e7 83 01 94 b5 de 10 ab 28 57 90 98 e3 09 1b 49 dc 47 b9 cd 2a 83 de a5 63 4d 41 10 7e 1f a8 f9 3d b7 af a7 e9 bb 16 81 11 3c 9a 69 86 69 15 5e dd 69 ea c0 61 ad 65 10 16 78 99 33 5d ab e2 db c7 8e 75 eb 42 76 21 42 65 67 94 5f a4 c1 5b 4d b0 85 0a ae d1 65 cd 0a 07 4d 46 58 37 b5 5f 99 71 b4 4d f6 45 1b be 3f 4a 06 17 97 79 0a 10 55 78 03 c7 06 a6 6d d8 db d6 b2 be f2 01 f1 04 e5 79 2c dd 9c 88 5e 10 6c d9 72 4f 94 81 72 c6 bb 1d a8 ab 74 dc ef 10 11 82 dc c0 e3 9a 2d d9 e7 12 1a 8f 64 4f 1c 8c cc 78 f0 fd fc b9 aa 46 fa 70 30 4a 0d 88 23 74 d9 fb 6c 87 61 8f a5 58 81 64 11 bc 9b c8 e5 48 1b 46 1b d1 52 43 26 99 aa d7 Data Ascii: \FKliPDb{,fO64(WIG*cMA~=<ii^iaex3]uBv!Beg_[MeMFX7_qME?JyUxmy,^lrOrt-dOxFp0J#tlaXdHFRC&
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: ee 05 31 ec d9 80 b7 3e 64 cb 5d 82 c9 bf e2 7e d5 9d c3 cb 46 ec 09 66 bb b8 f2 0d c1 fb 37 bc 64 a3 69 23 d2 6b 25 4e 5f e2 5d db 09 dc 93 e6 49 38 46 c5 e1 91 a3 6d be 2a 46 16 e7 d4 2c 4b 72 ef be fd f7 c5 5e 2a d3 48 d2 10 3d 80 b1 38 4e e5 d8 92 49 f8 9c 9f fa e6 8e 56 53 26 ff 00 78 83 e7 8e 85 1c a3 15 2c ad dc 1d bb 83 9b 01 b9 3b f9 01 b0 19 5c ef 02 99 9c 88 bf 70 6f f4 71 86 c5 a1 91 a3 24 7c 54 8c e4 5b aa ae 43 ee 7b 9d fb e3 6f bc 91 c8 c8 c7 7f 69 19 cb 97 57 91 e7 cb db bf 7d f1 7b 3c b2 33 b0 db de 71 7b 4a 5c 97 1f 03 92 3f 39 14 b9 21 9b da c3 d6 71 3e a4 65 89 55 f8 0c 4f a9 13 ca cc 8b f0 52 76 18 e3 66 e9 48 c9 c8 7b f8 91 9b 93 d4 56 21 bc fd e3 01 24 72 24 f9 b7 99 3f 8f fc 99 ff c4 00 3a 11 00 02 02 01 02 04 03 05 03 0a 07 00 00 Data Ascii: 1>d]~Ff7di#k%N_]I8FmF,Kr^H=8NIVS&x,;\poq$\|T[C{oiW}{<3q{J\?9!q>eUORvfH{V!$r$?:
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 94 04 fb 2b 2b d9 43 b6 56 56 50 ca ca 1f e9 3f ff c4 00 43 11 00 02 02 01 02 04 03 03 05 0c 09 05 00 00 00 00 01 02 03 11 00 04 12 13 21 31 41 22 51 61 05 10 32 14 23 71 81 a1 15 20 24 33 50 52 53 72 73 74 91 b2 30 34 35 42 90 b1 c1 c2 d1 43 60 62 92 b3 ff da 00 08 01 03 01 01 3f 00 ff 00 0f dd 20 f9 5e 9b 4d 3a f2 13 44 92 05 ee 37 8b ac e0 ff 00 e6 30 41 7d 24 19 24 2f 10 52 c3 c2 dd 18 74 35 90 6d 60 78 86 98 31 15 d0 57 6c 99 63 59 08 8c da d0 fe 35 cf df a3 80 6a 46 94 96 ae 28 4b f4 dd ef 89 78 bc 4a 35 b1 b6 fd 80 ff 00 ae 4b 11 89 f6 13 7c 94 ff 00 11 7e e5 b3 28 0d ca 3a ea 3a de 48 90 08 b7 2b f8 f7 01 5e 9d ce 68 8f ca a0 32 9f 09 12 cc 95 fb 39 0a 7d b5 93 20 8a 59 63 06 f6 b9 5b fa 0f f4 0e db 6b 95 b1 34 aa 3a 93 83 4e 79 5b 01 93 42 d0 b9 Data Ascii: ++CVVP?C!1A"Qa2#q $3PRSrst045BC`b? ^M:D70A}$$/Rt5m`x1WlcY5jF(KxJ5K\|~(::H+^h29} Yc[k4:Ny[B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49753	104.17.25.14	443	5888	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:42:00 UTC	269	OUT	GET /ajax/libs/fancybox/3.5.2/jquery.fancybox.min.css HTTP/1.1 Accept: / Accept-Language: en-CH Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: cdnjs.cloudflare.com Connection: Keep-Alive
2024-08-28 20:42:00 UTC	940	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:42:00 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03e58-3611" Last-Modified: Mon, 04 May 2020 16:10:00 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: MISS Expires: Mon, 18 Aug 2025 20:42:00 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ogqq4pJ13pbFRlsZE63oBH3M7mtDa4Bz%2BvhmsEenRsGqMCDiiod%2FTKECn2rlB%2BoyE9BtXp1ol%2BaLmNR%2B%2BnFfDJVSWU8Ig1ZXBIVXejAo0xVjl4lRQuyCV%2FPR16JBu6vvbN89G80Y"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8ba720191a6a0f64-EWR alt-svc: h3=":443"; ma=86400
2024-08-28 20:42:00 UTC	429	IN	Data Raw: 33 36 31 31 0d 0a 62 6f 64 79 2e 63 6f 6d 70 65 6e 73 61 74 65 2d 66 6f 72 2d 73 63 72 6f 6c 6c 62 61 72 7b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 66 61 6e 63 79 62 6f 78 2d 61 63 74 69 76 65 7b 68 65 69 67 68 74 3a 61 75 74 6f 7d 2e 66 61 6e 63 79 62 6f 78 2d 69 73 2d 68 69 64 64 65 6e 7b 6c 65 66 74 3a 2d 39 39 39 39 70 78 3b 6d 61 72 67 69 6e 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 21 69 6d 70 6f 72 74 61 6e 74 3b 74 6f 70 3a 2d 39 39 39 39 70 78 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 2e 66 61 6e 63 79 62 6f 78 2d 63 6f 6e 74 61 69 6e 65 72 7b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 66 61 63 65 2d 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6c 65 66 74 3a 30 3b Data Ascii: 3611body.compensate-for-scrollbar{overflow:hidden}.fancybox-active{height:auto}.fancybox-is-hidden{left:-9999px;margin:0;position:absolute!important;top:-9999px;visibility:hidden}.fancybox-container{-webkit-backface-visibility:hidden;height:100%;left:0;
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 61 6e 73 6c 61 74 65 5a 28 30 29 3b 77 69 64 74 68 3a 31 30 30 25 3b 7a 2d 69 6e 64 65 78 3a 39 39 39 39 32 7d 2e 66 61 6e 63 79 62 6f 78 2d 63 6f 6e 74 61 69 6e 65 72 20 2a 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 7d 2e 66 61 6e 63 79 62 6f 78 2d 62 67 2c 2e 66 61 6e 63 79 62 6f 78 2d 69 6e 6e 65 72 2c 2e 66 61 6e 63 79 62 6f 78 2d 6f 75 74 65 72 2c 2e 66 61 6e 63 79 62 6f 78 2d 73 74 61 67 65 7b 62 6f 74 74 6f 6d 3a 30 3b 6c 65 66 74 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 72 69 67 68 74 3a 30 3b 74 6f 70 3a 30 7d 2e 66 61 6e 63 79 62 6f 78 2d 6f 75 74 65 72 7b 2d 77 65 62 6b 69 74 2d 6f 76 65 72 66 6c 6f 77 2d 73 63 72 6f 6c 6c 69 6e 67 3a 74 6f 75 63 68 3b 6f 76 65 72 66 6c 6f 77 2d 79 3a 61 75 74 6f 7d Data Ascii: anslateZ(0);width:100%;z-index:99992}.fancybox-container *{box-sizing:border-box}.fancybox-bg,.fancybox-inner,.fancybox-outer,.fancybox-stage{bottom:0;left:0;position:absolute;right:0;top:0}.fancybox-outer{-webkit-overflow-scrolling:touch;overflow-y:auto}
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 65 72 66 6c 6f 77 3a 76 69 73 69 62 6c 65 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 5a 28 30 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 5a 28 30 29 3b 7a 2d 69 6e 64 65 78 3a 39 39 39 39 34 7d 2e 66 61 6e 63 79 62 6f 78 2d 69 73 2d 6f 70 65 6e 20 2e 66 61 6e 63 79 62 6f 78 2d 73 74 61 67 65 7b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 66 61 6e 63 79 62 6f 78 2d 73 6c 69 64 65 7b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 66 61 63 65 2d 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6c 65 66 74 3a 30 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 3b 6f 76 65 72 66 6c 6f 77 3a 61 75 74 6f 3b 2d 77 65 62 6b 69 74 2d 6f 76 Data Ascii: erflow:visible;-webkit-transform:translateZ(0);transform:translateZ(0);z-index:99994}.fancybox-is-open .fancybox-stage{overflow:hidden}.fancybox-slide{-webkit-backface-visibility:hidden;display:none;height:100%;left:0;outline:none;overflow:auto;-webkit-ov
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 3a 76 69 73 69 62 6c 65 3b 70 61 64 64 69 6e 67 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 74 6f 70 20 6c 65 66 74 3b 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 74 6f 70 20 6c 65 66 74 3b 74 72 61 6e 73 69 74 69 6f 6e 2d 70 72 6f 70 65 72 74 79 3a 6f 70 61 63 69 74 79 2c 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3b 74 72 61 6e 73 69 74 69 6f 6e 2d 70 72 6f 70 65 72 74 79 3a 74 72 61 6e 73 66 6f 72 6d 2c 6f 70 61 63 69 74 79 3b 74 72 61 6e 73 69 74 69 6f 6e 2d 70 72 6f 70 65 72 74 79 3a 74 72 61 6e 73 66 6f 72 6d 2c 6f 70 61 63 69 74 79 2c 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3b 2d 77 65 62 6b 69 74 2d 75 73 65 72 Data Ascii: :visible;padding:0;position:absolute;top:0;-webkit-transform-origin:top left;transform-origin:top left;transition-property:opacity,-webkit-transform;transition-property:transform,opacity;transition-property:transform,opacity,-webkit-transform;-webkit-user
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 79 62 6f 78 2d 69 66 72 61 6d 65 2c 2e 66 61 6e 63 79 62 6f 78 2d 76 69 64 65 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 3a 30 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 72 67 69 6e 3a 30 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 70 61 64 64 69 6e 67 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 66 61 6e 63 79 62 6f 78 2d 69 66 72 61 6d 65 7b 6c 65 66 74 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 7d 2e 66 61 6e 63 79 62 6f 78 2d 65 72 72 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 75 72 73 6f 72 3a 64 65 66 61 75 6c 74 3b 6d 61 78 2d 77 69 64 74 68 3a 34 30 30 70 78 3b 70 61 64 64 69 6e 67 3a 34 30 70 78 Data Ascii: ybox-iframe,.fancybox-video{background:transparent;border:0;display:block;height:100%;margin:0;overflow:hidden;padding:0;width:100%}.fancybox-iframe{left:0;position:absolute;top:0}.fancybox-error{background:#fff;cursor:default;max-width:400px;padding:40px
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 58 28 30 29 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 30 3b 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 30 3b 74 72 61 6e 73 69 74 69 6f 6e 2d 70 72 6f 70 65 72 74 79 3a 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3b 74 72 61 6e 73 69 74 69 6f 6e 2d 70 72 6f 70 65 72 74 79 3a 74 72 61 6e 73 66 6f 72 6d 3b 74 72 61 6e 73 69 74 69 6f 6e 2d 70 72 6f 70 65 72 74 79 3a 74 72 61 6e 73 66 6f 72 6d 2c 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3b 74 72 61 6e 73 69 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 6c 69 6e 65 61 72 3b 7a 2d 69 6e 64 65 78 3a 39 39 39 39 38 7d 2e 66 61 6e 63 79 62 6f 78 2d 63 6c 6f 73 65 2d 73 6d 61 6c 6c 7b 62 61 63 6b 67 Data Ascii: ansform:scaleX(0);-webkit-transform-origin:0;transform-origin:0;transition-property:-webkit-transform;transition-property:transform;transition-property:transform,-webkit-transform;transition-timing-function:linear;z-index:99998}.fancybox-close-small{backg
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 7a 34 32 52 77 51 33 41 4d 41 67 44 6a 66 63 66 75 70 38 57 6f 52 79 6b 66 42 41 4b 35 6d 51 48 4b 53 7a 35 72 62 58 4a 50 69 73 31 68 6a 69 56 33 43 49 71 67 47 30 68 4c 5a 50 6b 56 6b 41 34 70 34 78 35 6f 52 31 62 56 65 44 72 64 43 4c 72 57 32 51 30 44 35 62 63 77 59 33 54 47 4d 48 62 64 77 33 6d 50 52 75 4f 74 61 73 70 59 50 31 77 2f 2f 47 31 4f 49 63 57 31 34 38 48 30 44 4d 43 71 49 2f 33 6d 4d 4d 41 41 41 41 41 53 55 56 4f 52 4b 35 43 59 49 49 3d 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 72 65 70 65 61 74 2d 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 62 6f 74 74 6f 6d 3a 30 3b 63 6f 6e 74 65 6e 74 3a 22 22 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6c 65 66 74 3a 30 3b 70 6f 69 6e 74 65 72 2d 65 Data Ascii: z42RwQ3AMAgDjfcfup8WoRykfBAK5mQHKSz5rbXJPis1hjiV3CIqgG0hLZPkVkA4p4x5oR1bVeDrdCLrW2Q0D5bcwY3TGMHbdw3mPRuOtaspYP1w//G1OIcW148H0DMCqI/3mMMAAAAASUVORK5CYII=);background-repeat:repeat-x;background-size:contain;bottom:0;content:"";display:block;left:0;pointer-e
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 66 61 64 65 2e 66 61 6e 63 79 62 6f 78 2d 73 6c 69 64 65 2d 2d 6e 65 78 74 2c 2e 66 61 6e 63 79 62 6f 78 2d 66 78 2d 66 61 64 65 2e 66 61 6e 63 79 62 6f 78 2d 73 6c 69 64 65 2d 2d 70 72 65 76 69 6f 75 73 7b 6f 70 61 63 69 74 79 3a 30 3b 74 72 61 6e 73 69 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 31 39 2c 31 2c 2e 32 32 2c 31 29 7d 2e 66 61 6e 63 79 62 6f 78 2d 66 78 2d 66 61 64 65 2e 66 61 6e 63 79 62 6f 78 2d 73 6c 69 64 65 2d 2d 63 75 72 72 65 6e 74 7b 6f 70 61 63 69 74 79 3a 31 7d 2e 66 61 6e 63 79 62 6f 78 2d 66 78 2d 7a 6f 6f 6d 2d 69 6e 2d 6f 75 74 2e 66 61 6e 63 79 62 6f 78 2d 73 6c 69 64 65 2d 2d 70 72 65 76 69 6f 75 73 7b 6f 70 61 63 69 74 79 3a 30 3b 2d 77 65 62 6b 69 74 2d 74 72 61 Data Ascii: fade.fancybox-slide--next,.fancybox-fx-fade.fancybox-slide--previous{opacity:0;transition-timing-function:cubic-bezier(.19,1,.22,1)}.fancybox-fx-fade.fancybox-slide--current{opacity:1}.fancybox-fx-zoom-in-out.fancybox-slide--previous{opacity:0;-webkit-tra
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 2d 31 30 30 25 2c 30 2c 30 29 20 73 63 61 6c 65 28 2e 31 29 20 73 6b 65 77 28 2d 31 30 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 2d 31 30 30 25 2c 30 2c 30 29 20 73 63 61 6c 65 28 2e 31 29 20 73 6b 65 77 28 2d 31 30 64 65 67 29 7d 2e 66 61 6e 63 79 62 6f 78 2d 66 78 2d 74 75 62 65 2e 66 61 6e 63 79 62 6f 78 2d 73 6c 69 64 65 2d 2d 6e 65 78 74 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 31 30 30 25 2c 30 2c 30 29 20 73 63 61 6c 65 28 2e 31 29 20 73 6b 65 77 28 31 30 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 31 30 30 25 2c 30 2c 30 29 20 73 63 61 6c 65 28 2e 31 29 20 73 Data Ascii: ransform:translate3d(-100%,0,0) scale(.1) skew(-10deg);transform:translate3d(-100%,0,0) scale(.1) skew(-10deg)}.fancybox-fx-tube.fancybox-slide--next{-webkit-transform:translate3d(100%,0,0) scale(.1) skew(10deg);transform:translate3d(100%,0,0) scale(.1) s
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 2d 2d 66 62 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 33 62 35 39 39 38 7d 2e 66 61 6e 63 79 62 6f 78 2d 73 68 61 72 65 5f 5f 62 75 74 74 6f 6e 2d 2d 66 62 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 33 34 34 65 38 36 7d 2e 66 61 6e 63 79 62 6f 78 2d 73 68 61 72 65 5f 5f 62 75 74 74 6f 6e 2d 2d 70 74 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 62 64 30 38 31 64 7d 2e 66 61 6e 63 79 62 6f 78 2d 73 68 61 72 65 5f 5f 62 75 74 74 6f 6e 2d 2d 70 74 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 61 61 30 37 31 39 7d 2e 66 61 6e 63 79 62 6f 78 2d 73 68 61 72 65 5f 5f 62 75 74 74 6f 6e 2d 2d 74 77 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 31 64 61 31 66 32 7d 2e 66 61 6e 63 79 62 6f 78 2d 73 68 61 72 65 5f 5f 62 75 74 74 6f 6e 2d 2d 74 77 3a 68 6f 76 Data Ascii: --fb{background:#3b5998}.fancybox-share__button--fb:hover{background:#344e86}.fancybox-share__button--pt{background:#bd081d}.fancybox-share__button--pt:hover{background:#aa0719}.fancybox-share__button--tw{background:#1da1f2}.fancybox-share__button--tw:hov

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49754	104.17.25.14	443	5888	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:42:00 UTC	267	OUT	GET /ajax/libs/slick-carousel/1.8.0/slick-theme.css HTTP/1.1 Accept: / Accept-Language: en-CH Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: cdnjs.cloudflare.com Connection: Keep-Alive
2024-08-28 20:42:00 UTC	933	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:42:00 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03fd5-c49" Last-Modified: Mon, 04 May 2020 16:16:21 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: MISS Expires: Mon, 18 Aug 2025 20:42:00 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5avpirlKEh1%2FYjXMCCMkaPuvIUc2zQAvEABZrddtHlKdHiseJ4m9BCsn1tjc4liXXYDBdvFET38%2BnswgUN7OPfvB90bNWiEkUDtpIM30ZK57Wcla8V%2BaEuy4jnmG%2FZa05BzIV3q6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8ba72018fd887d06-EWR alt-svc: h3=":443"; ma=86400
2024-08-28 20:42:00 UTC	436	IN	Data Raw: 63 34 39 0d 0a 40 63 68 61 72 73 65 74 20 27 55 54 46 2d 38 27 3b 0a 2f 2a 20 53 6c 69 64 65 72 20 2a 2f 0a 2e 73 6c 69 63 6b 2d 6c 6f 61 64 69 6e 67 20 2e 73 6c 69 63 6b 2d 6c 69 73 74 0a 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 20 75 72 6c 28 27 2e 2f 61 6a 61 78 2d 6c 6f 61 64 65 72 2e 67 69 66 27 29 20 63 65 6e 74 65 72 20 63 65 6e 74 65 72 20 6e 6f 2d 72 65 70 65 61 74 3b 0a 7d 0a 0a 2f 2a 20 49 63 6f 6e 73 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 0a 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 73 6c 69 63 6b 27 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 0a 20 20 20 20 73 72 63 3a 20 75 72 6c 28 27 2e Data Ascii: c49@charset 'UTF-8';/* Slider /.slick-loading .slick-list{ background: #fff url('./ajax-loader.gif') center center no-repeat;}/ Icons */@font-face{ font-family: 'slick'; font-weight: normal; font-style: normal; src: url('.
2024-08-28 20:42:00 UTC	1369	IN	Data Raw: 27 2e 2f 66 6f 6e 74 73 2f 73 6c 69 63 6b 2e 73 76 67 23 73 6c 69 63 6b 27 29 20 66 6f 72 6d 61 74 28 27 73 76 67 27 29 3b 0a 7d 0a 2f 2a 20 41 72 72 6f 77 73 20 2a 2f 0a 2e 73 6c 69 63 6b 2d 70 72 65 76 2c 0a 2e 73 6c 69 63 6b 2d 6e 65 78 74 0a 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 30 3b 0a 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 0a 20 20 20 20 77 69 64 74 68 3a 20 32 30 70 78 3b 0a 20 20 20 20 68 65 69 67 68 74 3a 20 32 30 70 78 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d Data Ascii: './fonts/slick.svg#slick') format('svg');}/* Arrows */.slick-prev,.slick-next{ font-size: 0; line-height: 0; position: absolute; top: 50%; display: block; width: 20px; height: 20px; padding: 0; -webkit-transform
2024-08-28 20:42:00 UTC	1347	IN	Data Raw: 65 0a 7b 0a 20 20 20 20 63 6f 6e 74 65 6e 74 3a 20 27 e2 86 92 27 3b 0a 7d 0a 5b 64 69 72 3d 27 72 74 6c 27 5d 20 2e 73 6c 69 63 6b 2d 6e 65 78 74 3a 62 65 66 6f 72 65 0a 7b 0a 20 20 20 20 63 6f 6e 74 65 6e 74 3a 20 27 e2 86 90 27 3b 0a 7d 0a 0a 2f 2a 20 44 6f 74 73 20 2a 2f 0a 2e 73 6c 69 63 6b 2d 64 6f 74 74 65 64 2e 73 6c 69 63 6b 2d 73 6c 69 64 65 72 0a 7b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0a 7d 0a 0a 2e 73 6c 69 63 6b 2d 64 6f 74 73 0a 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 2d 32 35 70 78 3b 0a 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 70 61 64 64 69 Data Ascii: e{ content: '';}[dir='rtl'] .slick-next:before{ content: '';}/* Dots */.slick-dotted.slick-slider{ margin-bottom: 30px;}.slick-dots{ position: absolute; bottom: -25px; display: block; width: 100%; paddi
2024-08-28 20:42:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49755	199.60.103.30	443	5888	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:42:00 UTC	269	OUT	GET /hubfs/PS%20-%20Getting%20Started/spaceFrame_700.jpg HTTP/1.1 Accept: / Accept-Language: en-CH Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: hub.planswift.com Connection: Keep-Alive
2024-08-28 20:42:01 UTC	1364	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:42:01 GMT Content-Type: image/jpeg Content-Length: 111911 Connection: close CF-Ray: 8ba7201c1ea6431c-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 95836 Cache-Control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 ETag: "655df3c13e0c13fb99e69dea2d46515a" Last-Modified: Fri, 13 Mar 2020 19:47:01 GMT Strict-Transport-Security: max-age=31536000 Vary: Accept-Encoding Via: 1.1 c36b03c9737c294317e3651e77ee0c4a.cloudfront.net (CloudFront) Access-Control-Allow-Methods: GET cache-tag: F-27019193501,FD-26637824551,P-2347101,FLS-ALL Cf-Bgj: imgq:85,h2pri Cf-Polished: degrade=85, origSize=124643, status=webp_bigger Content-Security-Policy: upgrade-insecure-requests Edge-Cache-Tag: F-27019193501,FD-26637824551,P-2347101,FLS-ALL Timing-Allow-Origin: d8fk70yj6xfhx.cloudfront.net X-Amz-Cf-Id: 2AtZ0eU_WYJQuCVdFldPJgOvKkR9VGOhE2gP6XZ3JxKLaTS0Br36AQ== X-Amz-Cf-Pop: JFK50-P6 x-amz-id-2: KKrw3ri55FhA+T0XCfy1u2Az0kWBSbc8lRHGw1QWkXEawWvaOyM28BUCk3i0LWY3W6CRF/+G+DXl2jt7gbVVxQ== x-amz-meta-cache-tag: F-27019193501,FD-26637824551,P-2347101,FLS-ALL x-amz-request-id: 20R303YQ7FDWN2CY x-amz-server-side-encryption: AES256 x-amz-version-id: TOcbI3af4QIhNwsdHPfoltDQamc_1QBg X-Cache: Miss from cloudfront X-HS-CF-Lambda: us-east-1.EnforceAclForReads 3
2024-08-28 20:42:01 UTC	858	IN	Data Raw: 58 2d 48 53 2d 43 46 2d 4c 61 6d 62 64 61 2d 45 6e 66 6f 72 63 65 3a 20 75 73 2d 65 61 73 74 2d 31 2e 45 6e 66 6f 72 63 65 41 63 6c 46 6f 72 52 65 61 64 73 20 33 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 5f 62 6d 3d 67 6f 6e 56 56 30 6d 61 4e 59 63 72 43 76 4a 56 67 46 63 44 69 5f 59 69 6f 43 43 6c 56 43 4b 36 4b 6c 4f 38 70 70 53 35 46 37 55 2d 31 37 32 34 38 37 37 37 32 31 2d 31 2e 30 2e 31 2e 31 2d 71 49 46 73 72 43 69 33 58 61 36 62 77 71 55 36 36 5a 79 74 76 78 7a 53 64 73 38 6b 4b 41 75 30 59 4f 71 46 57 58 44 62 6e 47 6c 63 31 2e 70 59 6e 76 79 42 69 6c 74 48 54 32 5a 54 30 68 4d 76 5f 4d 46 30 4a 5a 4b 55 64 6f 34 78 49 64 6d 5f 5f 47 68 6c 34 77 3b 20 70 61 74 68 3d 2f 3b 20 65 78 70 69 72 65 73 3d 57 65 64 2c 20 32 38 2d 41 75 67 2d Data Ascii: X-HS-CF-Lambda-Enforce: us-east-1.EnforceAclForReads 3Set-Cookie: __cf_bm=gonVV0maNYcrCvJVgFcDi_YioCClVCK6KlO8ppS5F7U-1724877721-1.0.1.1-qIFsrCi3Xa6bwqU66ZytvxzSds8kKAu0YOqFWXDbnGlc1.pYnvyBiltHT2ZT0hMv_MF0JZKUdo4xIdm__Ghl4w; path=/; expires=Wed, 28-Aug-
2024-08-28 20:42:01 UTC	1369	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 84 00 05 05 05 05 05 05 05 06 06 05 08 08 07 08 08 0b 0a 09 09 0a 0b 11 0c 0d 0c 0d 0c 11 1a 10 13 10 10 13 10 1a 17 1b 16 15 16 1b 17 29 20 1c 1c 20 29 2f 27 25 27 2f 39 33 33 39 47 44 47 5d 5d 7d 01 05 05 05 05 05 05 05 06 06 05 08 08 07 08 08 0b 0a 09 09 0a 0b 11 0c 0d 0c 0d 0c 11 1a 10 13 10 10 13 10 1a 17 1b 16 15 16 1b 17 29 20 1c 1c 20 29 2f 27 25 27 2f 39 33 33 39 47 44 47 5d 5d 7d ff c2 00 11 08 01 d3 02 bc 03 01 22 00 02 11 01 03 11 01 ff c4 00 34 00 00 02 02 03 01 01 01 00 00 00 00 00 00 00 00 00 06 07 04 05 00 03 08 02 01 09 01 00 03 01 01 01 00 00 00 00 00 00 00 00 00 00 00 00 01 02 03 04 05 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 e7 72 e8 25 9d bc 4b 5c 9d 23 2d 6b 6c a3 Data Ascii: JFIF) )/'%'/9339GDG]]}) )/'%'/9339GDG]]}"4r%K\#-kl
2024-08-28 20:42:01 UTC	1369	IN	Data Raw: 2a e6 ad 56 79 59 12 01 9b 2a 68 62 32 3c eb 54 a2 08 fd 05 14 8b e2 9d e6 c3 cd 39 16 eb 3b 08 06 37 fa d3 d3 84 3f 33 e1 45 8e e6 c8 b9 ea c2 5f 38 50 8d 5f ce 95 b9 a8 e5 83 f7 8e 56 c4 62 65 d3 73 7e 34 01 6a 2f 0b 16 79 79 da 2e e2 9f 65 b1 00 65 98 9d c1 b1 92 ec da a6 e9 4c 49 4c 3a 5e 88 5e b1 b7 c9 7b 71 47 31 33 45 19 fd 9c b5 4b 8d 5a c9 e4 e9 e8 c3 8f ce b7 0a 7d 7f f4 1c c6 2c 7f 80 de 42 37 1d 18 d3 f1 ea 2b ee 7c f2 3c 8d 27 19 cb a8 37 00 f6 90 2f d3 c2 3c fc 2f d1 4d fc 1d d3 91 4d 5c cd 73 4b be 76 bd ab d7 36 d3 7e 57 ac ee 0f 9b 0c 1c 61 73 1a d4 71 f5 75 c5 8e b9 0c 35 95 22 75 3d 7a ba 5d 74 9c 57 18 99 75 0f 2f 31 bb 51 cd 6c a4 35 5e 8a 27 e2 ac cc 50 2a 5a 59 79 5c ed 80 1b 80 75 dd 34 a9 36 53 c5 27 a4 bc a2 1d 29 cc 4e f6 1a a9 Data Ascii: VyYhb2<T9;7?3E_8P_Vbes~4j/yy.eeLIL:^^{qG13EKZ},B7+\|<'7/</MM\sKv6~Wasqu5"u=z]tWu/1Ql5^'P*ZYy\u46S')N
2024-08-28 20:42:01 UTC	1369	IN	Data Raw: 8d ad b1 db 89 af fa e3 9c 6e 3c 53 30 93 fb 64 a9 ee 45 52 8b 2d bb bb 39 17 a5 b2 bf 5c e7 6a be d6 39 cf 5e 9d 71 5b 2b fc 42 9a 98 52 35 69 70 54 0f 0f 6b 5a 48 6a ed 26 ac 74 6b f5 4b 35 de 0d a2 0e ca fb 89 bf b7 43 56 02 28 d8 37 b6 e2 56 bf 6c 92 8c c1 5c 2a 7d 72 a1 26 31 55 4d b3 44 bd 11 ca 64 0e b1 dc 33 7c 5e ea 3a 46 35 d2 48 10 05 d8 14 77 1a 27 a2 62 be e6 69 96 9f 4e 74 b7 8d f2 e5 c1 f8 b3 e5 b1 46 ee 4c 6e 26 13 2a 68 d0 e2 58 93 06 dc 11 00 92 dc ab 60 64 18 fd 18 5b 51 fa 0d 86 a7 bc 68 5a e7 a0 90 7d 25 06 7a f6 e6 ee 59 62 13 68 3f 4e de 72 6c 39 66 b4 b2 e5 69 b1 cd 9d dd 73 81 f0 4a 23 80 f6 c5 68 f8 54 90 ea 9d 27 02 71 74 de b0 a9 8a 30 fc 96 0d ec db ec 5a fc 22 27 bd f1 dc 9b d2 f3 12 28 cb a5 39 da 6b 52 8e f5 93 50 9d e8 90 Data Ascii: n<S0dER-9\j9^q[+BR5ipTkZHj&tkK5CV(7Vl\}r&1UMDd3\|^:F5Hw'biNtFLn&hX`d[QhZ}%zYbh?Nrl9fisJ#hT'qt0Z"'(9kRP
2024-08-28 20:42:01 UTC	1369	IN	Data Raw: 0b ba aa 67 00 4d 78 33 99 5d 4d ce 79 07 a2 39 5c 3a 17 4d ff 00 13 9c f2 1d c5 79 82 17 70 ce 01 ca ae b5 24 83 17 47 eb d6 c8 a9 10 be 57 8d 9a 42 a7 b1 d7 26 8a a8 8e 18 18 2d ee b4 a6 33 6d 7e 7d 9e 88 8c 22 d2 14 76 da f4 85 b3 19 66 79 4b a1 49 79 3e ed cf 70 f3 14 95 60 d5 65 f6 8f b0 e5 c7 0d da ec 3a c2 8f 8b cf d1 72 36 17 7c cb a6 e0 da 6c 3f 40 69 b8 69 f4 e0 db 9d 66 d5 ab bf a0 f3 76 e6 c7 a0 78 ee 59 5d a5 cb 61 c5 64 91 64 3b 6b 81 36 20 dd 0b 98 95 90 34 67 b5 6d 13 b0 2a 5e e3 41 30 a6 32 83 eb e0 06 e6 e8 01 03 99 b0 26 08 31 90 9d bd a5 8a 8a 6b 4f 68 c6 50 68 fd 73 5e 4f c0 61 cd 33 76 29 f0 3b c0 eb 8d 9f b7 99 67 0b f4 bf 23 2a 63 32 b9 d7 13 3c 74 f2 d4 86 bb f3 d7 26 41 79 8f 7a 1b f5 37 d1 02 23 ed 3b 94 d5 28 5c 59 08 e0 94 89 Data Ascii: gMx3]My9\:Myp$GWB&-3m~}"vfyKIy>p`e:r6\|l?@iifvxY]add;k6 4gm^A02&1kOhPhs^Oa3v);g#c2<t&Ayz7#;(\Y
2024-08-28 20:42:01 UTC	1369	IN	Data Raw: ec 8a 4f 4a 60 03 24 46 e2 a3 0e 45 62 eb 34 fa c9 ad 37 55 33 13 9d b8 7f 7b 0e 25 89 42 72 71 30 64 a3 a7 9b 55 5d ac e7 3a e8 ac ab a3 41 62 b8 37 18 ed d4 17 1c 53 bb 2a e9 8d 21 67 5d fc 04 49 99 6e 2c 77 58 73 ab 25 6d 96 ec 5f 9d 51 af 4c b8 9b 43 0c 19 55 c3 e3 97 8b d5 77 d4 ee 26 39 10 2d 78 87 db 8c a4 d8 c3 96 a3 2a 2c 90 52 cf 08 2b e5 f9 b0 af a8 1b 62 fd 0f 33 4c ba a7 9f 1a 02 bb 71 33 39 c5 ec 8c 9b 14 b0 97 65 cd dd 2e f0 55 84 d8 04 2b 91 f7 35 56 d5 7b a6 ed 1e 08 b3 ed f8 e3 d1 d9 14 c5 28 e0 6c f3 9f 4c f3 a5 b3 42 e0 30 f3 60 83 9b 00 f6 7a d0 75 3e a5 79 cf 5f a6 e2 b7 f7 0d 14 d0 f9 4a 71 6a ca ab c5 4f 61 7b 46 d4 48 96 1a d5 d7 6c d7 a6 1e 4a d7 0d 33 7b 55 bc ad 32 b0 93 5f 2c aa 3d 3b 0e 26 87 2a 18 96 f5 0a 0d b6 90 b3 d2 56 Data Ascii: OJ`$FEb47U3{%Brq0dU]:Ab7S!g]In,wXs%m_QLCUw&9-x,R+b3Lq39e.U+5V{(lLB0`zu>y_JqjOa{FHlJ3{U2_,=;&*V
2024-08-28 20:42:01 UTC	1369	IN	Data Raw: d4 e6 4d 6d 8f 98 2f be b3 02 1c ac c1 f6 af 24 e6 3c b6 d3 66 2d 2a ef 73 07 d1 5c d5 99 70 6b 1f 31 a0 b9 59 88 28 0f cc 73 53 2b 33 1e 89 45 d9 95 1f a0 7f 98 99 97 1a ed 33 33 d3 ee fc cd 22 cc 73 31 4e da cc c9 d6 76 9c c5 30 6c f3 07 f6 46 63 76 94 39 82 8d 7b 99 53 1e 3e 64 de 40 cc 47 ff c4 00 3e 10 00 02 02 02 00 06 01 03 02 04 05 03 04 01 03 05 03 04 02 05 01 06 00 07 11 12 13 14 21 15 22 23 31 32 10 16 24 33 08 20 25 41 42 17 34 61 35 43 51 52 62 45 46 81 53 63 65 71 72 ff da 00 08 01 01 00 01 0c 00 d5 96 8b ae 58 36 c0 e2 48 93 5c ac 63 e7 18 20 a4 dd 71 12 7a 4b 2c c4 a7 9f 61 f5 fe 18 5e 25 8c 6c 41 fe e3 20 f8 54 c3 9c e3 98 12 32 e1 b6 bc 2b 90 bd dd 32 28 c5 1d 5d 5c 4f e0 96 c4 8d 55 5d 58 27 f3 2d 29 03 b4 84 98 3b 45 c1 39 92 66 40 da Data Ascii: Mm/$<f-*s\pk1Y(sS+3E33"s1Nv0lFcv9{S>d@G>!"#12$3 %AB4a5CQRbEFSceqrX6H\c qzK,a^%lA T2+2(]\OU]X'-);E9f@
2024-08-28 20:42:01 UTC	1369	IN	Data Raw: 29 2c 3d b1 d0 15 bd c8 7a d0 19 83 72 bc 3c 76 bd 92 4b 2d 2f f4 c5 ad 6b 2c 97 fa 75 a5 78 b2 00 eb db 26 aa e4 ad f4 7b 82 f1 a6 f3 b6 a2 f2 70 ae d8 03 f4 6b 48 ca 3f 1f c1 85 80 e0 0a bb 21 19 43 b6 72 55 66 73 37 35 a3 7a c5 c5 a5 ce b6 c9 11 b7 54 90 91 a2 a6 d0 01 fb 0b f9 12 da e8 41 ae 3a bc 57 7a 46 87 2a 79 a9 5b a5 0c f5 96 55 5f d1 d5 da d6 5d a4 17 eb 1f 0b 6a 3e df a8 28 f6 7c 94 71 08 47 2c e3 ed 1f d5 2a e2 cb 57 36 b6 0b 2c b5 b7 3a b5 1a fe e8 a7 13 bf 3b 7e 79 6c 8d c6 51 ac 40 08 c6 ca fa f2 ed a2 32 fd 81 59 3d 5e a5 7d 75 38 fa c9 13 38 7b 96 a4 a4 a6 7a de e2 d8 42 1e a3 ae 26 e2 06 b5 7d 6e a0 be e5 d5 c3 cb c1 8a c5 7a 02 8f 51 b4 a7 7f df b9 56 42 35 65 06 c1 64 bc cd 5b 5c 56 03 4b 6a 91 42 b8 00 c6 21 36 df 94 52 37 e3 97 90 Data Ascii: ),=zr<vK-/k,ux&{pkH?!CrUfs75zTA:WzFy[U_]j>(\|qG,W6,:;~ylQ@2Y=^}u88{zB&}nzQVB5ed[\VKjB!6R7
2024-08-28 20:42:01 UTC	1369	IN	Data Raw: df c3 fc 44 ed 79 61 aa 9d 3d 19 70 05 23 32 2a 84 3f 67 29 a8 24 c5 83 56 a7 17 40 ff 00 0c ff 00 06 56 59 b0 1d 76 97 19 c3 b2 f2 7c 12 84 c9 ae 31 01 f0 d0 cd 5e e9 a1 98 90 47 b5 b5 6c 40 6a 1e c7 41 f2 be f5 cd 10 92 d8 a7 4d 16 55 d5 f7 5d 7b 6c 0c a5 5c f7 53 ee 5c a3 d6 36 e9 11 de c9 21 6b b2 eb fb 6e 94 29 25 b4 55 0e de 80 54 7e 63 86 cf 4f b4 2e 59 d3 7f c4 0b e8 4b 35 db a2 92 62 3b 96 e5 59 b0 05 28 d3 b8 07 6b 5a 60 d5 5a f9 0e 2f 26 6d 74 7d 66 1a ae ba 9a 32 8c 72 d6 cc da db f6 fb eb 4c f1 c6 b9 a7 a6 5e 6f f3 3d ab f6 96 97 d1 38 30 44 c0 8a 22 86 24 15 e7 2c 07 e2 2c a8 25 08 0e ce b4 c8 b2 65 98 09 d6 77 55 61 b7 4a 61 90 92 2e 64 3a b9 6d cf 16 92 ae ba 0b d6 73 20 fa e5 b7 af ba ea 02 f4 2a f6 bd 5d fa 29 dc d5 58 ac 6a da 5b 34 99 Data Ascii: Dya=p#2?g)$V@VYv\|1^Gl@jAMU]{l\S\6!kn)%UT~cO.YK5b;Y(kZ`Z/&mt}f2rL^o=80D"$,,%ewUaJa.d:ms ])Xj[4
2024-08-28 20:42:01 UTC	1369	IN	Data Raw: 5d 46 53 50 99 8e ed cc 5b 0d a2 9f 15 46 54 50 6e e5 a0 f8 d1 41 79 75 5e a3 ba a9 1b cb fe ec 47 8e 58 d5 5e 6a ba f0 5e 1a 12 eb ed c7 99 1c d9 ac 1b 70 f1 d3 ca a9 07 b3 17 95 21 16 37 31 fc af a8 8e 96 6b c8 c9 8d cb cb b3 83 48 d0 e9 c7 30 d4 85 c1 56 02 44 ee 82 8a 5a 5e b1 68 95 cd f9 e1 98 39 ca 3a 38 89 b7 2e 08 3c 78 ea d2 ca 29 08 64 96 32 4b cd 7e 97 62 4f d4 b4 40 4c 8f 71 e4 65 82 78 33 3a eb 12 7d 76 91 3a a4 32 cc 84 82 21 91 ee c4 b3 0f 8e 0d 63 b2 8a af e9 18 76 cf e8 e9 19 53 41 3a b1 9b b4 9c af d7 7d ab 8f 68 83 e8 b4 78 eb fe 5e 67 ec 98 b9 d8 19 8c 27 d5 2b 36 e4 15 c9 d2 5f 93 fc 3e 69 f9 aa a0 3e c6 d4 3a 35 b0 6a 94 db 2c 21 97 95 fc fb 57 2b ee 2a 20 63 88 39 b2 4c 0f b8 92 be b9 46 2b 1a ca d8 30 9b 91 b4 d4 2d 8a b3 ba bf 39 Data Ascii: ]FSP[FTPnAyu^GX^j^p!71kH0VDZ^h9:8.<x)d2K~bO@Lqex3:}v:2!cvSA:}hx^g'+6_>i>:5j,!W+* c9LF+0-9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49759	104.17.25.14	443	5888	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-28 20:42:01 UTC	265	OUT	GET /ajax/libs/slick-carousel/1.8.0/slick.min.css HTTP/1.1 Accept: / Accept-Language: en-CH Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: cdnjs.cloudflare.com Connection: Keep-Alive
2024-08-28 20:42:01 UTC	935	IN	HTTP/1.1 200 OK Date: Wed, 28 Aug 2024 20:42:01 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03fd5-559" Last-Modified: Mon, 04 May 2020 16:16:21 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: MISS Expires: Mon, 18 Aug 2025 20:42:01 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6qX%2FNWPUDF8xqOUjmu2%2F64hvxOiSchWnpgaSQu8F0jmYhZlnU8OperJ2QT9BbQlEZvCWiitxM%2F5hreFd7FPiXx4o7O%2BcCBmFL6V5s%2FrpCxH1hrQ8sWFBPuY0VC0Z3NMkU0MHPxBa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8ba7201e79fa431b-EWR alt-svc: h3=":443"; ma=86400
2024-08-28 20:42:01 UTC	434	IN	Data Raw: 35 35 39 0d 0a 2e 73 6c 69 63 6b 2d 73 6c 69 64 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 2d 77 65 62 6b 69 74 2d 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 2d 6d 6f 7a 2d 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 2d 6d 73 2d 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 2d 77 65 62 6b 69 74 2d 74 6f 75 63 68 2d 63 61 6c 6c 6f 75 74 3a 6e 6f 6e 65 3b 2d 6b 68 74 6d 6c 2d 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 2d 6d 73 2d 74 6f 75 63 68 2d 61 63 74 69 6f 6e 3a 70 61 6e 2d 79 3b 74 6f 75 63 68 2d 61 63 74 69 6f 6e 3a 70 61 6e 2d 79 3b 2d 77 65 62 Data Ascii: 559.slick-slider{position:relative;display:block;box-sizing:border-box;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;-webkit-touch-callout:none;-khtml-user-select:none;-ms-touch-action:pan-y;touch-action:pan-y;-web
2024-08-28 20:42:01 UTC	942	IN	Data Raw: 63 75 72 73 6f 72 3a 68 61 6e 64 7d 2e 73 6c 69 63 6b 2d 73 6c 69 64 65 72 20 2e 73 6c 69 63 6b 2d 6c 69 73 74 2c 2e 73 6c 69 63 6b 2d 73 6c 69 64 65 72 20 2e 73 6c 69 63 6b 2d 74 72 61 63 6b 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 30 2c 30 2c 30 29 3b 2d 6d 6f 7a 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 30 2c 30 2c 30 29 3b 2d 6d 73 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 30 2c 30 2c 30 29 3b 2d 6f 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 30 2c 30 2c 30 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 30 2c 30 2c 30 29 7d 2e 73 6c 69 63 6b 2d 74 72 61 63 6b 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c Data Ascii: cursor:hand}.slick-slider .slick-list,.slick-slider .slick-track{-webkit-transform:translate3d(0,0,0);-moz-transform:translate3d(0,0,0);-ms-transform:translate3d(0,0,0);-o-transform:translate3d(0,0,0);transform:translate3d(0,0,0)}.slick-track{position:rel
2024-08-28 20:42:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	16:40:10
Start date:	28/08/2024
Path:	C:\Users\user\Desktop\ps11.0.0.129pro.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ps11.0.0.129pro.exe"
Imagebase:	0x400000
File size:	54'814'096 bytes
MD5 hash:	FC13BC8B09702EC0CA1A48F7E9157380
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:40:10
Start date:	28/08/2024
Path:	C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-HJDMM.tmp\ps11.0.0.129pro.tmp" /SL5="$20410,54471570,58368,C:\Users\user\Desktop\ps11.0.0.129pro.exe"
Imagebase:	0x400000
File size:	718'848 bytes
MD5 hash:	5ED68C2D50F4232A83D39C41722BC908
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:40:42
Start date:	28/08/2024
Path:	C:\Users\user\AppData\Local\Temp\is-K4N7C.tmp\_isetup\_setup64.tmp
Wow64 process (32bit):	false
Commandline:	helper 105 0x3E4
Imagebase:	0x140000000
File size:	6'144 bytes
MD5 hash:	E4211D6D009757C078A9FAC7FF4F03D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:40:42
Start date:	28/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:41:07
Start date:	28/08/2024
Path:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\PlanSwift11\PlanSwift.exe" /regserver
Imagebase:	0xf80000
File size:	15'557'072 bytes
MD5 hash:	B157207600DF34B69CA9AA91F1659383
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000007.00000002.2340509901.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000007.00000003.2256979397.0000000006320000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:41:17
Start date:	28/08/2024
Path:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\PlanSwift11\PlanSwift.exe" /init
Imagebase:	0xf80000
File size:	15'557'072 bytes
MD5 hash:	B157207600DF34B69CA9AA91F1659383
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000009.00000003.2357414981.00000000064B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000009.00000002.2432296214.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	16:41:30
Start date:	28/08/2024
Path:	C:\Program Files (x86)\PlanSwift11\PlanSwift.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\PlanSwift11\PlanSwift.exe" -o "Sample Plan"
Imagebase:	0xf80000
File size:	15'557'072 bytes
MD5 hash:	B157207600DF34B69CA9AA91F1659383
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000B.00000002.2917164884.0000000000F81000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000B.00000003.2587147896.0000000006290000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	16:41:47
Start date:	28/08/2024
Path:	C:\Windows\splwow64.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\splwow64.exe 12288
Imagebase:	0x7ff72c7b0000
File size:	163'840 bytes
MD5 hash:	77DE7761B037061C7C112FD3C5B91E73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	23.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8%
Total number of Nodes:	1560
Total number of Limit Nodes:	21

Executed Functions

Function 00404654 Relevance: 43.9, APIs: 7, Strings: 18, Instructions: 182
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00404911,?,?,?,?,00000000,?,0040AAF0), ref: 0040466F
GetVersion.KERNEL32(kernel32.dll,00000000,00404911,?,?,?,?,00000000,?,0040AAF0), ref: 00404676
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0040468B
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 004046B3
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 004048D8
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 004048EE
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,kernel32.dll,00000000,00404911,?,?,?,?,00000000,?,0040AAF0), ref: 004048F9

Strings

version.dll, xrefs: 00404834
propsys.dll, xrefs: 004047A8
SetDllDirectoryW, xrefs: 004046AD
SetSearchPathMode, xrefs: 004048D2
clbcatq.dll, xrefs: 0040489D
ntmarta.dll, xrefs: 004048C0
userenv.dll, xrefs: 0040473F
kernel32.dll, xrefs: 0040466A
SetProcessDEPPolicy, xrefs: 004048E8
profapi.dll, xrefs: 00404857
oleacc.dll, xrefs: 00404811
setupapi.dll, xrefs: 00404762
dwmapi.dll, xrefs: 004047CB
cryptbase.dll, xrefs: 004047EE
apphelp.dll, xrefs: 00404785
uxtheme.dll, xrefs: 0040471C
SetDefaultDllDirectories, xrefs: 00404685
comres.dll, xrefs: 0040487A

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcessVersion
String ID: SetDefaultDllDirectories$SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$apphelp.dll$clbcatq.dll$comres.dll$cryptbase.dll$dwmapi.dll$kernel32.dll$ntmarta.dll$oleacc.dll$profapi.dll$propsys.dll$setupapi.dll$userenv.dll$uxtheme.dll$version.dll
API String ID: 3297890031-1119018034
Opcode ID: cc6ab64b48d02d140d73cec505fdc132eff82ff6553fc21a046d343f04ece132
Instruction ID: 8135fb14ee81180893b1f543c3a29e932c16cf19254b5bff3906bd7e71ea8aa3
Opcode Fuzzy Hash: cc6ab64b48d02d140d73cec505fdc132eff82ff6553fc21a046d343f04ece132
Instruction Fuzzy Hash: 9D611270600159AFDB00FBF6DA8398E77A89F80305B2045BBA604772D6D778EF059B5D

Function 0040A050 Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 0040A062
VirtualQuery.KERNEL32(00400000,?,0000001C,?), ref: 0040A06D
VirtualProtect.KERNEL32(?,?,00000040,?,00400000,?,0000001C,?), ref: 0040A0AE
VirtualProtect.KERNEL32(?,?,?,?,?,?,00000040,?,00400000,?,0000001C,?), ref: 0040A0E0
VirtualQuery.KERNEL32(?,?,0000001C,00400000,?,0000001C,?), ref: 0040A0F0

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: Virtual$ProtectQuery$InfoSystem
String ID:
API String ID: 2441996862-0
Opcode ID: e53a58f787b0994d942b1301a25b776e5790cc469dae4f0c0141b44a09a1105d
Instruction ID: d22f8a83843956dcd0f1bd3c30f31cd8ee5be065fb893754064b45e2edc0d12d
Opcode Fuzzy Hash: e53a58f787b0994d942b1301a25b776e5790cc469dae4f0c0141b44a09a1105d
Instruction Fuzzy Hash: 8921AEB12003086BD630DE998D85E6BB3D8DF85354F04483AF685E33C2D77DE864966A

Function 00405694 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040D4C0,00000001,?,0040575F,?,00000000,0040583E), ref: 004056B2

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 1c8cef5e7bc5498290c3f938cca84698e8f49793df951a569bfd97285a3601f8
Instruction ID: 16534491fad4532095b25154bcfa4eb159586e841354a195c3175f568a425c49
Opcode Fuzzy Hash: 1c8cef5e7bc5498290c3f938cca84698e8f49793df951a569bfd97285a3601f8
Instruction Fuzzy Hash: 4DE0D87170021827D710A9699C86EFB725CE758310F4006BFB908E73C2EDB59E8046ED

Function 0040AF8D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32 ref: 0040AF99

Part of subcall function 00409B20: GetLastError.KERNEL32(00000000,00409BC3,?,0040C244,?,020E1C7C), ref: 00409B44

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040AFD6
SetWindowLongA.USER32(00020410,000000FC,00409E38), ref: 0040AFED
RemoveDirectoryA.KERNEL32(00000000,0040B12C,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040B0D9
DestroyWindow.USER32(00020410,0040B12C,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040B0ED

Strings

STATIC, xrefs: 0040AFCF
InnoSetupLdrWindow, xrefs: 0040AFCA
/SL5="$%x,%d,%d,, xrefs: 0040B02D

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: Window$ErrorLast$CreateDestroyDirectoryLongRemove
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3757039580-3001827809
Opcode ID: 779aa3cc042d1ecda5eecd5a957243857221684a4f0e841bdcf92309e10b5571
Instruction ID: e11106d591c480187276ddc099787e7d0131364ad6526c401ab361da32b03a0a
Opcode Fuzzy Hash: 779aa3cc042d1ecda5eecd5a957243857221684a4f0e841bdcf92309e10b5571
Instruction Fuzzy Hash: AB412F70E006049BD711EBE9EE86B6937A4EB58304F10417BF114BB2E2C7B89C05CB9D

Function 00409558 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 56
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00409616,?,?,?,?,00000000,00000000,?,0040AB04), ref: 0040957A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00409580
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00409616,?,?,?,?,00000000,00000000,?,0040AB04), ref: 00409594
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040959A

Strings

Wow64RevertWow64FsRedirection, xrefs: 0040958A
Wow64DisableWow64FsRedirection, xrefs: 00409570
kernel32.dll, xrefs: 00409575, 0040958F
shell32.dll, xrefs: 004095D7

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: a877c76c9fc41a234e825ecf500836d7dc2a3ebdee614a9ba8f5c15843239161
Instruction ID: a26a6a73124c26f393fcd3150f7a0ae21a729c0721f3e308dc05a8b68c4216e4
Opcode Fuzzy Hash: a877c76c9fc41a234e825ecf500836d7dc2a3ebdee614a9ba8f5c15843239161
Instruction Fuzzy Hash: AD119170908244BEDB00FBA6CD02B497BA8DB85704F20447BB500762D3CA7D5D08DA2D

Function 0040AF7A Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040AFD6
SetWindowLongA.USER32(00020410,000000FC,00409E38), ref: 0040AFED

Part of subcall function 00407004: GetCommandLineA.KERNEL32(00000000,00407048,?,?,?,?,00000000,?,0040B05E,?), ref: 0040701C

Part of subcall function 00409EC4: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409FBC,020E1C7C,00409FB0,00000000,00409F97), ref: 00409F34
Part of subcall function 00409EC4: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409FBC,020E1C7C,00409FB0,00000000), ref: 00409F48
Part of subcall function 00409EC4: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409F61
Part of subcall function 00409EC4: GetExitCodeProcess.KERNEL32(?,0040C244), ref: 00409F73
Part of subcall function 00409EC4: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409FBC,020E1C7C,00409FB0), ref: 00409F7C

RemoveDirectoryA.KERNEL32(00000000,0040B12C,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040B0D9
DestroyWindow.USER32(00020410,0040B12C,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040B0ED

Strings

STATIC, xrefs: 0040AFCF
InnoSetupLdrWindow, xrefs: 0040AFCA
/SL5="$%x,%d,%d,, xrefs: 0040B02D

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: Window$CloseCreateHandleProcess$CodeCommandDestroyDirectoryExitLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3586484885-3001827809
Opcode ID: 2e3aa86d138e90c5b86658206792da66739f20ef7896738f1a5b938c9a18691c
Instruction ID: 2c50bf805cbcaae07aef26e9318175051bf4a01897437c95b2245b611fc910e4
Opcode Fuzzy Hash: 2e3aa86d138e90c5b86658206792da66739f20ef7896738f1a5b938c9a18691c
Instruction Fuzzy Hash: A6413B71A106049FD710EBE9EE96B6937E4EB58304F10427AF514BB2E1D7B89C04CB9C

Function 00409EC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409FBC,020E1C7C,00409FB0,00000000,00409F97), ref: 00409F34
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409FBC,020E1C7C,00409FB0,00000000), ref: 00409F48
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409F61
GetExitCodeProcess.KERNEL32(?,0040C244), ref: 00409F73
CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409FBC,020E1C7C,00409FB0), ref: 00409F7C

Part of subcall function 00409B20: GetLastError.KERNEL32(00000000,00409BC3,?,0040C244,?,020E1C7C), ref: 00409B44

Strings

D, xrefs: 00409F0E

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
String ID: D
API String ID: 3356880605-2746444292
Opcode ID: 38633e948b603c813f450b03e218898c53e69348259ca8204e0d5802e89edcbc
Instruction ID: 5612ed86ad08d4bddb5d15266d7073179e0372755be9feb1331a68d3317c9ad6
Opcode Fuzzy Hash: 38633e948b603c813f450b03e218898c53e69348259ca8204e0d5802e89edcbc
Instruction Fuzzy Hash: 57114FB16442096EDB00EBE6CC52F9FB7ACEF49718F50007BB604F72C6DA789D048669

Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.KERNEL32(0040D41C,00000000,00401AB4), ref: 00401A09
LocalFree.KERNEL32(00000000,00000000,00401AB4), ref: 00401A1B
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A3A
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A79
RtlLeaveCriticalSection.KERNEL32(0040D41C,00401ABB), ref: 00401AA4
RtlDeleteCriticalSection.KERNEL32(0040D41C,00401ABB), ref: 00401AAE

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 15ada844baba389fd7ade49cb76aeb00e47773f80fc89bec03b8d509a4e9cc02
Instruction ID: 2a1e8c518b16d72ac75c21d19d034316e64e92064156904d4596c6339aa50fda
Opcode Fuzzy Hash: 15ada844baba389fd7ade49cb76aeb00e47773f80fc89bec03b8d509a4e9cc02
Instruction Fuzzy Hash: 65114274B422805ADB11EBE99EC6F5276689785708F44407FF448B62F2C67CA848CB6D

Function 00403D02 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00403D9D
ExitProcess.KERNEL32 ref: 00403DE5

Strings

Error, xrefs: 00403D91
Runtime error at 00000000, xrefs: 00403D96, 00403DA9

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 06c1af3a807ed13e53e556f1551eab319716f56e5b0a099a7904d38b73613604
Instruction ID: 19c161ad1fd1f445befe0ff666437f64548d8e35ccd3b0abec794ae5707e41c3
Opcode Fuzzy Hash: 06c1af3a807ed13e53e556f1551eab319716f56e5b0a099a7904d38b73613604
Instruction Fuzzy Hash: 0421C834E152418AE714EFE59A817153E989B5930DF04817BD504B73E3C67C9A4EC36E

Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitializeCriticalSection.KERNEL32(0040D41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
RtlEnterCriticalSection.KERNEL32(0040D41C,0040D41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
LocalAlloc.KERNEL32(00000000,00000FF8,0040D41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
RtlLeaveCriticalSection.KERNEL32(0040D41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 8414f493d6facd55d67710fc415b07d88c3ef9d9c2abb5a5bebd487d02bb0f40
Instruction ID: ca3d82fa79822ebb621977d4c6345e30539334a4bf25a92a69ec079a2ec9ab95
Opcode Fuzzy Hash: 8414f493d6facd55d67710fc415b07d88c3ef9d9c2abb5a5bebd487d02bb0f40
Instruction Fuzzy Hash: F20192B4E442405EE715ABFA9A56B253BA4D789704F1080BFF044F72F2C67C6458C75D

Function 0040ACEC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 0040AD50

Strings

.tmp, xrefs: 0040AD96
xz@, xrefs: 0040AE04

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: Message
String ID: .tmp$xz@
API String ID: 2030045667-184514067
Opcode ID: 73bde8918a24a77bea396c0e21e9449f08e0d1092fa56e2cd179e8c652837428
Instruction ID: cd6e40cb12cf75a94289ddc930eeb34ae46a26edf5cb602d02798e23291f977e
Opcode Fuzzy Hash: 73bde8918a24a77bea396c0e21e9449f08e0d1092fa56e2cd179e8c652837428
Instruction Fuzzy Hash: B641C574B006009FD301EFA5DE92A6A77A5EB59704B10443BF800BB7E1CA79AC14CBAD

Function 0040AD07 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 0040AD50

Strings

.tmp, xrefs: 0040AD96
xz@, xrefs: 0040AE04

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: Message
String ID: .tmp$xz@
API String ID: 2030045667-184514067
Opcode ID: 245864c1a257ed0c967638b67db9bb329bbae4f50c3bb27b4eac2111c384816e
Instruction ID: 53719d66007282c5495c6098f99a266dc5e357c3cd51cf55fd0a3e0a4036c937
Opcode Fuzzy Hash: 245864c1a257ed0c967638b67db9bb329bbae4f50c3bb27b4eac2111c384816e
Instruction Fuzzy Hash: B441C974B006009FC701EFA5DE92A5A77A5EB59704B10443BF800BB3E1CBB9AC04CBAD

Function 00409808 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,004098F7,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040984E
GetLastError.KERNEL32(00000000,00000000,?,00000000,004098F7,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409857

Strings

.tmp, xrefs: 00409837

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 960547cf70513a17951bf964015fc0181e1b4ea2f4ac03f8a12b0497a0fc638c
Instruction ID: 99036c105fdce8595ace9a271e3c35a9b263f9a60d6b8e91bf220d2a738da6a3
Opcode Fuzzy Hash: 960547cf70513a17951bf964015fc0181e1b4ea2f4ac03f8a12b0497a0fc638c
Instruction Fuzzy Hash: 9F216775A10208ABDB00FFA5C8529DFB7B8EF84304F50457BE501B7382DA7C9E058BA9

Function 004099B0 Relevance: 5.0, APIs: 4, Instructions: 45
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,?,0000000D,?,0040B0C5,000000FA,00000032,0040B12C), ref: 004099CF
Sleep.KERNEL32(?,?,?,?,0000000D,?,0040B0C5,000000FA,00000032,0040B12C), ref: 004099DF
GetLastError.KERNEL32(?,?,?,0000000D,?,0040B0C5,000000FA,00000032,0040B12C), ref: 004099F2
GetLastError.KERNEL32(?,?,?,0000000D,?,0040B0C5,000000FA,00000032,0040B12C), ref: 004099FC

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: c7bd6a21121ddb9efccb4cc95de40b345340be1ee537211c691cca6293df28a9
Instruction ID: eb7512966d821cc35779f37d74516ce45850f6d6c39c5245c2e713911e3afcfa
Opcode Fuzzy Hash: c7bd6a21121ddb9efccb4cc95de40b345340be1ee537211c691cca6293df28a9
Instruction Fuzzy Hash: F9F0BBB27012986BCB24A5AE8C86A6FB348EAD1358710403FF504F7393D439DC0156A9

Function 00401FD4 Relevance: 3.1, APIs: 2, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.KERNEL32(0040D41C,00000000,00402148), ref: 00402017

Part of subcall function 00401918: RtlInitializeCriticalSection.KERNEL32(0040D41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
Part of subcall function 00401918: RtlEnterCriticalSection.KERNEL32(0040D41C,0040D41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
Part of subcall function 00401918: LocalAlloc.KERNEL32(00000000,00000FF8,0040D41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
Part of subcall function 00401918: RtlLeaveCriticalSection.KERNEL32(0040D41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
String ID:
API String ID: 296031713-0
Opcode ID: f63e8093b7c21695f3c5f0f727b66ad92d47f8bd02e6a7dbcfb51ec74dbfdd03
Instruction ID: 72c497f3d878e3d6a4a9583ee00a9bb41c235ef620702b970aaba137d6b92855
Opcode Fuzzy Hash: f63e8093b7c21695f3c5f0f727b66ad92d47f8bd02e6a7dbcfb51ec74dbfdd03
Instruction Fuzzy Hash: 2341C2B2E007019FD710CFA9DE8561A7BA0EB58314B15817BD549B73E1D378A849CB48

Function 00409470 Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,00000000,004094CD,?,0000000D,00000000), ref: 004094A7
GetLastError.KERNEL32(00000000,00000000,004094CD,?,0000000D,00000000), ref: 004094AF

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: c0db1d20fd31e541160b63e3497e325e130249f4291eb920d6e73b2757d25af2
Instruction ID: 3ecb5528e430a0dbfb16afca1391696119c8a93f01f942fa518b6202f59a1a87
Opcode Fuzzy Hash: c0db1d20fd31e541160b63e3497e325e130249f4291eb920d6e73b2757d25af2
Instruction Fuzzy Hash: BCF0C871A18608AFCB01DF759C4149DB3E8EB4831475045B7F814F36C3E6385E018598

Function 00407454 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 0040745E
LoadLibraryA.KERNEL32(00000000,00000000,004074A8,?,00000000,004074C6,?,00008000), ref: 0040748D

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: d48a79d8ee70c80f60c93aacfed67c0ad6e199761e735f170a71233113bd88e2
Instruction ID: a630936203178071a9ee71a4306d19d7bf0886e547c0eed2c6a3f5d1fd0b17c9
Opcode Fuzzy Hash: d48a79d8ee70c80f60c93aacfed67c0ad6e199761e735f170a71233113bd88e2
Instruction Fuzzy Hash: B9F08270A14704BEDB125F768C5282ABEACEB49B1475388B6F900A26D2E53C5820C569

Function 0040B127 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

RemoveDirectoryA.KERNEL32(00000000,0040B12C,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040B0D9
DestroyWindow.USER32(00020410,0040B12C,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040B0ED

Part of subcall function 004099B0: Sleep.KERNEL32(?,?,?,?,0000000D,?,0040B0C5,000000FA,00000032,0040B12C), ref: 004099CF
Part of subcall function 004099B0: GetLastError.KERNEL32(?,?,?,0000000D,?,0040B0C5,000000FA,00000032,0040B12C), ref: 004099F2
Part of subcall function 004099B0: GetLastError.KERNEL32(?,?,?,0000000D,?,0040B0C5,000000FA,00000032,0040B12C), ref: 004099FC

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: ErrorLast$DestroyDirectoryRemoveSleepWindow
String ID:
API String ID: 2192421792-0
Opcode ID: 749a3a76f0822e3b0378f1cfdf6566d6ecf3ce6e9571a6def38d7042e2bc1528
Instruction ID: c4257d42d2f8726f3081f51206accfa845b32ba07db0e0e129925ba9990b842b
Opcode Fuzzy Hash: 749a3a76f0822e3b0378f1cfdf6566d6ecf3ce6e9571a6def38d7042e2bc1528
Instruction Fuzzy Hash: D9F0E170A119009BD725EFA9EE9A72632E5E7A4305F04413AA104BF2F1C7BD9C48CA8D

Function 00407AE0 Relevance: 3.0, APIs: 2, Instructions: 30fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00407AF7
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00407B06

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 5c17caa541fddce76649cc04805944c392fc8533b1365d2e374aefba6a6f009b
Instruction ID: e6678645df70ceda1296de0698669a3f17118b423087409050d1bdfb176b5629
Opcode Fuzzy Hash: 5c17caa541fddce76649cc04805944c392fc8533b1365d2e374aefba6a6f009b
Instruction Fuzzy Hash: 33E092B17081106AEB20A65E9884F6767ECCBC5368F04457BF608DB286D678EC008377

Function 00407B20 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 00407B3F
GetLastError.KERNEL32(?,?,?,00000000), ref: 00407B47

Part of subcall function 00407940: GetLastError.KERNEL32(xz@,004079DE,?,?,020E03AC,?,0040AB73,00000001,00000000,00000002,00000000,0040B16A,?,00000000,0040B1A1), ref: 00407943

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 5d72a474d6866116df7c50e7d91214adeba9db5fc19ecb02cee2fd0cbf9ab777
Instruction ID: e41e806bfeb234626b87b501edff7cf6b7d3219fcc40cd55b05b53632260e4a9
Opcode Fuzzy Hash: 5d72a474d6866116df7c50e7d91214adeba9db5fc19ecb02cee2fd0cbf9ab777
Instruction Fuzzy Hash: BDE092767082005BD610E55EC881F9B33DCDFC5368F004137B658EB1D1DA75A8008366

Function 00407A78 Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 00407A8F
GetLastError.KERNEL32(?,00000000,?,00000001), ref: 00407A9B

Part of subcall function 00407940: GetLastError.KERNEL32(xz@,004079DE,?,?,020E03AC,?,0040AB73,00000001,00000000,00000002,00000000,0040B16A,?,00000000,0040B1A1), ref: 00407943

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 376b7221faa1d9c8226b04aa14be382687234a7c39477bd240d3c8d17531cd0a
Instruction ID: 5d7889b2766bb560f48239758183442fe2ff1acd2572488175a49b0c159bb46e
Opcode Fuzzy Hash: 376b7221faa1d9c8226b04aa14be382687234a7c39477bd240d3c8d17531cd0a
Instruction Fuzzy Hash: 57E04FB16002109FEB20EEB98981B5673D89F44364F048576E614DF2C6D378DC008B66

Function 00401430 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401739), ref: 0040145F
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401739), ref: 00401486

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: e3bf9ef34a83e5b8d51b462a41b7d68ce2248d991abf67c6f3f1ae437811ef8b
Instruction ID: 66c3474f10fe082fedccbde799efe3bb5b58ff080b56d2e089ed954f0af67306
Opcode Fuzzy Hash: e3bf9ef34a83e5b8d51b462a41b7d68ce2248d991abf67c6f3f1ae437811ef8b
Instruction Fuzzy Hash: DAF02772B0032017DB2069AA0CC1B536AC59F85B90F1540BBFA4CFF3F9D2B98C0442A9

Function 00407BD6 Relevance: 1.8, APIs: 1, Instructions: 279fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00407B93

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: dc8f9862481319be3bdbd5661d3fcc7de93382422b7ff2ce1cd8379c78404356
Instruction ID: 1ffe8940fb0bba7a1c466ab1a63027f62bf18732910125c6c2e91df4c90979d7
Opcode Fuzzy Hash: dc8f9862481319be3bdbd5661d3fcc7de93382422b7ff2ce1cd8379c78404356
Instruction Fuzzy Hash: 7351B12084E2910FDB125B7459A85A13FA1FF5331532A52FBC4D2AB1E3D27CA847835F

Function 00405708 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,0040583E), ref: 00405727

Part of subcall function 00405164: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00405181

Part of subcall function 00405694: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040D4C0,00000001,?,0040575F,?,00000000,0040583E), ref: 004056B2

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: 9ba8296990a72112227324fa3ee9fcc0b1e9336ed56d3b895413b02212f8560e
Instruction ID: c7d7bdc64998b5a50f072f8a8ba779086e7d05f386a85bc6535a333606642bb6
Opcode Fuzzy Hash: 9ba8296990a72112227324fa3ee9fcc0b1e9336ed56d3b895413b02212f8560e
Instruction Fuzzy Hash: 05315075E00509ABCF00DF95C8819EEB379FF84304F548977E815BB285E739AE068B94

Function 00407A2A Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00407A6C

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d70932e6098281890bada4fb0cb49f00060c997d215399a4c6e17c77cbc25981
Instruction ID: 042ae40820150c0b4851109f40d588701a9899a67d40570aa5757512981d293a
Opcode Fuzzy Hash: d70932e6098281890bada4fb0cb49f00060c997d215399a4c6e17c77cbc25981
Instruction Fuzzy Hash: 6FE0ED753442586EE340DAED6D81FA677DC974A714F008132B998DB382D4719D118BA8

Function 00406E64 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00406EAC,?,?,?,?,00000000,?,00406EC1,0040721B,00000000,00407260,?,?,?), ref: 00406E8F

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 24e4b9a91e1daf3bf67ed32386f94fc4a36e54d9486d967fbff76b5f6006ff24
Instruction ID: 7ab40f028fd3c5f14a353e55118c7c81c89abefc65ec3810316971f178424404
Opcode Fuzzy Hash: 24e4b9a91e1daf3bf67ed32386f94fc4a36e54d9486d967fbff76b5f6006ff24
Instruction Fuzzy Hash: 21E06D35204704BFD701EEA2DD52A5ABBACDB89B04BA24476F501A6682D6796E1084A8

Function 00407A2C Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00407A6C

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9c11b2a4cf94016adbe46f41987ce67f399dd20175b5552a4b2bfc50b96cd780
Instruction ID: 8ced2eed2e357b00b36525f681a949bcf9e14530d7ff6951507f50c56b932d1f
Opcode Fuzzy Hash: 9c11b2a4cf94016adbe46f41987ce67f399dd20175b5552a4b2bfc50b96cd780
Instruction Fuzzy Hash: 95E0ED753442586EE240DAED6D81F96779C974A714F008122B998DB382D4719D118BA8

Function 00407B7C Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00407B93

Part of subcall function 00407940: GetLastError.KERNEL32(xz@,004079DE,?,?,020E03AC,?,0040AB73,00000001,00000000,00000002,00000000,0040B16A,?,00000000,0040B1A1), ref: 00407943

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: c995ec0617991e2e94a6585707192c72dfa586fe6c201feb7b9ef6767feef1e5
Instruction ID: 9cacba7c6654c632647ec303d4b17c56949909c1fcff6adca1bc3dcca5067dcb
Opcode Fuzzy Hash: c995ec0617991e2e94a6585707192c72dfa586fe6c201feb7b9ef6767feef1e5
Instruction Fuzzy Hash: 52E0ED726081106BEB10E65A9984E9777ECDFC5364F00407BB648DB241D578AC058676

Function 00407738 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,004095FB,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 00407757

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: ae2211e31bb54872ca0cc89886dd4699aa21f9c9d48a8aafd9a4e38039cc465e
Instruction ID: 444c138c93f6580368b8f7bf76726c6abc5f79d38e46f5c5344eab39dd4d6646
Opcode Fuzzy Hash: ae2211e31bb54872ca0cc89886dd4699aa21f9c9d48a8aafd9a4e38039cc465e
Instruction Fuzzy Hash: 20E0D8A1B8830126F62426144C87F77110E43C0740F60403A7B04EF3D2D6FEB909429F

Function 00407B60 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,0210AF98,0040AF31,00000000), ref: 00407B67

Part of subcall function 00407940: GetLastError.KERNEL32(xz@,004079DE,?,?,020E03AC,?,0040AB73,00000001,00000000,00000002,00000000,0040B16A,?,00000000,0040B1A1), ref: 00407943

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 1909adfb068d84a4c7c509a03c933fc32f464db51ef0452f103150ab7bc1f699
Instruction ID: 97af4fe43c66ae010506ec3d7cd84cb65660405db9abbaf149828d557edbb573
Opcode Fuzzy Hash: 1909adfb068d84a4c7c509a03c933fc32f464db51ef0452f103150ab7bc1f699
Instruction Fuzzy Hash: F3C04CB160410057DB00A6AE85C1E1672D85A4825830040B6B604DB257D678E8108719

Function 004074AF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,004074CD), ref: 004074C0

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: b2df83a3f7eadccbe6543f05c1e4b9f9d7ac47d1857bfd650161f3857d5c0035
Instruction ID: 2360f01ce0fe84dc83243c5f87e7f13f8f92df382308918f1fe84dd18a5cd7c9
Opcode Fuzzy Hash: b2df83a3f7eadccbe6543f05c1e4b9f9d7ac47d1857bfd650161f3857d5c0035
Instruction Fuzzy Hash: C8B09B76F1C2006DE705DAD5745153877D4D7C47103A14877F114D25C0D53C94108519

Function 004074CB Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,004074CD), ref: 004074C0

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: eeeb51977643a1c07891125f237145a2d5169de148269e7e0dcbc59e3a378873
Instruction ID: d86a438f0f99301b82867e6a10fbdb03c4267dfb17041a1f22e3924364c889c4
Opcode Fuzzy Hash: eeeb51977643a1c07891125f237145a2d5169de148269e7e0dcbc59e3a378873
Instruction Fuzzy Hash: 55A002A9D08104BACE10EAE58CD5A7D77A86A883047D048AA7215B2181C53DE911963B

Function 00406DF8 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,00406DF4,?,00406AD1,?,?,004095D4,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00409616), ref: 00406DFA

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 1f54fb0d7342efd56636b4bf43ce0ada456b4309ba7930a48c32b3046dc9142d
Instruction ID: 95ac89871b9e49aa2ffc5daef894b278f4bc9d8aafa7dca88aae54a0e9e7edad
Opcode Fuzzy Hash: 1f54fb0d7342efd56636b4bf43ce0ada456b4309ba7930a48c32b3046dc9142d
Instruction Fuzzy Hash:

Function 004083C4 Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00408454

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3554af80b116e35b21060cbbc6df44ef5282ed17f45008ec87b0ebbddb4e439e
Instruction ID: f6409c4485ca7bd338f5543af8cc2530bb3769743075a02b7f3240cefa60082b
Opcode Fuzzy Hash: 3554af80b116e35b21060cbbc6df44ef5282ed17f45008ec87b0ebbddb4e439e
Instruction Fuzzy Hash: 3E1181716006059BDB00EF69C981B4B7794EF84359F04847EF998AB2C6DF38DC058B6A

Function 00401658 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,0000000C,?,-00000008,00003FFB,004018BF), ref: 004016B2

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: ae0a35522eec5974c246f826a8cf4d5dbbbccf5172876aab042d95c32cb5ff07
Instruction ID: d2bd3e7102ef9204b91f8816383c595cec19663beeae75bd92b4ab4675e4226e
Opcode Fuzzy Hash: ae0a35522eec5974c246f826a8cf4d5dbbbccf5172876aab042d95c32cb5ff07
Instruction Fuzzy Hash: E401F772A042104BC310AF28DDC092A77D4DB84324F19497ED985B73A1D23B7C0587A8

Function 004079FC Relevance: 1.3, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00407A0C

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 066f784fd68329df4130f6e67c5a0e1de43b19e02d9a5afc60124be3f7097d47
Instruction ID: 317b5c03ede138d5cd26287ffab94a369f1a3233cb4abf22224d679caf67fd96
Opcode Fuzzy Hash: 066f784fd68329df4130f6e67c5a0e1de43b19e02d9a5afc60124be3f7097d47
Instruction Fuzzy Hash: 30D05E91B00A6007E215E6BE598864A92D85F88685B08847AF644E73D1D67CAD018389

Function 0040836C Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00408351), ref: 00408383

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: da78ddfa397c9e2cdf4956a2ea141b2947b48037f15e72f78cdce16bc7675b7a
Instruction ID: c3f7fe7f71c209b7548f3f70eea4568eea5cceda8148a565dbcaceff9471b988
Opcode Fuzzy Hash: da78ddfa397c9e2cdf4956a2ea141b2947b48037f15e72f78cdce16bc7675b7a
Instruction Fuzzy Hash: 9CD002B1755304AFDB90EEB94DC5B0237D87B48700F14457A6E44EB2C6E775D8108B14

Non-executed Functions

Function 00409920 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 0040992F
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00409935
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 0040994E
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 00409975
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 0040997A
ExitWindowsEx.USER32(00000002,00000000), ref: 0040998B

Strings

SeShutdownPrivilege, xrefs: 00409947

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 179ed9162b652ccf15c6d14b836035b236f42e51fdbed839cad4311b1fc8396b
Instruction ID: 69b49e6867c4070d7a8a5f136f8c55bc3de077f0d280c98028d7d6ae56364c3e
Opcode Fuzzy Hash: 179ed9162b652ccf15c6d14b836035b236f42e51fdbed839cad4311b1fc8396b
Instruction Fuzzy Hash: 21F062F068430275E610ABB68C07F6B61885BC0B48F50193EBA55F52C3D7BCD804866F

Function 0040A10C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00002B67,0000000A), ref: 0040A116
SizeofResource.KERNEL32(00000000,00000000,?,0040AB8B,00000000,0040B122,?,00000001,00000000,00000002,00000000,0040B16A,?,00000000,0040B1A1), ref: 0040A129
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,?,0040AB8B,00000000,0040B122,?,00000001,00000000,00000002,00000000,0040B16A,?,00000000), ref: 0040A13B
LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,0040AB8B,00000000,0040B122,?,00000001,00000000,00000002,00000000,0040B16A), ref: 0040A14C

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 6d1e58e0e179c15565de9e5b9098d59155bd11748cd142999f7bb8aa7b6e98b6
Instruction ID: 8b92cee28785ce20b64f8d9370ff96c2b68540d1e256e0df05e6767f26cc4d74
Opcode Fuzzy Hash: 6d1e58e0e179c15565de9e5b9098d59155bd11748cd142999f7bb8aa7b6e98b6
Instruction Fuzzy Hash: 10E07EE035830265EA103AFA0DC3B2A00484B6474DF05403FB700B92C7DDBCDC1591AE

Function 004056E0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004058E2,?,?,?,00000000,00405A94), ref: 004056F3

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: c7e217b6e51c096be6b931cb56113e619872b2713a6c7d1a918660c486d4d873
Instruction ID: d144edb85d9c502d4ea0939edf991ab5ce3f28f90927345f3a95d007e4e99129
Opcode Fuzzy Hash: c7e217b6e51c096be6b931cb56113e619872b2713a6c7d1a918660c486d4d873
Instruction Fuzzy Hash: DCD0A7AA31E250BAE310519B2D85EBB4BDCCBC57B4F14443FFA48D7242D2248C06A7B6

Function 004026C4 Relevance: 1.5, APIs: 1, Instructions: 20timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 004026CE

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: SystemTime
String ID:
API String ID: 2656138-0
Opcode ID: 9ed56ef6959dd8920af8b6d924cbc2bc4732ada3ba303b98172f22f33df6bd3d
Instruction ID: 8398a6df79db6557de4560d78939933842e781e1ed99b38cfbf2fd723ed8f470
Opcode Fuzzy Hash: 9ed56ef6959dd8920af8b6d924cbc2bc4732ada3ba303b98172f22f33df6bd3d
Instruction Fuzzy Hash: 3BE04F21E0010A42C704ABA5CD435FDF7AEAB95604F044172A418E92E0F631C252C748

Function 004088C0 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction ID: 3b27ac6c5e0f9a5810868b706c98a54019571903b6d877547466b603179570a7
Opcode Fuzzy Hash: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction Fuzzy Hash: 9E32D674E04219DFCB14CF99CA80A9DBBB2BF88314F24816AD855B7385DB34AE42CF55

Function 004074D8 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,004075DD,?,00000000,00409DF0), ref: 00407501
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00407507
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,004075DD,?,00000000,00409DF0), ref: 00407555

Strings

.DEFAULT\Control Panel\International, xrefs: 0040752C
Locale, xrefs: 00407544
kernel32.dll, xrefs: 004074FC
GetUserDefaultUILanguage, xrefs: 004074F7
Control Panel\Desktop\ResourceLocale, xrefs: 00407564

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 0178f007b2e9ce97110c2286f944ebc52b58938adea7bd75e582725685aec29c
Instruction ID: 86f2a6ba799f7653865fc0e2ce0ef1955b98c5cb30eb2cc475413799582f5e83
Opcode Fuzzy Hash: 0178f007b2e9ce97110c2286f944ebc52b58938adea7bd75e582725685aec29c
Instruction Fuzzy Hash: 27215570E48205BBDB00EAA5CC55BDF77A8AB44354F50887BA501F76C1DB7CBA04865E

Function 00403A97 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B1E
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B42
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B5E
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403B7F
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403BA8
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403BB2
GetStdHandle.KERNEL32(000000F5), ref: 00403BD2
GetFileType.KERNEL32(?,000000F5), ref: 00403BE9
CloseHandle.KERNEL32(?,?,000000F5), ref: 00403C04
GetLastError.KERNEL32(000000F5), ref: 00403C1E

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction ID: 6684f6b4d1923fa93cc5777a7ebe0ca766b8c5f16b1f456132d2f0a6dbb27d3d
Opcode Fuzzy Hash: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction Fuzzy Hash: 444194302042009EF7305F258805B237DEDEB4571AF208A3FA1D6BA6E1E77DAE419B5D

Function 0040584C Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00405A94,?,?,?,?,00000000,00000000,00000000,?,00406A73,00000000,00406A86), ref: 00405866

Part of subcall function 00405694: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040D4C0,00000001,?,0040575F,?,00000000,0040583E), ref: 004056B2

Part of subcall function 004056E0: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004058E2,?,?,?,00000000,00405A94), ref: 004056F3

Strings

:mm, xrefs: 00405A48
m/d/yy, xrefs: 00405935
mmmm d, yyyy, xrefs: 00405957
:mm:ss, xrefs: 00405A62
AMPM, xrefs: 00405A31

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 5a553179c7555abcfcf22225c6a629e87a34c3027ea7095babbe5e1ef45f2de3
Instruction ID: 6fbfddc16810fcf353c8d16d6476d0df8e1e1129542ac215d571de96c8bf2126
Opcode Fuzzy Hash: 5a553179c7555abcfcf22225c6a629e87a34c3027ea7095babbe5e1ef45f2de3
Instruction Fuzzy Hash: A8512034B005486BDB00EBA59891A8F7769DB98304F50D87BB505BB3C6DA3DDE098F5C

Function 004036B8 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 004036F2
SysAllocStringLen.OLEAUT32(?,00000000), ref: 004036FD
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403710
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0040371A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403729

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: a67f2483392f3a9295a6f421ec51b00ba0520a603cf3575c2b5e933881db78c1
Instruction ID: 1285967c487f36a4f1f77a8b8e1f1fe351824cacfdb80e5859a13ebcd08b75b2
Opcode Fuzzy Hash: a67f2483392f3a9295a6f421ec51b00ba0520a603cf3575c2b5e933881db78c1
Instruction Fuzzy Hash: 17F068A13442543AF56075A75C43FAB198CCB45BAEF10457FF704FA2C2D8B89D0492BD

Function 00403018 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

RtlUnwind.KERNEL32(?,0040303C,00000000,00000000), ref: 00403037

Strings

a@, xrefs: 00403070
,`@, xrefs: 0040304E

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: Unwind
String ID: a@$,`@
API String ID: 3419175465-3299659662
Opcode ID: 74c36dcaebc9beb569fc9a652e38c4b91acfc0ad3c1c730ca21132f2aeeaf1ad
Instruction ID: e18fd8dce0ff00c2f0e26d0eabb8ee8c5bb09bfe6675b42a72717897def5721e
Opcode Fuzzy Hash: 74c36dcaebc9beb569fc9a652e38c4b91acfc0ad3c1c730ca21132f2aeeaf1ad
Instruction Fuzzy Hash: 951182352042029BD724DE18CA89B2777B5AB44744F24C13AA404AB3DAC77CDC81A769

Function 0040A160 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,00000000,Setup,00000010), ref: 0040A195

Strings

The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will install... Do you wish to continue? prompt at the beginning of Setup./SILENT, /VERYSILENTInstructs Setup to be silent or very si, xrefs: 0040A179
Setup, xrefs: 0040A185

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: Message
String ID: Setup$The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will install... Do you wish to continue? prompt at the beginning of Setup./SILENT, /VERYSILENTInstructs Setup to be silent or very si
API String ID: 2030045667-3271211647
Opcode ID: 2fcb4469882f519d07bdc4c54c2b2bf709aeffd752a3b32377c5605777b8a92b
Instruction ID: 75c34cc78b7437cb0ca87fafc7654258806437370cb031ed823535619a0dd887
Opcode Fuzzy Hash: 2fcb4469882f519d07bdc4c54c2b2bf709aeffd752a3b32377c5605777b8a92b
Instruction Fuzzy Hash: 8BE0E5302043087EE301EA629C03F5A7BACE7CAB04F600477F900B55C1C6786E10842D

Function 004030DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,0040AAE6), ref: 004030E3
GetCommandLineA.KERNEL32(00000000,0040AAE6), ref: 004030EE

Strings

U1hd.@, xrefs: 00403103

Memory Dump Source

Source File: 00000000.00000002.2483781673.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2483735387.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483828052.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2483874200.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ps11.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: U1hd.@
API String ID: 2123368496-2904493091
Opcode ID: 4ac654993ecb6f0c10b1cacd39e13426f3fb1ace3b4aa0046ecf3c9b516135ec
Instruction ID: daea45a2aa12e23edc1a75ca5ccfa9dec32d0aab9986280789c112b27ba3568a
Opcode Fuzzy Hash: 4ac654993ecb6f0c10b1cacd39e13426f3fb1ace3b4aa0046ecf3c9b516135ec
Instruction Fuzzy Hash: 3AC0027894134055D764AFF69E497047594A74930DF40443FA20C7A1F1D67C460A6BDD

Analysis Process: ps11.0.0.129pro.tmpPID: 6252, Parent PID: 5316COMMON

Execution Graph

Execution Coverage:	17.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	91

Executed Functions

Function 00471FB0 Relevance: 78.0, APIs: 4, Strings: 40, Instructions: 961COMMON

Download Yara Rule

Strings

Existing file's SHA-1 hash matches our file. Skipping., xrefs: 004725BD
Skipping due to "onlyifdoesntexist" flag., xrefs: 004722D6
Dest file exists., xrefs: 004722C3
Version of our file: (none), xrefs: 00472404
InUn, xrefs: 00472A67
Time stamp of our file: (failed to read), xrefs: 004722AF
Version of existing file: (none), xrefs: 00472602
Failed to read existing file's SHA-1 hash. Proceeding., xrefs: 004725D8
Skipping due to "onlyifdestfileexists" flag., xrefs: 00472802
Version of our file: %u.%u.%u.%u, xrefs: 004723F8
Will register the file (a type library) later., xrefs: 00472E2A
Failed to strip read-only attribute., xrefs: 004727DB
Non-default bitness: 32-bit, xrefs: 004721C3
Incrementing shared file count (64-bit)., xrefs: 00472EA3
Dest file is protected by Windows File Protection., xrefs: 004721F5
Installing into GAC, xrefs: 00473022
Time stamp of existing file: %s, xrefs: 00472333
Same version. Skipping., xrefs: 004725ED
User opted not to overwrite the existing file. Skipping., xrefs: 00472755
Will register the file (a DLL/OCX) later., xrefs: 00472E36
@, xrefs: 004720B8
, xrefs: 004724D7, 004726A8, 00472726
Dest filename: %s, xrefs: 0047219C
Uninstaller requires administrator: %s, xrefs: 00472A97
Existing file is protected by Windows File Protection. Skipping., xrefs: 004726F4
-- File entry --, xrefs: 00472003
Same time stamp. Skipping., xrefs: 0047265D
Existing file's SHA-1 hash is different from our file. Proceeding., xrefs: 004725CC
Existing file is a newer version. Skipping., xrefs: 0047250A
Version of existing file: %u.%u.%u.%u, xrefs: 00472484
Existing file has a later time stamp. Skipping., xrefs: 004726D7
Time stamp of our file: %s, xrefs: 004722A3
Couldn't read time stamp. Skipping., xrefs: 0047263D
Non-default bitness: 64-bit, xrefs: 004721B7
Time stamp of existing file: (failed to read), xrefs: 0047233F
Stripped read-only attribute., xrefs: 004727CF
Installing the file., xrefs: 00472811
.tmp, xrefs: 004728BF
User opted not to strip the existing file's read-only attribute. Skipping., xrefs: 0047279E
Incrementing shared file count (32-bit)., xrefs: 00472EBC

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID:
String ID: $-- File entry --$.tmp$@$Couldn't read time stamp. Skipping.$Dest file exists.$Dest file is protected by Windows File Protection.$Dest filename: %s$Existing file has a later time stamp. Skipping.$Existing file is a newer version. Skipping.$Existing file is protected by Windows File Protection. Skipping.$Existing file's SHA-1 hash is different from our file. Proceeding.$Existing file's SHA-1 hash matches our file. Skipping.$Failed to read existing file's SHA-1 hash. Proceeding.$Failed to strip read-only attribute.$InUn$Incrementing shared file count (32-bit).$Incrementing shared file count (64-bit).$Installing into GAC$Installing the file.$Non-default bitness: 32-bit$Non-default bitness: 64-bit$Same time stamp. Skipping.$Same version. Skipping.$Skipping due to "onlyifdestfileexists" flag.$Skipping due to "onlyifdoesntexist" flag.$Stripped read-only attribute.$Time stamp of existing file: %s$Time stamp of existing file: (failed to read)$Time stamp of our file: %s$Time stamp of our file: (failed to read)$Uninstaller requires administrator: %s$User opted not to overwrite the existing file. Skipping.$User opted not to strip the existing file's read-only attribute. Skipping.$Version of existing file: %u.%u.%u.%u$Version of existing file: (none)$Version of our file: %u.%u.%u.%u$Version of our file: (none)$Will register the file (a DLL/OCX) later.$Will register the file (a type library) later.
API String ID: 0-4021121268
Opcode ID: 9b0317b4961dc6b7de6dda8672017abf8ba6ff50b7d201a794512797a2ab2110
Instruction ID: 0fbe08a8dfb669b68b74da88cae92a768434a9e08d12aa80b8890da3ef91b26a
Opcode Fuzzy Hash: 9b0317b4961dc6b7de6dda8672017abf8ba6ff50b7d201a794512797a2ab2110
Instruction Fuzzy Hash: D0927534A04288DFDB11DFA5C985BDDBBB0AF05305F1480ABE848BB392D7789E45DB19

Function 00458E58 Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 186
pipeprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00458EBF
QueryPerformanceCounter.KERNEL32(00000000,00000000,00459152,?,?,00000000,00000000,?,0045984E,?,00000000,00000000), ref: 00458EC8
GetSystemTimeAsFileTime.KERNEL32(00000000,00000000), ref: 00458ED2
GetCurrentProcessId.KERNEL32(?,00000000,00000000,00459152,?,?,00000000,00000000,?,0045984E,?,00000000,00000000), ref: 00458EDB
CreateNamedPipeA.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 00458F51
GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000,?,00000000,00000000), ref: 00458F5F
CreateFileA.KERNEL32(00000000,C0000000,00000000,0049CB28,00000003,00000000,00000000,00000000,0045910E), ref: 00458FA7
SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,004590FD,?,00000000,C0000000,00000000,0049CB28,00000003,00000000,00000000,00000000,0045910E), ref: 00458FE0

Part of subcall function 0042DD54: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD67

CreateProcessA.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 00459089
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 004590BF
CloseHandle.KERNEL32(000000FF,00459104,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 004590F7

Part of subcall function 00453C98: GetLastError.KERNEL32(00000000,0045482D,00000005,00000000,00454862,?,?,00000000,0049E62C,00000004,00000000,00000000,00000000,?,0049AFD9,00000000), ref: 00453C9B

Strings

CreateProcess, xrefs: 00459092
CreateFile, xrefs: 00458FB5
i, xrefs: 0045903C
\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x, xrefs: 00458F27
64-bit helper EXE wasn't extracted, xrefs: 00458EB3
CreateNamedPipe, xrefs: 00458F6F
SetNamedPipeHandleState, xrefs: 00458FE9
Cannot utilize 64-bit features on this version of Windows, xrefs: 00458EA0
Helper process PID: %u, xrefs: 004590DC
Starting 64-bit helper process., xrefs: 00458E8D
D, xrefs: 00459002
helper %d 0x%x, xrefs: 00459068

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
API String ID: 770386003-3271284199
Opcode ID: dff213d6845d1ce12187837163df3fed6713aae07842f8df309b9af4a5a76848
Instruction ID: 040c0b68ca5c8794fa0f134b015e2131507262e67e069d6a1689acc5a442bbd1
Opcode Fuzzy Hash: dff213d6845d1ce12187837163df3fed6713aae07842f8df309b9af4a5a76848
Instruction Fuzzy Hash: 9C710170A00754AEDB11DF65CC45B9EB7F8AB05705F1084AAF908FB282DB785944CF69

Function 0042E52C Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 178
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(0049C788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E566
GetVersion.KERNEL32(00000000,0042E710,?,0049C788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E583
GetModuleHandleA.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,0042E710,?,0049C788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E59C
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042E5A2
CheckTokenMembership.KERNELBASE(00000000,00000000,?,00000000,0042E710,?,0049C788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E5B7
FreeSid.ADVAPI32(00000000,0042E717,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E70A

Strings

CheckTokenMembership, xrefs: 0042E592
advapi32.dll, xrefs: 0042E597

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressAllocateCheckFreeHandleInitializeMembershipModuleProcTokenVersion
String ID: CheckTokenMembership$advapi32.dll
API String ID: 2252812187-1888249752
Opcode ID: 57ec89755551ae7df788eaa3907230e1190ab4f5e850f826cba690bdd8673667
Instruction ID: bd7b6b299922f244852f5898a9d4d4a5ef1c154b8f3e5ea1adaf5ad24a825e41
Opcode Fuzzy Hash: 57ec89755551ae7df788eaa3907230e1190ab4f5e850f826cba690bdd8673667
Instruction Fuzzy Hash: 36519471B44315AEEB11EAE69C42B7F77ACDB19304F94047BB500EB282D57CDD048B69

Function 00450A28 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 76
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,00450B45,?,?,?,?,00000000,00000000,?,00482BE3), ref: 00450A53

Part of subcall function 004509F8: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00450A10

LoadLibraryA.KERNEL32(00000000,00000000,00450B45,?,?,?,?,00000000,00000000,?,00482BE3), ref: 00450A8F
GetProcAddress.KERNEL32(00000000,RmStartSession), ref: 00450AAD
GetProcAddress.KERNEL32(00000000,RmRegisterResources), ref: 00450AC2
GetProcAddress.KERNEL32(00000000,RmGetList), ref: 00450AD7
GetProcAddress.KERNEL32(00000000,RmShutdown), ref: 00450AEC
GetProcAddress.KERNEL32(00000000,RmRestart), ref: 00450B01
GetProcAddress.KERNEL32(00000000,RmEndSession), ref: 00450B16

Strings

RmEndSession, xrefs: 00450B0B
Rstrtmgr.dll, xrefs: 00450A7C
RmStartSession, xrefs: 00450AA2
RmRestart, xrefs: 00450AF6
RmRegisterResources, xrefs: 00450AB7
RmGetList, xrefs: 00450ACC
RmShutdown, xrefs: 00450AE1

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystemVersion
String ID: RmEndSession$RmGetList$RmRegisterResources$RmRestart$RmShutdown$RmStartSession$Rstrtmgr.dll
API String ID: 2754715182-3419246398
Opcode ID: 46c12f4daf4fbae7617cd256ec2e540cfc6f6583c1cc6e75a445f22d907e8a5e
Instruction ID: 2841e6775defb51719e30d1654eee8915289afef741f041a49b247766738df14
Opcode Fuzzy Hash: 46c12f4daf4fbae7617cd256ec2e540cfc6f6583c1cc6e75a445f22d907e8a5e
Instruction Fuzzy Hash: 8F212EB4510204BFE710FBE2DC86B6E77E8E714759F540537B840A71A2E678A949CB1C

Function 0042409C Relevance: 21.4, APIs: 14, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f016360d3842955404ef56acd92bc9e70efad84fb0465ee387b729ec647d9a1
Instruction ID: 825bfe9503c2e42b9fb69ea357955289e6132b3f8b751ff356745ab72a8b0ef1
Opcode Fuzzy Hash: 2f016360d3842955404ef56acd92bc9e70efad84fb0465ee387b729ec647d9a1
Instruction Fuzzy Hash: F0E18C34700124EFD710DB69E585A5EB7B4FB88304FA440A6FA85EB356C738EE81DB19

Function 00422CEC Relevance: 18.3, APIs: 12, Instructions: 255windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000223,00000000,00000000), ref: 00422E84
ShowWindow.USER32(00000000,00000003,00000000,00000223,00000000,00000000,00000000,0042304E), ref: 00422E94

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: MessageSendShowWindow
String ID:
API String ID: 1631623395-0
Opcode ID: b94703348a3744cdd13f5dbc203efc1315d5245cad15e99a247d5aa95f1a9098
Instruction ID: 26a98208f56e96a8b9863cf96f01cb8393c818091eec428a2aa80c5483449fd4
Opcode Fuzzy Hash: b94703348a3744cdd13f5dbc203efc1315d5245cad15e99a247d5aa95f1a9098
Instruction Fuzzy Hash: 82915270B04254EFD711DFA9DA86F9E77F4AB04304F5600BAF504AB392C779AE40AB58

Function 004688B8 Relevance: 15.7, APIs: 4, Strings: 4, Instructions: 1679windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004986A0: MulDiv.KERNEL32(?,?,00000006), ref: 00498717
Part of subcall function 004986A0: MulDiv.KERNEL32(?,?,0000000D), ref: 0049872C

Part of subcall function 004984E8: GetWindowRect.USER32(00000000), ref: 004984FE

LoadBitmapA.USER32(00400000,STOPIMAGE), ref: 00468CC8

Part of subcall function 00467FCC: KiUserCallbackDispatcher.NTDLL(?,?,?,?,00468D7C,00000000,00000000,00000000,0000000C,00000000,00000000,0046A02D), ref: 00467FE4

Part of subcall function 00414A8C: KiUserCallbackDispatcher.NTDLL(?,?,?,?,004207B4,?,00000000,?,?,00420664,?,?,00000000,?,004983C8,?), ref: 00414AA1

Part of subcall function 0049876C: MulDiv.KERNEL32(0000000D,?,0000000D), ref: 00498776

Part of subcall function 0042F1C8: GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042F224
Part of subcall function 0042F1C8: SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042F241

Part of subcall function 00498438: GetDC.USER32(00000000), ref: 0049845A
Part of subcall function 00498438: SelectObject.GDI32(?,00000000), ref: 00498480
Part of subcall function 00498438: ReleaseDC.USER32(00000000,?), ref: 004984D1

Part of subcall function 0049875C: MulDiv.KERNEL32(0000004B,?,00000006), ref: 00498766

GetSystemMenu.USER32(00000000,00000000,0000000C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?,?,00000000,?), ref: 0046996B
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 0046997C
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 00469994

Strings

SGH, xrefs: 00468BC3, 00468BD7
STOPIMAGE, xrefs: 00468CBD
, xrefs: 00468D89
(Default), xrefs: 00469F7D

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Menu$AppendCallbackDispatcherUser$AddressAutoBitmapCompleteLoadObjectProcRectReleaseSelectSystemWindow
String ID: $(Default)$SGH$STOPIMAGE
API String ID: 2840318529-2873020421
Opcode ID: 598874c6b1f2f0206bb0ba6e06ba2f4bdcd1531042266678baf7be50294a009e
Instruction ID: d49526af9a03aae3e552daa5a29a50732b243f9195a71988a3f372d3fafe4f82
Opcode Fuzzy Hash: 598874c6b1f2f0206bb0ba6e06ba2f4bdcd1531042266678baf7be50294a009e
Instruction Fuzzy Hash: 62F2D7386005148FCB00EB69D8D5F9977F5BF89304F1542F6E5089B36AD778AC4ACB4A

Function 0045663C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetDiskFreeSpaceExA,00000000,0045677B), ref: 0045666C
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00456672
GetDiskFreeSpaceExA.KERNELBASE(00000000,?,?,00000000,00000000,00456759,?,00000000,kernel32.dll,GetDiskFreeSpaceExA,00000000,0045677B), ref: 004566C8

Strings

kernel32.dll, xrefs: 00456667
GetDiskFreeSpaceExA, xrefs: 00456662

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressDiskFreeHandleModuleProcSpace
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1197914913-3712701948
Opcode ID: 9ae04e6e6f2b5b6cbe301462148d0f0cdba75de31720b50319e7771419bca8cd
Instruction ID: b3c638b06f07771193fa82c07f29861e578aec67d60b7d75356f70af58752f0b
Opcode Fuzzy Hash: 9ae04e6e6f2b5b6cbe301462148d0f0cdba75de31720b50319e7771419bca8cd
Instruction Fuzzy Hash: 84418271A00249AFCF01EFA5C8829EEB7B8EF4C305F51456AF804F7252D6785E098B68

Function 00476DFC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00476F66,?,?,0049F1E4,00000000), ref: 00476E55
FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,00476F66,?,?,0049F1E4,00000000), ref: 00476F32
FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,00476F66,?,?,0049F1E4,00000000), ref: 00476F40

Strings

unins, xrefs: 00476EA8
unins???.*, xrefs: 00476E3F

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: unins$unins???.*
API String ID: 3541575487-1009660736
Opcode ID: 0ca8668b9591b8cdad9a3ed13bcc90246d534be7d28ea552e6b49d4cba737eaa
Instruction ID: 06b31390bd8adb060a56858260c59005c9fe75b120fc3b84233d96653cdead55
Opcode Fuzzy Hash: 0ca8668b9591b8cdad9a3ed13bcc90246d534be7d28ea552e6b49d4cba737eaa
Instruction Fuzzy Hash: 3A313070600508AFCB10EF65D981ADEBBA9DB45318F5184B6F808A76A6DB38DF418F58

Function 00453238 Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,0045329B,?,?,-00000001,00000000), ref: 00453275
GetLastError.KERNEL32(00000000,?,00000000,0045329B,?,?,-00000001,00000000), ref: 0045327D

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: dbef2df41a14447db331cc17e1515e02d4012ff1045ce1d21f964eeeeb9dde4a
Instruction ID: 01611b9c15ef78b160da910fd5818d9ac2674b067f1b6166a22c9a12ef003207
Opcode Fuzzy Hash: dbef2df41a14447db331cc17e1515e02d4012ff1045ce1d21f964eeeeb9dde4a
Instruction Fuzzy Hash: CAF02D72A04704AB8B10DF76AC0149EF7BCEB8637672046BBFC14E3692DB794F058558

Function 004089F8 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049E4C4,00000001,?,00408AC3,?,00000000,00408BA2), ref: 00408A16

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 6517a6df1027816fea4addc753f432335232e8d46b8be6dc802d5a2abbf08fa6
Instruction ID: 256e1aeba2a9af0ec73989512e647111dc5dc60b4a8a7c740aeb84942aea65fa
Opcode Fuzzy Hash: 6517a6df1027816fea4addc753f432335232e8d46b8be6dc802d5a2abbf08fa6
Instruction Fuzzy Hash: 61E0683170021457C311A91A8C82AFBB34CDB18354F40427FBD44E73C2EDB89E4146EC

Function 00424014 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,?,004245E1,?,00000000,004245EC), ref: 0042403E

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 3c6509642d3bb9f27e5e83e23d7c94f2c76b3e04732c449b11ab7c6176b5423f
Instruction ID: 62037174fb3a4e63d39f4d80a9d1e591ad15120c94b51c82d4663250cb3dbf53
Opcode Fuzzy Hash: 3c6509642d3bb9f27e5e83e23d7c94f2c76b3e04732c449b11ab7c6176b5423f
Instruction Fuzzy Hash: A0F0C579205608AFCB40DF9DC588D4AFBE8FB4C260B158295B988CB321C234FE808F94

Function 00455DCC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?), ref: 00455DE2

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 065d5d2aa7b724ed6289c5adcb70c30f8e9a1dde2e28f2192dd81213443c68fe
Instruction ID: 85d927fa64bde7e0f6bd0e56391a747b52e91616c2131cbf33e1fd207173554c
Opcode Fuzzy Hash: 065d5d2aa7b724ed6289c5adcb70c30f8e9a1dde2e28f2192dd81213443c68fe
Instruction Fuzzy Hash: 91D0C2B230460063C700BA68DC825AA358D8B84305F00483E7CC5DA2C3EABDDA4C5696

Function 00470798 Relevance: 75.8, APIs: 1, Strings: 42, Instructions: 512
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00470584: RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,?,?,0049F1E4,?,0047089B,?,00000000,00470E5A,?,_is1), ref: 004705A7

RegCloseKey.ADVAPI32(?,00470E61,?,_is1,?,Software\Microsoft\Windows\CurrentVersion\Uninstall\,00000000,00470EAC,?,?,0049F1E4,00000000), ref: 00470E54

Strings

Inno Setup: Icon Group, xrefs: 004708ED
Inno Setup: Selected Components, xrefs: 00470968
" /SILENT, xrefs: 00470B1A
QuietUninstallString, xrefs: 00470B27
Inno Setup: User Info: Name, xrefs: 004709E6
Inno Setup: User, xrefs: 0047092A
DisplayIcon, xrefs: 00470AB3
Inno Setup: User Info: Serial, xrefs: 00470A10
Inno Setup: No Icons, xrefs: 0047090B
NoModify, xrefs: 00470C60
Inno Setup: Setup Type, xrefs: 00470949
MajorVersion, xrefs: 00470CBF
Publisher, xrefs: 00470B61
URLInfoAbout, xrefs: 00470B7E
InstallDate, xrefs: 00470C93
HelpTelephone, xrefs: 00470B9B
Contact, xrefs: 00470C0F
_is1, xrefs: 004707F4
MinorVersion, xrefs: 00470CD1
InstallLocation, xrefs: 004708DE
Inno Setup: Language, xrefs: 00470A37
Readme, xrefs: 00470BF2
HelpLink, xrefs: 00470BB8
Inno Setup: Setup Version, xrefs: 00470889
DisplayVersion, xrefs: 00470B44
URLUpdateInfo, xrefs: 00470BD5
Software\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 004707EE
Inno Setup: Selected Tasks, xrefs: 004709AF
DisplayName, xrefs: 00470A96
Inno Setup: User Info: Organization, xrefs: 004709FB
Inno Setup: Deselected Tasks, xrefs: 004709CE
UninstallString, xrefs: 00470AED
ModifyPath, xrefs: 00470C4C
VersionMajor, xrefs: 00470CE3
NoRepair, xrefs: 00470C74
Comments, xrefs: 00470C2C
EstimatedSize, xrefs: 00470DD1
5.6.0 (a), xrefs: 0047088E
Inno Setup: Deselected Components, xrefs: 00470987
VersionMinor, xrefs: 00470CF5
RegisterPreviousData, xrefs: 00470E0A
Inno Setup: App Path, xrefs: 004708BE

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CloseValue
String ID: " /SILENT$5.6.0 (a)$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$EstimatedSize$HelpLink$HelpTelephone$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: Language$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: Setup Version$Inno Setup: User$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$InstallDate$InstallLocation$MajorVersion$MinorVersion$ModifyPath$NoModify$NoRepair$Publisher$QuietUninstallString$Readme$RegisterPreviousData$Software\Microsoft\Windows\CurrentVersion\Uninstall\$URLInfoAbout$URLUpdateInfo$UninstallString$VersionMajor$VersionMinor$_is1
API String ID: 3132538880-3062487745
Opcode ID: 9f28b3b96a330183d4468730b8497a8bbac6966dd28d1051c105c4121a65aa52
Instruction ID: 68cffd019da3db90744331f4f1d0944faa52771372b45a2f1c00725d9431181f
Opcode Fuzzy Hash: 9f28b3b96a330183d4468730b8497a8bbac6966dd28d1051c105c4121a65aa52
Instruction Fuzzy Hash: BD123234A01148DBDB14EB55D881ADE73F5EB48304F60C5BBE808AB3A5DB78AE45CF58

Function 0049509C Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 431
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,00000000,00495591,?,?,?,?,00000000,00000000,00000000), ref: 004950DC
FindWindowA.USER32(00000000,00000000), ref: 0049510D

Strings

SENDMESSAGE, xrefs: 00495161
FINDWINDOWBYCLASSNAME, xrefs: 004950E9
CALLDLLPROC, xrefs: 00495401
POSTBROADCASTMESSAGE, xrefs: 004952F7
CHARTOOEMBUFF, xrefs: 00495532
REGISTERWINDOWMESSAGE, xrefs: 0049526F
SLEEP, xrefs: 004950C6
SENDBROADCASTMESSAGE, xrefs: 004952A9
FINDWINDOWBYWINDOWNAME, xrefs: 00495125
SENDBROADCASTNOTIFYMESSAGE, xrefs: 0049534B
OEMTOCHARBUFF, xrefs: 004954EF
LOADDLL, xrefs: 0049539F
SENDNOTIFYMESSAGE, xrefs: 00495213
CREATEMUTEX, xrefs: 004954BD
POSTMESSAGE, xrefs: 004951B7
FREEDLL, xrefs: 00495488

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: FindSleepWindow
String ID: CALLDLLPROC$CHARTOOEMBUFF$CREATEMUTEX$FINDWINDOWBYCLASSNAME$FINDWINDOWBYWINDOWNAME$FREEDLL$LOADDLL$OEMTOCHARBUFF$POSTBROADCASTMESSAGE$POSTMESSAGE$REGISTERWINDOWMESSAGE$SENDBROADCASTMESSAGE$SENDBROADCASTNOTIFYMESSAGE$SENDMESSAGE$SENDNOTIFYMESSAGE$SLEEP
API String ID: 3078808852-3310373309
Opcode ID: ee162352838cf05ce363ca1656fe0d9b55fc035dab91cd58ed32eabfb4a40949
Instruction ID: 6e39e5f40b4690e9c7fd1dd5a0e11dacbc15fd021feddc1ff3cdf3b48b19ae49
Opcode Fuzzy Hash: ee162352838cf05ce363ca1656fe0d9b55fc035dab91cd58ed32eabfb4a40949
Instruction Fuzzy Hash: 4AC16360B04A006BDB15BB3E8C4252F5E9A9B84714721D97FB406EB78BCE3CDC0A475D

Function 00475228 Relevance: 54.9, APIs: 9, Strings: 22, Instructions: 665
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegDeleteValueA.ADVAPI32(?,00000000,?,00000002,00000000,00000000,00475964,?,?,?,?,00000000,00475AC8,?,?,0049F1E4), ref: 00475462
RegCloseKey.ADVAPI32(?,?,00000000,?,00000002,00000000,00000000,00475964,?,?,?,?,00000000,00475AC8), ref: 0047546B
RegDeleteValueA.ADVAPI32(?,00000000,00000000,00475953,?,00000000,00475964,?,?,?,?,00000000,00475AC8,?,?,0049F1E4), ref: 004755E5

Part of subcall function 0042E2AC: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,c]H,?,00000001,?,?,00485D63,?,00000001,00000000), ref: 0042E2C8

Strings

Successfully deleted the value., xrefs: 00475470, 00475926
Successfully deleted the key., xrefs: 00475406
Creating or setting the value., xrefs: 0047561A
break, xrefs: 0047575F
-- Registry entry --, xrefs: 004752C4
Deleting the value., xrefs: 0047544B, 004755CE
Non-default bitness: 32-bit, xrefs: 00475355
Cannot access 64-bit registry keys on this version of Windows, xrefs: 00475375
olddata, xrefs: 004756F2, 00475751
Deleting the key., xrefs: 004753BC
Value name: %s, xrefs: 00475334
{olddata}, xrefs: 00475687, 0047571E
Creating or opening the key., xrefs: 004754BD
Non-default bitness: 64-bit, xrefs: 00475385
Key of value to delete does not exist., xrefs: 0047547F
Key: %s\%s, xrefs: 00475307
Key to delete is not deletable., xrefs: 004753E2
Successfully created or set the value., xrefs: 00475911
New key created, need to set permissions again., xrefs: 0047550F
Opening the key., xrefs: 00475559
Successfully created the key., xrefs: 00475932
Failed to parse "qword" value, xrefs: 0047587B

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: DeleteValue$CloseOpen
String ID: -- Registry entry --$Cannot access 64-bit registry keys on this version of Windows$Creating or opening the key.$Creating or setting the value.$Deleting the key.$Deleting the value.$Failed to parse "qword" value$Key of value to delete does not exist.$Key to delete is not deletable.$Key: %s\%s$New key created, need to set permissions again.$Non-default bitness: 32-bit$Non-default bitness: 64-bit$Opening the key.$Successfully created or set the value.$Successfully created the key.$Successfully deleted the key.$Successfully deleted the value.$Value name: %s$break$olddata${olddata}
API String ID: 1772201698-3420049442
Opcode ID: 83daf75b2a364c211437c07579e3f07e216eec802dd99a5cd3745e9f688f5946
Instruction ID: 61f0ae1151baec5157cfffb110c815512081f13f2c3a2807483165c9d979bbc8
Opcode Fuzzy Hash: 83daf75b2a364c211437c07579e3f07e216eec802dd99a5cd3745e9f688f5946
Instruction Fuzzy Hash: CC423F74A00648AFDB14DBA9C485BDEB7F5AF08304F44806AF908EF362DB789D45CB59

Function 004063FC Relevance: 43.9, APIs: 7, Strings: 18, Instructions: 182
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,004066B9,?,?,?,?,00000000,?,0049B7F4), ref: 00406417
GetVersion.KERNEL32(kernel32.dll,00000000,004066B9,?,?,?,?,00000000,?,0049B7F4), ref: 0040641E
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00406433
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040645B
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406680
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 00406696
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,kernel32.dll,00000000,004066B9,?,?,?,?,00000000,?,0049B7F4), ref: 004066A1

Strings

propsys.dll, xrefs: 00406550
SetDefaultDllDirectories, xrefs: 0040642D
uxtheme.dll, xrefs: 004064C4
SetDllDirectoryW, xrefs: 00406455
cryptbase.dll, xrefs: 00406596
oleacc.dll, xrefs: 004065B9
clbcatq.dll, xrefs: 00406645
profapi.dll, xrefs: 004065FF
ntmarta.dll, xrefs: 00406668
version.dll, xrefs: 004065DC
kernel32.dll, xrefs: 00406412
dwmapi.dll, xrefs: 00406573
setupapi.dll, xrefs: 0040650A
comres.dll, xrefs: 00406622
apphelp.dll, xrefs: 0040652D
userenv.dll, xrefs: 004064E7
SetSearchPathMode, xrefs: 0040667A
SetProcessDEPPolicy, xrefs: 00406690

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcessVersion
String ID: SetDefaultDllDirectories$SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$apphelp.dll$clbcatq.dll$comres.dll$cryptbase.dll$dwmapi.dll$kernel32.dll$ntmarta.dll$oleacc.dll$profapi.dll$propsys.dll$setupapi.dll$userenv.dll$uxtheme.dll$version.dll
API String ID: 3297890031-1119018034
Opcode ID: 2c56b33dd224f24940b22a135b2d6f6ee028c26b19cb0cb345135bf18bc139ab
Instruction ID: 7e21cf5f117f2e3abcec30b6674fd8076a5a40f26409e7412662737288cf0c05
Opcode Fuzzy Hash: 2c56b33dd224f24940b22a135b2d6f6ee028c26b19cb0cb345135bf18bc139ab
Instruction Fuzzy Hash: 5C612030A00009EBDB01FBAAD982D8D7BB89B45749B214077A405772F6DB3CEF199B5D

Function 00456E68 Relevance: 26.6, APIs: 4, Strings: 11, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

756FE550.OLE32(0049CA78,00000000,00000001,0049C774,?,00000000,00457213), ref: 00456EAE
756FE550.OLE32(0049C764,00000000,00000001,0049C774,?,00000000,00457213), ref: 00456ED4
SysFreeString.OLEAUT32(00000000), ref: 0045708B

Strings

%ProgramFiles(x86)%\, xrefs: 00456F5E
IShellLink::QueryInterface(IID_IPropertyStore), xrefs: 00456FED
{pf32}\, xrefs: 00456F4E
IPropertyStore::SetValue(PKEY_AppUserModel_ID), xrefs: 00457070
IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning), xrefs: 00457021
IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall), xrefs: 004570C2
IPropertyStore::SetValue(PKEY_AppUserModel_StartPinOption), xrefs: 004570FA
CoCreateInstance, xrefs: 00456EDF
IPropertyStore::Commit, xrefs: 00457113
IPersistFile::Save, xrefs: 00457192
IShellLink::QueryInterface(IID_IPersistFile), xrefs: 00457134

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: E550$FreeString
String ID: %ProgramFiles(x86)%\$CoCreateInstance$IPersistFile::Save$IPropertyStore::Commit$IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall)$IPropertyStore::SetValue(PKEY_AppUserModel_ID)$IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning)$IPropertyStore::SetValue(PKEY_AppUserModel_StartPinOption)$IShellLink::QueryInterface(IID_IPersistFile)$IShellLink::QueryInterface(IID_IPropertyStore)${pf32}\
API String ID: 491012016-2363233914
Opcode ID: 9ca0f2c698db80649945b9350dc905d6631d2159658ec078cc89ec2c96876d1f
Instruction ID: 154d62db614bf572cdce6365470ff325a9a7bc4b666e286c7839a5d1e04c42dc
Opcode Fuzzy Hash: 9ca0f2c698db80649945b9350dc905d6631d2159658ec078cc89ec2c96876d1f
Instruction Fuzzy Hash: 6DB13D71A04104AFDB10DFA9D885B9E7BF8AF09306F1440A6F804E7362DB78DD49CB69

Function 00485BEC Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 72
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00485BFD
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00485C0A
GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00485C18
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00485C20
GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 00485C2C
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 00485C4D
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 00485C60
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 00485C66
GetSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00485C7D

Strings

GetNativeSystemInfo, xrefs: 00485C04
GetSystemWow64DirectoryA, xrefs: 00485C47
kernel32.dll, xrefs: 00485BF8
advapi32.dll, xrefs: 00485C5B
RegDeleteKeyExA, xrefs: 00485C56
IsWow64Process, xrefs: 00485C1A

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressProc$HandleInfoModuleSystem$CurrentNativeProcess
String ID: GetNativeSystemInfo$GetSystemWow64DirectoryA$IsWow64Process$RegDeleteKeyExA$advapi32.dll$kernel32.dll
API String ID: 2230631259-2623177817
Opcode ID: cae30746f47e1356bc141dd5db5f8ee3c0f5864c67aa86814ed9369829535eff
Instruction ID: 4793b91b08f537c5c7133cebea58263f30cb4d2bfaaeaa8115caf1165de3eaa0
Opcode Fuzzy Hash: cae30746f47e1356bc141dd5db5f8ee3c0f5864c67aa86814ed9369829535eff
Instruction Fuzzy Hash: AD119695104F4199EE1173798D8A76F29888B11719F184C3B78847A3D3DABC8D85AF3F

Function 0046A2F8 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042E2AC: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,c]H,?,00000001,?,?,00485D63,?,00000001,00000000), ref: 0042E2C8

RegCloseKey.ADVAPI32(?,0046A512,?,?,00000001,00000000,00000000,0046A52D,?,00000000,00000000,?), ref: 0046A4FB

Strings

Inno Setup: Selected Tasks, xrefs: 0046A467
Inno Setup: Deselected Components, xrefs: 0046A43C
Inno Setup: Icon Group, xrefs: 0046A3D6
Inno Setup: User Info: Organization, xrefs: 0046A4CA
%s\%s_is1, xrefs: 0046A375
Inno Setup: User Info: Serial, xrefs: 0046A4DD
Inno Setup: Setup Type, xrefs: 0046A40A
Inno Setup: User Info: Name, xrefs: 0046A4B7
Inno Setup: Deselected Tasks, xrefs: 0046A489
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0046A357
Inno Setup: No Icons, xrefs: 0046A3E3
Inno Setup: App Path, xrefs: 0046A3BA
Inno Setup: Selected Components, xrefs: 0046A41A

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1093091907
Opcode ID: 91a4df7c5d363a74e74d07328859dcb79e5edcb39d64312ce7ac2d0fb52cf18e
Instruction ID: 007e6c1a4f1bc7f55b9d08a8faa4fb609cb6f153de700ca59babbad8c8de7ab2
Opcode Fuzzy Hash: 91a4df7c5d363a74e74d07328859dcb79e5edcb39d64312ce7ac2d0fb52cf18e
Instruction Fuzzy Hash: 6F519170600A049FCB11DB65D942BEEB7B4EF49304F5084BAE841B7391E738AE15CF5A

Function 004743C8 Relevance: 23.1, APIs: 4, Strings: 9, Instructions: 341
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042CC94: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042CCB8

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00474580
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 0047469B
SHChangeNotify.SHELL32(00000002,00000001,00000000,00000000), ref: 004746B1
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 004746D6

Strings

Dest filename: %s, xrefs: 00474522
Successfully created the icon., xrefs: 00474675
{group}\, xrefs: 00474422
target.lnk, xrefs: 00474720
.lnk, xrefs: 00474454
.pif, xrefs: 00474477, 00474615
.url, xrefs: 0047449A
Creating the icon., xrefs: 00474595
Desktop.ini, xrefs: 00474757

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ChangeNotify$FullNamePathPrivateProfileStringWrite
String ID: .lnk$.pif$.url$Creating the icon.$Desktop.ini$Dest filename: %s$Successfully created the icon.$target.lnk${group}\
API String ID: 971782779-2902529204
Opcode ID: 4f1fbef38a8fa56300ffdb0017b0dfe2dec0232dbceec9903187ddc4fb61924e
Instruction ID: 9e0bad664f62cb20c2b6c4b37cb3f6142eb007fcf494cb2f88b90ed4c3c34bf8
Opcode Fuzzy Hash: 4f1fbef38a8fa56300ffdb0017b0dfe2dec0232dbceec9903187ddc4fb61924e
Instruction Fuzzy Hash: 1CD13434A00149AFDB01EFA9D581BEDBBF4AF48304F50816AF904B7392D7789E45CB69

Function 0047E658 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042DD28: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,004545B0,00000000,00454862,?,?,00000000,0049E62C,00000004,00000000,00000000,00000000,?,0049AFD9), ref: 0042DD3B

Part of subcall function 0042DD54: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD67

Part of subcall function 0042DD80: GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00454356,00000000,004543F9,?,?,00000000,00000000,00000000,00000000,00000000,?,004547E9,00000000), ref: 0042DD9A
Part of subcall function 0042DD80: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042DDA0

SHGetKnownFolderPath.SHELL32(0049CD48,00008000,00000000,?,00000000,0047E92C), ref: 0047E832
757283B0.OLE32(?,0047E875), ref: 0047E868

Part of subcall function 0042D698: GetEnvironmentVariableA.KERNEL32(00000000,00000000,00000000,?,?,00000000,0042DECE,00000000,0042DF60,?,?,?,0049E62C,00000000,00000000), ref: 0042D6C3

Strings

\Program Files, xrefs: 0047E747
SystemDrive, xrefs: 0047E6BF
COMMAND.COM, xrefs: 0047E907
Failed to get path of 64-bit Program Files directory, xrefs: 0047E7C9
cmd.exe, xrefs: 0047E8E6
CommonFilesDir, xrefs: 0047E75A, 0047E7D6
ProgramFilesDir, xrefs: 0047E720, 0047E7A7
Common Files, xrefs: 0047E791
Failed to get path of 64-bit Common Files directory, xrefs: 0047E7F8

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Directory$757283AddressEnvironmentFolderHandleKnownModulePathProcSystemVariableWindows
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 795111782-544719455
Opcode ID: 984c888b60f47b11e2b6d4e820364b2832851e3a6ba9345cc7be6e364b5d71bc
Instruction ID: bc52f855f352529d10430792a7831f614d7f200ed672bd81af1a1ebcab1d5fa8
Opcode Fuzzy Hash: 984c888b60f47b11e2b6d4e820364b2832851e3a6ba9345cc7be6e364b5d71bc
Instruction Fuzzy Hash: 38619334600204EFDB10EBA6D84269E7B65EB48319F50C6B7E504D73A5C73C9E49CB9D

Function 0045D450 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 182
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 0045D46A
GetModuleHandleA.KERNEL32(advapi32.dll), ref: 0045D48A
GetProcAddress.KERNEL32(00000000,GetNamedSecurityInfoW), ref: 0045D497
GetProcAddress.KERNEL32(00000000,SetNamedSecurityInfoW), ref: 0045D4A4
GetProcAddress.KERNEL32(00000000,SetEntriesInAclW), ref: 0045D4B2

Part of subcall function 0045D358: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0045D3F7,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045D3D1

AllocateAndInitializeSid.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045D6A5,?,?,00000000), ref: 0045D56B
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045D6A5,?,?,00000000), ref: 0045D574

Strings

SetEntriesInAclW, xrefs: 0045D4AC
W, xrefs: 0045D582
SetNamedSecurityInfoW, xrefs: 0045D49E
GetNamedSecurityInfoW, xrefs: 0045D491
advapi32.dll, xrefs: 0045D485

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressProc$AllocateByteCharErrorHandleInitializeLastModuleMultiVersionWide
String ID: GetNamedSecurityInfoW$SetEntriesInAclW$SetNamedSecurityInfoW$W$advapi32.dll
API String ID: 59345061-4263478283
Opcode ID: 460e5e8892b740904f5673cf246e9fb888ff19562035c90d8fd5629549a4de0e
Instruction ID: 783a5280d5c6dd2c4afe06b2d07c38c27ed9239d6cb54be80e3f389c0ae86338
Opcode Fuzzy Hash: 460e5e8892b740904f5673cf246e9fb888ff19562035c90d8fd5629549a4de0e
Instruction Fuzzy Hash: B75164B1D00608EFDB20DF99C841BAEB7B8EF48315F14806AF915B7381D6789945CF69

Function 004592D4 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 0045930B
TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 00459327
WaitForSingleObject.KERNEL32(?,00002710,?), ref: 00459335
GetExitCodeProcess.KERNEL32(?), ref: 00459346
CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 0045938D
Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 004593A9

Strings

Helper process exited, but failed to get exit code., xrefs: 0045937F
Helper process exited with failure code: 0x%x, xrefs: 00459373
Stopping 64-bit helper process. (PID: %u), xrefs: 004592FD
Helper process exited., xrefs: 00459355
Helper isn't responding; killing it., xrefs: 00459317

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
API String ID: 3355656108-1243109208
Opcode ID: 4af708aef4a7175976a509e22392017ea88cf5ce9a8777e2999ff7a7e7eb42f3
Instruction ID: e85fc657e119397c97ed97e1faf084f02df15e80d39cea5897c552b80fc28b15
Opcode Fuzzy Hash: 4af708aef4a7175976a509e22392017ea88cf5ce9a8777e2999ff7a7e7eb42f3
Instruction Fuzzy Hash: 1C212A70604740DBC720E779C88575B77D49F48305F04892EBC9ADB292EA78EC489B6A

Function 004594AC Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127pipeCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,0045968B,?,00000000,004596EE,?,?,00000000,00000000), ref: 00459509
TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00459620,?,00000000,00000001,00000000,00000000,00000000,0045968B), ref: 00459566
GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00459620,?,00000000,00000001,00000000,00000000,00000000,0045968B), ref: 00459573
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 004595BF
GetOverlappedResult.KERNEL32(?,?,00000000,00000001,004595F9,?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00459620,?,00000000), ref: 004595E5
GetLastError.KERNEL32(?,?,00000000,00000001,004595F9,?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00459620,?,00000000), ref: 004595EC

Part of subcall function 00453C98: GetLastError.KERNEL32(00000000,0045482D,00000005,00000000,00454862,?,?,00000000,0049E62C,00000004,00000000,00000000,00000000,?,0049AFD9,00000000), ref: 00453C9B

Strings

CreateEvent, xrefs: 00459517
TransactNamedPipe, xrefs: 0045957F

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
String ID: CreateEvent$TransactNamedPipe
API String ID: 2182916169-3012584893
Opcode ID: b1f368c04b1020bf14d46fda1d24282a5f891e4b494a754878cc2d13957cea83
Instruction ID: 5e3c9d9fc8331b786f0ce76ad2fce8520c17318b204ac54c9f287bbe44ec3061
Opcode Fuzzy Hash: b1f368c04b1020bf14d46fda1d24282a5f891e4b494a754878cc2d13957cea83
Instruction Fuzzy Hash: 8B418D71A00608FFDB05DFA5C981F9EB7F9EB48714F1140A6F900E7692D6789E54CB28

Function 0047EE64 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 104libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DD54: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD67

GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 0047EF91

Strings

_isetup\_shfoldr.dll, xrefs: 0047EF02
shfolder.dll, xrefs: 0047EE9F
shell32.dll, xrefs: 0047EF2F
2, xrefs: 0047EED3
SHFOLDERDLL, xrefs: 0047EF0F
SHGetFolderPathA, xrefs: 0047EF86
Failed to get address of SHGetFolderPath function, xrefs: 0047EFA2
Failed to load DLL "%s", xrefs: 0047EF74

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressDirectoryProcSystem
String ID: 2$Failed to get address of SHGetFolderPath function$Failed to load DLL "%s"$SHFOLDERDLL$SHGetFolderPathA$_isetup\_shfoldr.dll$shell32.dll$shfolder.dll
API String ID: 996212319-3422985891
Opcode ID: fcd19f6215784c6dfd8cd3c6b71287cecdfa42f77a11c6e2d854b04c9c52ee28
Instruction ID: fa60ec47ff5fe4c3202210013a094a81b74b2f24ac2998f1880efbdd6ce8d1c7
Opcode Fuzzy Hash: fcd19f6215784c6dfd8cd3c6b71287cecdfa42f77a11c6e2d854b04c9c52ee28
Instruction Fuzzy Hash: C1413330A00149DFDB10EFA6D9415EEB7B5EB48309F50C9BBE408A7752D7389E09CB59

Function 0042FA40 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 90windowregistryCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042FA6F
GetFocus.USER32 ref: 0042FA77
RegisterClassA.USER32(0049C7AC), ref: 0042FA98
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,0042FB6C,88000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0042FAD6
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000), ref: 0042FB1C
ShowWindow.USER32(00000000,00000008,00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000,00000000,TWindowDisabler-Window), ref: 0042FB2D
SetFocus.USER32(00000000,00000000,0042FB4F,?,?,?,00000001,00000000,?,00458BE2,00000000,0049E62C), ref: 0042FB34

Strings

,I, xrefs: 0042FB46, 0042FAFF, 0042FB0C
TWindowDisabler-Window, xrefs: 0042FACF, 0042FB15

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Window$CreateFocus$ActiveClassRegisterShow
String ID: ,I$TWindowDisabler-Window
API String ID: 3167913817-1404624659
Opcode ID: 7bc8afc147b9f6d5f1ca6723a7c004efacc5d5b5070bad591d74333f7a3b595c
Instruction ID: a62ceaa4fb40b7d97b276e036e96e71c03e0c95da72a7b9a05d0a528f526b251
Opcode Fuzzy Hash: 7bc8afc147b9f6d5f1ca6723a7c004efacc5d5b5070bad591d74333f7a3b595c
Instruction Fuzzy Hash: A9218171B80710BAE210EB66DD13F1A7AA4EB14B04FE1413BF604BB2D1D7B97D0586AD

Function 00401A90 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049E420,00000000,00401B68), ref: 00401ABD
LocalFree.KERNEL32(00000000,00000000,00401B68), ref: 00401ACF
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401AEE
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401B2D
RtlLeaveCriticalSection.KERNEL32(0049E420,00401B6F), ref: 00401B58
RtlDeleteCriticalSection.KERNEL32(0049E420,00401B6F), ref: 00401B62

Strings

|I, xrefs: 00401B11
PI, xrefs: 00401B07
@I, xrefs: 00401ADB, 00401AF5, 00401AFD

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID: @I$PI$|I
API String ID: 3782394904-480730394
Opcode ID: 9c9fe91b7cfdd215891b8d9d4ae7614f409749d5390e9780682ddeadd6d5bc02
Instruction ID: e11c9f51ffc8675c4dd52d411ec329e75971582e09b40c19516fbc4ecb4e7f79
Opcode Fuzzy Hash: 9c9fe91b7cfdd215891b8d9d4ae7614f409749d5390e9780682ddeadd6d5bc02
Instruction Fuzzy Hash: 1E119D30B00340AAEB15EB67AC82B263BE49765708F44047BF40067AF2D67DA840876E

Function 00423D04 Relevance: 15.1, APIs: 10, Instructions: 98windowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041F854: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041F234,?,00423D1F,0042409C,0041F234), ref: 0041F872

GetClassInfoA.USER32(00400000,00423B0C), ref: 00423D2F
RegisterClassA.USER32(0049C630), ref: 00423D47
GetSystemMetrics.USER32(00000000), ref: 00423D69
GetSystemMetrics.USER32(00000001), ref: 00423D78
SetWindowLongA.USER32(004108F0,000000FC,00423B1C), ref: 00423DD4
SendMessageA.USER32(004108F0,00000080,00000001,00000000), ref: 00423DF5
GetSystemMenu.USER32(004108F0,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,0042409C,0041F234), ref: 00423E00
DeleteMenu.USER32(00000000,0000F030,00000000,004108F0,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,0042409C,0041F234), ref: 00423E0F
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,004108F0,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 00423E1C
DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,004108F0,00000000,00000000,00400000,00000000,00000000,00000000), ref: 00423E32

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Menu$DeleteSystem$ClassMetrics$AllocInfoLongMessageRegisterSendVirtualWindow
String ID:
API String ID: 183575631-0
Opcode ID: 42766b2cc6abd2be64f3bc2fe5cffaa53e797ada250decb9b92dc24698764991
Instruction ID: 3c08988f126546789c3863b6090fce38962bc241f8b01a8198fec2671c318d21
Opcode Fuzzy Hash: 42766b2cc6abd2be64f3bc2fe5cffaa53e797ada250decb9b92dc24698764991
Instruction Fuzzy Hash: B73173B17402506AEB10AF69EC82F6736989714709F60017BFA44EE2D7D6BDED00876D

Function 0048399C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 175windowCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 00483B59
FreeLibrary.KERNEL32(00000000), ref: 00483B6D
SendNotifyMessageA.USER32(00020410,00000496,00002710,00000000), ref: 00483BDF

Strings

GetCustomSetupExitCode, xrefs: 004839F9
Not restarting Windows because Setup is being run from the debugger., xrefs: 00483B8E
Deinitializing Setup., xrefs: 004839BA
Restarting Windows., xrefs: 00483BBA
DeinitializeSetup, xrefs: 00483A55

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: FreeLibrary$MessageNotifySend
String ID: DeinitializeSetup$Deinitializing Setup.$GetCustomSetupExitCode$Not restarting Windows because Setup is being run from the debugger.$Restarting Windows.
API String ID: 3817813901-1884538726
Opcode ID: 2f4240ef34fbe43b4aea162ce7982a52e1ca68373d35113a18e6d1e477d5c402
Instruction ID: a7658fa90fa50a6681ebd46fdfba4a8865f7ab3218c47a7b33a96826d64c50ce
Opcode Fuzzy Hash: 2f4240ef34fbe43b4aea162ce7982a52e1ca68373d35113a18e6d1e477d5c402
Instruction Fuzzy Hash: E451C130704240AFD715EF69D885B1E77A4FB19B09F50887BE800D73A2DB38AE48CB59

Function 00468610 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 004686B3
ExtractIconA.SHELL32(00400000,00000000,?), ref: 004686D9

Part of subcall function 0046854C: DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000003), ref: 004685E7
Part of subcall function 0046854C: DestroyCursor.USER32(00000000), ref: 004685FD

ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 00468730
SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00468791
ExtractIconA.SHELL32(00400000,00000000,?), ref: 004687B7

Strings

SGH, xrefs: 0046861B
shell32.dll, xrefs: 00468714
c:\directory, xrefs: 004686AE

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Icon$Extract$FileInfo$CursorDestroyDraw
String ID: SGH$c:\directory$shell32.dll
API String ID: 3376378930-2896416345
Opcode ID: b4f340eccbb26c3d68640a3c689541b6a9652ee581d3a978a71e3150859d61ed
Instruction ID: d32c5e131bc5b3b5ac91ee83d5472092c15c56af87a6d3ac7aa87ded2e77d7dc
Opcode Fuzzy Hash: b4f340eccbb26c3d68640a3c689541b6a9652ee581d3a978a71e3150859d61ed
Instruction Fuzzy Hash: 4D516270600248AFD710EF65CD8AFDEB7E9AB48304F5082BBF4049B751DA799E81CA59

Function 00474278 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 67COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00474339,?,?,?,00000008,00000000,00000000,00000000,?,00474595,?,?,00000000,00474818), ref: 0047429C

Part of subcall function 0042D224: GetPrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0042D29A

Part of subcall function 004073E0: DeleteFileA.KERNEL32(00000000,0049E62C,0049B325,00000000,0049B37A,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 004073EB

SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00474339,?,?,?,00000008,00000000,00000000,00000000,?,00474595), ref: 00474313
RemoveDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00474339,?,?,?,00000008,00000000,00000000,00000000), ref: 00474319

Strings

{0AFACED1-E828-11D1-9187-B532F1E9575D}, xrefs: 004742D5
desktop.ini, xrefs: 004742B0
CLSID2, xrefs: 004742C6
target.lnk, xrefs: 004742F1
.ShellClassInfo, xrefs: 004742CB

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryPrivateProfileRemoveString
String ID: .ShellClassInfo$CLSID2$desktop.ini$target.lnk${0AFACED1-E828-11D1-9187-B532F1E9575D}
API String ID: 884541143-1710247218
Opcode ID: 19fc3075fbb2a555a3fcf41d0c7adfc047a07825b1eb0ce73bb5d9dad7d123d8
Instruction ID: dfe2ce50f8dec565f98165a468ea849bbfb81df799dc1772a97f7391a7f94dd7
Opcode Fuzzy Hash: 19fc3075fbb2a555a3fcf41d0c7adfc047a07825b1eb0ce73bb5d9dad7d123d8
Instruction Fuzzy Hash: 9211B230700514BBD711EAA59C82BAEB3ACDB84754F60817BFC1CAB2C1DB3C9E01866D

Function 004539C8 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 56libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453A86,?,?,?,?,00000000,00000000,?,0049B83A), ref: 004539EA
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004539F0
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453A86,?,?,?,?,00000000,00000000,?,0049B83A), ref: 00453A04
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453A0A

Strings

Wow64RevertWow64FsRedirection, xrefs: 004539FA
kernel32.dll, xrefs: 004539E5, 004539FF
Wow64DisableWow64FsRedirection, xrefs: 004539E0
shell32.dll, xrefs: 00453A47

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: 515663870329bb096ba18d99d8e346448dc1c09e42cd04c75157c0b054f8c85d
Instruction ID: 18891d3ceb8887e2f5320c13b89f4eae329e81661ad9de64afed935a1ef9114c
Opcode Fuzzy Hash: 515663870329bb096ba18d99d8e346448dc1c09e42cd04c75157c0b054f8c85d
Instruction Fuzzy Hash: EA119130644255BEEB00EF72D802B5E77A8D74479AF60447BF88066292D67C9E4C8A2D

Function 004019CC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0049E420,00000000,00401A82,?,?,0040222E,022E4560,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
RtlEnterCriticalSection.KERNEL32(0049E420,0049E420,00000000,00401A82,?,?,0040222E,022E4560,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
LocalAlloc.KERNEL32(00000000,00000FF8,0049E420,00000000,00401A82,?,?,0040222E,022E4560,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
RtlLeaveCriticalSection.KERNEL32(0049E420,00401A89,00000000,00401A82,?,?,0040222E,022E4560,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Strings

|I, xrefs: 00401A0E
PI, xrefs: 00401A04
@I, xrefs: 004019FA

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID: @I$PI$|I
API String ID: 730355536-480730394
Opcode ID: a4bc39b30c5ed4d75bf3f4cd8aa94f51fbbb45c94376e80eb638db1dc0cdf7cb
Instruction ID: 94269b02b44d1611755d75869bdd1b1cad58823c34eb859de2800409b3eb1631
Opcode Fuzzy Hash: a4bc39b30c5ed4d75bf3f4cd8aa94f51fbbb45c94376e80eb638db1dc0cdf7cb
Instruction Fuzzy Hash: BC01C070644240AEFB19EB6B98027253ED4D799748F11883BF440A6AF1CABD4840CB6E

Function 00430E20 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23registryclipboardthreadCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatA.USER32(commdlg_help), ref: 00430E28
RegisterClipboardFormatA.USER32(commdlg_FindReplace), ref: 00430E37
GetCurrentThreadId.KERNEL32 ref: 00430E51
GlobalAddAtomA.KERNEL32(00000000), ref: 00430E72

Strings

commdlg_FindReplace, xrefs: 00430E32
WndProcPtr%.8X%.8X, xrefs: 00430E63
commdlg_help, xrefs: 00430E23

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ClipboardFormatRegister$AtomCurrentGlobalThread
String ID: WndProcPtr%.8X%.8X$commdlg_FindReplace$commdlg_help
API String ID: 4130936913-2943970505
Opcode ID: 4842943032f7e665edf48454b8f0668acbf12da500d71f69c3a659e3ac448604
Instruction ID: 010e98d13399693fc9d497d8664f6f2789eb24ebecb377ca83b09cc51ba55008
Opcode Fuzzy Hash: 4842943032f7e665edf48454b8f0668acbf12da500d71f69c3a659e3ac448604
Instruction Fuzzy Hash: 58F082B09483408ED300EB768842B1E7BE4AB58718F404A3FB498A62A1D77A9910CB1F

Function 004739D4 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 272fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,00473BA5,?,00000000,?,0049F1E4,00000000,00473D95,?,00000000,?,00000000,?,00473F61), ref: 00473B81
FindClose.KERNEL32(000000FF,00473BAC,00473BA5,?,00000000,?,0049F1E4,00000000,00473D95,?,00000000,?,00000000,?,00473F61,?), ref: 00473B9F
FindNextFileA.KERNEL32(000000FF,?,00000000,00473CC7,?,00000000,?,0049F1E4,00000000,00473D95,?,00000000,?,00000000,?,00473F61), ref: 00473CA3
FindClose.KERNEL32(000000FF,00473CCE,00473CC7,?,00000000,?,0049F1E4,00000000,00473D95,?,00000000,?,00000000,?,00473F61,?), ref: 00473CC1

Strings

2@G, xrefs: 00473A1A, 00473A31
2@G, xrefs: 00473C2B, 00473C2E

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Find$CloseFileNext
String ID: 2@G$2@G
API String ID: 2066263336-1466267537
Opcode ID: 3566d6bf605272ca1692cc471e93de5193724bd9cdd26924202facaae5838f15
Instruction ID: 8940149770a3d34fb7664ae878ddd7cfd29c95f0839e879e90260d1bac7f5ff7
Opcode Fuzzy Hash: 3566d6bf605272ca1692cc471e93de5193724bd9cdd26924202facaae5838f15
Instruction Fuzzy Hash: A1C14B3090424D9FCF11DFA5C881ADEBBB9FF48304F5081AAE848B7291D738AA45DF54

Function 0045580C Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 154COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,00455A28,00455A28,?,00455A28,00000000), ref: 004559B6
CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,00455A28,00455A28,?,00455A28), ref: 004559C3

Part of subcall function 00455778: WaitForInputIdle.USER32(?,00000032), ref: 004557A4
Part of subcall function 00455778: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 004557C6
Part of subcall function 00455778: GetExitCodeProcess.KERNEL32(?,?), ref: 004557D5
Part of subcall function 00455778: CloseHandle.KERNEL32(?,00455802,004557FB,?,?,?,00000000,?,?,004559D7,?,?,?,00000044,00000000,00000000), ref: 004557F5

Strings

cmd.exe" /C ", xrefs: 004558E9
D, xrefs: 00455954
.cmd, xrefs: 004558B7
COMMAND.COM" /C , xrefs: 00455920
.bat, xrefs: 0045589C

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
API String ID: 854858120-615399546
Opcode ID: 52c44cea75f5b4e31f80bb56a87c2cc1f5305133f2a7233a52dfb56e3db8b35d
Instruction ID: 0bf838f29b43a6125692e3b7c5bec048a51817b33ba316f47a5a27346a6aee42
Opcode Fuzzy Hash: 52c44cea75f5b4e31f80bb56a87c2cc1f5305133f2a7233a52dfb56e3db8b35d
Instruction Fuzzy Hash: 34518B7060074DABDB00EF95D892BEEBBB9AF44305F50453BB804B7292D77C5E098759

Function 00423B1C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96windowCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(00400000,MAINICON), ref: 00423BAC
GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00419476,00000000,?,?,?,00000001), ref: 00423BD9
OemToCharA.USER32(?,?), ref: 00423BEC
CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00419476,00000000,?,?,?,00000001), ref: 00423C2C

Strings

MAINICON, xrefs: 00423BA1
2, xrefs: 00423B7A

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Char$FileIconLoadLowerModuleName
String ID: 2$MAINICON
API String ID: 3935243913-3181700818
Opcode ID: f69665658a275a2bae8a7589e315de5afc27425a811c7b840aadd70870948a58
Instruction ID: 9510fd107b4d1d478bc251de40ec4f21bd31917ac71a3749b9d0f73c54ce2f3c
Opcode Fuzzy Hash: f69665658a275a2bae8a7589e315de5afc27425a811c7b840aadd70870948a58
Instruction Fuzzy Hash: 1031C271A042549EDB10EF69D8C47C67BE8AF14308F4441BAE844DB293D7BEDA88CB55

Function 004193C8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 004193CD
GlobalAddAtomA.KERNEL32(00000000), ref: 004193EE
GetCurrentThreadId.KERNEL32 ref: 00419409
GlobalAddAtomA.KERNEL32(00000000), ref: 0041942A

Part of subcall function 00423558: GetDC.USER32(00000000), ref: 004235AE
Part of subcall function 00423558: EnumFontsA.GDI32(00000000,00000000,004234F8,004108F0,00000000,?,?,00000000,?,00419463,00000000,?,?,?,00000001), ref: 004235C1
Part of subcall function 00423558: GetDeviceCaps.GDI32(00000000,0000005A), ref: 004235C9
Part of subcall function 00423558: ReleaseDC.USER32(00000000,00000000), ref: 004235D4

Part of subcall function 00423B1C: LoadIconA.USER32(00400000,MAINICON), ref: 00423BAC
Part of subcall function 00423B1C: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00419476,00000000,?,?,?,00000001), ref: 00423BD9
Part of subcall function 00423B1C: OemToCharA.USER32(?,?), ref: 00423BEC
Part of subcall function 00423B1C: CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00419476,00000000,?,?,?,00000001), ref: 00423C2C

Part of subcall function 0041F5A8: GetVersion.KERNEL32(?,00419480,00000000,?,?,?,00000001), ref: 0041F5B6
Part of subcall function 0041F5A8: SetErrorMode.KERNEL32(00008000,?,00419480,00000000,?,?,?,00000001), ref: 0041F5D2
Part of subcall function 0041F5A8: LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00419480,00000000,?,?,?,00000001), ref: 0041F5DE
Part of subcall function 0041F5A8: SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00419480,00000000,?,?,?,00000001), ref: 0041F5EC
Part of subcall function 0041F5A8: GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F61C
Part of subcall function 0041F5A8: GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F645
Part of subcall function 0041F5A8: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F65A
Part of subcall function 0041F5A8: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F66F
Part of subcall function 0041F5A8: GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F684
Part of subcall function 0041F5A8: GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F699
Part of subcall function 0041F5A8: GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F6AE
Part of subcall function 0041F5A8: GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F6C3
Part of subcall function 0041F5A8: GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F6D8
Part of subcall function 0041F5A8: GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F6ED

Strings

ControlOfs%.8X%.8X, xrefs: 0041941B
Delphi%.8X, xrefs: 004193DF

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressProc$AtomCharCurrentErrorGlobalLoadMode$CapsDeviceEnumFileFontsIconLibraryLowerModuleNameProcessReleaseThreadVersion
String ID: ControlOfs%.8X%.8X$Delphi%.8X
API String ID: 316262546-2767913252
Opcode ID: 0eaf2971df0e281bc12c3b4cdbea7c86a0ae7f77c1ec2d642d91beb276c542ff
Instruction ID: 70937e91f797630ba3b8911ce9801afdb7ec3901755c8c3c4a5a11a92c11164f
Opcode Fuzzy Hash: 0eaf2971df0e281bc12c3b4cdbea7c86a0ae7f77c1ec2d642d91beb276c542ff
Instruction Fuzzy Hash: 92111A706182409AC300FF76D94279E3BE09B64309F80953FF449A72A2DB3DAD458B5F

Function 0045D8DC Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000057,00000000,0045D9A8,?,?,?,?,00000000), ref: 0045D947
SetLastError.KERNEL32(00000000,00000002,?,?,?,0045DA14,?,00000000,0045D9A8,?,?,?,?,00000000), ref: 0045D986

Strings

USERS, xrefs: 0045D939
MACHINE, xrefs: 0045D92A
CLASSES_ROOT, xrefs: 0045D90C
CURRENT_USER, xrefs: 0045D91B

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ErrorLast
String ID: CLASSES_ROOT$CURRENT_USER$MACHINE$USERS
API String ID: 1452528299-1580325520
Opcode ID: e67dd52cdc243cbb5e72bacc990bd15c15be47e674f81fc936459ad46248d631
Instruction ID: 6e5dfac74c505aaab96e92fe344d79fc6b24c6561d5ee78f4b35f8cdf0e82ab5
Opcode Fuzzy Hash: e67dd52cdc243cbb5e72bacc990bd15c15be47e674f81fc936459ad46248d631
Instruction Fuzzy Hash: 1611A5B5A04209AFD731DEA1C941BAA7AACDF48306F6040376D04A6283D67C5F0AD52E

Function 00413ACC Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 00413AF4
GetWindowLongA.USER32(?,000000F0), ref: 00413AFF
GetWindowLongA.USER32(?,000000F4), ref: 00413B11
SetWindowLongA.USER32(?,000000F4,?), ref: 00413B24
SetPropA.USER32(?,00000000,00000000), ref: 00413B3B
SetPropA.USER32(?,00000000,00000000), ref: 00413B52

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: 7ce4dc3fc8e6c19e22986d13dd13120370638c3e9722ee2c323b47d3b17dffc8
Instruction ID: ae8f1583d3b1519aebe57cde2a9c9bb5e562c2388428f51edfa5c09d84851558
Opcode Fuzzy Hash: 7ce4dc3fc8e6c19e22986d13dd13120370638c3e9722ee2c323b47d3b17dffc8
Instruction Fuzzy Hash: 8B11FC75500204BFCB00DFD9DC84E9A3BE8EB19364F104266B918DB2A2D738E990CB94

Function 0047EB80 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,0047ECD6,?,?,00000000,0049E62C,00000000,00000000,?,0049B16D,00000000,0049B316,?,00000000), ref: 0047EC13
GetLastError.KERNEL32(00000000,00000000,00000000,0047ECD6,?,?,00000000,0049E62C,00000000,00000000,?,0049B16D,00000000,0049B316,?,00000000), ref: 0047EC1C

Strings

Created temporary directory: , xrefs: 0047EBB5
_isetup, xrefs: 0047EBFE
\_setup64.tmp, xrefs: 0047EC8E

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: Created temporary directory: $\_setup64.tmp$_isetup
API String ID: 1375471231-2952887711
Opcode ID: 0f0b0515f85f06296a40b338b4e2b0cf96337e1e5d4ff16465a1bc321aeead68
Instruction ID: c283b957d57768a43b738a714497c16dc780c6316116deeb7645fbdf29d3348a
Opcode Fuzzy Hash: 0f0b0515f85f06296a40b338b4e2b0cf96337e1e5d4ff16465a1bc321aeead68
Instruction Fuzzy Hash: 5D415534A001099BDB11EFA2DC81ADEB7B9FF48305F50457BE400B7392DB38AE058B98

Function 00423F14 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00423EAC), ref: 00423F38
GetWindow.USER32(?,00000003), ref: 00423F4D
GetWindowLongA.USER32(?,000000EC), ref: 00423F5C
SetWindowPos.USER32(00000000,EB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,0042463B,?,?,00424203), ref: 00423F92

Strings

EB, xrefs: 00423F82, 00423F86

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Window$EnumLongWindows
String ID: EB
API String ID: 4191631535-4058845024
Opcode ID: 5771768f8ce08727a424e163e7e9d722af5a8f3176c60bef59618d8305e3be86
Instruction ID: d60c47438ca5cb8406b8c3c26f1ac59805b97d32456ef5cb908caaf585e7f615
Opcode Fuzzy Hash: 5771768f8ce08727a424e163e7e9d722af5a8f3176c60bef59618d8305e3be86
Instruction Fuzzy Hash: E5115E71B04610AFDB109F28E989F5677F4EB08719F61066AF9649B2E2C378DC40CB58

Function 00475098 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 0045D8DC: SetLastError.KERNEL32(00000057,00000000,0045D9A8,?,?,?,?,00000000), ref: 0045D947

GetLastError.KERNEL32(00000000,00000000,00000000,00475161,?,?,0049F1E4,00000000), ref: 0047511A
GetLastError.KERNEL32(00000000,00000000,00000000,00475161,?,?,0049F1E4,00000000), ref: 00475130

Strings

Could not set permissions on the key because it currently does not exist., xrefs: 00475124
Failed to set permissions on the key (%d)., xrefs: 00475141
Setting permissions on key: %s\%s, xrefs: 004750DE

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ErrorLast
String ID: Could not set permissions on the key because it currently does not exist.$Failed to set permissions on the key (%d).$Setting permissions on key: %s\%s
API String ID: 1452528299-522033246
Opcode ID: 755e96f04561cc2ba2169aa2e341280b19d0003c5820bd9e3e69adb55b1cfc44
Instruction ID: 2a2223fffcf2406a56d971c1622c3964edc143106c9d3d4d998c40d24feba673
Opcode Fuzzy Hash: 755e96f04561cc2ba2169aa2e341280b19d0003c5820bd9e3e69adb55b1cfc44
Instruction Fuzzy Hash: F2216570E046045FDB00DBA9C8427DEBBE8DB89315F50447BE404EB342DBB85D0587A9

Function 0046D0BC Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 320COMMON

Download Yara Rule

Strings

PrepareToInstall failed: %s, xrefs: 0046D41A
NextButtonClick, xrefs: 0046D1F8
Need to restart Windows? %s, xrefs: 0046D441

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID:
String ID: Need to restart Windows? %s$NextButtonClick$PrepareToInstall failed: %s
API String ID: 0-2329492092
Opcode ID: d994d9dd07780758271bb4ebd375dcf455272fcd63042a2653a17e2aa9d33510
Instruction ID: 9403cb44c2d85c33ef4c02c2a4fe381a2d6631b9486eb5c5050b844422602506
Opcode Fuzzy Hash: d994d9dd07780758271bb4ebd375dcf455272fcd63042a2653a17e2aa9d33510
Instruction Fuzzy Hash: 3BD13E34E00109DFDB00EF99C585AEE77F5EB49308F6444B6E804AB352E778AE45CB5A

Function 004851F4 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 226COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?,?,00000000,00485545), ref: 00485318
SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 004853B6

Strings

Need to restart Windows? %s, xrefs: 004853F3
, xrefs: 00485473

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ActiveChangeNotifyWindow
String ID: $Need to restart Windows? %s
API String ID: 1160245247-4200181552
Opcode ID: d8a9afc88dbc73c607e3ab65152998b367490c6e232baabd5cc8deeeb62433e1
Instruction ID: 81185d5a93dc8923eb5b61d1edfd94eb1f2ea81deeedd38fa8f34b1627dfdd43
Opcode Fuzzy Hash: d8a9afc88dbc73c607e3ab65152998b367490c6e232baabd5cc8deeeb62433e1
Instruction Fuzzy Hash: 0F91BF74A006449FDB10EB69D885B9E7BF0AF59308F5044BBE800DB362D77CAD49CB5A

Function 004548FC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 200fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,00454B42,?,00000000,00454BB6,?,?,-00000001,00000000,?,0047EDE7,00000000,0047ED34,00000000), ref: 00454B1E
FindClose.KERNEL32(000000FF,00454B49,00454B42,?,00000000,00454BB6,?,?,-00000001,00000000,?,0047EDE7,00000000,0047ED34,00000000,00000000), ref: 00454B3C

Strings

|;H, xrefs: 00454BA8, 00454985, 00454996, 00454968
|;H, xrefs: 00454B49, 00454AC3, 00454AC6

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Find$CloseFileNext
String ID: |;H$|;H
API String ID: 2066263336-2257849856
Opcode ID: de7188482288c2741de90b6ca0a556f3672fa1e39a11f0826931bd87513c0566
Instruction ID: 0a8a6d2e4ba1183b98523bb6c8f5e257ece7ffcf1ec6bc8b68957d5ee00727fa
Opcode Fuzzy Hash: de7188482288c2741de90b6ca0a556f3672fa1e39a11f0826931bd87513c0566
Instruction Fuzzy Hash: 7181863090424D9FCF11DFA5C845BEFBB75AF89309F1440A6D8546B392D339AE8ACB58

Function 00471260 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 0042CC94: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042CCB8

GetLastError.KERNEL32(00000000,0047145D,?,?,0049F1E4,00000000), ref: 0047133A
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 004713B4
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 004713D9

Strings

Creating directory: %s, xrefs: 00471322

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ChangeNotify$ErrorFullLastNamePath
String ID: Creating directory: %s
API String ID: 2451617938-483064649
Opcode ID: add17e3587bebde1ffa385b19543913611458dcac141b3bc5c46d5987e206a9d
Instruction ID: 1c67069dbc0ed1d624ed0b8c576199a2cd3546509f6f272be70fdcc9739f0d33
Opcode Fuzzy Hash: add17e3587bebde1ffa385b19543913611458dcac141b3bc5c46d5987e206a9d
Instruction Fuzzy Hash: 3D515674E00248ABDB01DFA9D982BDEBBF5AF48304F50847AE854B7392D7785E04CB59

Function 004555D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,SfcIsFileProtected), ref: 0045567E
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,00455744), ref: 004556E8

Strings

sfc.dll, xrefs: 00455640
SfcIsFileProtected, xrefs: 00455678

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressByteCharMultiProcWide
String ID: SfcIsFileProtected$sfc.dll
API String ID: 2508298434-591603554
Opcode ID: 24eaf44969d8cf01853d9c036a6326a6a7afdd4b29fe3f476df6d0cdf2e12921
Instruction ID: 311e8501e48ef86dedbd1e32416f62ff44579e2f461d143f7aa5c8e880f43ce1
Opcode Fuzzy Hash: 24eaf44969d8cf01853d9c036a6326a6a7afdd4b29fe3f476df6d0cdf2e12921
Instruction Fuzzy Hash: FC418670A00718DBEB20EB55DC95BAD77B8AB04309F5041B7A908E7293D7785F48DA5C

Function 0044B8C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0044B935
SelectObject.GDI32(?,00000000), ref: 0044B958
ReleaseDC.USER32(00000000,?), ref: 0044B98B

Strings

SGH, xrefs: 0044B8C8

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ObjectReleaseSelect
String ID: SGH
API String ID: 1831053106-1451514267
Opcode ID: 6ae954a2c0d23ceefc1a58381199537289997262cadc448a5b2220dc96acd543
Instruction ID: 5f6416779418d586cf190573f7bf4a7bb4d400156242e88c08e8c7aea5cbb268
Opcode Fuzzy Hash: 6ae954a2c0d23ceefc1a58381199537289997262cadc448a5b2220dc96acd543
Instruction Fuzzy Hash: C62177B0E04308AFEB11DFA5C881B9EBBB8EB49304F5184BAF500A7291D77CD940CB59

Function 00404D2A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00404DC5
ExitProcess.KERNEL32 ref: 00404E0D

Strings

Runtime error at 00000000, xrefs: 00404DBE, 00404DD1
Error, xrefs: 00404DB9

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 3b61d1fed352f5282028831249daba76a748604d35a297349552cc65daff4f89
Instruction ID: d5004cfacfd42fd5c2be0182736057b03719568bea5446043c3b888183e5f090
Opcode Fuzzy Hash: 3b61d1fed352f5282028831249daba76a748604d35a297349552cc65daff4f89
Instruction Fuzzy Hash: AE21B360A442519AEB15E7B7EC857163BD197E9348F048177E700B73E3C6BC984487AE

Function 0044B5F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0044B680,?,SGH,?,?), ref: 0044B652
DrawTextW.USER32(?,?,00000000,?,?), ref: 0044B665
DrawTextA.USER32(?,00000000,00000000,?,?), ref: 0044B699

Strings

SGH, xrefs: 0044B5FC

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: DrawText$ByteCharMultiWide
String ID: SGH
API String ID: 65125430-1451514267
Opcode ID: 63c04f90603744f798e42aba6243c37eae4be5ab149869f7acaebc15ddea55e3
Instruction ID: 1ea4d790d63f24178cbae964d575408221d26853f0f73c11de666758b6730ab2
Opcode Fuzzy Hash: 63c04f90603744f798e42aba6243c37eae4be5ab149869f7acaebc15ddea55e3
Instruction Fuzzy Hash: D111B6B27046047FE710DAAA9C82D6FB7ECDB49724F10457AF504E7290DA399E018A69

Function 00450424 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,00000000,004504FD,?,?,?,?,00000000,00000000), ref: 0045048C
LoadLibraryA.KERNEL32(00000000,00000000,004504FD,?,?,?,?,00000000,00000000), ref: 004504D2

Part of subcall function 004503F4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0045040C

Strings

RICHED32.DLL, xrefs: 004504BF
RICHED20.DLL, xrefs: 00450479

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: LibraryLoad$DirectorySystem
String ID: RICHED20.DLL$RICHED32.DLL
API String ID: 2630572097-740611112
Opcode ID: 6f68eeb65eba81d6ac66c3940e4fbe5edb9d04ecbac620b0ea9682543601a27d
Instruction ID: 4d2f5d6df61b0d0ac72fc53e5f3b8721577eb5fe8aac3b6587ce23d73eaa98fa
Opcode Fuzzy Hash: 6f68eeb65eba81d6ac66c3940e4fbe5edb9d04ecbac620b0ea9682543601a27d
Instruction Fuzzy Hash: 4F212174500248FFDB00FFA2D886B5E77F8EB5435AF504477E800A7662D7786A498E5C

Function 0042F1C8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042F241

Part of subcall function 0042DD54: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD67

Part of subcall function 0042E824: SetErrorMode.KERNEL32(00008000), ref: 0042E82E
Part of subcall function 0042E824: LoadLibraryA.KERNEL32(00000000,00000000,0042E878,?,00000000,0042E896,?,00008000), ref: 0042E85D

GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042F224

Strings

SHAutoComplete, xrefs: 0042F21E
shlwapi.dll, xrefs: 0042F201

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressAutoCompleteDirectoryErrorLibraryLoadModeProcSystem
String ID: SHAutoComplete$shlwapi.dll
API String ID: 395431579-1506664499
Opcode ID: fea78621d95c1e237c5d632cecc57cb2540f2c7cd751ae87f924e1c2e904f64f
Instruction ID: 6fa00d493cbbc8796123fe1d0635de5045be30c1a8ceda1a87749c26dfdb7117
Opcode Fuzzy Hash: fea78621d95c1e237c5d632cecc57cb2540f2c7cd751ae87f924e1c2e904f64f
Instruction Fuzzy Hash: 6501C434700758FBE711DB62EC42B5A7AF8DB56704FD000B7B00062691C6BA9D48862D

Function 00456240 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E2AC: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,c]H,?,00000001,?,?,00485D63,?,00000001,00000000), ref: 0042E2C8

RegCloseKey.ADVAPI32(?,004562AB,?,00000001,00000000), ref: 0045629E

Strings

PendingFileRenameOperations2, xrefs: 0045627F
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 0045624C
PendingFileRenameOperations, xrefs: 00456270

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-2115312317
Opcode ID: 5fba846f718c07a23e1fe0a39e00e19641bb8bb1b86b0900bced3307de782ca4
Instruction ID: 03744892537dc61f373a56118159d2a705b6a08e7bce835c08af8ac15a0ef851
Opcode Fuzzy Hash: 5fba846f718c07a23e1fe0a39e00e19641bb8bb1b86b0900bced3307de782ca4
Instruction Fuzzy Hash: 2EF09671204604AFDB05E7A6DC13B6B73ACD744715FE245B7F900C7682DAB9ED04962C

Function 00481CFC Relevance: 6.1, APIs: 4, Instructions: 147fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,?,?,?,00000000,00481EF5,?,00000000,00000000,?,?,00483247,?,?,00000000), ref: 00481DA2
FindClose.KERNEL32(000000FF,000000FF,?,?,?,?,00000000,00481EF5,?,00000000,00000000,?,?,00483247,?,?), ref: 00481DAF
FindNextFileA.KERNEL32(000000FF,?,00000000,00481EC8,?,?,?,?,00000000,00481EF5,?,00000000,00000000,?,?,00483247), ref: 00481EA4
FindClose.KERNEL32(000000FF,00481ECF,00481EC8,?,?,?,?,00000000,00481EF5,?,00000000,00000000,?,?,00483247,?), ref: 00481EC2

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: ac95960268f67b52c1c322d972fa95fd5f125385e9a4bda87d1985851c0802c3
Instruction ID: 17f22ded17bc1a24cab4fcc20d90d4fd316fd24d8fcbd26835ba9c2c345e8b29
Opcode Fuzzy Hash: ac95960268f67b52c1c322d972fa95fd5f125385e9a4bda87d1985851c0802c3
Instruction Fuzzy Hash: 46512C75A00648AFCB11EF65CC45ADEB7FCAB88315F5048ABA808E7351D6389F86CF54

Function 00421704 Relevance: 6.1, APIs: 4, Instructions: 127windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 004217F1
SetMenu.USER32(00000000,00000000), ref: 0042180E
SetMenu.USER32(00000000,00000000), ref: 00421843
SetMenu.USER32(00000000,00000000), ref: 0042185F

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Menu
String ID:
API String ID: 3711407533-0
Opcode ID: 4f4a6720c0d4240df17a752d101e3e079c79ea095c8752a38fea6d697220fe84
Instruction ID: cda4d875d1f608ccb0f244f9e48059a425efb766f93e731c33a2d40a56ce0a72
Opcode Fuzzy Hash: 4f4a6720c0d4240df17a752d101e3e079c79ea095c8752a38fea6d697220fe84
Instruction Fuzzy Hash: 4641B230B002604BDB20BE3A98857DB36959FA1708F48047FB8408F3A7CA7DCC8587AD

Function 004176A8 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 004176F0
SetCursor.USER32(00000000), ref: 00417733
GetLastActivePopup.USER32(?), ref: 0041775D
GetForegroundWindow.USER32(?), ref: 00417764

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Cursor$ActiveForegroundLastPopupWindow
String ID:
API String ID: 1959210111-0
Opcode ID: 17e353cb9ed1886caefb16564110946e599dcae6e76cc5e95c37a117120ecdbf
Instruction ID: 2e5a0fdf5ba03c47f255224e58a8cf5d0223c50b95843e628a0bc5c759944eb4
Opcode Fuzzy Hash: 17e353cb9ed1886caefb16564110946e599dcae6e76cc5e95c37a117120ecdbf
Instruction Fuzzy Hash: C521A1342086018ACB10EF2AD885ADB33B1AB54754F45456BE4658B3A2D73CFC80CB89

Function 00416FD2 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 00417014
SetTextColor.GDI32(?,00000000), ref: 0041702E
SetBkColor.GDI32(?,00000000), ref: 00417048
CallWindowProcA.USER32(?,?,?,?,?), ref: 00417070

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Color$CallMessageProcSendTextWindow
String ID:
API String ID: 601730667-0
Opcode ID: 9e3e2694ee45dac8d31a23f67f82d5f08d8b2d5533639d352c95bf2745043790
Instruction ID: 80572e548b46958a0d24f1498dfa195ce4484893cdd9813db9ff7b95e026d91f
Opcode Fuzzy Hash: 9e3e2694ee45dac8d31a23f67f82d5f08d8b2d5533639d352c95bf2745043790
Instruction Fuzzy Hash: A71151B5604700AFD710EE6ECD84E8B77EDDF49310B14882BB599DB612C62CEC418B79

Function 00423558 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004235AE
EnumFontsA.GDI32(00000000,00000000,004234F8,004108F0,00000000,?,?,00000000,?,00419463,00000000,?,?,?,00000001), ref: 004235C1
GetDeviceCaps.GDI32(00000000,0000005A), ref: 004235C9
ReleaseDC.USER32(00000000,00000000), ref: 004235D4

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CapsDeviceEnumFontsRelease
String ID:
API String ID: 2698912916-0
Opcode ID: e97f28f260114bd4b50ee825155fd8757a5a43882207122cecfc92cdae6cf7ce
Instruction ID: e37963186075478de4bf5b94465d182e7684c730ebf482ac601e72b604436184
Opcode Fuzzy Hash: e97f28f260114bd4b50ee825155fd8757a5a43882207122cecfc92cdae6cf7ce
Instruction Fuzzy Hash: B301D2A17043006AE700BF795D82B9B37649F00309F04467BF808AF3C2D67E9805476E

Function 00455778 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,00000032), ref: 004557A4
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 004557C6
GetExitCodeProcess.KERNEL32(?,?), ref: 004557D5
CloseHandle.KERNEL32(?,00455802,004557FB,?,?,?,00000000,?,?,004559D7,?,?,?,00000044,00000000,00000000), ref: 004557F5

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
String ID:
API String ID: 4071923889-0
Opcode ID: 25019a6fde2673af39ea8f60e32856048f2a5345213706564f05ac8426ed01d1
Instruction ID: 5ee05597952c7b60c0905264d30be017cf261a6af7f6414952b470fafc47fcf8
Opcode Fuzzy Hash: 25019a6fde2673af39ea8f60e32856048f2a5345213706564f05ac8426ed01d1
Instruction Fuzzy Hash: B801B970A40A18BEEB10D7A58C16F7BBBACDF49770F610567F904D72C2D5B85D00C668

Function 0047ED34 Relevance: 6.0, APIs: 4, Instructions: 35sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0047ED55
GetLastError.KERNEL32 ref: 0047ED5F
GetTickCount.KERNEL32 ref: 0047ED69
Sleep.KERNEL32(00000032), ref: 0047ED79

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: 5d1d09b0ffd9139022f2f1044ca85cb4d004949c50f6cbd8fb92ddc82e99e44e
Instruction ID: 9351cbf26d123a2afca119e6512bbbf3229a572f7ed5a5225b004393602327fe
Opcode Fuzzy Hash: 5d1d09b0ffd9139022f2f1044ca85cb4d004949c50f6cbd8fb92ddc82e99e44e
Instruction Fuzzy Hash: 57E0E53130914245AA3035BB58826EF45C8CA89368F148BBFE088D6282C81C4C06957E

Function 0045CAF4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00451104: SetEndOfFile.KERNEL32(?,?,0045CBD2,00000000,0045CD5D,?,00000000,00000002,00000002), ref: 0045110B

FlushFileBuffers.KERNEL32(?), ref: 0045CD29

Strings

NumRecs range exceeded, xrefs: 0045CC26
EndOffset range exceeded, xrefs: 0045CC5D

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: File$BuffersFlush
String ID: EndOffset range exceeded$NumRecs range exceeded
API String ID: 3593489403-659731555
Opcode ID: 4511f9c3013fcb3e84f5fea4ca75803d875160a8c38b65402ff1f7a2ea995c79
Instruction ID: 31f4abf116af19d9e5b678acab2297332ff925687264b8022cc2431fdfe05cd7
Opcode Fuzzy Hash: 4511f9c3013fcb3e84f5fea4ca75803d875160a8c38b65402ff1f7a2ea995c79
Instruction Fuzzy Hash: 95617234A002948FDB25DF25C891BDAB7B5AF49305F0084DAED899B352D674AEC8CF54

Function 004856FC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00485886,?,00000000,004858C7,?,?,?,?,00000000,00000000,00000000,?,0046D345), ref: 00485735
SetActiveWindow.USER32(?,00000000,00485886,?,00000000,004858C7,?,?,?,?,00000000,00000000,00000000,?,0046D345), ref: 00485747

Strings

Will not restart Windows automatically., xrefs: 00485866

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Window$ActiveForeground
String ID: Will not restart Windows automatically.
API String ID: 307657957-4169339592
Opcode ID: 34989ff5964fb43013a0cd34c5f88aaa23c5ebb61d77ba7488245dd85afea415
Instruction ID: 6f7075e6ad957313efa8b6ce47ae5790fbafee6225c710032776f40f86fe86c7
Opcode Fuzzy Hash: 34989ff5964fb43013a0cd34c5f88aaa23c5ebb61d77ba7488245dd85afea415
Instruction Fuzzy Hash: A741E534604A40EFD721FB65DC05B6E7BE89B25304F548CB7E840D73A2D67C98189B2E

Function 0049B7DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 00403344: GetModuleHandleA.KERNEL32(00000000,0049B7EA), ref: 0040334B
Part of subcall function 00403344: GetCommandLineA.KERNEL32(00000000,0049B7EA), ref: 00403356

Part of subcall function 004063FC: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,004066B9,?,?,?,?,00000000,?,0049B7F4), ref: 00406417
Part of subcall function 004063FC: GetVersion.KERNEL32(kernel32.dll,00000000,004066B9,?,?,?,?,00000000,?,0049B7F4), ref: 0040641E
Part of subcall function 004063FC: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00406433
Part of subcall function 004063FC: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040645B

Part of subcall function 00406854: 6F571CD0.COMCTL32(0049B7F9), ref: 00406854

Part of subcall function 00410BF4: GetCurrentThreadId.KERNEL32 ref: 00410C42

Part of subcall function 004194D0: GetVersion.KERNEL32(0049B812), ref: 004194D0

Part of subcall function 0044FDB0: GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,0049B826), ref: 0044FDEB
Part of subcall function 0044FDB0: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044FDF1

Part of subcall function 0045027C: GetVersionExA.KERNEL32(0049E794,0049B82B), ref: 0045028B

Part of subcall function 004539C8: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453A86,?,?,?,?,00000000,00000000,?,0049B83A), ref: 004539EA
Part of subcall function 004539C8: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004539F0
Part of subcall function 004539C8: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453A86,?,?,?,?,00000000,00000000,?,0049B83A), ref: 00453A04
Part of subcall function 004539C8: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453A0A

Part of subcall function 004578E4: GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 0045793E

Part of subcall function 00465A14: LoadLibraryA.KERNEL32(00000000,SHPathPrepareForWriteA,00000000,00465A8A,?,?,?,?,00000000,00000000,?,0049B84E), ref: 00465A5F
Part of subcall function 00465A14: GetProcAddress.KERNEL32(00000000,00000000), ref: 00465A65

Part of subcall function 0046E39C: GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046E3E7

Part of subcall function 0047AB48: GetModuleHandleA.KERNEL32(kernel32.dll,?,0049B858), ref: 0047AB4E
Part of subcall function 0047AB48: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 0047AB5B
Part of subcall function 0047AB48: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 0047AB6B

Part of subcall function 0048615C: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 0048628F

Part of subcall function 004987D0: RegisterClipboardFormatA.USER32(QueryCancelAutoPlay), ref: 004987E9

SetErrorMode.KERNEL32(00000001,00000000,0049B8A0), ref: 0049B872

Part of subcall function 0049B59C: GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,0049B87C,00000001,00000000,0049B8A0), ref: 0049B5A6
Part of subcall function 0049B59C: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0049B5AC

Part of subcall function 00424964: SendMessageA.USER32(?,0000B020,00000000,?), ref: 00424983

Part of subcall function 00424754: SetWindowTextA.USER32(?,00000000), ref: 0042476C

ShowWindow.USER32(?,00000005,00000000,0049B8A0), ref: 0049B8D3

Part of subcall function 00484738: SetActiveWindow.USER32(?), ref: 004847E6

Strings

Setup, xrefs: 0049B8B9

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressProc$HandleModule$VersionWindow$ActiveClipboardCommandCurrentErrorF571FormatLibraryLineLoadMessageModeRegisterSendShowTextThread
String ID: Setup
API String ID: 3351940568-3839654196
Opcode ID: ff3bd980f19775fce471cc0b58d43bfcf481a72cfcbaf89a70458cc86981bf1e
Instruction ID: a7f49a1b2454fb9d13c9cc57ed783aecfdb57265b8d5b61bb1227c4f39fe8e57
Opcode Fuzzy Hash: ff3bd980f19775fce471cc0b58d43bfcf481a72cfcbaf89a70458cc86981bf1e
Instruction Fuzzy Hash: 1831D2712085409ED601BBB7F81391D3BA8EB9971CBA2443FF904D6653DF3D6814CA6E

Function 0048615C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00485BEC: GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00485BFD
Part of subcall function 00485BEC: GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00485C0A
Part of subcall function 00485BEC: GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00485C18
Part of subcall function 00485BEC: GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00485C20
Part of subcall function 00485BEC: GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 00485C2C
Part of subcall function 00485BEC: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 00485C4D
Part of subcall function 00485BEC: GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 00485C60
Part of subcall function 00485BEC: GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 00485C66

Part of subcall function 00485F28: GetVersionExA.KERNEL32(?,00486192,00000000,004862B4,?,?,?,?,00000000,00000000,?,0049B85D), ref: 00485F36
Part of subcall function 00485F28: GetVersionExA.KERNEL32(0000009C,?,00486192,00000000,004862B4,?,?,?,?,00000000,00000000,?,0049B85D), ref: 00485F88

Part of subcall function 0042DD54: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD67

Part of subcall function 0042E824: SetErrorMode.KERNEL32(00008000), ref: 0042E82E
Part of subcall function 0042E824: LoadLibraryA.KERNEL32(00000000,00000000,0042E878,?,00000000,0042E896,?,00008000), ref: 0042E85D

GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 0048628F

Strings

SHGetKnownFolderPath, xrefs: 0048625C
shell32.dll, xrefs: 00486277

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressProc$HandleModuleSystemVersion$CurrentDirectoryErrorInfoLibraryLoadModeNativeProcess
String ID: SHGetKnownFolderPath$shell32.dll
API String ID: 1303913335-2936008475
Opcode ID: 2f728e5d1a87b07d538365de82dde8f45d387ad31d77bd496df4ad016f527203
Instruction ID: 307e002974625469ace4e20107f2a2d0c4b5f1a610f079db10435b7f3a975dc7
Opcode Fuzzy Hash: 2f728e5d1a87b07d538365de82dde8f45d387ad31d77bd496df4ad016f527203
Instruction Fuzzy Hash: 5B310DB06102019EC700FFBA999674E3BA5DB5430CB51897BF400FB2D2D77DA8199B5E

Function 00454220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,0045430F,?,?,00000000,0049E62C,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00454266
GetLastError.KERNEL32(00000000,00000000,?,00000000,0045430F,?,?,00000000,0049E62C,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045426F

Strings

.tmp, xrefs: 0045424F

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: d27af9141acd211afe8f92a3fe8f46ca61c2cd4ee23f15482ee5b9e11b598b6e
Instruction ID: 415d91b16f05740ba1416afe7bf5adb9ba5615b539517dd81add0c9acb6d8760
Opcode Fuzzy Hash: d27af9141acd211afe8f92a3fe8f46ca61c2cd4ee23f15482ee5b9e11b598b6e
Instruction Fuzzy Hash: C9216775A002189BDB01EFA1C8429DFB7B8EB84309F50457BFC01BB342D63C9E458B65

Function 004578E4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00457874: CoInitialize.OLE32(00000000), ref: 0045787A

Part of subcall function 0042DD54: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD67

Part of subcall function 0042E824: SetErrorMode.KERNEL32(00008000), ref: 0042E82E
Part of subcall function 0042E824: LoadLibraryA.KERNEL32(00000000,00000000,0042E878,?,00000000,0042E896,?,00008000), ref: 0042E85D

GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 0045793E

Strings

shell32.dll, xrefs: 00457926
SHCreateItemFromParsingName, xrefs: 0045790B

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressDirectoryErrorInitializeLibraryLoadModeProcSystem
String ID: SHCreateItemFromParsingName$shell32.dll
API String ID: 1013667774-2320870614
Opcode ID: 2dad218d2bcd8b8d04a6be3da9667650384e8d6c0be75f7dad0e1017a7e35301
Instruction ID: 883c9a478e7d65875247b88054ead2603694175a92ab65d05d339cd7b334e9d1
Opcode Fuzzy Hash: 2dad218d2bcd8b8d04a6be3da9667650384e8d6c0be75f7dad0e1017a7e35301
Instruction Fuzzy Hash: F7F03670604608ABE700EBA6E842F5D77ACDB45759F604077B800B2692D67CAE08C96D

Function 0046E39C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DD54: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD67

Part of subcall function 0042E824: SetErrorMode.KERNEL32(00008000), ref: 0042E82E
Part of subcall function 0042E824: LoadLibraryA.KERNEL32(00000000,00000000,0042E878,?,00000000,0042E896,?,00008000), ref: 0042E85D

GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046E3E7

Strings

shell32.dll, xrefs: 0046E3CF
SHPathPrepareForWriteA, xrefs: 0046E3B4

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressDirectoryErrorLibraryLoadModeProcSystem
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2552568031-2683653824
Opcode ID: 75b7a76db085253fb4e1afae228b89b378ee629beb92f555a7f023e3cbe89257
Instruction ID: 1520e6e4c9beca3123f98d7cbe6aabbef4d784ad694bed30d21e1b99286f75d0
Opcode Fuzzy Hash: 75b7a76db085253fb4e1afae228b89b378ee629beb92f555a7f023e3cbe89257
Instruction Fuzzy Hash: 48F04434604618BBDB00EB63DC42F5E7BECD745754FA14076F400A6591EA78AE048969

Function 0047E5C4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,0047E916,00000000,0047E92C), ref: 0047E626

Strings

RegisteredOrganization, xrefs: 0047E615
RegisteredOwner, xrefs: 0047E603

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Close
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 3535843008-1113070880
Opcode ID: ba1d3af88125d37deb7769bce60f3bdea7a350656038f8bc4c18215c11c67e84
Instruction ID: b7a293ffbc304745ad82a7c218a700b437237249450e371f9f5efec7a02d2ef9
Opcode Fuzzy Hash: ba1d3af88125d37deb7769bce60f3bdea7a350656038f8bc4c18215c11c67e84
Instruction Fuzzy Hash: BCF0F030304108AFDB00EAA6EC82BAB3398C71530CF6085BBA105CB382E678EE05935C

Function 004770C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,004772F7), ref: 004770E5
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,004772F7), ref: 004770FC

Part of subcall function 00453C98: GetLastError.KERNEL32(00000000,0045482D,00000005,00000000,00454862,?,?,00000000,0049E62C,00000004,00000000,00000000,00000000,?,0049AFD9,00000000), ref: 00453C9B

Strings

CreateFile, xrefs: 004770F1

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: CreateFile
API String ID: 2528220319-823142352
Opcode ID: 8b979da8eb064dcf84bf0c7f08af0f3ea86d641e81bec75159ec054591adbaff
Instruction ID: 7698defaf15f1ec52deb809a1773a59103f7671ba23848988112bb9ee0245e09
Opcode Fuzzy Hash: 8b979da8eb064dcf84bf0c7f08af0f3ea86d641e81bec75159ec054591adbaff
Instruction Fuzzy Hash: D5E06D302843447BEA10EA69DCC6F4A77889B04778F10C161FA48AF3E2C5B9EC408658

Function 0042E2AC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,c]H,?,00000001,?,?,00485D63,?,00000001,00000000), ref: 0042E2C8

Strings

c]H, xrefs: 0042E2C2, 0042E2C5
System\CurrentControlSet\Control\Windows, xrefs: 0042E2C6

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Open
String ID: System\CurrentControlSet\Control\Windows$c]H
API String ID: 71445658-3663459043
Opcode ID: ed255555a649cb1171c21319c526f46fc311307b4f4854cf2574364da4ece07e
Instruction ID: 56e59db3f123c5f73e455ef79faaa31902e81261c81f50e50b595f428ef93046
Opcode Fuzzy Hash: ed255555a649cb1171c21319c526f46fc311307b4f4854cf2574364da4ece07e
Instruction Fuzzy Hash: 6FD0C772510128BBD701DA89DC41EFB775DDB15760F40401BFD1497141C2B4EC5197F4

Function 00483DC4 Relevance: 4.6, APIs: 3, Instructions: 108windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000,00000000,00483F21), ref: 00483EB9
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 00483ECA
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 00483EE2

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Menu$Append$System
String ID:
API String ID: 1489644407-0
Opcode ID: 889a1e0172067b814d840277a119bfb7f431957accaf9f91f771273a5256a38e
Instruction ID: 517f93ff3b7f79cbec7015235cad242bae1d5118d43b292230a06fe6919ea855
Opcode Fuzzy Hash: 889a1e0172067b814d840277a119bfb7f431957accaf9f91f771273a5256a38e
Instruction Fuzzy Hash: 4F31BF707043445AD711FF768C82BAE3A645B61708F50493BF901AB3E3CA7C9D09879D

Function 00452CE8 Relevance: 4.6, APIs: 3, Instructions: 75COMMON

Download Yara Rule

APIs

74D41520.VERSION(00000000,?,?,?,?), ref: 00452D08
74D41500.VERSION(00000000,?,00000000,?,00000000,00452D83,?,00000000,?,?,?,?), ref: 00452D35
74D41540.VERSION(?,00452DAC,?,?,00000000,?,00000000,?,00000000,00452D83,?,00000000,?,?,?,?), ref: 00452D4F

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: D41500D41520D41540
String ID:
API String ID: 2153611984-0
Opcode ID: 0b168feaf9c1533958fb5e02aa9a5501c5ad47ec3a54fa228dfedbb3323d7179
Instruction ID: ddd73f9b83f47df12750701182fb86573bb1adbd0e7288047a879799487d3de5
Opcode Fuzzy Hash: 0b168feaf9c1533958fb5e02aa9a5501c5ad47ec3a54fa228dfedbb3323d7179
Instruction Fuzzy Hash: EE216871A005086FD701DAA98D41DAFB7FCDB46711F554477FC04E3242D6799E08C769

Function 0042488C Relevance: 4.6, APIs: 3, Instructions: 59windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 004248A2
TranslateMessage.USER32(?), ref: 0042491F
DispatchMessageA.USER32(?), ref: 00424929

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: 217a056534c9592df3de3b745a25b010ee0154ab168cb63c5ecf066f178eda2d
Instruction ID: 2fd165f6649a427b3319829ae0df7e0e74220d275175f78bf4976128ec8e280a
Opcode Fuzzy Hash: 217a056534c9592df3de3b745a25b010ee0154ab168cb63c5ecf066f178eda2d
Instruction Fuzzy Hash: 9711C4703053605ADA20E634A9417ABB7C4CFC3704F82481EF9D987392D37D9D89879A

Function 00471494 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000), ref: 004714EE

Strings

Setting permissions on directory: %s, xrefs: 004714B4
Failed to set permissions on directory (%d)., xrefs: 004714FF

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set permissions on directory (%d).$Setting permissions on directory: %s
API String ID: 1452528299-3781482204
Opcode ID: b3ce2550a3e13a7f17b20411ef6b88505aa7d8c5d1afb7c3547408eec200ad37
Instruction ID: 9f45dfa5f0e3f48b2f53e46a978f86367242544ef595ae5f09ce392af88e9e4a
Opcode Fuzzy Hash: b3ce2550a3e13a7f17b20411ef6b88505aa7d8c5d1afb7c3547408eec200ad37
Instruction Fuzzy Hash: 40018870A041046BCB04DBAD948169DB7E89F8D314F5481BFB41DD73A2DA784D05879A

Function 00416AD4 Relevance: 4.5, APIs: 3, Instructions: 39COMMON

Download Yara Rule

APIs

SetPropA.USER32(00000000,00000000), ref: 00416AFA
SetPropA.USER32(00000000,00000000), ref: 00416B0F
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,00000000,00000000,?,00000000,00000000), ref: 00416B36

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Prop$Window
String ID:
API String ID: 3363284559-0
Opcode ID: ca2da7f31173854833d7953b84c34ce56dad1e92e4abe908f9585dd18103a5a6
Instruction ID: f49ac21c72ec4198518a05967b53ec16f1ca927682628d76ec8ffae5e4f9a687
Opcode Fuzzy Hash: ca2da7f31173854833d7953b84c34ce56dad1e92e4abe908f9585dd18103a5a6
Instruction Fuzzy Hash: 75F0B271741220AFD710AB9A8C85FA633DCAB19715F160176BD09EF286C678DC41C7A8

Function 004014E4 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017ED), ref: 00401513
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017ED), ref: 0040153A

Strings

@I, xrefs: 00401522

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: @I
API String ID: 2087232378-2158259926
Opcode ID: 330fc9ac9334848db76790626a4e6865ddd8d256e618db0b42c7a50a10bae29b
Instruction ID: 9ed38fc533d8e4e5af650f240f956f2e356275670cbb68eb90ec247bb51ad9a4
Opcode Fuzzy Hash: 330fc9ac9334848db76790626a4e6865ddd8d256e618db0b42c7a50a10bae29b
Instruction Fuzzy Hash: 27F0A772B0073067EB60596A4C81F5359C49FC5794F154076FD0DFF3E9D6B58C0142A9

Function 0041F2E4 Relevance: 4.5, APIs: 3, Instructions: 27windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0041F2F4
IsWindowEnabled.USER32(?), ref: 0041F2FE
EnableWindow.USER32(?,00000000), ref: 0041F324

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Window$EnableEnabledVisible
String ID:
API String ID: 3234591441-0
Opcode ID: 75da7560ddbcbd352d2b263d7a30c73b5df1f70394dc16e5d6cfb5f5cdd4f04a
Instruction ID: 461c9e3a5a3bf819d65056d8b2c697f5f692a305fcbbe48695acf38c0ff2848d
Opcode Fuzzy Hash: 75da7560ddbcbd352d2b263d7a30c73b5df1f70394dc16e5d6cfb5f5cdd4f04a
Instruction Fuzzy Hash: E1E0EDB4101204AAE710AB76DCC1A56779CFB54354F818437AC159B293DA3DE8459A78

Function 0048558C Relevance: 4.5, APIs: 3, Instructions: 25threadCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,?,?,004855F1,?,004856D6,?,?,00000000), ref: 00485592
GetWindowThreadProcessId.USER32(00000000,?), ref: 004855A4
GetCurrentProcessId.KERNEL32(00000000,?,00000000,00000000,?,?,004855F1,?,004856D6,?,?,00000000), ref: 004855AD

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ProcessWindow$CurrentForegroundThread
String ID:
API String ID: 3477312055-0
Opcode ID: 996f93cc0fd1671acdde675fbe98a916be79a1cdc6d3173bcbec28e182a408af
Instruction ID: e5cea65bf3c8685f0139c76254c0cf587960dce2b28f2b0a7ae61f389893fd84
Opcode Fuzzy Hash: 996f93cc0fd1671acdde675fbe98a916be79a1cdc6d3173bcbec28e182a408af
Instruction Fuzzy Hash: D0D0C233507A29BEAA10F5E55C858AFB38CCD00258350013BF800A2241EB289E014BBE

Function 0046B48C Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 0046B59D

Strings

PrepareToInstall, xrefs: 0046B547, 0046B5EE

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ActiveWindow
String ID: PrepareToInstall
API String ID: 2558294473-1101760603
Opcode ID: 940b052460ab40ea94c23c5fc4ba09da6f3c3e6d91b794f747d77c987f2d964d
Instruction ID: 12cc071809b213cca7ba1653dbdd78da5d723c2ce4756a813ec79d5f26e2f1e1
Opcode Fuzzy Hash: 940b052460ab40ea94c23c5fc4ba09da6f3c3e6d91b794f747d77c987f2d964d
Instruction Fuzzy Hash: 55A1EA34A00109DFDB00EB99D885ADEB7F5EF48304F5580B6E404AB362D738AE45DB99

Function 0046DA68 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

/:*?"<>|, xrefs: 0046DC04, 0046DC1B

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID:
String ID: /:*?"<>|
API String ID: 0-4078764451
Opcode ID: 6f094b8812726cbc02ce5f50eed2ff111d59969c43823d6d775436d8d720d67c
Instruction ID: 177692e88230760e8155e2224c01f0e20157c89546d228b91cc0b450a8799d1c
Opcode Fuzzy Hash: 6f094b8812726cbc02ce5f50eed2ff111d59969c43823d6d775436d8d720d67c
Instruction Fuzzy Hash: BA719870F442486BEB20EB66DC82F9E77A19B40704F148467F600AB3D6E6F96D45874E

Function 00484738 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 004847E6

Strings

InitializeWizard, xrefs: 0048477F

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ActiveWindow
String ID: InitializeWizard
API String ID: 2558294473-2356795471
Opcode ID: e4ac0a122ca1e7c9cdc9a91b5d84d1b71ccd8b65d02e63232501f9de399a146e
Instruction ID: 2c4eb2d2ce3cdf9076819dabc61c012abf47f38b78b73eeb7d897b1b6c3aed57
Opcode Fuzzy Hash: e4ac0a122ca1e7c9cdc9a91b5d84d1b71ccd8b65d02e63232501f9de399a146e
Instruction Fuzzy Hash: 3C1182306142409FD300FB29FC46B5A77E8E766318F61847BE404C77A2EA39AC04CB6D

Function 0047ED88 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0047EDD2

Strings

Failed to remove temporary directory: , xrefs: 0047EDEB

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CountTick
String ID: Failed to remove temporary directory:
API String ID: 536389180-3544197614
Opcode ID: 37aa5d9ccd1d002184800533cc766f39b8b42b5caae886cfff8fc9e62a626fdb
Instruction ID: 243faad06da25b47f2fc0cdc3d54c4e5f156695eed535aa564692cad55505d84
Opcode Fuzzy Hash: 37aa5d9ccd1d002184800533cc766f39b8b42b5caae886cfff8fc9e62a626fdb
Instruction Fuzzy Hash: A5017930614204AADB21EB73DC47B9A37A8EB48709F6049BBF504E65E3DB7CDD48859C

Function 0047E4E0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E2AC: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,c]H,?,00000001,?,?,00485D63,?,00000001,00000000), ref: 0042E2C8

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,0047E72C,00000000,0047E92C), ref: 0047E525

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0047E4F5

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CloseOpen
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 47109696-1019749484
Opcode ID: 1c3776d28d2b9cbb5efbad68c8021045545d76d5ea91609f5cf6558ce882d54f
Instruction ID: 92c053ef1d41e80c891b8ed6103c9cd0526155270fe20ef01eab32a30e32dc25
Opcode Fuzzy Hash: 1c3776d28d2b9cbb5efbad68c8021045545d76d5ea91609f5cf6558ce882d54f
Instruction Fuzzy Hash: BFF0897170411877DA00A59BAD42B9F679C8B4475CF60417BF508D7343E9B9DD02426C

Function 00470584 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,?,?,0049F1E4,?,0047089B,?,00000000,00470E5A,?,_is1), ref: 004705A7

Strings

Inno Setup: Setup Version, xrefs: 004705A5

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Value
String ID: Inno Setup: Setup Version
API String ID: 3702945584-4166306022
Opcode ID: 65721742f7e512d27ed5dd98e1fd79e27b470269e4a1a6d13b159dcf7a98e169
Instruction ID: e2b9726969cadf35a54cc0b9c41f3637184491e7e0aa8a2d8a80b038b226dd63
Opcode Fuzzy Hash: 65721742f7e512d27ed5dd98e1fd79e27b470269e4a1a6d13b159dcf7a98e169
Instruction Fuzzy Hash: C0E06D713422047BD710AA2A9C85F9BABDDDF88765F00803AF90CDB392D578DD0086A8

Function 004705F4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,00470C72,?,?,00000000,00470E5A,?,_is1,?), ref: 00470607

Strings

NoModify, xrefs: 00470605

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Value
String ID: NoModify
API String ID: 3702945584-1699962838
Opcode ID: 0244ceced9a2fa6cefac3a6cd879e87dd8628e8dbcc7d54f36b9873f4b9d1e71
Instruction ID: d5770e1f7431411e42dd6826dd8125d0bf9ffab3ab2c5cc5a764c212a1aa88fa
Opcode Fuzzy Hash: 0244ceced9a2fa6cefac3a6cd879e87dd8628e8dbcc7d54f36b9873f4b9d1e71
Instruction Fuzzy Hash: FBE04FB0641308FFEB04DB55CD4AF6AB7ECDB48714F108059BA089B380E674EE008A68

Function 00480468 Relevance: 3.2, APIs: 2, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,?,00000001,00000000,00480747,?,-0000001A,0048264A,-00000010,?,00000004,0000001C,00000000,004829E7,?,0045E3F8), ref: 004804DE

Part of subcall function 0042E7AC: GetDC.USER32(00000000), ref: 0042E7BB
Part of subcall function 0042E7AC: EnumFontsA.GDI32(?,00000000,0042E798,00000000,00000000,0042E804,?,00000000,00000000,?,00000001,00000000,00000002,00000000,004833CD), ref: 0042E7E6
Part of subcall function 0042E7AC: ReleaseDC.USER32(00000000,?), ref: 0042E7FE

SendNotifyMessageA.USER32(00020410,00000496,00002711,-00000001), ref: 004806AE

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: EnumFontsMessageNotifyReleaseSend
String ID:
API String ID: 2649214853-0
Opcode ID: de6cb8aece078433d2c351260add2d1ff239ac26ea4a38c5fa980c85f4ce8ccd
Instruction ID: 527bf1574ec65b10efbaf36774355a0bd7e105d09414135505558f1978d40ef5
Opcode Fuzzy Hash: de6cb8aece078433d2c351260add2d1ff239ac26ea4a38c5fa980c85f4ce8ccd
Instruction Fuzzy Hash: D75183746201009BD761FF26D98164E37A9AB94309F50893BA8049B367D73CED4E8BAD

Function 00448C38 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

\"C, xrefs: 00448D1B

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID:
String ID: \"C
API String ID: 0-3531626700
Opcode ID: 30a328f435ee913d43f187996ccdb659d53b662c622b874d6f5605adaeeae596
Instruction ID: f5f483aec3d2c3735162743f0f10eca8e2323ca8cf87c051d84e324ab728ab9c
Opcode Fuzzy Hash: 30a328f435ee913d43f187996ccdb659d53b662c622b874d6f5605adaeeae596
Instruction Fuzzy Hash: 72518570E041099FEB01EFA9C482AAEBBF5EB49314F50457EE504E7392DB389D45CB98

Function 00402088 Relevance: 3.1, APIs: 2, Instructions: 122COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049E420,00000000,004021FC), ref: 004020CB

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049E420,00000000,00401A82,?,?,0040222E,022E4560,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049E420,0049E420,00000000,00401A82,?,?,0040222E,022E4560,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049E420,00000000,00401A82,?,?,0040222E,022E4560,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049E420,00401A89,00000000,00401A82,?,?,0040222E,022E4560,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
String ID:
API String ID: 296031713-0
Opcode ID: 547a076aece2b5fcd0bfa9c0aac183852627f31bce113781b835fdbf9e3dd56e
Instruction ID: 61fc07f4a870d1560c8aa4f523a2630168574f360eba5de965793f91e9822c8e
Opcode Fuzzy Hash: 547a076aece2b5fcd0bfa9c0aac183852627f31bce113781b835fdbf9e3dd56e
Instruction Fuzzy Hash: CF41D4B2E00311DFEB10CF6ADD8521A77A4F7A8324B15457BD854A77E2D379A841CB88

Function 0042E090 Relevance: 3.1, APIs: 2, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0042E1C8), ref: 0042E0CC
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,70000000,?,?,00000000,?,00000000,?,00000000,0042E1C8), ref: 0042E13C

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 84705cc745a76f35316d583d44dda58a4a0f4931e2014e09282529c66a3fa9aa
Instruction ID: ac779da0cea268326c2a6d460357836690a2c7bc48c0bb75f71a4d6dd427c8e5
Opcode Fuzzy Hash: 84705cc745a76f35316d583d44dda58a4a0f4931e2014e09282529c66a3fa9aa
Instruction Fuzzy Hash: F6415D71E00129ABDB11DE92D881BBFB7B9AB00704F94447AE804F7281D738AE44CBA5

Function 004015C0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000), ref: 00401624

Strings

@I, xrefs: 004015E7, 00401640

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: FreeVirtual
String ID: @I
API String ID: 1263568516-2158259926
Opcode ID: 6b057d2c0436b88e28c64713d6a5a00de73f86507ab2da55154a17b7a351f197
Instruction ID: bd76921ffe59aa88de5230eaed8b1f23e55216d7bf308acd6bfd4d0ca449e252
Opcode Fuzzy Hash: 6b057d2c0436b88e28c64713d6a5a00de73f86507ab2da55154a17b7a351f197
Instruction Fuzzy Hash: DC21E5706083109FD714DF19C880A1BBBE1AB85764F18C97AF4989B3A0D335EC41CB9A

Function 00452FC0 Relevance: 3.1, APIs: 2, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,?,?,00458B08,00000000,00458AF0,?,?,?,00000000,0045303A,?,?,?,00000001), ref: 00453014
GetLastError.KERNEL32(00000000,00000000,?,?,00458B08,00000000,00458AF0,?,?,?,00000000,0045303A,?,?,?,00000001), ref: 0045301C

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CreateErrorLastProcess
String ID:
API String ID: 2919029540-0
Opcode ID: 6bdd04fd0769ea286c19158849c0db6ee65ab2298e2dc204ccc1e1a0e9e62729
Instruction ID: 40d7024e4d16b92ea7ab131ffee0136a49eeacae8a41eb0ea1d4695c7838d43a
Opcode Fuzzy Hash: 6bdd04fd0769ea286c19158849c0db6ee65ab2298e2dc204ccc1e1a0e9e62729
Instruction Fuzzy Hash: 6B113972600208AF8B40DEA9EC41D9FB7ECEB4D751B11456AFD08E3242D678AE149B68

Function 0040B268 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,00000000,0000000A), ref: 0040B282
FreeResource.KERNEL32(00000000,00400000,00000000,0000000A,F0E80040,00000000,?,?,0040B3DF,00000000,0040B3F7,?,?,?,00000000), ref: 0040B293

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Resource$FindFree
String ID:
API String ID: 4097029671-0
Opcode ID: 11910ce2e48d667c178060aa418dc8182a300d2cc1cce9214c585b818dd27825
Instruction ID: 695c6acfda2bd8b41d5000065fdd751145cb6e9c132907bad199632a3a3e20ef
Opcode Fuzzy Hash: 11910ce2e48d667c178060aa418dc8182a300d2cc1cce9214c585b818dd27825
Instruction Fuzzy Hash: 9701F7717003046FD700EF66DC52D1A77ADDB49758711807BF500EB2D0D6799C01D66D

Function 0041F334 Relevance: 3.0, APIs: 2, Instructions: 49threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041F383
EnumThreadWindows.USER32(00000000,0041F2E4,00000000), ref: 0041F389

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Thread$CurrentEnumWindows
String ID:
API String ID: 2396873506-0
Opcode ID: 8784a61061ea2f72866c7836b43b9cd2818a747c771340166bb5f43570082ce4
Instruction ID: 69490fc5d8632824c24a89202964c68dfb33a06c8812e8dd8cc51cc2245d12bd
Opcode Fuzzy Hash: 8784a61061ea2f72866c7836b43b9cd2818a747c771340166bb5f43570082ce4
Instruction Fuzzy Hash: E7016D75A04608BFD701CF76EC5195ABBF8E789720B62C877E804D3790E7386811DE18

Function 00453458 Relevance: 3.0, APIs: 2, Instructions: 48fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(00000000,00000000), ref: 0045349A
GetLastError.KERNEL32(00000000,00000000,00000000,004534C0), ref: 004534A2

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ErrorFileLastMove
String ID:
API String ID: 55378915-0
Opcode ID: adca0fb654cbd27ed09ce5f3a2a0329ed0c23e60f2de00c2f2db474d6bd7b68a
Instruction ID: 5a71c9ebfc6e30e6f75dea94ac3527a97129e64dc0aec59c9e94cd5048fba101
Opcode Fuzzy Hash: adca0fb654cbd27ed09ce5f3a2a0329ed0c23e60f2de00c2f2db474d6bd7b68a
Instruction Fuzzy Hash: FD01DB71B04204BB8701DF796C4146EB7ECDB49756750457BFC08E3642D67C5E045558

Function 0040170C Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,?,?,?,?,00401973), ref: 00401766

Strings

@I, xrefs: 0040173B, 0040177B

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: FreeVirtual
String ID: @I
API String ID: 1263568516-2158259926
Opcode ID: 8d0a8cf20b205c9ca7559f22481a3cdfe46ae7719f246c59aafab3b89ca1ae88
Instruction ID: 4f728963ec5fa8eda03367237536c92bed861ff5ff18aa36a9f69eb769fc07b0
Opcode Fuzzy Hash: 8d0a8cf20b205c9ca7559f22481a3cdfe46ae7719f246c59aafab3b89ca1ae88
Instruction Fuzzy Hash: 9301FC766442148FC310DE29DCC0E2677E8D794378F15453EDA85673A1D37A6C0187D9

Function 00452F48 Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00452FA7), ref: 00452F81
GetLastError.KERNEL32(00000000,00000000,00000000,00452FA7), ref: 00452F89

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: b07e164ae0180da5e797fa5ef51a113e45cbec4dbac29b4f01935b6ba88dc4c2
Instruction ID: cf61ce5d280b64ea4255fcfe7f7ba91008230ec5b979775999a4ad96c0828db4
Opcode Fuzzy Hash: b07e164ae0180da5e797fa5ef51a113e45cbec4dbac29b4f01935b6ba88dc4c2
Instruction Fuzzy Hash: B0F02872A04204BFCB00EF75BD4259EB3F8EB0A311B5045B7FC04E3282E7B94E149698

Function 004530E0 Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,00000000,0045313D,?,-00000001,?), ref: 00453117
GetLastError.KERNEL32(00000000,00000000,0045313D,?,-00000001,?), ref: 0045311F

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 40645b36163f033e97ffdf6dc76953f4f043c170f49f07391dc5b9af07b27948
Instruction ID: 81c0bdea8a0994a861ca8edc2f0ad378144066bfaf6b8ff8599f6d62d0773b7c
Opcode Fuzzy Hash: 40645b36163f033e97ffdf6dc76953f4f043c170f49f07391dc5b9af07b27948
Instruction Fuzzy Hash: D5F04C71A00B04AFCB00EF75AC4149EB7ECDB0975275045B7FC04E3242E63C5F145558

Function 004535E8 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

RemoveDirectoryA.KERNEL32(00000000,00000000,00453645,?,-00000001,00000000), ref: 0045361F
GetLastError.KERNEL32(00000000,00000000,00453645,?,-00000001,00000000), ref: 00453627

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 91b6b9c871f83cb2d815dac639a9ca00aaf5eac3d0c82d0f8b11ba73be3f437d
Instruction ID: d4adb31c026f3fa451eddbaf1019c3137852e3bc79311a962629eb31c94406ba
Opcode Fuzzy Hash: 91b6b9c871f83cb2d815dac639a9ca00aaf5eac3d0c82d0f8b11ba73be3f437d
Instruction Fuzzy Hash: 00F0C871A04704BF8B10DFB5AC4249EB7E8EB0975676045BBFC04E3742E6785E049598

Function 004532B8 Relevance: 3.0, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00453317,?,?,00000000), ref: 004532F1
GetLastError.KERNEL32(00000000,00000000,00453317,?,?,00000000), ref: 004532F9

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: f2929d8a03bef60b57bd9d8f1d54ea3d547967c1c06ae77a67827eb3113f6d1f
Instruction ID: 48e04e5ec44c6ac1c9b7416c1fee27a195ecc4b6640575f77e406a75718a63f3
Opcode Fuzzy Hash: f2929d8a03bef60b57bd9d8f1d54ea3d547967c1c06ae77a67827eb3113f6d1f
Instruction Fuzzy Hash: 17F0FC71A04708ABCB10EFB5AC414AEB7A8EB4932676046B7FC14E36C3DB7D5F049558

Function 004236CC Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 004236D9
LoadCursorA.USER32(00000000,00000000), ref: 00423703

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CursorLoad
String ID:
API String ID: 3238433803-0
Opcode ID: 435632a159b4ee3f4de27f3f53cb37f8d356402f2aecc44b66926b1db8d28f8a
Instruction ID: 38849c99451a314d8fe435546c8a0ff0f6ed66ecc1deebef06b1f4ec46e3768a
Opcode Fuzzy Hash: 435632a159b4ee3f4de27f3f53cb37f8d356402f2aecc44b66926b1db8d28f8a
Instruction Fuzzy Hash: 5FF0A7617041206BD620593E6CC1D2A76AC8B81B35F61033BFA2BD73D1C66E6D41416D

Function 0042E824 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 0042E82E
LoadLibraryA.KERNEL32(00000000,00000000,0042E878,?,00000000,0042E896,?,00008000), ref: 0042E85D

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 52fc65cf806279aaad662d3b1e3333b45c46a16ca84e47e60ba8f8dfd3806aa9
Instruction ID: d8a4edba93e6b3564287fdd291ee362a4641d771db482aeeea55453c97403edd
Opcode Fuzzy Hash: 52fc65cf806279aaad662d3b1e3333b45c46a16ca84e47e60ba8f8dfd3806aa9
Instruction Fuzzy Hash: 49F08270B14744BEDB116F779C6282BBBECE749B1079249B6F800A3691E63C88108928

Function 0046F6F0 Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,0046F786), ref: 0046F6FA
756FE550.OLE32(0049CBA0,00000000,00000001,0049CBB0,?,?,0046F786), ref: 0046F716

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: E550Version
String ID:
API String ID: 1323609852-0
Opcode ID: 27d9c8de699d70c3af72ca495f1d6c89b44d9af8c0a5d583989dd02520804707
Instruction ID: 332733ba3b7aad20b23de4c2050fe78918fd3c6ecf1ada1e8d4443b9132fd7c7
Opcode Fuzzy Hash: 27d9c8de699d70c3af72ca495f1d6c89b44d9af8c0a5d583989dd02520804707
Instruction Fuzzy Hash: CCF03771245241AEEF14DB29EC46B4537D46711715F504077E084C7292E269949A9B1E

Function 0041675A Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,?,?), ref: 00416771
GetClassInfoA.USER32(00000000,?,?), ref: 00416781

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: 78c4e29436f80b4b0d425f71d8ee3ae4dc0b298ba6739ce350afe6e520a042aa
Instruction ID: 274aca261c31f541687662128f2c88f3b3bc1ada98ceb95192ccf52487cc15f7
Opcode Fuzzy Hash: 78c4e29436f80b4b0d425f71d8ee3ae4dc0b298ba6739ce350afe6e520a042aa
Instruction Fuzzy Hash: 67E012B26015216ADB10DF998D81EE326DCDB0C354B110163BA04CE185D764DD0047A4

Function 0047E875 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(0049CD58,00008000,00000000,?), ref: 0047E885
757283B0.OLE32(?,0047E8C8), ref: 0047E8BB

Strings

\Program Files, xrefs: 0047E747
SystemDrive, xrefs: 0047E6BF
COMMAND.COM, xrefs: 0047E907
Failed to get path of 64-bit Program Files directory, xrefs: 0047E7C9
cmd.exe, xrefs: 0047E8E6
CommonFilesDir, xrefs: 0047E75A, 0047E7D6
ProgramFilesDir, xrefs: 0047E720, 0047E7A7
Common Files, xrefs: 0047E791
Failed to get path of 64-bit Common Files directory, xrefs: 0047E7F8

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: 757283FolderKnownPath
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 733073498-544719455
Opcode ID: f7eb8dc9dfbd8fd713037c34d21e9b35a2074041128512ee54110ee0df60047e
Instruction ID: c99023a47a98c18ccccacd7d7febfbddf1e638e1f292d924a8ca3b733edffaa7
Opcode Fuzzy Hash: f7eb8dc9dfbd8fd713037c34d21e9b35a2074041128512ee54110ee0df60047e
Instruction Fuzzy Hash: 2BE09B31740640BFEB119F63DC52B5977A8EB4EB04BB284F3F500D6690D67CAD08961C

Function 004510D0 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000002,?,?,004718CD,?,00000000), ref: 004510E6
GetLastError.KERNEL32(?,00000000,?,00000002,?,?,004718CD,?,00000000), ref: 004510EE

Part of subcall function 00450E8C: GetLastError.KERNEL32(00450CA8,00450F4E,?,00000000,?,0049AA60,00000001,00000000,00000002,00000000,0049ABC1,?,?,00000005,00000000,0049ABF5), ref: 00450E8F

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: c703f6107b77aa26ad3f54e779f74b6f667f5f4b9045cd3d78d886431c85af3c
Instruction ID: 35e945613fc18ccecab22534e9d11e811fcb2dd239ff33a76439916eeb31a03f
Opcode Fuzzy Hash: c703f6107b77aa26ad3f54e779f74b6f667f5f4b9045cd3d78d886431c85af3c
Instruction Fuzzy Hash: 78E012B5305201ABE710EA7599C2F2B22D8DB44715F11846AF944CB197D6B4CC858B25

Function 004855C0 Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004855CA
GetTickCount.KERNEL32 ref: 004855C1

Part of subcall function 0048558C: GetForegroundWindow.USER32(00000000,00000000,?,?,004855F1,?,004856D6,?,?,00000000), ref: 00485592
Part of subcall function 0048558C: GetWindowThreadProcessId.USER32(00000000,?), ref: 004855A4
Part of subcall function 0048558C: GetCurrentProcessId.KERNEL32(00000000,?,00000000,00000000,?,?,004855F1,?,004856D6,?,?,00000000), ref: 004855AD

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CountProcessTickWindow$CurrentForegroundThread
String ID:
API String ID: 711787588-0
Opcode ID: 8a2aadf448318b4650585d1f8fd06eecde4e3469398304ca24b4ad923bb8dbb6
Instruction ID: e3cc9d972cdf87937eb669e9bdf79cc56a8cd3ffb79b0b4055aa310992070ef3
Opcode Fuzzy Hash: 8a2aadf448318b4650585d1f8fd06eecde4e3469398304ca24b4ad923bb8dbb6
Instruction Fuzzy Hash: 79D0C980201A52A9DD0036B6969223E06099F9236CF900C7FB80AAA18BDC5C89451B7F

Function 0041F484 Relevance: 3.0, APIs: 2, Instructions: 16threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041F49E
EnumThreadWindows.USER32(00000000,0041F420,00000000), ref: 0041F4A4

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Thread$CurrentEnumWindows
String ID:
API String ID: 2396873506-0
Opcode ID: 2729d1d79ecff6432a236deb35ee743c8ded0647c3df85ada7a6525f03c6ac71
Instruction ID: 75665bbd1333b87d4042b69af81cf8ad2dce64c3ae0a8143277a6f01837293b2
Opcode Fuzzy Hash: 2729d1d79ecff6432a236deb35ee743c8ded0647c3df85ada7a6525f03c6ac71
Instruction Fuzzy Hash: 1CE06771A10220AFDF10EF79ED95B5637E5E760324F52483BA404D62A1E3787885EB2C

Function 00408A6C Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408BA2), ref: 00408A8B

Part of subcall function 0040727C: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00407299

Part of subcall function 004089F8: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049E4C4,00000001,?,00408AC3,?,00000000,00408BA2), ref: 00408A16

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: e3bde22edff9b95fb01644fc2752e12edfd564b8e42cb00d732a26da313984e4
Instruction ID: 1a1ee965da3d5e477180f9d3e1b3e31d3a1d40cbd97d3d5e52e02950362564b9
Opcode Fuzzy Hash: e3bde22edff9b95fb01644fc2752e12edfd564b8e42cb00d732a26da313984e4
Instruction Fuzzy Hash: A7314F75E001099BCF00EB95C8819EEB779EF84314F51857BE814BB286E738AE458B99

Function 0042002C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

SetScrollInfo.USER32(00000000,?,?,00000001), ref: 004200C9

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: InfoScroll
String ID:
API String ID: 629608716-0
Opcode ID: 4038a9721f8deaf5412c4e17f668d42a633933aac620105991029e29eea6c581
Instruction ID: fb0b6b32162d284d5e4e4472e465846aa9f3b1678ed1a2f027c040ff7edaf6c0
Opcode Fuzzy Hash: 4038a9721f8deaf5412c4e17f668d42a633933aac620105991029e29eea6c581
Instruction Fuzzy Hash: 4E214FB1604755AFD340DF39A44076ABBE4BB48314F04892EE098C3341E779E995CBD6

Function 0046D9FC Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0041F334: GetCurrentThreadId.KERNEL32 ref: 0041F383
Part of subcall function 0041F334: EnumThreadWindows.USER32(00000000,0041F2E4,00000000), ref: 0041F389

SHPathPrepareForWriteA.SHELL32(00000000,00000000,00000000,00000000,00000000,0046DA5A,?,00000000,?,?,0046DC6C,?,00000000,0046DCE0), ref: 0046DA3E

Part of subcall function 0041F3E8: IsWindow.USER32(?), ref: 0041F3F6
Part of subcall function 0041F3E8: EnableWindow.USER32(?,00000001), ref: 0041F405

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ThreadWindow$CurrentEnableEnumPathPrepareWindowsWrite
String ID:
API String ID: 3319771486-0
Opcode ID: 14c83a23c86b42327ca1301f62a4784445c04927232d49b89820285b89b2dd83
Instruction ID: 0c208c65a233b0f8173889f0c0708269dbf0c44dae4fff659f8412be6aa39092
Opcode Fuzzy Hash: 14c83a23c86b42327ca1301f62a4784445c04927232d49b89820285b89b2dd83
Instruction Fuzzy Hash: EEF0FA31B4C340AFEB00ABA1AC06B2ABBA8E308B01F60443BF400C2181E57968448A2E

Function 00441884 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

FindWindowA.USER32 ref: 0044189B

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: d61e7892e696cd19dbec5936e1f60c0eb1c4f94c101f5f53d8ed807e2bb541d1
Instruction ID: 850523c8192acc5f312cb1de621ff25e5ab3bd2d92c35f47567aa441f6601735
Opcode Fuzzy Hash: d61e7892e696cd19dbec5936e1f60c0eb1c4f94c101f5f53d8ed807e2bb541d1
Instruction Fuzzy Hash: 2FF01D34605109EBEB1CEF58D0659BF77A5EF59310B20806FF5079B3A0D634AE80D659

Function 004169E0 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,00000000,00400000,?), ref: 00416A15

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 66225c5018934712ca213f7cbc9da523afb779e1f1452fe3fdaea1241b34de43
Instruction ID: 5ef094d12f7d71e5830b73219e88c414bb2d46ce683ba0b40c209d6d3be90de3
Opcode Fuzzy Hash: 66225c5018934712ca213f7cbc9da523afb779e1f1452fe3fdaea1241b34de43
Instruction Fuzzy Hash: 26F025B2200510AFDB84CF9CD9C0F9373ECEB0C210B0881A6FA08CF24AD261EC108BB1

Function 00414E44 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 00414E7F

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction ID: 59ac3629b8f45f7a6bca1b57e2bf54285868c68ba6336e642f1ef9b7bb8d2b05
Opcode Fuzzy Hash: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction Fuzzy Hash: B2F0DA762042019FC740DF6CC8C488A77E5FF89255B5546A9F989CB356C731EC54CB91

Function 00450F9C Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00450FDC

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9fba401eb2ef93c052fefded133532dd7b7648c4e12e3770cd5a720851f907d3
Instruction ID: 0bb8bc98a2ce5191ccdfd632eb20aa7c5cb2b99e9b0e2766e1f3384ce1d09118
Opcode Fuzzy Hash: 9fba401eb2ef93c052fefded133532dd7b7648c4e12e3770cd5a720851f907d3
Instruction Fuzzy Hash: 28E092B13401483ED340DFAC7C81F9237CC931A314F008033B948D7241C4619D118BA8

Function 0042D15C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,0042D1A4,?,00000001,?,?,00000000,?,0042D1F6,00000000,004531FD,00000000,0045321E,?,00000000), ref: 0042D187

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: df0e329498236c2f478cc1db8dd22838dd1caee4c40fefc7c7d6d469df34ded1
Instruction ID: 90f30b3d4511ddb26d4e54eb5cb5bde7ef97429f4a5987d97ea56347c6c51953
Opcode Fuzzy Hash: df0e329498236c2f478cc1db8dd22838dd1caee4c40fefc7c7d6d469df34ded1
Instruction Fuzzy Hash: C0E09B71704344BFD701FF62DC53E5ABBECDB49714BA14476B404D7691D5785E10C468

Function 0042ED58 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453A6B,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042ED77

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 1828867668d4f08c7f2c42ac7f7c8b165bd44dc6f1d36d1d73a42743962ef3e6
Instruction ID: e79f09bbc4d4bb3d85d444e79d719d693aec0fec5ee663d6819558c24f001612
Opcode Fuzzy Hash: 1828867668d4f08c7f2c42ac7f7c8b165bd44dc6f1d36d1d73a42743962ef3e6
Instruction Fuzzy Hash: F1E0206179471226F23515566C43B77160E43C0704F94403A7F40DD3D3D6AE9906425E

Function 0041B400 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetTextExtentPointA.GDI32(?,00000000,00000000), ref: 0041B42B

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ExtentPointText
String ID:
API String ID: 566491939-0
Opcode ID: 97ef2b47204d9ad8b68a2942e27bd59d3a2041fe26efab6d88411218ff44afed
Instruction ID: 057afb1858efcd2ad2350c2ac732019e343566302d0f77af58694ac232672b8c
Opcode Fuzzy Hash: 97ef2b47204d9ad8b68a2942e27bd59d3a2041fe26efab6d88411218ff44afed
Instruction Fuzzy Hash: B0E04FA17087206B9200A67E5D8199B66CCCA49229314813AB458E7393DB28DE0142EE

Function 00406300 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000000,00423B0C,00000000,94CA0000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,0042409C), ref: 00406329

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 8af83935ca987eeebb979c0a6a94b74e9f9155cd6b79be10dcadafa6e5b8a04f
Instruction ID: 1d12608fc0467a25e6c73015cc4d191371d7057fe5102c86e19c90aa3d4ae925
Opcode Fuzzy Hash: 8af83935ca987eeebb979c0a6a94b74e9f9155cd6b79be10dcadafa6e5b8a04f
Instruction Fuzzy Hash: 4CE002B2204309BFDB00DE8ADDC1DABB7ACFB4C654F844105BB1C972428275AD608BB1

Function 0042E274 Relevance: 1.5, APIs: 1, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042E2A0

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0176313b990e627144a98c563797b2aa94ba8c1742ed393e805deb037db11557
Instruction ID: 044d428b259045dd8d70169eba5582473f2465fe40b566e0c3803628c0088fca
Opcode Fuzzy Hash: 0176313b990e627144a98c563797b2aa94ba8c1742ed393e805deb037db11557
Instruction Fuzzy Hash: 95E07EB6600119AF9B40DE8DDC81EEB37ADAB5D350F444016FA08E7200C2B8EC519BB4

Function 004553F4 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000,000000FF,00472274,00000000,00473090,?,00000000,004730D9,?,00000000,00473212,?,00000000,?,00000000), ref: 0045540A

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 48fdf784f5c9952460186cd779b6c0633e1e93f0c81735265aae423de7589abb
Instruction ID: 28e14624e7d984739f20d0e4d86e518db2bc554dea3c65e8367e83ac0f5ee186
Opcode Fuzzy Hash: 48fdf784f5c9952460186cd779b6c0633e1e93f0c81735265aae423de7589abb
Instruction Fuzzy Hash: EDE09B70904A004BC714DF3A948031A76D19F89321F04C66ABC98CB3D7D73C84495617

Function 00414B0C Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00498602,?,00498624,?,?,00000000,00498602,?,?), ref: 00414B2B

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction ID: 3a83c41fa5c3d176b15f2666d2672a78f9af76d4247255e2ff0bda4df6ea0631
Opcode Fuzzy Hash: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction Fuzzy Hash: 59E012723001199F8250CE5EDC88C57FBEDEBC966130983A6F508C7306DA31EC44C7A0

Function 004073A0 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004073B4

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 803a6739d4a2560f638b2739305ab39b64de9ba4a7bf4e405682762548192292
Instruction ID: 517e21fc39e357fcc75414f86969db1bfc0739985e912eef881c3d4632b4c6ac
Opcode Fuzzy Hash: 803a6739d4a2560f638b2739305ab39b64de9ba4a7bf4e405682762548192292
Instruction Fuzzy Hash: 74D012723181506AE220A55A5C44EAB6EDCCBC5770F10063AB958D21C1D6309C01C675

Function 00423ADC Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00423A88: SystemParametersInfoA.USER32(00000048,00000000,00000000,00000000), ref: 00423A9D

ShowWindow.USER32(004108F0,00000009,?,00000000,0041F234,00423DCA,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,0042409C), ref: 00423AF7

Part of subcall function 00423AB8: SystemParametersInfoA.USER32(00000049,00000000,00000000,00000000), ref: 00423AD4

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: InfoParametersSystem$ShowWindow
String ID:
API String ID: 3202724764-0
Opcode ID: 0cd5f38af876faa104da453c3b02373ae7a31cfe7914aa4df65171e45d68c077
Instruction ID: a4d1e59934daad15499cd62f29d800d7a8388f589a5efdc182870931650505b7
Opcode Fuzzy Hash: 0cd5f38af876faa104da453c3b02373ae7a31cfe7914aa4df65171e45d68c077
Instruction Fuzzy Hash: 81D05B127411702102107A7B2405A8B45AC4D9225B384047BB48097303D95D4D0552A8

Function 00424754 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(?,00000000), ref: 0042476C

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 805f3cc7500933323b9257a6a261a55e12d82397c97f56fe04234c9d564d4e6f
Instruction ID: 9eeed77ebbf23638ebb637759628e88e4fff7ef3ebed755505968d13fb2e7b10
Opcode Fuzzy Hash: 805f3cc7500933323b9257a6a261a55e12d82397c97f56fe04234c9d564d4e6f
Instruction Fuzzy Hash: 44D05EE2B011702BCB01BAAD54C4AC667CC8B8925AB1940BBF904EF257C738CE408398

Function 0042D1FC Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0045342D,00000000,00453446,?,-00000001,00000000), ref: 0042D207

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 1551a48d1e797e5d679e20981dd88cffeca844634b99c0218d01e97a9570d1a0
Instruction ID: e5f2e3cc9ba97ef7900907df2193dd237fa001b37e9b2d68f150ea36bea2ffb0
Opcode Fuzzy Hash: 1551a48d1e797e5d679e20981dd88cffeca844634b99c0218d01e97a9570d1a0
Instruction Fuzzy Hash: 6AD012D075521055DE1469FD2CC635701884B6D335BA49AB7F968E72E3D23DC957103C

Function 00414A8C Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,004207B4,?,00000000,?,?,00420664,?,?,00000000,?,004983C8,?), ref: 00414AA1

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: b30e0f149d6ce6ecfaa99d58deb2f9c5147ee1e779888ff8811825aa21b8416c
Instruction ID: 74d1fdeef6e580d8e57303468b384991d7437886a41b74f4b6fe49057d189cfd
Opcode Fuzzy Hash: b30e0f149d6ce6ecfaa99d58deb2f9c5147ee1e779888ff8811825aa21b8416c
Instruction Fuzzy Hash: D5D0A9B2310A108FC3A0CA6CC8C4E03B3ECAF4C260B048699F28AC7B01C360FC008FA0

Function 0042D1B4 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00451DA3,00000000), ref: 0042D1BF

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c6261a7e0408d86b810210719df0536c3713516ab14925cb53ff9fc6307b56ff
Instruction ID: de8bff456184001464f3abbdb54ffbc0c147f56bb2634b1a4235557a7056eb2a
Opcode Fuzzy Hash: c6261a7e0408d86b810210719df0536c3713516ab14925cb53ff9fc6307b56ff
Instruction Fuzzy Hash: 81C08CE0712210169E10A5BD2CC652B02C84A5833A3A40A37B429E66E2D23D88662029

Function 00467FCC Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,00468D7C,00000000,00000000,00000000,0000000C,00000000,00000000,0046A02D), ref: 00467FE4

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction ID: a3a9c25b9c80179eca176ae0059a0aa24e3542550d9dc9bac8dced773014ab2a
Opcode Fuzzy Hash: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction Fuzzy Hash: 0ED09272210A109F8364CAADC9C4C97B3ECEF4C2213004659E54AC3B15D664FC018BA0

Function 00407350 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,0040AB64,0040D110,?,00000000,?), ref: 0040736D

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6df07167fcbbb1abe9a8d9004c2f8e03f6698eab998c13cf44a7632a4752909a
Instruction ID: a78e408fffc15bc8d0ee8a54c686fbaa4e2694f5c3f88f37cecd524e454749ad
Opcode Fuzzy Hash: 6df07167fcbbb1abe9a8d9004c2f8e03f6698eab998c13cf44a7632a4752909a
Instruction Fuzzy Hash: ADC048B13C130032F93025A61C87F1604889714B1AE60943AB740BE1C2D8E9A818016C

Function 0041F82C Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,00000000), ref: 0041F840

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: aa2ab5d04534ce78fd06398472ac87fc8e200d4b6eb1d54961e47d4e7a3c3f50
Instruction ID: 48f25c4fc7afed193c39a16cc91a0304f94a1296cd048c63733264e3b5f0309e
Opcode Fuzzy Hash: aa2ab5d04534ce78fd06398472ac87fc8e200d4b6eb1d54961e47d4e7a3c3f50
Instruction Fuzzy Hash: D2D0C932100108AFDB018E94AC018677B69EB48210B148815FD0485221D633E831AA91

Function 0045053C Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00450748,00000000,?,0046994E,0000000C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?), ref: 0045055A

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 3b5d6f1d3ed04027572ea0d6e89df830a9afaa18df5df1ded2cf0a851c8239d5
Instruction ID: f957f6540a7e946476307e77e1b586f9f0bd4786b608fbaad65e24b1ca4ffac3
Opcode Fuzzy Hash: 3b5d6f1d3ed04027572ea0d6e89df830a9afaa18df5df1ded2cf0a851c8239d5
Instruction Fuzzy Hash: AFD0C9B0511204EADB10EB65E88A30333E0F3343E6F801137E400C3262E3399888EF8C

Function 00451104 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,?,0045CBD2,00000000,0045CD5D,?,00000000,00000002,00000002), ref: 0045110B

Part of subcall function 00450E8C: GetLastError.KERNEL32(00450CA8,00450F4E,?,00000000,?,0049AA60,00000001,00000000,00000002,00000000,0049ABC1,?,?,00000005,00000000,0049ABF5), ref: 00450E8F

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 2f66420dfdec2ee722637dd7a077e757eb137bea55ce6f4fccac44aeccfb3de3
Instruction ID: b009645766b32297bd0322e78edf4af2955e4b8d8b267255ddd48f13edbe2cec
Opcode Fuzzy Hash: 2f66420dfdec2ee722637dd7a077e757eb137bea55ce6f4fccac44aeccfb3de3
Instruction Fuzzy Hash: 66C04C65300500478F10A6AE89C2A0763E85F4D30631045A6B904DF217D668D8048A18

Function 004073E0 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,0049E62C,0049B325,00000000,0049B37A,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 004073EB

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 82f694a863dc49a2ead69e0db5442f46faaad9dac0c4b5c637e63aceca805bd3
Instruction ID: b32d93fc701aa1162a174406e7d11ef14f94d69b7075bb962530761d6eacc69a
Opcode Fuzzy Hash: 82f694a863dc49a2ead69e0db5442f46faaad9dac0c4b5c637e63aceca805bd3
Instruction Fuzzy Hash: 5BB012E13D320A26CA0079FE4CC191B00CC46297063405A3A3406E71C3DC3CC8180414

Function 00407738 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000,?,0049A9EE,00000000,0049ABC1,?,?,00000005,00000000,0049ABF5,?,?,00000000), ref: 00407743

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 3b93a0dfb35fa201a37191345c3ab32b9803f1abf024df2cdbebea3e02f12497
Instruction ID: c18bf430a4858a09d5fd0626d157798880aaaa8ea81a5298b6cf69089c3012d4
Opcode Fuzzy Hash: 3b93a0dfb35fa201a37191345c3ab32b9803f1abf024df2cdbebea3e02f12497
Instruction Fuzzy Hash: B0B012E03D161B27CA0079FE4CC191A01CC46292163501B3A3006E71C3D83CC8080514

Function 0042E87F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,0042E89D), ref: 0042E890

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 3f5ca8107a421579e24e876ed9f2491131596575bec673942313541f3fe4ade1
Instruction ID: 8695c582b33247a37f73f24666a6b5554d32f9d966171ece6814e81b39e17e84
Opcode Fuzzy Hash: 3f5ca8107a421579e24e876ed9f2491131596575bec673942313541f3fe4ade1
Instruction Fuzzy Hash: 49B09B76F0C6005DF705DAD5745552D67D4D7C57203E14977F150D35C0D53C5800491C

Function 0047F0B0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00483B77), ref: 0047F0C6

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 858eb0118262b34170f6180fa21013c79327445a079e9b05e28bff18936a946b
Instruction ID: cf7f85de4c68a96240474416f9a4e6835409013229594df3bd42ce9901ad0706
Opcode Fuzzy Hash: 858eb0118262b34170f6180fa21013c79327445a079e9b05e28bff18936a946b
Instruction Fuzzy Hash: 6DC00271511200AEC750DF749D4475537D4A714325F1A8437580CC3262D6754858CB08

Function 00416A7C Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?), ref: 00416A83

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: DestroyWindow
String ID:
API String ID: 3375834691-0
Opcode ID: 9d6690cf9d3310b1ea67583473288d09d9a8b553081644455fd58860a5b2f519
Instruction ID: 444a78761fbc6a727879d8c4239369b0bde5fc0390465f01f64749401816922a
Opcode Fuzzy Hash: 9d6690cf9d3310b1ea67583473288d09d9a8b553081644455fd58860a5b2f519
Instruction Fuzzy Hash: CDA002756015049ADE04A7A5C849F662298BB44204FC915F971449B092C53C99008E58

Function 0047FD7C Relevance: 1.4, APIs: 1, Instructions: 157COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,0047FF67,?,?,?,?,00000000,00000000,00000000,00000000), ref: 0047FF21

Part of subcall function 0042CE90: GetSystemMetrics.USER32(0000002A), ref: 0042CEA2

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ByteCharMetricsMultiSystemWide
String ID:
API String ID: 224039744-0
Opcode ID: b73e543589ac67b63ccf4b4ebdb4cceff9928c14aa76178dbea93eec9b2da95e
Instruction ID: e09aa96826961c47231f102daffb915614c8b0ba799924493f182314f06166aa
Opcode Fuzzy Hash: b73e543589ac67b63ccf4b4ebdb4cceff9928c14aa76178dbea93eec9b2da95e
Instruction Fuzzy Hash: 28518370600245AFDB20DFA5D984BDAB7F8EB19304F118177E804E73A2D778AD49CB59

Function 0045D828 Relevance: 1.3, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 0042CC94: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042CCB8

SetLastError.KERNEL32(00000000,00000000,?,?,00000000,0045D8C8), ref: 0045D8A1

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ErrorFullLastNamePath
String ID:
API String ID: 2157422313-0
Opcode ID: 9fdc60850a605299c1dd6cd11e65b0b7c1f0a37adafbeabf435f5d9ffb744de0
Instruction ID: cc037949978bc58fed2e3f3883182fa51edce2801ff99df8b97b7a8931ea5217
Opcode Fuzzy Hash: 9fdc60850a605299c1dd6cd11e65b0b7c1f0a37adafbeabf435f5d9ffb744de0
Instruction Fuzzy Hash: 82117370B00204AFDB10EEA5CC819AEB7B8DF48355F60457ABC14E3392D6789F089659

Function 0041F854 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041F234,?,00423D1F,0042409C,0041F234), ref: 0041F872

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e9b0f0e9299e17d878422f97f99b00588243c29834ad84fb5cccc8c64114728c
Instruction ID: f08fc093bd3761fae95f56252c9cb4b1dce7b9a4e026fad3115f2fcf1a938b7c
Opcode Fuzzy Hash: e9b0f0e9299e17d878422f97f99b00588243c29834ad84fb5cccc8c64114728c
Instruction Fuzzy Hash: CC115A746007059BDB10EF1AC880B82FBE4EFA9350F10C53AE9588F385D774E849CBA9

Function 0045379C Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00453805), ref: 004537E7

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 7e0596aca86948bad5b9929c4bd76fe985b651164123b249f1df83741d6a8662
Instruction ID: cb4131d2e651d1d846aaeffdd441063052296316b0d396e6bd3d8335f5975378
Opcode Fuzzy Hash: 7e0596aca86948bad5b9929c4bd76fe985b651164123b249f1df83741d6a8662
Instruction Fuzzy Hash: BA012076A04208AF8711DF69AC014EEFBF8EB4D7617208677FC54D3382D7744E0596A4

Non-executed Functions

Function 0041F5A8 Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00419480,00000000,?,?,?,00000001), ref: 0041F5B6
SetErrorMode.KERNEL32(00008000,?,00419480,00000000,?,?,?,00000001), ref: 0041F5D2
LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00419480,00000000,?,?,?,00000001), ref: 0041F5DE
SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00419480,00000000,?,?,?,00000001), ref: 0041F5EC
GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F61C
GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F645
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F65A
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F66F
GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F684
GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F699
GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F6AE
GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F6C3
GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F6D8
GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F6ED
FreeLibrary.KERNEL32(00000001,?,00419480,00000000,?,?,?,00000001), ref: 0041F6FF

Strings

Ctl3dSubclassDlgEx, xrefs: 0041F664
Ctl3dUnregister, xrefs: 0041F63A
Ctl3dSubclassCtl, xrefs: 0041F64F
CTL3D32.DLL, xrefs: 0041F5D9
Ctl3DColorChange, xrefs: 0041F6CD
Ctl3dRegister, xrefs: 0041F611
Ctl3dAutoSubclass, xrefs: 0041F6A3
Ctl3dUnAutoSubclass, xrefs: 0041F6B8
Ctl3dDlgFramePaint, xrefs: 0041F679
BtnWndProc3d, xrefs: 0041F6E2
Ctl3dCtlColorEx, xrefs: 0041F68E

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressProc$ErrorLibraryMode$FreeLoadVersion
String ID: BtnWndProc3d$CTL3D32.DLL$Ctl3DColorChange$Ctl3dAutoSubclass$Ctl3dCtlColorEx$Ctl3dDlgFramePaint$Ctl3dRegister$Ctl3dSubclassCtl$Ctl3dSubclassDlgEx$Ctl3dUnAutoSubclass$Ctl3dUnregister
API String ID: 2323315520-3614243559
Opcode ID: 553eb9304ec4bd864aba8c05da11fa400c4f4bf06fb1748ad3bec77f9db718a8
Instruction ID: ada4b9d978a757ba6954df3af716d105719faea7ce3d9b9d26d7a4626bcf7c8a
Opcode Fuzzy Hash: 553eb9304ec4bd864aba8c05da11fa400c4f4bf06fb1748ad3bec77f9db718a8
Instruction Fuzzy Hash: 093112B1600610BBD710EBB1ACC6A653294F76C724795097BF144D71A2E77CA84A8F1C

Function 0047A42C Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 0047A298: GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,02217A10,?,?,?,02217A10,0047A45C,00000000,0047A57A,?,?,?,?), ref: 0047A2B1
Part of subcall function 0047A298: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0047A2B7
Part of subcall function 0047A298: GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02217A10,?,?,?,02217A10,0047A45C,00000000,0047A57A,?,?,?,?), ref: 0047A2CA
Part of subcall function 0047A298: CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02217A10,?,?,?,02217A10), ref: 0047A2F4
Part of subcall function 0047A298: CloseHandle.KERNEL32(00000000,?,?,?,02217A10,0047A45C,00000000,0047A57A,?,?,?,?), ref: 0047A312

Part of subcall function 0047A370: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,0047A402,?,?,?,02217A10,?,0047A464,00000000,0047A57A,?,?,?,?), ref: 0047A3A0

ShellExecuteEx.SHELL32(0000003C), ref: 0047A4B4
GetLastError.KERNEL32(00000000,0047A57A,?,?,?,?), ref: 0047A4BD
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 0047A50A
GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 0047A52E
CloseHandle.KERNEL32(00000000,0047A55F,00000000,00000000,000000FF,000000FF,00000000,0047A558,?,00000000,0047A57A,?,?,?,?), ref: 0047A552

Strings

ShellExecuteEx, xrefs: 0047A4CE
MsgWaitForMultipleObjects, xrefs: 0047A517
runas, xrefs: 0047A481
GetExitCodeProcess, xrefs: 0047A537
ShellExecuteEx returned hProcess=0, xrefs: 0047A4DE
<, xrefs: 0047A473

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Handle$CloseFile$AddressAttributesCodeCreateCurrentDirectoryErrorExecuteExitLastModuleMultipleObjectsProcProcessShellWait
String ID: <$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
API String ID: 883996979-221126205
Opcode ID: 756e9d8cd2e8f5fe7d31d3104a769a570d4aa386bf7ad0a0e904e43820c3d6d4
Instruction ID: b18f959c9e91056c8fbc0f61592269b1ee9ce22df27549e7464b1dfb4245635c
Opcode Fuzzy Hash: 756e9d8cd2e8f5fe7d31d3104a769a570d4aa386bf7ad0a0e904e43820c3d6d4
Instruction Fuzzy Hash: 1C3165B1900204BADB11EFA9C845ADEB7B8EF84315F50843BF508F7281D77C99148B5A

Function 00418814 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00418823
GetWindowPlacement.USER32(?,0000002C), ref: 00418840
GetWindowRect.USER32(?), ref: 0041885C
GetWindowLongA.USER32(?,000000F0), ref: 0041886A
GetWindowLongA.USER32(?,000000F8), ref: 0041887F
ScreenToClient.USER32(00000000), ref: 00418888
ScreenToClient.USER32(00000000,?), ref: 00418893

Strings

,, xrefs: 0041882C

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Window$ClientLongScreen$IconicPlacementRect
String ID: ,
API String ID: 2266315723-3772416878
Opcode ID: dac5a07ef4df856ef257039b4bd7ee432e64e833f517036103e80ee43864890f
Instruction ID: 4677e2b8f0f91e01fbb11cd2367981c379ed87121ba2a99f8ef1be567d42c28b
Opcode Fuzzy Hash: dac5a07ef4df856ef257039b4bd7ee432e64e833f517036103e80ee43864890f
Instruction Fuzzy Hash: 5A11E971505201AFDB00EF69C885F9B77E8AF49314F140A7EB958DB296D738D900CB69

Function 0042F75C Relevance: 13.6, APIs: 9, Instructions: 108windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0042F784
GetWindowLongA.USER32(?,000000F0), ref: 0042F798
GetWindowLongA.USER32(?,000000EC), ref: 0042F7AF
GetActiveWindow.USER32 ref: 0042F7B8
MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 0042F7E5
SetActiveWindow.USER32(?,0042F915,00000000,?), ref: 0042F806

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Window$ActiveLong$IconicMessage
String ID:
API String ID: 1633107849-0
Opcode ID: 59304190847aac26e0075f57bafe87f7c31a57b7a7a7829f8250f9d0c6767a26
Instruction ID: 13cdee708698089d3899b8003c30923a51aeb8c8037ba69dea4574f539849007
Opcode Fuzzy Hash: 59304190847aac26e0075f57bafe87f7c31a57b7a7a7829f8250f9d0c6767a26
Instruction Fuzzy Hash: C6319371A00614AFDB01EFB6DC52D5EBBF8EB09304B9144BAF804E3292D7389D15CB18

Function 00455E14 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 00455E23
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00455E29
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00455E42
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 00455E69
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 00455E6E
ExitWindowsEx.USER32(00000002,00000000), ref: 00455E7F

Strings

SeShutdownPrivilege, xrefs: 00455E3B

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 33266e7e6c5bcf07e454302898fcd46ba0004c93974bde34ce93e47c0a90cb6d
Instruction ID: 6597e5a33764c8e3d598d3dac94519450192e65d962eb3d098ce792c7942ec46
Opcode Fuzzy Hash: 33266e7e6c5bcf07e454302898fcd46ba0004c93974bde34ce93e47c0a90cb6d
Instruction Fuzzy Hash: 08F06270294B02B9E620A7718C17F3B31CC9B40B59F54092ABD05EA1C3E7BCD6088A7A

Function 0049ACD8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,0049AE16,?,?,00000000,0049E62C,?,0049AFA0,00000000,0049AFF4,?,?,00000000,0049E62C), ref: 0049AD2F
SetFileAttributesA.KERNEL32(00000000,00000010), ref: 0049ADB2
FindNextFileA.KERNEL32(000000FF,?,00000000,0049ADEE,?,00000000,?,00000000,0049AE16,?,?,00000000,0049E62C,?,0049AFA0,00000000), ref: 0049ADCA
FindClose.KERNEL32(000000FF,0049ADF5,0049ADEE,?,00000000,?,00000000,0049AE16,?,?,00000000,0049E62C,?,0049AFA0,00000000,0049AFF4), ref: 0049ADE8

Strings

isRS-, xrefs: 0049AD4F
isRS-???.tmp, xrefs: 0049AD19

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 134685335-3422211394
Opcode ID: ef026cc03e6abf9752fd5610b3298e7a79a8abfb8b0008897e9a20fdd0c9bd6b
Instruction ID: 509872b5afd022ab6a7e56293bca78668b2a9cc65f254986dd3efe44157c5e2a
Opcode Fuzzy Hash: ef026cc03e6abf9752fd5610b3298e7a79a8abfb8b0008897e9a20fdd0c9bd6b
Instruction Fuzzy Hash: 40319671D01518AFCF50EF65CC41ACEBBBDDB49305F1085B7A808A36A1EA38DF548E99

Function 00457E24 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 241windownativeCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00457EA1
PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00457EC8
SetForegroundWindow.USER32(?), ref: 00457ED9
NtdllDefWindowProc_A.USER32(00000000,?,?,?,00000000,004581B1,?,00000000,004581ED), ref: 0045819C

Strings

Cannot evaluate variable because [Code] isn't running yet, xrefs: 0045801C

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: MessagePostWindow$ForegroundNtdllProc_
String ID: Cannot evaluate variable because [Code] isn't running yet
API String ID: 2236967946-3182603685
Opcode ID: 40cd7261f6354e01fcbe6f15c19454d87f7f842b3a9d1f76528744e66c1efe47
Instruction ID: 73007c65d9b26f0badc6416940a7d6643a2c7ea29ac7ef5a0a3984ee3f093e1a
Opcode Fuzzy Hash: 40cd7261f6354e01fcbe6f15c19454d87f7f842b3a9d1f76528744e66c1efe47
Instruction Fuzzy Hash: C891EF34704604EFDB15CF55DD51F5ABBF9EB88704F2184BAE804A7792CA38AE09CB58

Function 00418160 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0041819F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 004181BD
GetWindowPlacement.USER32(?,0000002C), ref: 004181F3
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 0041821A

Strings

,, xrefs: 004181E1

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID: ,
API String ID: 568898626-3772416878
Opcode ID: 41f45a53b34bb0a25035aaca2655e251df30def2ee4f7a7bbae3a37ff76df842
Instruction ID: 3dd2bdadd829011ee7f0b750d59610fe616def585f77d2d2d1cec2b35816d924
Opcode Fuzzy Hash: 41f45a53b34bb0a25035aaca2655e251df30def2ee4f7a7bbae3a37ff76df842
Instruction Fuzzy Hash: 02215172600204ABCF00EFA9CCC1EDA77A8AF49314F55456AFD18EF246CB78D844CB68

Function 004650D0 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,0046528D), ref: 00465101
FindFirstFileA.KERNEL32(00000000,?,00000000,00465260,?,00000001,00000000,0046528D), ref: 00465190
FindNextFileA.KERNEL32(000000FF,?,00000000,00465242,?,00000000,?,00000000,00465260,?,00000001,00000000,0046528D), ref: 00465222
FindClose.KERNEL32(000000FF,00465249,00465242,?,00000000,?,00000000,00465260,?,00000001,00000000,0046528D), ref: 0046523C

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: f437e847b3d6420b85f5fcd4896d1eccc4c87146237b23e238fba55e016cc0e8
Instruction ID: 440dca86ff91bcf92ec396117f9ee2e7eb4a9bd4f86bd55e8ffce81b2904001c
Opcode Fuzzy Hash: f437e847b3d6420b85f5fcd4896d1eccc4c87146237b23e238fba55e016cc0e8
Instruction Fuzzy Hash: 6B41A230A04A589FDB10EF65DC55ADEB7B8EB89309F4044FAF404E7381E63C9E488E59

Function 0046554C Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,00465733), ref: 004655C1
FindFirstFileA.KERNEL32(00000000,?,00000000,004656FE,?,00000001,00000000,00465733), ref: 00465607
FindNextFileA.KERNEL32(000000FF,?,00000000,004656E0,?,00000000,?,00000000,004656FE,?,00000001,00000000,00465733), ref: 004656BC
FindClose.KERNEL32(000000FF,004656E7,004656E0,?,00000000,?,00000000,004656FE,?,00000001,00000000,00465733), ref: 004656DA

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: 3db08a411d096b441b5c740b6ab202c27a3bc45813a2853337e94f3a6eea8342
Instruction ID: 5fa7a0e481a84f03f33422116c22c7c15fd1db6c0b7bd2f560a0f02907c35907
Opcode Fuzzy Hash: 3db08a411d096b441b5c740b6ab202c27a3bc45813a2853337e94f3a6eea8342
Instruction Fuzzy Hash: 82417335A00A18DFCB10EFA5CC85ADEB7B9EB88305F4044AAF804E7341E6389E44CE59

Function 0042EDC4 Relevance: 7.6, APIs: 5, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00453717,00000000,00453738), ref: 0042EDE6
DeviceIoControl.KERNEL32(00000000,0009C040,?,00000002,00000000,00000000,?,00000000), ref: 0042EE11
GetLastError.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00453717,00000000,00453738), ref: 0042EE1E
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00453717,00000000,00453738), ref: 0042EE26
SetLastError.KERNEL32(00000000,00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00453717,00000000,00453738), ref: 0042EE2C

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ErrorLast$CloseControlCreateDeviceFileHandle
String ID:
API String ID: 1177325624-0
Opcode ID: ea6c5731b36a59312b81c6d5c38927c0a6240ca1da26294cb2b1b7201fb06e7f
Instruction ID: 70587ef730fcdfb329c4590a56e67438f12b0fd4b2c9556a93668e86dd7922da
Opcode Fuzzy Hash: ea6c5731b36a59312b81c6d5c38927c0a6240ca1da26294cb2b1b7201fb06e7f
Instruction Fuzzy Hash: 9CF090723917203AF620B17AAC86F7F428CCB89B68F50423AF714FF1D1D9A85D0955AD

Function 00485AAC Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00485AEA
GetWindowLongA.USER32(00000000,000000F0), ref: 00485B08
ShowWindow.USER32(00000000,00000005,00000000,000000F0,0049F0AC,00484FC6,00484FFA,00000000,0048501A,?,?,?,0049F0AC), ref: 00485B2A
ShowWindow.USER32(00000000,00000000,00000000,000000F0,0049F0AC,00484FC6,00484FFA,00000000,0048501A,?,?,?,0049F0AC), ref: 00485B3E

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Window$Show$IconicLong
String ID:
API String ID: 2754861897-0
Opcode ID: 5ed038d0fee307265a8cc90ebd386045eabe6c636dc290bfb2ee38ae70546125
Instruction ID: efa4bd5f1fc7600ece409678986b8d4d92fe2f8f41c5df1390631f3ba3a0680f
Opcode Fuzzy Hash: 5ed038d0fee307265a8cc90ebd386045eabe6c636dc290bfb2ee38ae70546125
Instruction Fuzzy Hash: CB011E706456409ADB10BB79DC89B5A32DC6B25304F19497BB900DB2A3CA7DEC849B6C

Function 00463B44 Relevance: 4.6, APIs: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00463C18), ref: 00463B9C
FindNextFileA.KERNEL32(000000FF,?,00000000,00463BF8,?,00000000,?,00000000,00463C18), ref: 00463BD8
FindClose.KERNEL32(000000FF,00463BFF,00463BF8,?,00000000,?,00000000,00463C18), ref: 00463BF2

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: b70b7565f1f162df1e0918d6feefe14ddb2046948f8f33f5112cdffd082c2b17
Instruction ID: a0cce92d96e660be0b97b7f28cec8121132c3377f259b36877ec83f4fdc062c8
Opcode Fuzzy Hash: b70b7565f1f162df1e0918d6feefe14ddb2046948f8f33f5112cdffd082c2b17
Instruction Fuzzy Hash: 4C21D8315046886EDB11DF66CC41ADEBBACDB49705F5084FBF808E3661E638DF44CA5A

Function 0042466C Relevance: 4.5, APIs: 3, Instructions: 32windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00424674
SetActiveWindow.USER32(?,?,?,?,0046E2FF), ref: 00424681

Part of subcall function 00423ADC: ShowWindow.USER32(004108F0,00000009,?,00000000,0041F234,00423DCA,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,0042409C), ref: 00423AF7

Part of subcall function 00423FA4: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,022125AC,0042469A,?,?,?,?,0046E2FF), ref: 00423FDF

SetFocus.USER32(00000000,?,?,?,?,0046E2FF), ref: 004246AE

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Window$ActiveFocusIconicShow
String ID:
API String ID: 649377781-0
Opcode ID: 6fb5541612255947ef2c91b9d7674ffacd1557a8c948e8d6abd3677b7be11a69
Instruction ID: 41fac251e040b5459bea7d3bbf68ddb82a9bf8d4fdffabeb223ec960e46dc8d5
Opcode Fuzzy Hash: 6fb5541612255947ef2c91b9d7674ffacd1557a8c948e8d6abd3677b7be11a69
Instruction Fuzzy Hash: FCF0D0717001108BDB40FFAAE9C5B9632A4AF49704B55057BBC05DF35BC67CDC458768

Function 0042F294 Relevance: 4.5, APIs: 3, Instructions: 28synchronizationCOMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(00000001,00000001), ref: 0042F2A1
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000,00000001,00000001), ref: 0042F2B1
CreateMutexA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0042F2D9

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: DescriptorSecurity$CreateDaclInitializeMutex
String ID:
API String ID: 3525989157-0
Opcode ID: e1732bc451b2c31eabe1c217130d90c02c9aa7ecb8220c38a554994fbf251302
Instruction ID: b330794617a7040f76ad0da05c7b1ee5a1856395dd3e8d048ce20caf316d4231
Opcode Fuzzy Hash: e1732bc451b2c31eabe1c217130d90c02c9aa7ecb8220c38a554994fbf251302
Instruction Fuzzy Hash: 18E0C0B16443007EE200EE758C82F5F76DCDB48714F00483AB654DB1C1E679D9489B96

Function 0041815E Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0041819F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 004181BD
GetWindowPlacement.USER32(?,0000002C), ref: 004181F3
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 0041821A

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID:
API String ID: 568898626-0
Opcode ID: 6fbe4a67fc3aa126bc923f1d6678d34b67b35ed78d6045068df79e78dbcc7cfc
Instruction ID: c40958ec65a3081d6570449c7fa77bc67a6f73258cf3a653cafff2f251148837
Opcode Fuzzy Hash: 6fbe4a67fc3aa126bc923f1d6678d34b67b35ed78d6045068df79e78dbcc7cfc
Instruction Fuzzy Hash: DE018F72240204BBDF10EE69DCC1EEB3398AB55364F15416AFD08DF242DA38EC8187A8

Function 00417A28 Relevance: 3.0, APIs: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417A53
GetCapture.USER32 ref: 00417A5C

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CaptureIconic
String ID:
API String ID: 2277910766-0
Opcode ID: e2b62a8e16e158399129b422c839338f97e6c3ad2ac0daa3b8d535a8f81942d9
Instruction ID: 4baae68772761491d2023ced8ce828277fc49fe1aa00b8ecf1210e993849b5ad
Opcode Fuzzy Hash: e2b62a8e16e158399129b422c839338f97e6c3ad2ac0daa3b8d535a8f81942d9
Instruction Fuzzy Hash: AFF0317134460287DB20E66AC885ABF62B99F48395F14443BE515C7356EA6CDD848358

Function 00424624 Relevance: 3.0, APIs: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0042462B

Part of subcall function 00423F14: EnumWindows.USER32(00423EAC), ref: 00423F38
Part of subcall function 00423F14: GetWindow.USER32(?,00000003), ref: 00423F4D
Part of subcall function 00423F14: GetWindowLongA.USER32(?,000000EC), ref: 00423F5C
Part of subcall function 00423F14: SetWindowPos.USER32(00000000,EB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,0042463B,?,?,00424203), ref: 00423F92

SetActiveWindow.USER32(?,?,?,00424203,00000000,004245EC), ref: 0042463F

Part of subcall function 00423ADC: ShowWindow.USER32(004108F0,00000009,?,00000000,0041F234,00423DCA,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,0042409C), ref: 00423AF7

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Window$ActiveEnumIconicLongShowWindows
String ID:
API String ID: 2671590913-0
Opcode ID: 79a778728c02cc4edaf90c7f9b948427ca67b0e60320da5664268fec259b68fe
Instruction ID: d3e93a58e57438a951a07f29fe0797b16f8422c20572e0da7720cbe2ca5f63be
Opcode Fuzzy Hash: 79a778728c02cc4edaf90c7f9b948427ca67b0e60320da5664268fec259b68fe
Instruction Fuzzy Hash: B4E01A60700100C7EF00EFAAE8C4F8662A4BF88304F95017ABC48CF24BD67CDC448724

Function 00412A68 Relevance: 1.7, APIs: 1, Instructions: 188nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,00412C65), ref: 00412C53

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 76210ea955b4234c29723da591833cea603cabc76a58ce7e5be2657fdfd9ecd6
Instruction ID: b726886feaa3cfb0c3c92f2e05cced8293b81fa2aba97a9fc1f2d8d784250eff
Opcode Fuzzy Hash: 76210ea955b4234c29723da591833cea603cabc76a58ce7e5be2657fdfd9ecd6
Instruction Fuzzy Hash: BD51F7317086058FC714DF6AD680A9AF3E5FFA8304B20866BD844C7365E7B8AD91C749

Function 0047A9E8 Relevance: 1.6, APIs: 1, Instructions: 107nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0047AB36

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 585be9cc75da624b932c569c9cc7d56660250742edc212070c3e728cd5e915db
Instruction ID: 142ce658738e24ce26e23a9e5e6300eeba1c5868b873d59cfdcf5a3cfb379ab0
Opcode Fuzzy Hash: 585be9cc75da624b932c569c9cc7d56660250742edc212070c3e728cd5e915db
Instruction Fuzzy Hash: 37413735A04105EFCB20CF99D6819AEB7F6EB88310B34C592E948DB305D338EE51DB96

Function 0042FA00 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0042FA1C

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 9c092c28255bcc30e80686d9f5dffef4909b4cfadbe587d4d40091b81cadcf9b
Instruction ID: e991843b48109e052d0f5957ab47f1130dd67dcde68d8ed9d112e108350b7662
Opcode Fuzzy Hash: 9c092c28255bcc30e80686d9f5dffef4909b4cfadbe587d4d40091b81cadcf9b
Instruction Fuzzy Hash: 02D05E7131010C6B9B00DE98E840C6B33AC9B88700BA08829F908C7201C634ED1097A8

Function 0044BBBC Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 282libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044BB38: GetVersionExA.KERNEL32(00000094), ref: 0044BB55

Part of subcall function 0044BB8C: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0044BBA4

LoadLibraryA.KERNEL32(00000000,00000000,0044BF9F,?,?,?,?,00000000,00000000,?,0044FDE1,0049B826), ref: 0044BC1E
GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044BC36
GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044BC48
GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044BC5A
GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044BC6C
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044BC7E
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044BC90
GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044BCA2
GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044BCB4
GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044BCC6
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044BCD8
GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044BCEA
GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044BCFC
GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044BD0E
GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044BD20
GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044BD32
GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044BD44
GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044BD56
GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 0044BD68
GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 0044BD7A
GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 0044BD8C
GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 0044BD9E
GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 0044BDB0
GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 0044BDC2
GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 0044BDD4
GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 0044BDE6
GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 0044BDF8
GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 0044BE0A
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 0044BE1C
GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 0044BE2E
GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 0044BE40
GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 0044BE52
GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 0044BE64
GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 0044BE76
GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 0044BE88
GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 0044BE9A
GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 0044BEAC
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0044BEBE
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 0044BED0
GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 0044BEE2
GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 0044BEF4
GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 0044BF06
GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 0044BF18
GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 0044BF2A
GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 0044BF3C
GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 0044BF4E
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 0044BF60
GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 0044BF72

Strings

GetThemePropertyOrigin, xrefs: 0044BE02
GetThemeIntList, xrefs: 0044BDF0
GetThemeDocumentationProperty, xrefs: 0044BF46
DrawThemeText, xrefs: 0044BC64
IsThemeDialogTextureEnabled, xrefs: 0044BEFE
CloseThemeData, xrefs: 0044BC40
GetThemeRect, xrefs: 0044BDCC
GetWindowTheme, xrefs: 0044BEDA
GetThemeString, xrefs: 0044BD60
GetThemeBool, xrefs: 0044BD72
IsAppThemed, xrefs: 0044BEC8
GetThemeEnumValue, xrefs: 0044BD96
GetThemeMetric, xrefs: 0044BD4E
GetThemePartSize, xrefs: 0044BC9A
GetThemeFilename, xrefs: 0044BE26
DrawThemeParentBackground, xrefs: 0044BF58
DrawThemeEdge, xrefs: 0044BCF4
GetThemeInt, xrefs: 0044BD84
HitTestThemeBackground, xrefs: 0044BCE2
GetThemeSysFont, xrefs: 0044BE80
DrawThemeIcon, xrefs: 0044BD06
DrawThemeBackground, xrefs: 0044BC52
GetThemeSysSize, xrefs: 0044BE6E
GetThemeMargins, xrefs: 0044BDDE
GetThemeSysString, xrefs: 0044BE92
GetThemeTextMetrics, xrefs: 0044BCBE
IsThemeActive, xrefs: 0044BEB6
GetThemePosition, xrefs: 0044BDA8
GetThemeBackgroundRegion, xrefs: 0044BCD0
GetThemeSysBool, xrefs: 0044BE5C
GetThemeColor, xrefs: 0044BD3C
IsThemeBackgroundPartiallyTransparent, xrefs: 0044BD2A
EnableTheming, xrefs: 0044BF6A
EnableThemeDialogTexture, xrefs: 0044BEEC
GetThemeTextExtent, xrefs: 0044BCAC
GetThemeBackgroundContentRect, xrefs: 0044BC76, 0044BC88
GetCurrentThemeName, xrefs: 0044BF34
GetThemeSysColor, xrefs: 0044BE38
OpenThemeData, xrefs: 0044BC2E
GetThemeFont, xrefs: 0044BDBA
SetThemeAppProperties, xrefs: 0044BF22
SetWindowTheme, xrefs: 0044BE14
uxtheme.dll, xrefs: 0044BC0B
GetThemeSysInt, xrefs: 0044BEA4
IsThemePartDefined, xrefs: 0044BD18
GetThemeSysColorBrush, xrefs: 0044BE4A
GetThemeAppProperties, xrefs: 0044BF10

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystemVersion
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 2754715182-2910565190
Opcode ID: 4f89ad1ee1c2b75867b26b778a0839c690505d420d1d268874128511fef9daaf
Instruction ID: ecd7112d65f411c7eccfc6eab1653a3c74b71e6b2ad24da097032ecd241f34bd
Opcode Fuzzy Hash: 4f89ad1ee1c2b75867b26b778a0839c690505d420d1d268874128511fef9daaf
Instruction Fuzzy Hash: 3AA14DB0A41710EBEB40EFF6DCC6A2A37A8EB15B1475405BBB440EF295D6789C048F5E

Function 0041CE9C Relevance: 33.2, APIs: 22, Instructions: 213windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0041CED0
CreateCompatibleDC.GDI32(?), ref: 0041CEDC
CreateBitmap.GDI32(0041ADD4,?,00000001,00000001,00000000), ref: 0041CF00
CreateCompatibleBitmap.GDI32(?,0041ADD4,?), ref: 0041CF10
SelectObject.GDI32(0041D2CC,00000000), ref: 0041CF2B
FillRect.USER32(0041D2CC,?,?), ref: 0041CF66
SetTextColor.GDI32(0041D2CC,00000000), ref: 0041CF7B
SetBkColor.GDI32(0041D2CC,00000000), ref: 0041CF92
PatBlt.GDI32(0041D2CC,00000000,00000000,0041ADD4,?,00FF0062), ref: 0041CFA8
CreateCompatibleDC.GDI32(?), ref: 0041CFBB
SelectObject.GDI32(00000000,00000000), ref: 0041CFEC
SelectPalette.GDI32(00000000,00000000,00000001), ref: 0041D004
RealizePalette.GDI32(00000000), ref: 0041D00D
SelectPalette.GDI32(0041D2CC,00000000,00000001), ref: 0041D01C
RealizePalette.GDI32(0041D2CC), ref: 0041D025
SetTextColor.GDI32(00000000,00000000), ref: 0041D03E
SetBkColor.GDI32(00000000,00000000), ref: 0041D055
BitBlt.GDI32(0041D2CC,00000000,00000000,0041ADD4,?,00000000,00000000,00000000,00CC0020), ref: 0041D071
SelectObject.GDI32(00000000,?), ref: 0041D07E
DeleteDC.GDI32(00000000), ref: 0041D094

Part of subcall function 0041A4E8: GetSysColor.USER32(?), ref: 0041A4F2

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ColorSelect$CreatePalette$CompatibleObject$BitmapRealizeText$DeleteFillRect
String ID:
API String ID: 269503290-0
Opcode ID: fb78ffdef2d9adf7f009b3edd3f00ef05de4076b53addab15fd239912548f677
Instruction ID: 50a53eb504fbb6e8939598bee840ef50963709612b5229ad76d17b3bfbc4c74e
Opcode Fuzzy Hash: fb78ffdef2d9adf7f009b3edd3f00ef05de4076b53addab15fd239912548f677
Instruction Fuzzy Hash: 8061DD71E44605AFDF10EBA9DC46FAFB7B8EF48704F10446AF504E7281C67CA9418B69

Function 0049B004 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 251synchronizationCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,00000000,0049B39C,?,?,00000000,?,00000000,00000000,?,0049B753,00000000,0049B75D,?,00000000), ref: 0049B087
CreateMutexA.KERNEL32(00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,0049B39C,?,?,00000000,?,00000000,00000000,?,0049B753,00000000), ref: 0049B09A
ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,0049B39C,?,?,00000000,?,00000000,00000000), ref: 0049B0AA
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 0049B0CB
ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,0049B39C,?,?,00000000,?,00000000), ref: 0049B0DB

Part of subcall function 0042D8DC: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D96A,?,?,?,00000001,?,004568AE,00000000,00456916), ref: 0042D911

Strings

/REGU, xrefs: 0049B05D
.lst, xrefs: 0049B118
Setup, xrefs: 0049B073
/REG, xrefs: 0049B039
Inno-Setup-RegSvr-Mutex, xrefs: 0049B091
.msg, xrefs: 0049B0FE

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ShowWindow$CreateFileModuleMultipleMutexNameObjectsWait
String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup
API String ID: 2000705611-3672972446
Opcode ID: eb7ec157cd996445c1cf28dde3ed886e2e927ff1c8f5b40b8b29ebf4020312d7
Instruction ID: 922fb04b7a2d79b689edf1ea04387d241f49b55f55cb6cef8150dce8e7e5188b
Opcode Fuzzy Hash: eb7ec157cd996445c1cf28dde3ed886e2e927ff1c8f5b40b8b29ebf4020312d7
Instruction Fuzzy Hash: 9791A730A042049FDF11EBA5E956BAF7FA4EB49304F5144B7F900AB6D2C77CA805CB99

Function 0045AF68 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 209COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045B224,?,?,?,?,?,00000006,?,00000000,0049A491,?,00000000,0049A534), ref: 0045B0D6

Strings

.fts, xrefs: 0045AFDC
.lnk, xrefs: 0045B043
The file appears to be in use (%d). Will delete on restart., xrefs: 0045B11F
.hlp, xrefs: 0045AF9F
.chw, xrefs: 0045B01D
.gid, xrefs: 0045AFB8
.chm, xrefs: 0045B004
Deleting file: %s, xrefs: 0045B075
Failed to delete the file; it may be in use (%d)., xrefs: 0045B1C5
Stripped read-only attribute., xrefs: 0045B0AF
Failed to strip read-only attribute., xrefs: 0045B0BB

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ErrorLast
String ID: .chm$.chw$.fts$.gid$.hlp$.lnk$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
API String ID: 1452528299-3112430753
Opcode ID: c66c83de6e0723bf347763b5212c2ecca6bc33ca34547677752470684e577ede
Instruction ID: 2fb3476e9d017ff0a5902371132bc4733b6d883e7af691887050c1a5ddfae389
Opcode Fuzzy Hash: c66c83de6e0723bf347763b5212c2ecca6bc33ca34547677752470684e577ede
Instruction Fuzzy Hash: 8E71A0307002486BCB01EB6998867AF7BA5EF48705F50846BFC11DB383DB7C9A49879D

Function 0041B83C Relevance: 21.1, APIs: 14, Instructions: 126windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 0041B853
CreateCompatibleDC.GDI32(00000000), ref: 0041B85D
GetObjectA.GDI32(?,00000018,00000004), ref: 0041B86F
CreateBitmap.GDI32(0000000B,?,00000001,00000001,00000000), ref: 0041B886
GetDC.USER32(00000000), ref: 0041B892
CreateCompatibleBitmap.GDI32(00000000,0000000B,?), ref: 0041B8BF
ReleaseDC.USER32(00000000,00000000), ref: 0041B8E5
SelectObject.GDI32(00000000,?), ref: 0041B900
SelectObject.GDI32(?,00000000), ref: 0041B90F
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B93B
SelectObject.GDI32(00000000,00000000), ref: 0041B949
SelectObject.GDI32(?,00000000), ref: 0041B957
DeleteDC.GDI32(00000000), ref: 0041B960
DeleteDC.GDI32(?), ref: 0041B969

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: 73ee91a3acc86688725df9706b2ea354b5f5707f63fbf8f57308390f59fb2a3c
Instruction ID: 5bdd10242b191c11111876c14ee0e8e9a171a3e9253023a3b6fe339c600245b0
Opcode Fuzzy Hash: 73ee91a3acc86688725df9706b2ea354b5f5707f63fbf8f57308390f59fb2a3c
Instruction Fuzzy Hash: F841AC71E40659ABDF10EAE9D846FAFB7BCEB08704F104466F614FB281C77869408BA4

Function 00455070 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 244registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E2AC: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,c]H,?,00000001,?,?,00485D63,?,00000001,00000000), ref: 0042E2C8

RegQueryValueExA.ADVAPI32(0045B3FA,00000000,00000000,?,00000000,?,00000000,00455309,?,0045B3FA,00000003,00000000,00000000,00455340), ref: 00455189

Part of subcall function 0042ED58: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453A6B,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042ED77

RegQueryValueExA.ADVAPI32(0045B3FA,00000000,00000000,00000000,?,00000004,00000000,00455253,?,0045B3FA,00000000,00000000,?,00000000,?,00000000), ref: 0045520D
RegQueryValueExA.ADVAPI32(0045B3FA,00000000,00000000,00000000,?,00000004,00000000,00455253,?,0045B3FA,00000000,00000000,?,00000000,?,00000000), ref: 0045523C

Strings

RegOpenKeyEx, xrefs: 0045510C
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004550A7
, xrefs: 004550FA
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004550E0

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: QueryValue$FormatMessageOpen
String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2812809588-1577016196
Opcode ID: 48ab2d270128e54a2d105054ddfe16ebaf655de2a65f8344653c84621143a182
Instruction ID: a1e8c034b49f6a69a24190b621a186803033118ea706e5513908ccb254d87fbd
Opcode Fuzzy Hash: 48ab2d270128e54a2d105054ddfe16ebaf655de2a65f8344653c84621143a182
Instruction Fuzzy Hash: 30914071D00608ABDB00DBE5D952BEEB7F8EB49305F50406BF904F7282D6789E098B69

Function 00459CE8 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 165registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00459BF4: RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,00459D31,00000000,00459EE9,?,00000000,00000000,00000000), ref: 00459C41

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00459EE9,?,00000000,00000000,00000000), ref: 00459D8F
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00459EE9,?,00000000,00000000,00000000), ref: 00459DF9

Part of subcall function 0042E2AC: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,c]H,?,00000001,?,?,00485D63,?,00000001,00000000), ref: 0042E2C8

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,00459EE9,?,00000000,00000000,00000000), ref: 00459E60

Strings

v1.1.4322, xrefs: 00459E52
SOFTWARE\Microsoft\.NETFramework\Policy\v2.0, xrefs: 00459DAC
.NET Framework not found, xrefs: 00459EAD
SOFTWARE\Microsoft\.NETFramework\Policy\v1.1, xrefs: 00459E13
SOFTWARE\Microsoft\.NETFramework\Policy\v4.0, xrefs: 00459D42
.NET Framework version %s not found, xrefs: 00459E99
v2.0.50727, xrefs: 00459DEB
v4.0.30319, xrefs: 00459D81

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Close$Open
String ID: .NET Framework not found$.NET Framework version %s not found$SOFTWARE\Microsoft\.NETFramework\Policy\v1.1$SOFTWARE\Microsoft\.NETFramework\Policy\v2.0$SOFTWARE\Microsoft\.NETFramework\Policy\v4.0$v1.1.4322$v2.0.50727$v4.0.30319
API String ID: 2976201327-446240816
Opcode ID: 571fcd6c2bbbd5bdd504cb78bb8ba544710cb3a13efd5566d6a0f750a38c5856
Instruction ID: 28c73818cd0e0a48a6ea9a4a771bbd3fec88f932accac903083750955a5b2269
Opcode Fuzzy Hash: 571fcd6c2bbbd5bdd504cb78bb8ba544710cb3a13efd5566d6a0f750a38c5856
Instruction Fuzzy Hash: 6A51C135A041059BCB00DF65D8A2BEE77BADB49305F5444BBA901D7383EB39AE0EC758

Function 00454D24 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 228registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E274: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042E2A0

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,00454EFB,?,00000000,00454FBF), ref: 00454E4B
RegCloseKey.ADVAPI32(?,?,?,00000000,00000004,00000000,00000001,?,00000000,?,00000000,00454EFB,?,00000000,00454FBF), ref: 00454F87

Part of subcall function 0042ED58: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453A6B,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042ED77

Strings

, xrefs: 00454DAD
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454D93
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454D63
RegCreateKeyEx, xrefs: 00454DBF

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CloseCreateFormatMessageQueryValue
String ID: $RegCreateKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2481121983-1280779767
Opcode ID: 87dfc163ec34621e45a5b984043924f63c67e73638eb467bdd1b5e3cc3beb70d
Instruction ID: c7e759269ab329005b5c2b3a4910326777c7a2f104b103968227fab848b04cb9
Opcode Fuzzy Hash: 87dfc163ec34621e45a5b984043924f63c67e73638eb467bdd1b5e3cc3beb70d
Instruction Fuzzy Hash: FB81FE71A00209AFDB10DF95C952BEEB7B8FB48305F50452AF900FB282D7789E45CB69

Function 0049986C Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004540B8: CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00499A3D,_iu,?,00000000,004541F2), ref: 004541A7
Part of subcall function 004540B8: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00499A3D,_iu,?,00000000,004541F2), ref: 004541B7

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004998E9
SetFileAttributesA.KERNEL32(00000000,00000080,00000000,00499A3D), ref: 0049990A
CreateWindowExA.USER32(00000000,STATIC,00499A4C,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00499931
SetWindowLongA.USER32(?,000000FC,004990C4), ref: 00499944
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00499A10,?,?,000000FC,004990C4,00000000,STATIC,00499A4C), ref: 00499974
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 004999E8
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00499A10,?,?,000000FC,004990C4,00000000), ref: 004999F4

Part of subcall function 0045452C: WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00454613

DestroyWindow.USER32(?,00499A17,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00499A10,?,?,000000FC,004990C4,00000000,STATIC), ref: 00499A0A

Strings

/SECONDPHASE="%s" /FIRSTPHASEWND=$%x , xrefs: 004999A3
STATIC, xrefs: 0049992A

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Window$File$CloseCreateHandle$AttributesCopyDestroyLongMultipleObjectsPrivateProfileStringWaitWrite
String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
API String ID: 1549857992-2312673372
Opcode ID: 14a9ae95835b4893c1703b324577e68a43f3587f61e6d40626b5572958c0ae20
Instruction ID: 1040efbc0f93b6302825a6538983252b96925761b6fd30358d8d845ff4183614
Opcode Fuzzy Hash: 14a9ae95835b4893c1703b324577e68a43f3587f61e6d40626b5572958c0ae20
Instruction Fuzzy Hash: 9A413171A40248AFDF00EFA9DC42F9E7BB8EB09704F11457AF510FB291D6799E048B68

Function 0042F654 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042F660
GetModuleHandleA.KERNEL32(user32.dll), ref: 0042F674
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0042F681
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0042F68E
GetWindowRect.USER32(?,00000000), ref: 0042F6DA
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D), ref: 0042F718

Strings

GetMonitorInfoA, xrefs: 0042F688
user32.dll, xrefs: 0042F66F
(, xrefs: 0042F6B9
MonitorFromWindow, xrefs: 0042F67B

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: f52442d850daa28c7af493b0d469880ff7019c19a3453f4f9b0bf585fff06b2b
Instruction ID: 4fddece845ce4b02eeba35f690bf3974305695bca327a465bc6d277b32236c01
Opcode Fuzzy Hash: f52442d850daa28c7af493b0d469880ff7019c19a3453f4f9b0bf585fff06b2b
Instruction Fuzzy Hash: F721C2B67006146BD300EA78EC85F3B77A9DBD4710F98463AF944DB382DA78EC084B59

Function 00463DE4 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00463DF0
GetModuleHandleA.KERNEL32(user32.dll), ref: 00463E04
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 00463E11
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00463E1E
GetWindowRect.USER32(?,00000000), ref: 00463E6A
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,00000000), ref: 00463EA8

Strings

(, xrefs: 00463E49
MonitorFromWindow, xrefs: 00463E0B
GetMonitorInfoA, xrefs: 00463E18
user32.dll, xrefs: 00463DFF

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: d88f9cd600263526e5748da069466a1f154afd92153142a6eac54a1a55331521
Instruction ID: 5546c7ca55dac75a37d5be63b5862a2b7bf7fa91672d6aed0c393ab4f47302e1
Opcode Fuzzy Hash: d88f9cd600263526e5748da069466a1f154afd92153142a6eac54a1a55331521
Instruction Fuzzy Hash: 5821B0B67006146BD300AB68CC41F3B76D9DB84B01F08452EF944DB382EA79ED018B6A

Function 00457550 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,004576B5,?,?,00000031,?), ref: 00457578
GetProcAddress.KERNEL32(00000000,OLEAUT32.DLL), ref: 0045757E
LoadTypeLib.OLEAUT32(00000000,?), ref: 004575CB

Part of subcall function 00453C98: GetLastError.KERNEL32(00000000,0045482D,00000005,00000000,00454862,?,?,00000000,0049E62C,00000004,00000000,00000000,00000000,?,0049AFD9,00000000), ref: 00453C9B

Strings

GetProcAddress, xrefs: 0045758B
OLEAUT32.DLL, xrefs: 00457573
UnRegisterTypeLib, xrefs: 0045756E
ITypeLib::GetLibAttr, xrefs: 00457601
LoadTypeLib, xrefs: 004575D6
UnRegisterTypeLib, xrefs: 00457637

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressErrorHandleLastLoadModuleProcType
String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
API String ID: 1914119943-2711329623
Opcode ID: 8338d3ef0ecaea7eb820dcd9b636b211f45bc6c31183a3406f40cb6df78e1c00
Instruction ID: 6576a6400b1684fe66b120d0c5268abc33dc5c30e9c8dd9853542a513f4dec10
Opcode Fuzzy Hash: 8338d3ef0ecaea7eb820dcd9b636b211f45bc6c31183a3406f40cb6df78e1c00
Instruction Fuzzy Hash: 2931B471604A04AFC711EFAADC41E5B77ADEB8C7157108476F804D3652DA38D904C728

Function 0042E8A8 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0042E9AD,?,00000000,004806D0,00000000), ref: 0042E8D1
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042E8D7
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E9AD,?,00000000,004806D0,00000000), ref: 0042E925

Strings

.DEFAULT\Control Panel\International, xrefs: 0042E8FC
Control Panel\Desktop\ResourceLocale, xrefs: 0042E934
kernel32.dll, xrefs: 0042E8CC
Locale, xrefs: 0042E914
GetUserDefaultUILanguage, xrefs: 0042E8C7

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 551fb6f786c2bbed214d9090f2be98c46a5d17fcfde8ec11d6b3a1826df5c3c7
Instruction ID: cdd838938204d4cbb06352ad172040986bb4042bf6ca521554dfda5889237b72
Opcode Fuzzy Hash: 551fb6f786c2bbed214d9090f2be98c46a5d17fcfde8ec11d6b3a1826df5c3c7
Instruction Fuzzy Hash: 7F212170B00229AFDB50EBA7DC46BAE77A9EB04304F904477A500E7291DB7C9E45DB1C

Function 00417210 Relevance: 15.2, APIs: 10, Instructions: 167windowCOMMON

Download Yara Rule

APIs

RectVisible.GDI32(?,?), ref: 004172A3
SaveDC.GDI32(?), ref: 004172B7
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 004172DA
RestoreDC.GDI32(?,?), ref: 004172F5
CreateSolidBrush.GDI32(00000000), ref: 00417375
FrameRect.USER32(?,?,?), ref: 004173A8
DeleteObject.GDI32(?), ref: 004173B2
CreateSolidBrush.GDI32(00000000), ref: 004173C2
FrameRect.USER32(?,?,?), ref: 004173F5
DeleteObject.GDI32(?), ref: 004173FF

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
String ID:
API String ID: 375863564-0
Opcode ID: 3d8156a366025064c63b491ecde1983d624f67cad55e4d1d2816c1a32c4f3a64
Instruction ID: c95a734d2d00aea9c177a3b06cfd5000d642d04c6817e823e80f404ee62f0a93
Opcode Fuzzy Hash: 3d8156a366025064c63b491ecde1983d624f67cad55e4d1d2816c1a32c4f3a64
Instruction Fuzzy Hash: 8B513A716086445FDB51EF69C8C0B9B77E8AF48314F1445AAFD488B287C738EC82CB99

Function 00404ABF Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B46
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B6A
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B86
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00404BA7
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00404BD0
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00404BDA
GetStdHandle.KERNEL32(000000F5), ref: 00404BFA
GetFileType.KERNEL32(?,000000F5), ref: 00404C11
CloseHandle.KERNEL32(?,?,000000F5), ref: 00404C2C
GetLastError.KERNEL32(000000F5), ref: 00404C46

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction ID: 0555156f4d2a620bb114dc01d937536d57074fdea11cd86abdfeb4dd56d828b4
Opcode Fuzzy Hash: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction Fuzzy Hash: 3741B3F02093009AF7305E248905B2375E5EBC0755F208E3FE296BA6E0D7BDE8458B1D

Function 00422678 Relevance: 15.1, APIs: 10, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000), ref: 004226C3
DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 004226E1
DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 004226EE
DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 004226FB
DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422708
DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 00422715
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 00422722
DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 0042272F
EnableMenuItem.USER32(00000000,0000F020,00000001), ref: 0042274D
EnableMenuItem.USER32(00000000,0000F030,00000001), ref: 00422769

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Menu$Delete$EnableItem$System
String ID:
API String ID: 3985193851-0
Opcode ID: b633a805c3dfefc2d241534ae929bcf98399df6f62762c46efeb8f5b5c6a909e
Instruction ID: 3d3520f8b7ec6d74ae20e05d6755b86abcf69838e80cbfb0a1e170c33371412b
Opcode Fuzzy Hash: b633a805c3dfefc2d241534ae929bcf98399df6f62762c46efeb8f5b5c6a909e
Instruction Fuzzy Hash: 4F2124703447047AE720E725DD8BFAB7AD89B04B08F044065B6447F2D3C6F8EA40869C

Function 00462974 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 004629AF
GetActiveWindow.USER32 ref: 00462A13
CoInitialize.OLE32(00000000), ref: 00462A27
SHBrowseForFolder.SHELL32(?), ref: 00462A3E
756CD120.OLE32(00462A7F,00000000,?,?,?,?,?,00000000,00462B03), ref: 00462A53
SetActiveWindow.USER32(?,00462A7F,00000000,?,?,?,?,?,00000000,00462B03), ref: 00462A69
SetActiveWindow.USER32(?,?,00462A7F,00000000,?,?,?,?,?,00000000,00462B03), ref: 00462A72

Strings

A, xrefs: 004629E7

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ActiveWindow$BrowseD120FolderInitializeMalloc
String ID: A
API String ID: 2698730301-3554254475
Opcode ID: 14be21f0889e27b63cff27c6b7920ac038a1d1e6a07f323e9ad5f5bcee8464c4
Instruction ID: 226cd12c2bf5eadadc06a8ace2d3cfe2a2dab59726cbcd1c1d639dda9b16e66d
Opcode Fuzzy Hash: 14be21f0889e27b63cff27c6b7920ac038a1d1e6a07f323e9ad5f5bcee8464c4
Instruction Fuzzy Hash: 2A3130B0E00208AFCB10EFB6D945A9EBBF8EB09304F51447AF414F7251E7789A04CB69

Function 004190E4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000E), ref: 00419100
GetSystemMetrics.USER32(0000000D), ref: 00419108
6F552980.COMCTL32(00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 0041910E

Part of subcall function 00410C88: 6F54C400.COMCTL32(,I,000000FF,00000000,0041913C,00000000,00419198,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00410C8C

6F5BCB00.COMCTL32(,I,00000000,00000000,00000000,00000000,00419198,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 0041915E
6F5BC740.COMCTL32(00000000,?,,I,00000000,00000000,00000000,00000000,00419198,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001), ref: 00419169
6F5BCB00.COMCTL32(,I,00000001,?,?,00000000,?,,I,00000000,00000000,00000000,00000000,00419198,?,00000000,0000000D,00000000), ref: 0041917C
6F550860.COMCTL32(,I,0041919F,?,00000000,?,,I,00000000,00000000,00000000,00000000,00419198,?,00000000,0000000D,00000000,0000000E), ref: 00419192

Strings

,I, xrefs: 00419134, 0041914C, 0041915A, 00419178, 0041918E, 0041915D, 0041917B, 00419191

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: MetricsSystem$C400C740F550860F552980
String ID: ,I
API String ID: 1828538299-3697734810
Opcode ID: 99d237f4e6602aa4adb10bbba9f27b4049ed62bd4d0bb7e82590963255ca77bb
Instruction ID: 6bf9c1d71f03a7720a29bcea3f2ffb204bbf738efc2d09f76f7aaa5da4135df4
Opcode Fuzzy Hash: 99d237f4e6602aa4adb10bbba9f27b4049ed62bd4d0bb7e82590963255ca77bb
Instruction Fuzzy Hash: D0116675744304BBEB14EBA5DC83F9E73A8EB04B04F50456AF604E72D1E6B99D808B58

Function 0045DB44 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,inflateInit_), ref: 0045DB4D
GetProcAddress.KERNEL32(00000000,inflate), ref: 0045DB5D
GetProcAddress.KERNEL32(00000000,inflateEnd), ref: 0045DB6D
GetProcAddress.KERNEL32(00000000,inflateReset), ref: 0045DB7D

Strings

inflateReset, xrefs: 0045DB77
inflateInit_, xrefs: 0045DB47
inflateEnd, xrefs: 0045DB67
inflate, xrefs: 0045DB57

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressProc
String ID: inflate$inflateEnd$inflateInit_$inflateReset
API String ID: 190572456-3516654456
Opcode ID: 4b5e01856a24b2cb288729c3d0fdc563aa5ebd2102de443a524bd77ba4052863
Instruction ID: 6393fdd59b419d4e4f2c5b3e50f991f6d57498fd626e4870853c8bb2a7f4f2ae
Opcode Fuzzy Hash: 4b5e01856a24b2cb288729c3d0fdc563aa5ebd2102de443a524bd77ba4052863
Instruction Fuzzy Hash: 1101FFB0D00600DBE724EF369C4672636EAAFA4706F15C43BAD49D66A3E778548CCE1C

Function 0041AD6C Relevance: 13.7, APIs: 9, Instructions: 176windowCOMMON

Download Yara Rule

APIs

SetBkColor.GDI32(?,00000000), ref: 0041AE49
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0041AE83
SetBkColor.GDI32(?,?), ref: 0041AE98
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 0041AEE2
SetTextColor.GDI32(00000000,00000000), ref: 0041AEED
SetBkColor.GDI32(00000000,00FFFFFF), ref: 0041AEFD
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00E20746), ref: 0041AF3C
SetTextColor.GDI32(00000000,00000000), ref: 0041AF46
SetBkColor.GDI32(00000000,?), ref: 0041AF53

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Color$StretchText
String ID:
API String ID: 2984075790-0
Opcode ID: 5bc53f5962781454f216dcd37823ba609026d20390a6d47597a363d233ee51bf
Instruction ID: cd8b06f21d39e7e3a7e3fb9164a1477e2cec4af8eaf2e363a2f859aea8ea57af
Opcode Fuzzy Hash: 5bc53f5962781454f216dcd37823ba609026d20390a6d47597a363d233ee51bf
Instruction Fuzzy Hash: 5B61B4B5A00515EFCB40EFADD985E9AB7F9EF08314B1481AAF518DB251C734ED408BA8

Function 00458954 Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0042DD54: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD67

CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00458B08,?, /s ",?,regsvr32.exe",?,00458B08), ref: 00458A7A

Strings

regsvr32.exe", xrefs: 0045899B
/s ", xrefs: 004589C3
0x%x, xrefs: 00458A9D
Spawning 64-bit RegSvr32: , xrefs: 004589DF
Spawning 32-bit RegSvr32: , xrefs: 00458A01
CreateProcess, xrefs: 00458A6C
/u, xrefs: 004589B6
D, xrefs: 00458A30

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CloseDirectoryHandleSystem
String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
API String ID: 2051275411-1862435767
Opcode ID: 6ffb9654566cc93f383a1c808905514fd035d6f9ea27fa0c38c667a968c986dd
Instruction ID: 80d87ab17c090028f18ddd9dc69d9a9522a7783b235ef4a64a7d04e5292bd67e
Opcode Fuzzy Hash: 6ffb9654566cc93f383a1c808905514fd035d6f9ea27fa0c38c667a968c986dd
Instruction Fuzzy Hash: 8341E470E003486BDB11EF95C842B9DB7B9AF45305F50407FB904BB296DF78AE098B59

Function 0044D7E4 Relevance: 13.6, APIs: 9, Instructions: 90COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,00000001,00000001), ref: 0044D815
GetSysColor.USER32(00000014), ref: 0044D81C
SetTextColor.GDI32(00000000,00000000), ref: 0044D834
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D85D
OffsetRect.USER32(?,000000FF,000000FF), ref: 0044D867
GetSysColor.USER32(00000010), ref: 0044D86E
SetTextColor.GDI32(00000000,00000000), ref: 0044D886
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D8AF
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D8DA

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Text$Color$Draw$OffsetRect
String ID:
API String ID: 1005981011-0
Opcode ID: defe8e31af95cf8684be8b87545b8814e3dc3725bd6bd2c972ea42babe5efaff
Instruction ID: 7afddb25c4ac74ad42c6f663f4adf30dc2f4b2673d3e6822d8b2a46fb9ac5c49
Opcode Fuzzy Hash: defe8e31af95cf8684be8b87545b8814e3dc3725bd6bd2c972ea42babe5efaff
Instruction Fuzzy Hash: AB21AFB46015047FD700FB2ACD8AE9B7BECDF19319B00457A7914EB393C678DE408669

Function 0041BAFC Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 144windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041BBD5
GetDC.USER32(?), ref: 0041BBE1
SelectPalette.GDI32(00000000,?,00000000), ref: 0041BC16
RealizePalette.GDI32(00000000), ref: 0041BC22
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BC50
SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041BC84

Strings

SGH, xrefs: 0041BB04

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Palette$Select$BitmapCreateFocusRealize
String ID: SGH
API String ID: 3275473261-1451514267
Opcode ID: c95e916aea5b0b320e39deb2acbd71507781b42672567b85ab8b3b895a144eff
Instruction ID: 6f3d196da8cc9963e266c073c65a40cf0d83fd4bf7ad6034c31d612a174a896e
Opcode Fuzzy Hash: c95e916aea5b0b320e39deb2acbd71507781b42672567b85ab8b3b895a144eff
Instruction Fuzzy Hash: 23511D70A00209AFDB11DFA9C895AEEBBF8FF49704F10446AF500A7750D7799D81CBA9

Function 0041BDCC Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041BEA7
GetDC.USER32(?), ref: 0041BEB3
SelectPalette.GDI32(00000000,?,00000000), ref: 0041BEED
RealizePalette.GDI32(00000000), ref: 0041BEF9
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BF1D
SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041BF51

Strings

SGH, xrefs: 0041BDD4

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Palette$Select$BitmapCreateFocusRealize
String ID: SGH
API String ID: 3275473261-1451514267
Opcode ID: 9472f51cddc4c318b63d6c649322b096de862bc5fca767e6fe291a367ca23efe
Instruction ID: d1d8e12ac76011fa0e11fd225ecf21e9d1788b3d06fe05564f2eab64f20773a9
Opcode Fuzzy Hash: 9472f51cddc4c318b63d6c649322b096de862bc5fca767e6fe291a367ca23efe
Instruction Fuzzy Hash: 28510875A00618AFCB11DFA9C891AEEBBF9EF49700F158066F504EB750D7389D40CBA8

Function 00499110 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00451104: SetEndOfFile.KERNEL32(?,?,0045CBD2,00000000,0045CD5D,?,00000000,00000002,00000002), ref: 0045110B

Part of subcall function 004073E0: DeleteFileA.KERNEL32(00000000,0049E62C,0049B325,00000000,0049B37A,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 004073EB

GetWindowThreadProcessId.USER32(00000000,?), ref: 004991A1
OpenProcess.KERNEL32(00100000,00000000,?,00000000,?), ref: 004991B5
SendNotifyMessageA.USER32(00000000,0000054D,00000000,00000000), ref: 004991CF
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 004991DB
CloseHandle.KERNEL32(00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 004991E1
Sleep.KERNEL32(000001F4,00000000,0000054D,00000000,00000000,00000000,?), ref: 004991F4

Strings

Deleting Uninstall data files., xrefs: 00499117

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: FileProcess$CloseDeleteHandleMessageNotifyObjectOpenSendSingleSleepThreadWaitWindow
String ID: Deleting Uninstall data files.
API String ID: 1570157960-2568741658
Opcode ID: a75ae79c053ad6ac0b5b5976d9e9d340c51e696bfd279fffd7f80cca7ec41fd6
Instruction ID: cb2d451af3da6ac1aa23b78e01510326c5efc9a8891bb24b57213afaa5902f8c
Opcode Fuzzy Hash: a75ae79c053ad6ac0b5b5976d9e9d340c51e696bfd279fffd7f80cca7ec41fd6
Instruction Fuzzy Hash: 12216170704201BFEB10EF6AAC87B163798EB54359F21053FB500DA2E3DA785C04DA2D

Function 00471980 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E2AC: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,c]H,?,00000001,?,?,00485D63,?,00000001,00000000), ref: 0042E2C8

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,00471A7D,?,?,?,?,00000000), ref: 004719E7
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,00471A7D), ref: 004719FE
AddFontResourceA.GDI32(00000000), ref: 00471A1B
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00471A2F

Strings

Failed to set value in Fonts registry key., xrefs: 004719F0
AddFontResource, xrefs: 00471A39
Failed to open Fonts registry key., xrefs: 00471A05

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CloseFontMessageNotifyOpenResourceSendValue
String ID: AddFontResource$Failed to open Fonts registry key.$Failed to set value in Fonts registry key.
API String ID: 955540645-649663873
Opcode ID: 8b4ea22680946d364f4d90cf99275e7d37523d1381b4fe7fb8c6c9a4dcfbd7a4
Instruction ID: 6be23d3c66d5b45113e93d23cbe6506080f980a76637a72e5f0690e3c1ed4635
Opcode Fuzzy Hash: 8b4ea22680946d364f4d90cf99275e7d37523d1381b4fe7fb8c6c9a4dcfbd7a4
Instruction Fuzzy Hash: 6B21B2707412047BDB10EA6A9C42FAA77ACDB44744F60C037B904EB3D2EA7CDE06966D

Function 00464224 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004168A0: GetClassInfoA.USER32(00400000,?,?), ref: 0041690F
Part of subcall function 004168A0: UnregisterClassA.USER32(?,00400000), ref: 0041693B
Part of subcall function 004168A0: RegisterClassA.USER32(?), ref: 0041695E

GetVersion.KERNEL32 ref: 00464254
SendMessageA.USER32(00000000,0000112C,00000004,00000004), ref: 00464292
SHGetFileInfo.SHELL32(00464330,00000000,?,00000160,00004011), ref: 004642AF
LoadCursorA.USER32(00000000,00007F02), ref: 004642CD
SetCursor.USER32(00000000,00000000,00007F02,00464330,00000000,?,00000160,00004011), ref: 004642D3
SetCursor.USER32(?,00464313,00007F02,00464330,00000000,?,00000160,00004011), ref: 00464306

Strings

Explorer, xrefs: 0046426E

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ClassCursor$Info$FileLoadMessageRegisterSendUnregisterVersion
String ID: Explorer
API String ID: 2594429197-512347832
Opcode ID: e4246b70e64443b15e1828aa2d441563241c4fbc43c60fe3ab0de6d9b0488d6c
Instruction ID: b3b98aa5a53488e53f8304eecf0dc9993ee5463f80e55bafd62bb8cbb11790a6
Opcode Fuzzy Hash: e4246b70e64443b15e1828aa2d441563241c4fbc43c60fe3ab0de6d9b0488d6c
Instruction Fuzzy Hash: 4321BB307403046AFF11BBB65C47B9A76989B45708F5040BBBA05EB2C3D9BD5851866D

Function 0047A298 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66libraryfileloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,02217A10,?,?,?,02217A10,0047A45C,00000000,0047A57A,?,?,?,?), ref: 0047A2B1
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0047A2B7
GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02217A10,?,?,?,02217A10,0047A45C,00000000,0047A57A,?,?,?,?), ref: 0047A2CA
CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02217A10,?,?,?,02217A10), ref: 0047A2F4
CloseHandle.KERNEL32(00000000,?,?,?,02217A10,0047A45C,00000000,0047A57A,?,?,?,?), ref: 0047A312

Strings

kernel32.dll, xrefs: 0047A2AC
GetFinalPathNameByHandleA, xrefs: 0047A2A7

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: FileHandle$AddressAttributesCloseCreateModuleProc
String ID: GetFinalPathNameByHandleA$kernel32.dll
API String ID: 2704155762-2318956294
Opcode ID: a59c07aee94911eef482bc5c220816c671b36ef22c230ab7a9c446e625d5bb00
Instruction ID: 57555985d840a7600da8c416dd6304c6eb604502ffba81a2bb08ee3d21931ea9
Opcode Fuzzy Hash: a59c07aee94911eef482bc5c220816c671b36ef22c230ab7a9c446e625d5bb00
Instruction Fuzzy Hash: 6E01C05078070476E52035AA4C87FBF298C8B9476DF2482377E1CEE2D2E9AD8D26016F

Function 0045A69C Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 121COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045A81E,?,00000000,00000000,00000000,?,00000006,?,00000000,0049A491,?,00000000,0049A534), ref: 0045A762

Part of subcall function 00454BF0: FindClose.KERNEL32(000000FF,00454CE6), ref: 00454CD5

Strings

Stripped read-only attribute., xrefs: 0045A724
Failed to delete directory (%d)., xrefs: 0045A7F8
Failed to delete directory (%d). Will retry later., xrefs: 0045A77B
Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 0045A73C
Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 0045A7D7
Deleting directory: %s, xrefs: 0045A6EB
Failed to strip read-only attribute., xrefs: 0045A730

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CloseErrorFindLast
String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
API String ID: 754982922-1448842058
Opcode ID: 730997fa2cd99f66768164cc9a86bc0327c0ac0addc6dbaf1d407e38d2bc42cc
Instruction ID: ed451348c7d3678a4819a833a09a40bf82a586c96773c367329f7393d5e0e002
Opcode Fuzzy Hash: 730997fa2cd99f66768164cc9a86bc0327c0ac0addc6dbaf1d407e38d2bc42cc
Instruction Fuzzy Hash: 9441A734A101189BCB00EB6988417AE76A59F89306F55867FAC01E7383DB7CCA1D875F

Function 004232E0 Relevance: 12.1, APIs: 8, Instructions: 119windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00423334
GetCapture.USER32 ref: 00423343
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00423349
ReleaseCapture.USER32 ref: 0042334E
GetActiveWindow.USER32 ref: 0042335D
SendMessageA.USER32(00000000,0000B000,00000000,00000000), ref: 004233DC
SendMessageA.USER32(00000000,0000B001,00000000,00000000), ref: 00423440
GetActiveWindow.USER32 ref: 0042344F

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CaptureMessageSend$ActiveWindow$Release
String ID:
API String ID: 862346643-0
Opcode ID: f69812db9b2b79ec794c9b8766cda1920263d90c5a2084de5f9108f08cb6d884
Instruction ID: 18bdd7e577e3521af934e8bbd68e58ee55e38e107d312ae6febd14bbc8fb8244
Opcode Fuzzy Hash: f69812db9b2b79ec794c9b8766cda1920263d90c5a2084de5f9108f08cb6d884
Instruction Fuzzy Hash: 07414D30B00254AFDB10EF6AD982B9E77F1AF04704F5440BAE440AB2A2DB7D9F40CB58

Function 00429910 Relevance: 12.1, APIs: 8, Instructions: 62COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042991A
GetTextMetricsA.GDI32(00000000), ref: 00429923

Part of subcall function 0041A678: CreateFontIndirectA.GDI32(?), ref: 0041A737

SelectObject.GDI32(00000000,00000000), ref: 00429932
GetTextMetricsA.GDI32(00000000,?), ref: 0042993F
SelectObject.GDI32(00000000,00000000), ref: 00429946
ReleaseDC.USER32(00000000,00000000), ref: 0042994E
GetSystemMetrics.USER32(00000006), ref: 00429973
GetSystemMetrics.USER32(00000006), ref: 0042998D

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Metrics$ObjectSelectSystemText$CreateFontIndirectRelease
String ID:
API String ID: 1583807278-0
Opcode ID: ebe386440f1a564b7a2be8c9c844170705a7c8a01c9df30573aa27e63a99e835
Instruction ID: 064b8ceea34646deb673d9898a5f132a00f345b4bbd4d539d92df2c89931976d
Opcode Fuzzy Hash: ebe386440f1a564b7a2be8c9c844170705a7c8a01c9df30573aa27e63a99e835
Instruction Fuzzy Hash: 1801C4D17047112BF710B2B69CC2F6B5588DB84368F44053FFA869A3D3E97D9C80866E

Function 0041E2B4 Relevance: 12.1, APIs: 8, Instructions: 60windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0041E2B7
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041E2C1
ReleaseDC.USER32(00000000,00000000), ref: 0041E2CE
MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041E2DD
GetStockObject.GDI32(00000007), ref: 0041E2EB
GetStockObject.GDI32(00000005), ref: 0041E2F7
GetStockObject.GDI32(0000000D), ref: 0041E303
LoadIconA.USER32(00000000,00007F00), ref: 0041E314

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ObjectStock$CapsDeviceIconLoadRelease
String ID:
API String ID: 225703358-0
Opcode ID: 1e12ba7333a2ec96098868c8fab9023dc0cbd8294bc285aecc6e15b03be122cc
Instruction ID: eda06bb9e73b08d19024368069479301758e63dc44a0e31fec7fdbc279e4b1ec
Opcode Fuzzy Hash: 1e12ba7333a2ec96098868c8fab9023dc0cbd8294bc285aecc6e15b03be122cc
Instruction Fuzzy Hash: 8C112B70645301AAE740FF765996BAA3690D724708F40943BF604EF3D2DB7E5C418B6E

Function 00464634 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 273COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F02), ref: 00464738
SetCursor.USER32(00000000,00000000,00007F02,00000000,004647CD), ref: 0046473E
SetCursor.USER32(?,004647B5,00007F02,00000000,004647CD), ref: 004647A8

Strings

, xrefs: 004649B3
, xrefs: 004649CE
Internal error: Item already expanding, xrefs: 004646D5

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Cursor$Load
String ID: $ $Internal error: Item already expanding
API String ID: 1675784387-1948079669
Opcode ID: f0d8b3a22494a668e36ff372e63dbf03653d2e1c551dd02a847e0882ae5da109
Instruction ID: 9cbbcba472df96bd09ce797c5f765fac8c2f652b56477a68fde2327aac6a5f51
Opcode Fuzzy Hash: f0d8b3a22494a668e36ff372e63dbf03653d2e1c551dd02a847e0882ae5da109
Instruction Fuzzy Hash: 8CB1C174600604DFDB20DF65C585B9BBBF0AF85308F1580ABE8459B792E778ED44CB1A

Function 0045452C Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 225COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00454613

Strings

MoveFileEx, xrefs: 00454823
[rename], xrefs: 00454676, 004546B2
WININIT.INI, xrefs: 004545C1
.tmp, xrefs: 004545CF
NUL, xrefs: 004546D5

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
API String ID: 390214022-3304407042
Opcode ID: bce683bc22196d0e4cfba1a3992938394582949cf0449ecb7a1b020fbcb042d1
Instruction ID: c5648654d35dc4fa5992192bdfac3c74e0b4d15883e79a195514524b6fb94f40
Opcode Fuzzy Hash: bce683bc22196d0e4cfba1a3992938394582949cf0449ecb7a1b020fbcb042d1
Instruction Fuzzy Hash: D1912334A001099BDB01EFA5D841BDEB7F5EF89309F508467E900BB692D778AE49CB58

Function 00478B78 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200windowCOMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(00000000,COMBOBOX,?), ref: 00478BD1
SetWindowLongW.USER32(00000000,000000FC,00478B2C), ref: 00478BF8
GetACP.KERNEL32(00000000,00478E10,?,00000000,00478E3A), ref: 00478C35
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00478C7B

Strings

Inno Setup: Language, xrefs: 00478D03
COMBOBOX, xrefs: 00478BCA

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ClassInfoLongMessageSendWindow
String ID: COMBOBOX$Inno Setup: Language
API String ID: 3391662889-4234151509
Opcode ID: af1ab3f1e6629c52558b0d9e2532faf18a64c56603a7a54476f89899a4427b8d
Instruction ID: 682803ff50862e4f861120484dcd5d7abcf6ba35e73422eedafe13b56c9a1620
Opcode Fuzzy Hash: af1ab3f1e6629c52558b0d9e2532faf18a64c56603a7a54476f89899a4427b8d
Instruction Fuzzy Hash: 1A814F34640209DFC711DF69C889A9AB7F5FB19304F1481BEE808D73A2DB38AD45CB59

Function 00408BB0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408DF8,?,?,?,?,00000000,00000000,00000000,?,00409DFF,00000000,00409E12), ref: 00408BCA

Part of subcall function 004089F8: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049E4C4,00000001,?,00408AC3,?,00000000,00408BA2), ref: 00408A16

Part of subcall function 00408A44: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,00408C46,?,?,?,00000000,00408DF8), ref: 00408A57

Strings

m/d/yy, xrefs: 00408C99
:mm:ss, xrefs: 00408DC6
mmmm d, yyyy, xrefs: 00408CBB
AMPM, xrefs: 00408D95
:mm, xrefs: 00408DAC

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 9a7eb394a66080edfd24f68117555f400a3e3cdfc1c474aefde3fc5f2e1ccb78
Instruction ID: 6e389ecbf5aa42e5faf75f2f0cdd2dfe5a993f3520af0ea01b43abf2a46df86b
Opcode Fuzzy Hash: 9a7eb394a66080edfd24f68117555f400a3e3cdfc1c474aefde3fc5f2e1ccb78
Instruction Fuzzy Hash: 20514E34B00148ABDB01EBAAC94169E676ADB98308F50947FB091BB7C7CE3CDA05975D

Function 00411B84 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158windowCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,00411D89), ref: 00411C1C
InsertMenuItemA.USER32(?,000000FF,00000001,0000002C), ref: 00411CDA

Part of subcall function 00411F3C: CreatePopupMenu.USER32 ref: 00411F56

InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 00411D66

Part of subcall function 00411F3C: CreateMenu.USER32 ref: 00411F60

InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 00411D4D

Strings

,, xrefs: 00411C2F
?, xrefs: 00411C36

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Menu$Insert$Create$ItemPopupVersion
String ID: ,$?
API String ID: 2359071979-2308483597
Opcode ID: 9b134eee889e33d37a4ec0c56774254259b9a4ff3835cb0723709589e0e67a2a
Instruction ID: 3fb5e0cd3bdc3201fae72ff24864c2251e092a1c83a82613ff871d7f09dca240
Opcode Fuzzy Hash: 9b134eee889e33d37a4ec0c56774254259b9a4ff3835cb0723709589e0e67a2a
Instruction Fuzzy Hash: 82510674A00145ABDB10EF7ADD816DA7BF9AB09304F21417BFA04E73A6E738D941CB58

Function 0041C2F3 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 0041C3B8
GetObjectA.GDI32(?,00000018,?), ref: 0041C3C7
GetBitmapBits.GDI32(?,?,?), ref: 0041C418
GetBitmapBits.GDI32(?,?,?), ref: 0041C426
DeleteObject.GDI32(?), ref: 0041C42F
DeleteObject.GDI32(?), ref: 0041C438
CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 0041C455

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Object$BitmapBitsDelete$CreateIcon
String ID:
API String ID: 1030595962-0
Opcode ID: ec19989a10235cbf9a1edf4f8eb35756c5d910f1ff26f4107efc2cfff39a000d
Instruction ID: 503a746306143f5d70b37ccc37edd8169d972c8c437de2bc6362dd1504a2ea70
Opcode Fuzzy Hash: ec19989a10235cbf9a1edf4f8eb35756c5d910f1ff26f4107efc2cfff39a000d
Instruction Fuzzy Hash: 52511831E002199FCB14DFE9C8819EEB7F9EF48314B10852AF914E7391D638AD81CB64

Function 0041D368 Relevance: 10.7, APIs: 7, Instructions: 152windowCOMMON

Download Yara Rule

APIs

SetStretchBltMode.GDI32(00000000,00000003), ref: 0041D38E
GetDeviceCaps.GDI32(00000000,00000026), ref: 0041D3AD
SelectPalette.GDI32(?,?,00000001), ref: 0041D413
RealizePalette.GDI32(?), ref: 0041D422
StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00000000,?,?), ref: 0041D48C
StretchDIBits.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00000000,?), ref: 0041D4CA
SelectPalette.GDI32(?,?,00000001), ref: 0041D4EF

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: PaletteStretch$Select$BitsCapsDeviceModeRealize
String ID:
API String ID: 2222416421-0
Opcode ID: 04b102cceab6519e9c3a92a55d02afe56828cc33fe19e53c7d712d938cb733d8
Instruction ID: 994e6928e375576195bbff131da20e2633e51e8889d6c5a0b4bc55991cd6db0b
Opcode Fuzzy Hash: 04b102cceab6519e9c3a92a55d02afe56828cc33fe19e53c7d712d938cb733d8
Instruction Fuzzy Hash: 10512FB0A00604AFD714DFA9C985F9AB7F9EF08304F148599B959D7292C778ED80CB58

Function 00457B6C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,?,?), ref: 00457BBE

Part of subcall function 0042470C: GetWindowTextA.USER32(?,?,00000100), ref: 0042472C

Part of subcall function 0041F334: GetCurrentThreadId.KERNEL32 ref: 0041F383
Part of subcall function 0041F334: EnumThreadWindows.USER32(00000000,0041F2E4,00000000), ref: 0041F389

Part of subcall function 00424754: SetWindowTextA.USER32(?,00000000), ref: 0042476C

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00457C25
TranslateMessage.USER32(?), ref: 00457C43
DispatchMessageA.USER32(?), ref: 00457C4C

Strings

[Paused] , xrefs: 00457BF4

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Message$TextThreadWindow$CurrentDispatchEnumSendTranslateWindows
String ID: [Paused]
API String ID: 1007367021-4230553315
Opcode ID: 88b9b1bc554ff4d24cec4666a6ef0019c55efa5fb37cd3d889b18cecd8748ee2
Instruction ID: 06e1226616be40fe5bc559768a91633e97e499603686e5a952697563b4c26b81
Opcode Fuzzy Hash: 88b9b1bc554ff4d24cec4666a6ef0019c55efa5fb37cd3d889b18cecd8748ee2
Instruction Fuzzy Hash: 523195319082485EDB12DBB5E841BDE7BF8DB49304F908077E810E7292D63C9909CB68

Function 0046C9CC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99sleepCOMMON

Download Yara Rule

APIs

GetCursor.USER32(00000000,0046CB0B), ref: 0046CA88
LoadCursorA.USER32(00000000,00007F02), ref: 0046CA96
SetCursor.USER32(00000000,00000000,00007F02,00000000,0046CB0B), ref: 0046CA9C
Sleep.KERNEL32(000002EE,00000000,00000000,00007F02,00000000,0046CB0B), ref: 0046CAA6
SetCursor.USER32(00000000,000002EE,00000000,00000000,00007F02,00000000,0046CB0B), ref: 0046CAAC

Strings

CheckPassword, xrefs: 0046CA30

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Cursor$LoadSleep
String ID: CheckPassword
API String ID: 4023313301-1302249611
Opcode ID: 2f2df5208c73c0f70ca975b4ddce3b87f5786bbaa89a865973171e5e53164ffe
Instruction ID: bcd76fd93e1a99cf90124dfe3263064cb68ae33075349506e991cb0062b53ae2
Opcode Fuzzy Hash: 2f2df5208c73c0f70ca975b4ddce3b87f5786bbaa89a865973171e5e53164ffe
Instruction Fuzzy Hash: 9F3184347402449FD711DB69C8CAFAE7BE0AF05304F1580B6B9449B3E2D778AE44CB49

Function 00479B94 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00479ABC: GetWindowThreadProcessId.USER32(00000000), ref: 00479AC4
Part of subcall function 00479ABC: GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,00479BBB,0049F0AC,00000000), ref: 00479AD7
Part of subcall function 00479ABC: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00479ADD

SendMessageA.USER32(00000000,0000004A,00000000,00479F4E), ref: 00479BC9
GetTickCount.KERNEL32 ref: 00479C0E
GetTickCount.KERNEL32 ref: 00479C18
MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,0000000A,000000FF), ref: 00479C6D

Strings

CallSpawnServer: Unexpected status: %d, xrefs: 00479C56
CallSpawnServer: Unexpected response: $%x, xrefs: 00479BFE

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CountTick$AddressHandleMessageModuleMultipleObjectsProcProcessSendThreadWaitWindow
String ID: CallSpawnServer: Unexpected response: $%x$CallSpawnServer: Unexpected status: %d
API String ID: 613034392-3771334282
Opcode ID: 8b778137e9f8cf098977899a82ecc36c6b0d955811c981a6f501f830f78023e4
Instruction ID: cbcd9513cc52e37f36519a22da81b3a7bae046c7646e3a127f5da4f74cc7d7de
Opcode Fuzzy Hash: 8b778137e9f8cf098977899a82ecc36c6b0d955811c981a6f501f830f78023e4
Instruction Fuzzy Hash: 6831BF74B002159EDF10EBB9C8867EEB6E5AF44304F50803BB148EB382D67C9E4187AD

Function 0045A014 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(626D6573,CreateAssemblyCache), ref: 0045A0CF

Strings

CreateAssemblyCache, xrefs: 0045A0C6
.NET Framework CreateAssemblyCache function failed, xrefs: 0045A0F2
Failed to load .NET Framework DLL "%s", xrefs: 0045A0B4
Failed to get address of .NET Framework CreateAssemblyCache function, xrefs: 0045A0DA
Fusion.dll, xrefs: 0045A06F

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressProc
String ID: .NET Framework CreateAssemblyCache function failed$CreateAssemblyCache$Failed to get address of .NET Framework CreateAssemblyCache function$Failed to load .NET Framework DLL "%s"$Fusion.dll
API String ID: 190572456-3990135632
Opcode ID: 0edb6cc7ddd363ed8297a47b0f0b8b88e8d68d857a2d0b213e2bd09813e3ca9e
Instruction ID: 9a321e89453ba4f36132349ca91dc91ba75a1bd21e0a38aa57df13fbbf55b943
Opcode Fuzzy Hash: 0edb6cc7ddd363ed8297a47b0f0b8b88e8d68d857a2d0b213e2bd09813e3ca9e
Instruction Fuzzy Hash: B831A970D006059BCB11EFA5C84169EF7B5AF44715F40867BE910A7382DB3C9A188799

Function 0041C5D8 Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041C4D8: GetObjectA.GDI32(?,00000018), ref: 0041C4E5

GetFocus.USER32 ref: 0041C5F8
GetDC.USER32(?), ref: 0041C604
SelectPalette.GDI32(?,?,00000000), ref: 0041C625
RealizePalette.GDI32(?), ref: 0041C631
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0041C648
SelectPalette.GDI32(?,00000000,00000000), ref: 0041C670
ReleaseDC.USER32(?,?), ref: 0041C67D

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Palette$Select$BitsFocusObjectRealizeRelease
String ID:
API String ID: 3303097818-0
Opcode ID: 06f70be5c2937d22c7d59323c1d4f85c74eb10055d491e17f779f64a32073242
Instruction ID: 25388d08763cc31724119198cc62293da4a252d14e83de2780c9a5f0ba17a272
Opcode Fuzzy Hash: 06f70be5c2937d22c7d59323c1d4f85c74eb10055d491e17f779f64a32073242
Instruction Fuzzy Hash: C6116A71A40608BBDB10EBE9CC85FAFB7FCEF48700F15446AB518E7281D6789D008B68

Function 00485DEC Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E2AC: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,c]H,?,00000001,?,?,00485D63,?,00000001,00000000), ref: 0042E2C8

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,00485EA4), ref: 00485E89

Strings

ProductType, xrefs: 00485E28
WinNT, xrefs: 00485E39
ServerNT, xrefs: 00485E6D
LanmanNT, xrefs: 00485E53
System\CurrentControlSet\Control\ProductOptions, xrefs: 00485E10

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CloseOpen
String ID: LanmanNT$ProductType$ServerNT$System\CurrentControlSet\Control\ProductOptions$WinNT
API String ID: 47109696-2530820420
Opcode ID: d204000cd0dd23f5283872a698eba520b0b08f6ba3bf909afc745200d47d4b59
Instruction ID: 958e9ce0adda5e93bd714243c33e0b6baf0b7e119fe8a1de1007b7a18bb7fad4
Opcode Fuzzy Hash: d204000cd0dd23f5283872a698eba520b0b08f6ba3bf909afc745200d47d4b59
Instruction Fuzzy Hash: 64119D30604A44AEDB11FB658C01BAF7BA9DB15304F5048B7A900E7682EB389F45D31C

Function 00498124 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00498135

Part of subcall function 0041A678: CreateFontIndirectA.GDI32(?), ref: 0041A737

SelectObject.GDI32(00000000,00000000), ref: 00498157
GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,004986D5), ref: 0049816B
GetTextMetricsA.GDI32(00000000,?), ref: 0049818D
ReleaseDC.USER32(00000000,00000000), ref: 004981AA

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 00498162

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Text$CreateExtentFontIndirectMetricsObjectPointReleaseSelect
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 2948443157-222967699
Opcode ID: dc57bc42999370203c81eaa79737aff211a8c36498386b118903cc0376ee0f29
Instruction ID: becc67f45299d5a222b921ec3b3989b1c3fa076d37f44047e4772cd89fbd87dd
Opcode Fuzzy Hash: dc57bc42999370203c81eaa79737aff211a8c36498386b118903cc0376ee0f29
Instruction Fuzzy Hash: D1019B75604608BFDB00DBE9CC42F9FB7ECDB49704F55047AB500E7291DA78AD018B68

Function 0044CDDC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044CDAC: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0044CDC4

LoadLibraryA.KERNEL32(00000000,00000000,0044CE9E,?,?,?,?,00000000,00000000), ref: 0044CE26
GetProcAddress.KERNEL32(00000000,LresultFromObject), ref: 0044CE37
GetProcAddress.KERNEL32(00000000,CreateStdAccessibleObject), ref: 0044CE47

Strings

LresultFromObject, xrefs: 0044CE31
CreateStdAccessibleObject, xrefs: 0044CE41
oleacc.dll, xrefs: 0044CE13

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: CreateStdAccessibleObject$LresultFromObject$oleacc.dll
API String ID: 2141747552-1050967733
Opcode ID: 6dc9bb8cb144e0b2d69b42c7161e343f8afd27fcc46fb63d2f57594f47690d2c
Instruction ID: a702f4643fe6e099115479b548097bfe9a63d2924ca5d738d996a727133e4afc
Opcode Fuzzy Hash: 6dc9bb8cb144e0b2d69b42c7161e343f8afd27fcc46fb63d2f57594f47690d2c
Instruction Fuzzy Hash: 65119170602308ABF710EFA2DCC2B5A77A8E794708F64047BA00066691D7BD99448A1D

Function 0041B8F2 Relevance: 10.6, APIs: 7, Instructions: 57windowCOMMON

Download Yara Rule

APIs

SelectObject.GDI32(00000000,?), ref: 0041B900
SelectObject.GDI32(?,00000000), ref: 0041B90F
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B93B
SelectObject.GDI32(00000000,00000000), ref: 0041B949
SelectObject.GDI32(?,00000000), ref: 0041B957
DeleteDC.GDI32(00000000), ref: 0041B960
DeleteDC.GDI32(?), ref: 0041B969

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ObjectSelect$Delete$Stretch
String ID:
API String ID: 1458357782-0
Opcode ID: 9877176484a70d403600f1714a00c8a025884f8eac3cfbcae5058479fbc8ea05
Instruction ID: 7af7168ee4e3f122af8b0d4427163761b09037522acd9a56f3a9582fc2e5d9ca
Opcode Fuzzy Hash: 9877176484a70d403600f1714a00c8a025884f8eac3cfbcae5058479fbc8ea05
Instruction Fuzzy Hash: F7117CB2E40559ABDF10D6D9D885FAFB7BCEF08304F004416B714FB241C678A8418B94

Function 00423824 Relevance: 10.6, APIs: 7, Instructions: 56threadwindowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 0042383F
WindowFromPoint.USER32(?,?), ref: 0042384C
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0042385A
GetCurrentThreadId.KERNEL32 ref: 00423861
SendMessageA.USER32(00000000,00000084,?,?), ref: 0042387A
SendMessageA.USER32(00000000,00000020,00000000,00000000), ref: 00423891
SetCursor.USER32(00000000), ref: 004238A3

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
String ID:
API String ID: 1770779139-0
Opcode ID: 70500f7dcf266beb48586870626c57fb13a9a50022589c1df5f619c5c3ec88b1
Instruction ID: af43fee0338c9e624ebb6e65c196278dc7248109df2d757125d2dc099b9481b9
Opcode Fuzzy Hash: 70500f7dcf266beb48586870626c57fb13a9a50022589c1df5f619c5c3ec88b1
Instruction Fuzzy Hash: 4C01B16230431136D6207A795C86E2F26E8DFC5B19F50413FB509BE282DA3D8C00636D

Function 00497F48 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll), ref: 00497F58
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 00497F65
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00497F72

Strings

GetMonitorInfoA, xrefs: 00497F6C
MonitorFromRect, xrefs: 00497F5F
user32.dll, xrefs: 00497F53

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetMonitorInfoA$MonitorFromRect$user32.dll
API String ID: 667068680-2254406584
Opcode ID: b60da09477df66d8a7de5606af5b9ca1eea5f1c90e34b2e31f6b9da5e1214bea
Instruction ID: 9c7c2a4d3a8a83d63d4dd00cde25b2465012ab0140f6e66d699dd8068a2c56a0
Opcode Fuzzy Hash: b60da09477df66d8a7de5606af5b9ca1eea5f1c90e34b2e31f6b9da5e1214bea
Instruction Fuzzy Hash: 10F0F652B19A1466DA2025764C41F7B7DCCCB85760F140037FD44B73CAE95C8C0443BD

Function 0045DA18 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,ISCryptGetVersion), ref: 0045DA21
GetProcAddress.KERNEL32(00000000,ArcFourInit), ref: 0045DA31
GetProcAddress.KERNEL32(00000000,ArcFourCrypt), ref: 0045DA41

Strings

ArcFourInit, xrefs: 0045DA2B
ISCryptGetVersion, xrefs: 0045DA1B
ArcFourCrypt, xrefs: 0045DA3B

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressProc
String ID: ArcFourCrypt$ArcFourInit$ISCryptGetVersion
API String ID: 190572456-508647305
Opcode ID: 7a556fa67a55cf8447a9efdb62b0761e5535bcf007e3935c7a68e24fad993a97
Instruction ID: 1edccc56acb66b4562ddfa4c7a90d58ee85ee4b976394e257a4a6a33c45d2cf5
Opcode Fuzzy Hash: 7a556fa67a55cf8447a9efdb62b0761e5535bcf007e3935c7a68e24fad993a97
Instruction Fuzzy Hash: 52F01DB09056008BD314DF36AC45727379DEB98306F58803BA845D11A3E77A089CEA0C

Function 0045DF18 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressInit), ref: 0045DF21
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompress), ref: 0045DF31
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressEnd), ref: 0045DF41

Strings

BZ2_bzDecompressInit, xrefs: 0045DF1B
BZ2_bzDecompress, xrefs: 0045DF2B
BZ2_bzDecompressEnd, xrefs: 0045DF3B

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressProc
String ID: BZ2_bzDecompress$BZ2_bzDecompressEnd$BZ2_bzDecompressInit
API String ID: 190572456-212574377
Opcode ID: 88957fa4a0c2cec21efe549f3502b6a6b9bb452ed3dd0ea2322b65fd9bc7507f
Instruction ID: c781611ed6df2ffd52f678218cea13a9d8474895aea0bca464552a1c0941260e
Opcode Fuzzy Hash: 88957fa4a0c2cec21efe549f3502b6a6b9bb452ed3dd0ea2322b65fd9bc7507f
Instruction Fuzzy Hash: 97F030B5E00300DEE724DF32AC0972336D9AFA4716F14803BA946D66A3D378444DCE2D

Function 0042E2D4 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 32registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegDeleteKeyA.ADVAPI32(00000000,00000000), ref: 0042E2E0
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,?,00000000,0042E47B,00000000,0042E493,?,?,?,?,00000006,?,00000000,0049A491), ref: 0042E2FB
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042E301
RegDeleteKeyExA.ADVAPI32(00000000,00000000,00000100,00000000,?,00000000,0042E47B,00000000,0042E493,?,?,?,?,00000006,?,00000000), ref: 0042E31D

Strings

RegDeleteKeyExA, xrefs: 0042E2F1
advapi32.dll, xrefs: 0042E2F6

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Delete$AddressHandleModuleProc
String ID: RegDeleteKeyExA$advapi32.dll
API String ID: 636244128-1846899949
Opcode ID: 362f5f100e4d63b612f5d27974d6092d6f3e2718a2a4fd0f8b39e618b9934fb6
Instruction ID: 4593d6951ad1389f122581937974f3187b46c4a982a9796ded25b619d02fe20b
Opcode Fuzzy Hash: 362f5f100e4d63b612f5d27974d6092d6f3e2718a2a4fd0f8b39e618b9934fb6
Instruction Fuzzy Hash: 84E06571750234F6D674AA677C4AF97260CD764726F940837F545661D187BC1C40CA5C

Function 0042EEAC Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30libraryloaderwindowCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilterEx,00000004,0049C938,00457A81,00457E24,004579D8,00000000,00000B06,00000000,00000000,00000002,00000000,004833CD), ref: 0042EEC5
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EECB
InterlockedExchange.KERNEL32(0049E66C,00000001), ref: 0042EEDC

Part of subcall function 0042EE3C: GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EF00,00000004,0049C938,00457A81,00457E24,004579D8,00000000,00000B06,00000000,00000000,00000002,00000000,004833CD), ref: 0042EE52
Part of subcall function 0042EE3C: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EE58
Part of subcall function 0042EE3C: InterlockedExchange.KERNEL32(0049E664,00000001), ref: 0042EE69

ChangeWindowMessageFilterEx.USER32(00000000,?,00000001,00000000,00000004,0049C938,00457A81,00457E24,004579D8,00000000,00000B06,00000000,00000000,00000002,00000000,004833CD), ref: 0042EEF0

Strings

user32.dll, xrefs: 0042EEC0
ChangeWindowMessageFilterEx, xrefs: 0042EEBB

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc$ChangeFilterMessageWindow
String ID: ChangeWindowMessageFilterEx$user32.dll
API String ID: 142928637-2676053874
Opcode ID: 389e91f0b6fea372d76e4afa2011532d8e09b8c5ffcd98648874458c7b9a3310
Instruction ID: d73472cc1cf9ee785b15135c95e247d87a8e276cbab312dacd1aac06db931f35
Opcode Fuzzy Hash: 389e91f0b6fea372d76e4afa2011532d8e09b8c5ffcd98648874458c7b9a3310
Instruction Fuzzy Hash: 6BE01BB1750720E6EE10B7777C46FA72654DB64769F950437F100A51D1C7FE0C848A6D

Function 0047AB48 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0049B858), ref: 0047AB4E
GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 0047AB5B
GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 0047AB6B

Strings

VerSetConditionMask, xrefs: 0047AB55
VerifyVersionInfoW, xrefs: 0047AB65
kernel32.dll, xrefs: 0047AB49

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: VerSetConditionMask$VerifyVersionInfoW$kernel32.dll
API String ID: 667068680-222143506
Opcode ID: f918b1f17610fa3fe6e9289c2553ead6d441b2495088aa60f3db5d1622f86243
Instruction ID: 1c83343f1a628b76699a86152b4b61cb0c5f8596cf17e21d447650a2aa5998b6
Opcode Fuzzy Hash: f918b1f17610fa3fe6e9289c2553ead6d441b2495088aa60f3db5d1622f86243
Instruction Fuzzy Hash: FFC012E0280700EEE600B7B11C82D7F255DD590B25320C03B7189B5183D6BC1C284F2E

Function 0041B998 Relevance: 9.1, APIs: 6, Instructions: 113windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041BA0E
GetDC.USER32(?), ref: 0041BA1A
GetDeviceCaps.GDI32(?,00000068), ref: 0041BA36
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041BA53
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041BA6A
ReleaseDC.USER32(?,?), ref: 0041BAB6

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: EntriesPaletteSystem$CapsDeviceFocusRelease
String ID:
API String ID: 2502006586-0
Opcode ID: 8677b4c9643155cfa8b241eb815e8948b89f536ec76e5c7ec5a5b4487363e7b6
Instruction ID: a7c0e65a03819a5ca0ecfd2330013adb4d65aecf06c5c54e884ed256bbcda07e
Opcode Fuzzy Hash: 8677b4c9643155cfa8b241eb815e8948b89f536ec76e5c7ec5a5b4487363e7b6
Instruction Fuzzy Hash: 7941C371A042149FDB10DFA9C886AAFBBB4EF45740F1484AAF940EB351D238AD11CBA5

Function 0041C21C Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041C265
GetSystemMetrics.USER32(0000000C), ref: 0041C26F
GetDC.USER32(00000000), ref: 0041C279
GetDeviceCaps.GDI32(00000000,0000000E), ref: 0041C2A0
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0041C2AD
ReleaseDC.USER32(00000000,00000000), ref: 0041C2E6

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: b56dce364db8681bf449ce1525ba10edc72df88ae5eafd2cc45f48ffa874235a
Instruction ID: 9f2a90fdc7dd77bbc6d9abc5b90aadbfd0b864dc6f709442552c07669a95c1ee
Opcode Fuzzy Hash: b56dce364db8681bf449ce1525ba10edc72df88ae5eafd2cc45f48ffa874235a
Instruction Fuzzy Hash: 07213C75E44649AFEB00EFE9C882BEEB7B4EB48714F10806AF514B7280D7795940CB69

Function 0048074C Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EC), ref: 0048075A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,0046E2F5), ref: 00480780
GetWindowLongA.USER32(?,000000EC), ref: 00480790
SetWindowLongA.USER32(?,000000EC,00000000), ref: 004807B1
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 004807C5
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 004807E1

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: a93a24f8a385916f42bf9898816c0f6cea5074e50c25229c13845d94f2c34b12
Instruction ID: aec5aa95f666439bcced33b23c4c5c58863438cb4560c463508bf228766ea8a4
Opcode Fuzzy Hash: a93a24f8a385916f42bf9898816c0f6cea5074e50c25229c13845d94f2c34b12
Instruction Fuzzy Hash: 200129B5650210ABD600EB79CD81F2A77A8AB1D354F050666F994DB3E3C239EC048F48

Function 0041B700 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0041AB70: CreateBrushIndirect.GDI32 ref: 0041ABDB

UnrealizeObject.GDI32(00000000), ref: 0041B70C
SelectObject.GDI32(?,00000000), ref: 0041B71E
SetBkColor.GDI32(?,00000000), ref: 0041B741
SetBkMode.GDI32(?,00000002), ref: 0041B74C
SetBkColor.GDI32(?,00000000), ref: 0041B767
SetBkMode.GDI32(?,00000001), ref: 0041B772

Part of subcall function 0041A4E8: GetSysColor.USER32(?), ref: 0041A4F2

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: c61030d912a8a6847aea8d9dd9de33bb9ce49b13cbe3d1a7ba6db01534d8f73f
Instruction ID: e5a7d4b7c2e235827ad94a1825542cc68ab193fc61db3cfd758683236e3ca83d
Opcode Fuzzy Hash: c61030d912a8a6847aea8d9dd9de33bb9ce49b13cbe3d1a7ba6db01534d8f73f
Instruction Fuzzy Hash: 25F0C275615100ABDE00FFBADACAE4B37989F443097048097B504DF197C67CE8504B39

Function 00455F08 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E2AC: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,c]H,?,00000001,?,?,00485D63,?,00000001,00000000), ref: 0042E2C8

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,0045609F,?,00000000,004560DF), ref: 00455FE5

Strings

SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00455F68
WININIT.INI, xrefs: 00456014
PendingFileRenameOperations2, xrefs: 00455FB4
PendingFileRenameOperations, xrefs: 00455F84

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
API String ID: 47109696-2199428270
Opcode ID: b1fa0388c9cc40cc5bb3918762f67d29aeeab1942f923d6299d7476c810119f5
Instruction ID: a4a9f2ec6dce7785653c913c6c24b0c1e176cc517468c749f5f74b0afa9d98e4
Opcode Fuzzy Hash: b1fa0388c9cc40cc5bb3918762f67d29aeeab1942f923d6299d7476c810119f5
Instruction Fuzzy Hash: F551B430E002089BDB15EF62DD51ADEB7B9EF45705F50817BF904A72C2DB78AE49CA18

Function 0049A990 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 00424754: SetWindowTextA.USER32(?,00000000), ref: 0042476C

ShowWindow.USER32(?,00000005,00000000,0049ABF5,?,?,00000000), ref: 0049A9C6

Part of subcall function 0042DD54: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD67

Part of subcall function 00407738: SetCurrentDirectoryA.KERNEL32(00000000,?,0049A9EE,00000000,0049ABC1,?,?,00000005,00000000,0049ABF5,?,?,00000000), ref: 00407743

Part of subcall function 0042D8DC: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D96A,?,?,?,00000001,?,004568AE,00000000,00456916), ref: 0042D911

Strings

.dat, xrefs: 0049AA0D
IMsg, xrefs: 0049AA9A
Uninstall, xrefs: 0049A9AC
.msg, xrefs: 0049AA2C

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
String ID: .dat$.msg$IMsg$Uninstall
API String ID: 3312786188-1660910688
Opcode ID: da85b63c2f22f13781a14cc0fb46b7049666a4e28c94577ffa0444f6b381a344
Instruction ID: c04811e11aa7b306946e3b963f00114f19b049d920a4edae29fcffe974af9854
Opcode Fuzzy Hash: da85b63c2f22f13781a14cc0fb46b7049666a4e28c94577ffa0444f6b381a344
Instruction Fuzzy Hash: 24316074A00214AFCB00FF65CC5295E7BB5FB49304F61847AF800AB752DB39AD15CB99

Function 0042EF38 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonCreate), ref: 0042EF6A
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EF70
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,user32.dll,ShutdownBlockReasonCreate), ref: 0042EF99

Strings

user32.dll, xrefs: 0042EF65
ShutdownBlockReasonCreate, xrefs: 0042EF60

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressByteCharHandleModuleMultiProcWide
String ID: ShutdownBlockReasonCreate$user32.dll
API String ID: 828529508-2866557904
Opcode ID: 54f918a627300866d359fc4902b15493ec36370e2bfa8870a9d3efce00e910ff
Instruction ID: 98e14bcb75ccd3fa79125cd8f842b3c85c6f4936fd04c03cffbbcbf6111bfa2c
Opcode Fuzzy Hash: 54f918a627300866d359fc4902b15493ec36370e2bfa8870a9d3efce00e910ff
Instruction Fuzzy Hash: 8AF0F6E134462237E620B27FAC82F7B55CC8F98719F15003AB508FA2C1EA6CC905426F

Function 00458888 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 004588B8
GetExitCodeProcess.KERNEL32(?,?), ref: 004588D9
CloseHandle.KERNEL32(?,0045890C), ref: 004588FF

Strings

MsgWaitForMultipleObjects, xrefs: 004588C5
GetExitCodeProcess, xrefs: 004588E2

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CloseCodeExitHandleMultipleObjectsProcessWait
String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
API String ID: 2573145106-3235461205
Opcode ID: a63eea042720b412f6253df48c4ad4ae0bbb112a2da49a3bac6adc515d8d2a68
Instruction ID: 5ab474d98eb3a0ece9291f621c53fee7be03ae90ebbbcbdbcbdfc60506012216
Opcode Fuzzy Hash: a63eea042720b412f6253df48c4ad4ae0bbb112a2da49a3bac6adc515d8d2a68
Instruction Fuzzy Hash: 5601A271600204AFDB11EBA98C02A6A73A8EB45715F60057AF810F73D3DE38AE04961D

Function 0042EE3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EF00,00000004,0049C938,00457A81,00457E24,004579D8,00000000,00000B06,00000000,00000000,00000002,00000000,004833CD), ref: 0042EE52
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EE58
InterlockedExchange.KERNEL32(0049E664,00000001), ref: 0042EE69

Strings

ChangeWindowMessageFilter, xrefs: 0042EE48
user32.dll, xrefs: 0042EE4D

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 3478007392-2498399450
Opcode ID: b41fa3605276e12a0c1fa2295fb575996c300a3307de7a79c762c968af81e3a1
Instruction ID: 048ca61b172dfedb03cf1c059d2784ab3124221c9e2a99dd16ddbc81be59c6a3
Opcode Fuzzy Hash: b41fa3605276e12a0c1fa2295fb575996c300a3307de7a79c762c968af81e3a1
Instruction Fuzzy Hash: B6E0B6A1661310EAFA10B7736C8AF562555AB34B19FA1043BF100651E1C6BC0884C91D

Function 00479ABC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 00479AC4
GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,00479BBB,0049F0AC,00000000), ref: 00479AD7
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00479ADD

Strings

AllowSetForegroundWindow, xrefs: 00479ACD
user32.dll, xrefs: 00479AD2

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressHandleModuleProcProcessThreadWindow
String ID: AllowSetForegroundWindow$user32.dll
API String ID: 1782028327-3855017861
Opcode ID: b21f7722f9ab78200a24ebcbb03f5faf6ca75ee35d7ba98bc44e18f457458fa2
Instruction ID: ba37cbfad0dd6d16563a31998266d3d41f0b2e73f3e1651ddf86cc9f380f05df
Opcode Fuzzy Hash: b21f7722f9ab78200a24ebcbb03f5faf6ca75ee35d7ba98bc44e18f457458fa2
Instruction Fuzzy Hash: 9ED0A9A020234276ED00F3B69C4BEAB33AC8F84708710C83B7408E2186CA7CEC448A3C

Function 00448A1C Relevance: 7.7, APIs: 5, Instructions: 160libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,00000000,00448C1C), ref: 00448B48
GetLastError.KERNEL32(00000000,?,?,00000000,00448C1C), ref: 00448B6F
GetProcAddress.KERNEL32(00000000,00000000), ref: 00448BD6
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00448C1C), ref: 00448BF1

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID:
API String ID: 1866314245-0
Opcode ID: dee4c815c0dc1aaf2ecda37d5d19560f87301e95d4990df2ec0d578c3d84c388
Instruction ID: 86cd10a4b754a346bbb6b93b1800c6189756eba4f25aae068f18fd67d3000257
Opcode Fuzzy Hash: dee4c815c0dc1aaf2ecda37d5d19560f87301e95d4990df2ec0d578c3d84c388
Instruction Fuzzy Hash: B35146B0A001459FDB00EF95C481AAFB7F8EF45315F10817EE414BB396CA789E458B59

Function 004170BC Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

BeginPaint.USER32(00000000,?), ref: 004170E2
SaveDC.GDI32(?), ref: 00417113
ExcludeClipRect.GDI32(?,?,?,?,?,?,00000000,004171D5), ref: 00417174
RestoreDC.GDI32(?,?), ref: 0041719B
EndPaint.USER32(00000000,?,004171DC,00000000,004171D5), ref: 004171CF

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Paint$BeginClipExcludeRectRestoreSave
String ID:
API String ID: 3808407030-0
Opcode ID: 2aefb1f11be775139b331da31e14453598fb34486e2afd9f20f5c966e66715d4
Instruction ID: a59a5e74ec56046a8e44d3172024536881dae92cda495952d4f2aea49f83957e
Opcode Fuzzy Hash: 2aefb1f11be775139b331da31e14453598fb34486e2afd9f20f5c966e66715d4
Instruction Fuzzy Hash: 9C413D70A08204AFDB14DBA9C985FAA77F9FB48314F1544AAE8059B362C7789D81CB18

Function 00414C90 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,?), ref: 00414CC6
MulDiv.KERNEL32(?,?,?), ref: 00414CE0
MulDiv.KERNEL32(?,?,?), ref: 00414D09
MulDiv.KERNEL32(?,?,?), ref: 00414D34
MulDiv.KERNEL32(00000000,?,00000000), ref: 00414D7C

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6723b5202e330dc32e4e910c1744c1f6af12d9a6ca138e20ff4de4c990d11818
Instruction ID: b7433d6af5671a809cf87ab508426f3e85ed5e2fdb4bb50135625d5106dc29cf
Opcode Fuzzy Hash: 6723b5202e330dc32e4e910c1744c1f6af12d9a6ca138e20ff4de4c990d11818
Instruction Fuzzy Hash: 1B3170706057009FC720EB2DC884AABB7E8AF89710F04891EF9D5C3751D238EC808B59

Function 0041C048 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041C05A
GetSystemMetrics.USER32(0000000C), ref: 0041C064
GetDC.USER32(00000000), ref: 0041C0A2
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041C0E9
DeleteObject.GDI32(00000000), ref: 0041C12A

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: MetricsSystem$BitmapCreateDeleteObject
String ID:
API String ID: 1095203571-0
Opcode ID: 142aaef5fb75dc877dec10a7682396b9e25510c94f542f6073738a5e6d3aa482
Instruction ID: af0cd6ff41168786fc466cfb62adbf741af89e47da0ede509f3e80318da31809
Opcode Fuzzy Hash: 142aaef5fb75dc877dec10a7682396b9e25510c94f542f6073738a5e6d3aa482
Instruction Fuzzy Hash: 92314174E40205EFDB00DFA5C981AAEB7F5EB48704F1185AAF510AB381D7789E80DF98

Function 00429C5C Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429C98
SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429CC7
SendMessageA.USER32(00000000,000000C1,00000000,00000000), ref: 00429CE3
SendMessageA.USER32(00000000,000000B1,00000000,00000000), ref: 00429D0E
SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 00429D2C

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bc63629cb27ad13ca6417472d4f3f1d186b1f81fbb10e3d200fe59e3d4f08092
Instruction ID: 60921b255c01a359d0eb68e62e5e28d9b6fe2da514f119f30b014399c46582d3
Opcode Fuzzy Hash: bc63629cb27ad13ca6417472d4f3f1d186b1f81fbb10e3d200fe59e3d4f08092
Instruction Fuzzy Hash: C121AF707007057AD710ABA7DC82F4BB6ACDB40708F90043EB501AB2D2DB78AD41866D

Function 00403CA4 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403CFC
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403D06
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403D15

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 5ebc352aac4f77473dff7e3dcc86cc0c7398385e60e6a11f17e44d50ff4a2e93
Instruction ID: 657f84db466bd1c54801a2b30447fc2084338491f8142acf58a262d5883cef98
Opcode Fuzzy Hash: 5ebc352aac4f77473dff7e3dcc86cc0c7398385e60e6a11f17e44d50ff4a2e93
Instruction Fuzzy Hash: FCF0A4917442043BF21025A65C43F6B198CCB82B9BF50053FB704FA1D2D87C9D04427D

Function 00414870 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

SelectPalette.GDI32(00000000,00000000,00000000), ref: 004148A9
RealizePalette.GDI32(00000000), ref: 004148B1
SelectPalette.GDI32(00000000,00000000,00000001), ref: 004148C5
RealizePalette.GDI32(00000000), ref: 004148CB
ReleaseDC.USER32(00000000,00000000), ref: 004148D6

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Palette$RealizeSelect$Release
String ID:
API String ID: 2261976640-0
Opcode ID: de0628dfb3b178927ad573b2282efd4894c3506f2a3e842425f6db2cbe849912
Instruction ID: 1b199f70f0334c5ad2d95ba866badc65d16692e0f82b4d98eea4daff33ed8e78
Opcode Fuzzy Hash: de0628dfb3b178927ad573b2282efd4894c3506f2a3e842425f6db2cbe849912
Instruction Fuzzy Hash: 8901DF7521C3806AE200B63D8C85A9F6FEC9FCA314F05596EF498DB382CA7ACC018765

Function 00401548 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,00100000,00002000,00000004,PI,?,?,?,004018B4), ref: 00401566
VirtualAlloc.KERNEL32(?,?,00002000,00000004,?,00100000,00002000,00000004,PI,?,?,?,004018B4), ref: 0040158B
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00100000,00002000,00000004,PI,?,?,?,004018B4), ref: 004015B1

Strings

PI, xrefs: 0040154B
@I, xrefs: 00401599

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Virtual$Alloc$Free
String ID: @I$PI
API String ID: 3668210933-3401599750
Opcode ID: 161c11ae7b6f9ae7ff932e846a1f4c6586aa7d2c364371bd01e5d51a5173f337
Instruction ID: e4c2a63ffe102577e082cd27da14851d232fb322b3ad2ea48a30cae3431602c8
Opcode Fuzzy Hash: 161c11ae7b6f9ae7ff932e846a1f4c6586aa7d2c364371bd01e5d51a5173f337
Instruction Fuzzy Hash: 05F0C871740320AAEB315A294C85F133AD4DBC5754F144075BE09FF3D9D6B8980082AD

Function 00407434 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156shareCOMMON

Download Yara Rule

APIs

WNetGetUniversalNameA.MPR(00000000,00000001,?,00000400), ref: 00407493
WNetOpenEnumA.MPR(00000001,00000001,00000000,00000000,?), ref: 0040750D
WNetEnumResourceA.MPR(?,FFFFFFFF,?,?), ref: 00407565

Strings

Z, xrefs: 004074CC

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Enum$NameOpenResourceUniversal
String ID: Z
API String ID: 3604996873-1505515367
Opcode ID: 59fc97221ce8e2239389e9c8dfc74c2c781be37928cd4af1c274feeaca823a59
Instruction ID: 40f8d8e8b2f406d6a8a22564fe957c27a4ea1e6c79599dfe788430968c9fdea8
Opcode Fuzzy Hash: 59fc97221ce8e2239389e9c8dfc74c2c781be37928cd4af1c274feeaca823a59
Instruction Fuzzy Hash: DD51A270E04608AFDB11EF99CC41A9EBBF9EB09314F1045BAE400B72D1D778AE418F5A

Function 004613A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

GetDeviceCaps.GDI32(00000000,0000000C), ref: 004613D4
GetDIBits.GDI32(00000000,00000000,?,00000000,00000000,004615E1), ref: 004614D4

Strings

(, xrefs: 00461416
, xrefs: 00461437

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: BitsCapsDevice
String ID: $(
API String ID: 1216508973-55695022
Opcode ID: 5957ec3d1a6f1ea59fd2c6b39eb5ebbf337cafbddb9fa20bd40169d8452b2992
Instruction ID: 5dc47b70b294587cc13581978d3ce92ec5f010f9ab1f52b5f87cd7b8da97004a
Opcode Fuzzy Hash: 5957ec3d1a6f1ea59fd2c6b39eb5ebbf337cafbddb9fa20bd40169d8452b2992
Instruction Fuzzy Hash: 67413E71E00209AFDB00DFA9C885AAEFBF8FF49304F14406AE515F72A0D7799944CB5A

Function 0044D62C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 0044D6BA
DrawTextA.USER32(00000000,00000000,00000000,?,00000D20), ref: 0044D6E5
DrawTextA.USER32(00000000,00000000,00000000,00000000,00000800), ref: 0044D76D

Strings

, xrefs: 0044D69F

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: DrawText$EmptyRect
String ID:
API String ID: 182455014-2867612384
Opcode ID: cc4b98afb5af873806a59ffed94079cde15aa62e8b9a8ce5cfefa5f042e0e5f3
Instruction ID: 12a4b21e602b9f7a78cd53eafda620a7b7433ebb18c5ccfef023c502be569e40
Opcode Fuzzy Hash: cc4b98afb5af873806a59ffed94079cde15aa62e8b9a8ce5cfefa5f042e0e5f3
Instruction Fuzzy Hash: B6515171E00244AFDB11DFA5C885BDEBBF9EF49308F05847AE805EB252D7789944CB64

Function 0042F440 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042F46A

Part of subcall function 0041A678: CreateFontIndirectA.GDI32(?), ref: 0041A737

SelectObject.GDI32(?,00000000), ref: 0042F48D
ReleaseDC.USER32(00000000,?), ref: 0042F56C

Strings

...\, xrefs: 0042F51E

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CreateFontIndirectObjectReleaseSelect
String ID: ...\
API String ID: 3133960002-983595016
Opcode ID: 2af15c3dc1833e7e9814f4e1f7c6155fe4929be84ac28a6d797fd996331978fe
Instruction ID: 6da19e17498f2b2ee05211f2735e4231f31b0ac4056ea50bc180adaf4849e001
Opcode Fuzzy Hash: 2af15c3dc1833e7e9814f4e1f7c6155fe4929be84ac28a6d797fd996331978fe
Instruction Fuzzy Hash: 3E313370B00229ABDF11EF9AD851BAEB7B8EB48304FD0447BF414A7291C77C5D45CA59

Function 004540B8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00499A3D,_iu,?,00000000,004541F2), ref: 004541A7
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00499A3D,_iu,?,00000000,004541F2), ref: 004541B7

Strings

.tmp, xrefs: 0045415B
_iu, xrefs: 00454149

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: .tmp$_iu
API String ID: 3498533004-10593223
Opcode ID: 5e7e7330920760a362de61974844bc6fa9155fc720dbeaaa07e30b0c94462987
Instruction ID: 578c6d25dcdad9d531da493d0199c9855db5075e5bb7f28aad5cf4ca392b9bb0
Opcode Fuzzy Hash: 5e7e7330920760a362de61974844bc6fa9155fc720dbeaaa07e30b0c94462987
Instruction Fuzzy Hash: F431C770E00119ABCB11EFA5C842B9EBBB5AF54309F60416AF804BB3C2D6385F4586A8

Function 004168A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,?,?), ref: 0041690F
UnregisterClassA.USER32(?,00400000), ref: 0041693B
RegisterClassA.USER32(?), ref: 0041695E

Strings

@, xrefs: 004168B9

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Class$InfoRegisterUnregister
String ID: @
API String ID: 3749476976-2766056989
Opcode ID: ff9d28bb6dad64ab188a5f4c0217e90f4a5b736283fc06ba7ac15740cd906827
Instruction ID: f0814f926fbfb3063bbfc520005841906eff1053595eb63299fc6e458af65efd
Opcode Fuzzy Hash: ff9d28bb6dad64ab188a5f4c0217e90f4a5b736283fc06ba7ac15740cd906827
Instruction Fuzzy Hash: 70316E702043418BDB20EF69C485B9A77E5AB89308F04447FF985DF392DB39DD858B6A

Function 0049AE44 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,0049B794,00000000,0049AF3A,?,?,00000000,0049E62C), ref: 0049AEB4
SetFileAttributesA.KERNEL32(00000000,00000000,00000000,0049B794,00000000,0049AF3A,?,?,00000000,0049E62C), ref: 0049AEDD
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 0049AEF6

Strings

isRS-%.3u.tmp, xrefs: 0049AE93

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: File$Attributes$Move
String ID: isRS-%.3u.tmp
API String ID: 3839737484-3657609586
Opcode ID: dc8df3f2f4f7bc59b7093eb071ad98aa6f70b00ea94bbcb06950d6bb6ff0dfd6
Instruction ID: 415d8d7a3c0b5b589bb549a000c4c9dff3981c63a88e3c9eb767bed987fa61db
Opcode Fuzzy Hash: dc8df3f2f4f7bc59b7093eb071ad98aa6f70b00ea94bbcb06950d6bb6ff0dfd6
Instruction Fuzzy Hash: BB2175B0D14219AFCF00EFA9C8819AFBBB8EF54314F10457BF814B72D1D6385E018A99

Function 0045742C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042CC94: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042CCB8

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 00457480
RegisterTypeLib.OLEAUT32(00000000,00000000,00000000), ref: 004574AD

Strings

RegisterTypeLib, xrefs: 004574B8
LoadTypeLib, xrefs: 0045748B

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Type$AllocByteCharFullLoadMultiNamePathRegisterStringWide
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 1312246647-2435364021
Opcode ID: ef98400a3cb6d0e3d8d993fb867b0761591a4800f398f9cc68cb898a501ed530
Instruction ID: 9f3c69dbed6527a7536611739b590712afd4786c139aba5f8c5ce656fa2fa7d6
Opcode Fuzzy Hash: ef98400a3cb6d0e3d8d993fb867b0761591a4800f398f9cc68cb898a501ed530
Instruction Fuzzy Hash: 0D11B130B04604BFDB11DFA6DD51A5ABBADEB89305F1084B6BC04D3652EA389A04CA18

Function 004579E4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000B06,00000000,00000000), ref: 004579FE
SendMessageA.USER32(00000000,00000B00,00000000,00000000), ref: 00457A9B

Strings

Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 00457A2A
Failed to create DebugClientWnd, xrefs: 00457A64

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: MessageSend
String ID: Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)$Failed to create DebugClientWnd
API String ID: 3850602802-3720027226
Opcode ID: 16e6f572504ebc5ac44d4a44ac4de445e12655a487ff2082bdd663418aa47eb6
Instruction ID: 7661ec3ee55535d7bb0132d7474b1b2b549bac739db16c54c1b5169243e81f0b
Opcode Fuzzy Hash: 16e6f572504ebc5ac44d4a44ac4de445e12655a487ff2082bdd663418aa47eb6
Instruction Fuzzy Hash: A211E3706082506FE310AB68AC81B8F7B989B55319F14847BF985DB383D3799D18C7AE

Function 0047A614 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00424754: SetWindowTextA.USER32(?,00000000), ref: 0042476C

GetFocus.USER32 ref: 0047A67F
GetKeyState.USER32(0000007A), ref: 0047A691
WaitMessage.USER32(?,00000000,0047A6B8,?,00000000,0047A6DF,?,?,00000001,00000000,?,00482443,00000000,004833CD), ref: 0047A69B

Strings

Wnd=$%x, xrefs: 0047A663

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: FocusMessageStateTextWaitWindow
String ID: Wnd=$%x
API String ID: 1381870634-2927251529
Opcode ID: fbf7d9d6a711ab23059899cb5a5e93ff3bb2cb2f9d9e060085412fc59d5d4b08
Instruction ID: 5496be8882e693a083150370110c20d3f1b0597852f05344834113170fa52e2e
Opcode Fuzzy Hash: fbf7d9d6a711ab23059899cb5a5e93ff3bb2cb2f9d9e060085412fc59d5d4b08
Instruction Fuzzy Hash: FC11A370600204AFC701EF66C851ADE77B8EB89704B6184BAF848E7291D738AD108A6E

Function 0046FD50 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32(?), ref: 0046FD58
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 0046FD67

Strings

(invalid), xrefs: 0046FDEA
%.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u, xrefs: 0046FDDC

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: %.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u$(invalid)
API String ID: 1748579591-1013271723
Opcode ID: bb060cc39148aedb455345e7bc3ff301bf93d173113d396d92c14034a51e3361
Instruction ID: 1dc787eced2517cb8807bab7c2b20f1510b2cd86f013857d73bb6b07fca1fef3
Opcode Fuzzy Hash: bb060cc39148aedb455345e7bc3ff301bf93d173113d396d92c14034a51e3361
Instruction Fuzzy Hash: CB11F8A440C3919AD340DF2AC44472BBAE4AF99704F04496EF9C8D6391E77AC948DB67

Function 00454772 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,00000020), ref: 0045477F

Part of subcall function 004073E0: DeleteFileA.KERNEL32(00000000,0049E62C,0049B325,00000000,0049B37A,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 004073EB

MoveFileA.KERNEL32(00000000,00000000), ref: 004547A4

Part of subcall function 00453C98: GetLastError.KERNEL32(00000000,0045482D,00000005,00000000,00454862,?,?,00000000,0049E62C,00000004,00000000,00000000,00000000,?,0049AFD9,00000000), ref: 00453C9B

Strings

DeleteFile, xrefs: 00454790
MoveFile, xrefs: 004547AD

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: File$AttributesDeleteErrorLastMove
String ID: DeleteFile$MoveFile
API String ID: 3024442154-139070271
Opcode ID: 71221107bf25d878ccb81ec85fbf13119e2723752350075c097fd98521c2f0fd
Instruction ID: 530c5230d1c48a198e6632d8711bb006f4eeac499d42d39edb4531016cb1c6b4
Opcode Fuzzy Hash: 71221107bf25d878ccb81ec85fbf13119e2723752350075c097fd98521c2f0fd
Instruction Fuzzy Hash: C2F086752142445AE701FFA6D84266E63ECDB8431FFA1443BFC00BB6C3DA3C9D094929

Function 00465A14 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044BBBC: LoadLibraryA.KERNEL32(00000000,00000000,0044BF9F,?,?,?,?,00000000,00000000,?,0044FDE1,0049B826), ref: 0044BC1E
Part of subcall function 0044BBBC: GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044BC36
Part of subcall function 0044BBBC: GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044BC48
Part of subcall function 0044BBBC: GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044BC5A
Part of subcall function 0044BBBC: GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044BC6C
Part of subcall function 0044BBBC: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044BC7E
Part of subcall function 0044BBBC: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044BC90
Part of subcall function 0044BBBC: GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044BCA2
Part of subcall function 0044BBBC: GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044BCB4
Part of subcall function 0044BBBC: GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044BCC6
Part of subcall function 0044BBBC: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044BCD8
Part of subcall function 0044BBBC: GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044BCEA
Part of subcall function 0044BBBC: GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044BCFC
Part of subcall function 0044BBBC: GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044BD0E

Part of subcall function 004659E8: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004659FB

LoadLibraryA.KERNEL32(00000000,SHPathPrepareForWriteA,00000000,00465A8A,?,?,?,?,00000000,00000000,?,0049B84E), ref: 00465A5F
GetProcAddress.KERNEL32(00000000,00000000), ref: 00465A65

Strings

shell32.dll, xrefs: 00465A4C
SHPathPrepareForWriteA, xrefs: 00465A31

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressProc$LibraryLoad$DirectorySystem
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 1442766254-2683653824
Opcode ID: fe2831c3bb8ed4c39e8a4c6e29017082e705bae0e86327bffda5122bb532dd84
Instruction ID: 40adbffb9e5bdfd27d779661ae68592eaffae07e03a1378c290830cb38e34495
Opcode Fuzzy Hash: fe2831c3bb8ed4c39e8a4c6e29017082e705bae0e86327bffda5122bb532dd84
Instruction Fuzzy Hash: 07F04470640A08BFD701FBA2DC93F5E7BACDB45714FA0457BB400B6592E67C9E048A5D

Function 00459BF4 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E2AC: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,c]H,?,00000001,?,?,00485D63,?,00000001,00000000), ref: 0042E2C8

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,00459D31,00000000,00459EE9,?,00000000,00000000,00000000), ref: 00459C41

Strings

SOFTWARE\Microsoft\.NETFramework, xrefs: 00459C14
.NET Framework not found, xrefs: 00459C50
InstallRoot, xrefs: 00459C30

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CloseOpen
String ID: .NET Framework not found$InstallRoot$SOFTWARE\Microsoft\.NETFramework
API String ID: 47109696-2631785700
Opcode ID: f24fec9af5db2f1991bdd4949737939eb090882c06033953ff2337a17e6f707b
Instruction ID: 38d3340ec7adb02875813bbcd1e17bd1b65749923c884860087a6e41a9d30ab7
Opcode Fuzzy Hash: f24fec9af5db2f1991bdd4949737939eb090882c06033953ff2337a17e6f707b
Instruction Fuzzy Hash: CEF0A9713001109BC710EB1A9881B9E63CEDB92316F24403BBA85C7353E63CCC0A8629

Function 00485D44 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E2AC: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,c]H,?,00000001,?,?,00485D63,?,00000001,00000000), ref: 0042E2C8

RegQueryValueExA.ADVAPI32(?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 00485D85
RegCloseKey.ADVAPI32(?,?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 00485DA8

Strings

System\CurrentControlSet\Control\Windows, xrefs: 00485D52
CSDVersion, xrefs: 00485D7C

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: CSDVersion$System\CurrentControlSet\Control\Windows
API String ID: 3677997916-1910633163
Opcode ID: b29298fece6ddff030e2d3247232e1114b5d59160d279f20c46d96787f1d0dc6
Instruction ID: b645d16e18edec4d070172cc92acd51db803b961f30f46d561e052e5721ee8e0
Opcode Fuzzy Hash: b29298fece6ddff030e2d3247232e1114b5d59160d279f20c46d96787f1d0dc6
Instruction Fuzzy Hash: 3DF04479E40608AADF51EAD1CC49BDF73FC9F44704F108567EA10E7281E638AA44CB59

Function 0042DD80 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00454356,00000000,004543F9,?,?,00000000,00000000,00000000,00000000,00000000,?,004547E9,00000000), ref: 0042DD9A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042DDA0

Strings

kernel32.dll, xrefs: 0042DD95
GetSystemWow64DirectoryA, xrefs: 0042DD90

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemWow64DirectoryA$kernel32.dll
API String ID: 1646373207-4063490227
Opcode ID: 43326381e3bc40d1b008ad4d96650147bbd089414008ba5bfef6f44b6a0c9d35
Instruction ID: 364facf3dcd8fd4fb48bac821a112922c1d8aa8d1bb3947713f5e14a9d28bbdd
Opcode Fuzzy Hash: 43326381e3bc40d1b008ad4d96650147bbd089414008ba5bfef6f44b6a0c9d35
Instruction Fuzzy Hash: 8EE026A1B60F0113D700317A5C8375B208E4F84718F90043F3984F52C2DDBCD988462D

Function 0042EFE4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,00000000,0042EF60), ref: 0042EFF2
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EFF8

Strings

user32.dll, xrefs: 0042EFED
ShutdownBlockReasonDestroy, xrefs: 0042EFE8

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ShutdownBlockReasonDestroy$user32.dll
API String ID: 1646373207-260599015
Opcode ID: dfc6bb9dc0fc5ec38f58292c2a590bdd0683480761c1ee7479f2282ad6a9d547
Instruction ID: d167ebeb3a0c78ffef62d304a6593c01274f0b6b7e47665dfbb0b7c0d901300f
Opcode Fuzzy Hash: dfc6bb9dc0fc5ec38f58292c2a590bdd0683480761c1ee7479f2282ad6a9d547
Instruction Fuzzy Hash: 68D0C792712732576A5035F53CC1AAB429CC9156AE3D40077FA40E6143D95DCC1926AC

Function 0044FDB0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,0049B826), ref: 0044FDEB
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044FDF1

Strings

NotifyWinEvent, xrefs: 0044FDE1
user32.dll, xrefs: 0044FDE6

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NotifyWinEvent$user32.dll
API String ID: 1646373207-597752486
Opcode ID: a5c0ac0c1efcf7d3608f9b1211c1a9f2a893ff30e05f8d2a27f72305b06527a9
Instruction ID: 223032890b7009ceba89b3f881feb785258270d151d072d0a62a9436c582bc8a
Opcode Fuzzy Hash: a5c0ac0c1efcf7d3608f9b1211c1a9f2a893ff30e05f8d2a27f72305b06527a9
Instruction Fuzzy Hash: 4FE012F0D417509AFB00FBB79846B093AE0D76471CB10107FF541A6653DBBC54588B1E

Function 0049B59C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,0049B87C,00000001,00000000,0049B8A0), ref: 0049B5A6
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0049B5AC

Strings

user32.dll, xrefs: 0049B5A1
DisableProcessWindowsGhosting, xrefs: 0049B59C

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: DisableProcessWindowsGhosting$user32.dll
API String ID: 1646373207-834958232
Opcode ID: d5542a5bc7d72abd5a44499ee74b42310aa3a6980590e66661c19fd9535292b1
Instruction ID: 6da5c6ba02401196c9eb2683e7e44f6352ab6d9b47b3021f0250e9007823bb90
Opcode Fuzzy Hash: d5542a5bc7d72abd5a44499ee74b42310aa3a6980590e66661c19fd9535292b1
Instruction Fuzzy Hash: DBB092C0280621B49D0032B22E02A1F1808CC9073DB1600773800B00C6CF6C850406BD

Function 0047F660 Relevance: 6.2, APIs: 4, Instructions: 195fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,0047F7D4,?,?,?,?,00000000,0047F929,?,?,?,00000000,?,0047FA38), ref: 0047F7B0
FindClose.KERNEL32(000000FF,0047F7DB,0047F7D4,?,?,?,?,00000000,0047F929,?,?,?,00000000,?,0047FA38,00000000), ref: 0047F7CE

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 5490ce2e4a8a6be0129899a0a65677de63da6418db4f18ee09802aee070e7d7e
Instruction ID: 6afaa1862f223a010857b175526ad6f3a005c42f9bdab82b788795c228cb7637
Opcode Fuzzy Hash: 5490ce2e4a8a6be0129899a0a65677de63da6418db4f18ee09802aee070e7d7e
Instruction Fuzzy Hash: AF811C7490024DAFDF11EF95C841ADFBBB8EF49304F5080BAE818A7291D7399A4ACF55

Function 00477420 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

Part of subcall function 0042F2FC: GetTickCount.KERNEL32 ref: 0042F302

Part of subcall function 0042F118: MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 0042F14D

GetLastError.KERNEL32(00000000,00477595,?,?,0049F1E4,00000000), ref: 0047747E

Strings

, xrefs: 004774B6, 004774D1
MoveFileEx, xrefs: 004774E3
LoggedMsgBox returned an unexpected value. Assuming Cancel., xrefs: 00477553

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CountErrorFileLastMoveTick
String ID: $LoggedMsgBox returned an unexpected value. Assuming Cancel.$MoveFileEx
API String ID: 2406187244-2685451598
Opcode ID: fef4c0af5834612e2d5ea7e1ebbea835981d8d546b6462e826bb862eb37a3f50
Instruction ID: 3a4f2aa56578524231cf1e08771c81933497d1cf7a86ef95451ad24693e386d2
Opcode Fuzzy Hash: fef4c0af5834612e2d5ea7e1ebbea835981d8d546b6462e826bb862eb37a3f50
Instruction Fuzzy Hash: AE418974A042099BCB10EFA5D882AEE7BB5EF48314FA08537E414F7351D7389E058BAD

Function 00414188 Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 004141D6
GetDesktopWindow.USER32 ref: 0041428E

Part of subcall function 00419350: 6F5BC6F0.COMCTL32(?,00000000,00414453,00000000,00414563,?,?,0049E62C), ref: 0041936C
Part of subcall function 00419350: ShowCursor.USER32(00000001,?,00000000,00414453,00000000,00414563,?,?,0049E62C), ref: 00419389

SetCursor.USER32(00000000,?,?,?,?,00413F83,00000000,00413F96), ref: 004142CC

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CursorDesktopWindow$Show
String ID:
API String ID: 2074268717-0
Opcode ID: 8cfee51e6bd22bc240f75105183b6b05eca44474532d8ed2e66bef73f0c2bade
Instruction ID: 19a59601e3d98a3dbb13d851837e3bb0d350916c882c7f1eea00ba3daa39fbf9
Opcode Fuzzy Hash: 8cfee51e6bd22bc240f75105183b6b05eca44474532d8ed2e66bef73f0c2bade
Instruction Fuzzy Hash: 1B414C74600161EFCB10EF6AE988B9637E1ABA5318B4588BBF414CB365D738DC81CB1D

Function 00408EE4 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000100), ref: 00408F05
LoadStringA.USER32(00400000,0000FF9E,?,00000040), ref: 00408F74
LoadStringA.USER32(00400000,0000FF9F,?,00000040), ref: 0040900F
MessageBoxA.USER32(00000000,?,?,00002010), ref: 0040904E

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: LoadString$FileMessageModuleName
String ID:
API String ID: 704749118-0
Opcode ID: 812d311920031a8e66895dbedfea53089e64aafa65463e8f60422c8f645d5955
Instruction ID: ceac9c6dafe2e417819c9b5c7653bc03c0e73b1c5c8721bcefa97444966463b6
Opcode Fuzzy Hash: 812d311920031a8e66895dbedfea53089e64aafa65463e8f60422c8f645d5955
Instruction Fuzzy Hash: 6B3152716083819EE330EB65C945B9B77D89B86704F00483EB6C8EB2D2DBB999048767

Function 0044EF30 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000001A1,?,00000000), ref: 0044EF79

Part of subcall function 0044D5BC: SendMessageA.USER32(00000000,000001A0,?,00000000), ref: 0044D5EE

InvalidateRect.USER32(00000000,00000000,00000001,00000000,000001A1,?,00000000), ref: 0044EFFD

Part of subcall function 0042C044: SendMessageA.USER32(00000000,0000018E,00000000,00000000), ref: 0042C058

IsRectEmpty.USER32(?), ref: 0044EFBF
ScrollWindowEx.USER32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000006), ref: 0044EFE2

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: MessageSend$Rect$EmptyInvalidateScrollWindow
String ID:
API String ID: 855768636-0
Opcode ID: 56fedc3c824f681ffb97ee76af59f0b164c14fb9fb26d55f6b9d3763c1518eae
Instruction ID: 10a93ef1daca5ec4afac806ac6fb62918bca6b9886f72cf97470359dbd205846
Opcode Fuzzy Hash: 56fedc3c824f681ffb97ee76af59f0b164c14fb9fb26d55f6b9d3763c1518eae
Instruction Fuzzy Hash: F211387170030027E720BA7E9C86B5B76899B88748F04083FB545EB383DD79D80987AA

Function 00498540 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,?,00000000), ref: 004985A4
OffsetRect.USER32(?,00000000,?), ref: 004985BF
OffsetRect.USER32(?,?,00000000), ref: 004985D9
OffsetRect.USER32(?,00000000,?), ref: 004985F4

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: OffsetRect
String ID:
API String ID: 177026234-0
Opcode ID: 7227e87c82edf3b73214f9f840370941cfd7a92bce1455806e7b5ebc6cc0f4df
Instruction ID: 8b9bdd49d27fca5e75dbe6db6c835dbd513a0ca6e6a290038abf4a817680a360
Opcode Fuzzy Hash: 7227e87c82edf3b73214f9f840370941cfd7a92bce1455806e7b5ebc6cc0f4df
Instruction Fuzzy Hash: 31216DB6604201ABD700DE6DCC85E5B77DEEBC4310F15CA2EF554C7289DA34ED488796

Function 004981F8 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(8B500000,00000008,?), ref: 0049820D
MulDiv.KERNEL32(50142444,00000008,?), ref: 00498221
MulDiv.KERNEL32(F6D32BE8,00000008,?), ref: 00498235
MulDiv.KERNEL32(8BF88BFF,00000008,?), ref: 00498253

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 132935396d45b7e69a68efe33a8bbc5bdde74f5cffd31387bad91a8df47aab5f
Instruction ID: c263e920e86d7ba729101781d4086a24ed44da230d09118e8444651330344356
Opcode Fuzzy Hash: 132935396d45b7e69a68efe33a8bbc5bdde74f5cffd31387bad91a8df47aab5f
Instruction Fuzzy Hash: F7112172604604ABCB40DFADC8C4D9B7BECEF4D360B1441AAF918DB246DA74ED408BA4

Function 0041F910 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,0041F900,?), ref: 0041F931
UnregisterClassA.USER32(0041F900,00400000), ref: 0041F95A
RegisterClassA.USER32(0049C598), ref: 0041F964
SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 0041F99F

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: 40794632ad4b036f7c8720a2117b4821032445c197b6d1963bfd5713e60cc588
Instruction ID: 68e5657fabb3e6ce4c602d6ce4962bfcd13d5dfe703a8334c3f88caa16143e55
Opcode Fuzzy Hash: 40794632ad4b036f7c8720a2117b4821032445c197b6d1963bfd5713e60cc588
Instruction Fuzzy Hash: 10019EB22001147BCB10EF69DC81E9B3798A719324B10413BBA05EB2E1C63AAC158BAD

Function 0040D4A0 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,?,00000000), ref: 0040D4B7
LoadResource.KERNEL32(00400000,72756F73,0040AC58,00400000,00000001,00000000,?,0040D414,00000000,?,00000000,?,?,0047EB44,0000000A,00000000), ref: 0040D4D1
SizeofResource.KERNEL32(00400000,72756F73,00400000,72756F73,0040AC58,00400000,00000001,00000000,?,0040D414,00000000,?,00000000,?,?,0047EB44), ref: 0040D4EB
LockResource.KERNEL32(74536563,00000000,00400000,72756F73,00400000,72756F73,0040AC58,00400000,00000001,00000000,?,0040D414,00000000,?,00000000,?), ref: 0040D4F5

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 9bd8c699d2ce0c84cebcbedeaf10d9de5ae675f1ab96295db303bf00b8c9f240
Instruction ID: 6e22508d3f73bf4cb8027158dc6397cf7561c54783b82958bb500a3598b7952a
Opcode Fuzzy Hash: 9bd8c699d2ce0c84cebcbedeaf10d9de5ae675f1ab96295db303bf00b8c9f240
Instruction Fuzzy Hash: 66F017736055046F9744EEADA881D6B77DCDE48364310417FF908D7246D938DD118B78

Function 004565CC Relevance: 6.0, APIs: 4, Instructions: 41registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E2AC: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,c]H,?,00000001,?,?,00485D63,?,00000001,00000000), ref: 0042E2C8

RegDeleteValueA.ADVAPI32(?,00000000,00000082,00000002,00000000,?,?,00000000,0045C03E,?,?,?,?,?,00000000,0045C065), ref: 00456608
RegCloseKey.ADVAPI32(00000000,?,00000000,00000082,00000002,00000000,?,?,00000000,0045C03E,?,?,?,?,?,00000000), ref: 00456611
RemoveFontResourceA.GDI32(00000000), ref: 0045661E
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00456632

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CloseDeleteFontMessageNotifyOpenRemoveResourceSendValue
String ID:
API String ID: 4283692357-0
Opcode ID: ef2604004d0477fcf9c42de5b0627192ba7fe5c9928ce5781339e9a5e785a368
Instruction ID: 8f096fb0a68a4ca8fa6e8945f44f96b9dbd63233ba955a9cb78d2d10420d775d
Opcode Fuzzy Hash: ef2604004d0477fcf9c42de5b0627192ba7fe5c9928ce5781339e9a5e785a368
Instruction Fuzzy Hash: A4F05EB574131076EA10B6B69D87F5B268C8F54745F50483BBA00EF2C3D97CD805566E

Function 00471578 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000), ref: 004715C9

Strings

Setting NTFS compression on directory: %s, xrefs: 00471597
Failed to set NTFS compression state (%d)., xrefs: 004715DA
Unsetting NTFS compression on directory: %s, xrefs: 004715AF

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on directory: %s$Unsetting NTFS compression on directory: %s
API String ID: 1452528299-1392080489
Opcode ID: a73fd2dfe4d8cbb9a99f35e53c735207b93d9530a4e7a214fb77b74dae22700c
Instruction ID: 3f73cee1f57e5e35b384814c3a7878c685ea2ef12ea039ff1fc7d7613c61d7e8
Opcode Fuzzy Hash: a73fd2dfe4d8cbb9a99f35e53c735207b93d9530a4e7a214fb77b74dae22700c
Instruction Fuzzy Hash: 4C014470E182487ACB0497AD54412DDBBA89F8D304F54C1AFA459E7352DE784A088B9A

Function 00471D24 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000), ref: 00471D75

Strings

Setting NTFS compression on file: %s, xrefs: 00471D43
Unsetting NTFS compression on file: %s, xrefs: 00471D5B
Failed to set NTFS compression state (%d)., xrefs: 00471D86

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on file: %s$Unsetting NTFS compression on file: %s
API String ID: 1452528299-3038984924
Opcode ID: 254d38055ca76b4feac3cba169e1e4a0297167a01b5654c7f007dae96817119d
Instruction ID: 66ce1e29452f11b14414607b7859346434939a7b5d469bcfff6b3f291fc87637
Opcode Fuzzy Hash: 254d38055ca76b4feac3cba169e1e4a0297167a01b5654c7f007dae96817119d
Instruction Fuzzy Hash: F5018630E0824876CB14DBAD54412DDBBE49F4D345F54C1EFA858E7392DF781A088B9A

Function 0047A12C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?,00000001,00000000,00000002,00000000,004833CD,?,?,?,?,?,0049B90F,00000000,0049B937), ref: 0047A135
OpenProcessToken.ADVAPI32(00000000,00000008,?,00000001,00000000,00000002,00000000,004833CD,?,?,?,?,?,0049B90F,00000000,0049B937), ref: 0047A13B
GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008,?,00000001,00000000,00000002,00000000,004833CD), ref: 0047A15D
CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008,?,00000001,00000000,00000002,00000000,004833CD), ref: 0047A16E

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 2fbf4b8595a77c53522ca8ddaa396419d3cf78121393ae1aa0aa93a59ffa9cd4
Instruction ID: f1eca045aef409c5038c0443c198cda798485bbe4f735b254377a35920a398ba
Opcode Fuzzy Hash: 2fbf4b8595a77c53522ca8ddaa396419d3cf78121393ae1aa0aa93a59ffa9cd4
Instruction Fuzzy Hash: 20F037616443006BD600E6B58D81E5B73DCDB44754F04883ABD94C71D1D678DC14A776

Function 004246D0 Relevance: 6.0, APIs: 4, Instructions: 26windowCOMMON

Download Yara Rule

APIs

GetLastActivePopup.USER32(?), ref: 004246DC
IsWindowVisible.USER32(?), ref: 004246ED
IsWindowEnabled.USER32(?), ref: 004246F7
SetForegroundWindow.USER32(?), ref: 00424701

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Window$ActiveEnabledForegroundLastPopupVisible
String ID:
API String ID: 2280970139-0
Opcode ID: 69d57edf6819ef94153fff758030895b48272b68886c806722d7cd0ec16a395b
Instruction ID: 089861d4a48d175db2243411625799630e322bd2ba2e4807a6d4d74949adae11
Opcode Fuzzy Hash: 69d57edf6819ef94153fff758030895b48272b68886c806722d7cd0ec16a395b
Instruction Fuzzy Hash: 1CE08691B03531129E31FAA518D1A9B018CEDC6B843461127FC26F7243DB1CCC0041BC

Function 00406284 Relevance: 6.0, APIs: 4, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32 ref: 00406287
GlobalUnWire.KERNEL32(00000000), ref: 0040628E
GlobalReAlloc.KERNEL32(00000000,00000000), ref: 00406293
GlobalFix.KERNEL32(00000000), ref: 00406299

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Global$AllocHandleWire
String ID:
API String ID: 2210401237-0
Opcode ID: a3b8d3293011eaaa35143cb505ff432a4562d86b91654664e64843e7403df00d
Instruction ID: 024a49765fc045a09389489d8ed5919b86daafa6bea6a005e9f609907830066e
Opcode Fuzzy Hash: a3b8d3293011eaaa35143cb505ff432a4562d86b91654664e64843e7403df00d
Instruction Fuzzy Hash: 64B009C6925A46B8EC0473B24C4BD3F041CE88472C3809A6E7554BA0839C7C9C002E3A

Function 0047C204 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 210registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,?,00000001,00000000,00000000,0047DAED,?,00000000,00000000,00000001,00000000,0047C4A1,?,00000000), ref: 0047C465

Strings

Failed to parse "reg" constant, xrefs: 0047C46C
Cannot access a 64-bit key in a "reg" constant on this version of Windows, xrefs: 0047C2D9

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Close
String ID: Cannot access a 64-bit key in a "reg" constant on this version of Windows$Failed to parse "reg" constant
API String ID: 3535843008-1938159461
Opcode ID: c8c27867fc18747b8321d7c39ff78363022f0b3b697f921366e7a306eb4f1a1e
Instruction ID: 743ce9558bcd9f063b3385574a31be4a9d11704bf1e285cb3cd7d7d63b7fcad6
Opcode Fuzzy Hash: c8c27867fc18747b8321d7c39ff78363022f0b3b697f921366e7a306eb4f1a1e
Instruction Fuzzy Hash: FE815370E00108AFCB10DFA5D481ADEBBF9AF48354F50C1AAE414B7392D738AE45CB99

Function 004782D4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 105timeCOMMON

Download Yara Rule

APIs

LocalFileTimeToFileTime.KERNEL32(?,?,?,00000000,00000000,00478407,?,00000000,00478418,?,00000000,00478461), ref: 004783D8
SetFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,00000000,00000000,00478407,?,00000000,00478418,?,00000000,00478461), ref: 004783EC

Strings

Extracting temporary file: , xrefs: 00478314

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: FileTime$Local
String ID: Extracting temporary file:
API String ID: 791338737-4171118009
Opcode ID: 87653c6dd3e9f0681e5e92659ad0f5dfe84cecde390bec123b10e6a30437a2b3
Instruction ID: 56bbe5f99103cba94ba8cc9c71eeb754cd36512b05a8a23dabfe57f848c4e452
Opcode Fuzzy Hash: 87653c6dd3e9f0681e5e92659ad0f5dfe84cecde390bec123b10e6a30437a2b3
Instruction Fuzzy Hash: E441A970E00249AFCB01DFA5C892ADFBBB8EB09704F51847AF914E7392D7799905CB54

Function 0046E1B8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89COMMON

Download Yara Rule

Strings

Failed to proceed to next wizard page; aborting., xrefs: 0046E2D0
Failed to proceed to next wizard page; showing wizard., xrefs: 0046E2E4

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID:
String ID: Failed to proceed to next wizard page; aborting.$Failed to proceed to next wizard page; showing wizard.
API String ID: 0-1974262853
Opcode ID: c28d75eee979bba55c3c9ca2f46d8c67aff9957e9d5b38f64964ed1c0e6383b4
Instruction ID: 8438ff265ad85ad584d57476898619fac77cf18ec005b7d2b36a6b69c01b36b1
Opcode Fuzzy Hash: c28d75eee979bba55c3c9ca2f46d8c67aff9957e9d5b38f64964ed1c0e6383b4
Instruction Fuzzy Hash: 6B319034604240DFD711DB9AD985F9977F9AB15304F6500FBF4049B392E738AE84DB1A

Function 0047ADC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E2AC: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,c]H,?,00000001,?,?,00485D63,?,00000001,00000000), ref: 0042E2C8

RegCloseKey.ADVAPI32(?,0047AEA6,?,?,00000001,00000000,00000000,0047AEC1), ref: 0047AE8F

Strings

%s\%s_is1, xrefs: 0047AE38
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0047AE1A

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1598650737
Opcode ID: fecf366aa8ef06fe3da5697ba5a739f3889059b87ca57dd240ed7095de627327
Instruction ID: 141d2e21b73e66dc43c33551688465b3a3c0980c078b9948e44c6582f11223e2
Opcode Fuzzy Hash: fecf366aa8ef06fe3da5697ba5a739f3889059b87ca57dd240ed7095de627327
Instruction Fuzzy Hash: 6F216670B003449FDB11DF65C8516EEBBF8EB89304F50847AE408E7381D7789D158B5A

Function 004508A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,0000044B,00000000,?), ref: 00450935
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00450966

Strings

open, xrefs: 00450959

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ExecuteMessageSendShell
String ID: open
API String ID: 812272486-2758837156
Opcode ID: 41377852c43bddfddcae31f96e2b69fa43cefbc2a0355827ec7b6d4d68a21241
Instruction ID: 9d2ddf54ec7714fdda98ff8d0cc6f814dd21c32a1b145895e499ae4a69db9d05
Opcode Fuzzy Hash: 41377852c43bddfddcae31f96e2b69fa43cefbc2a0355827ec7b6d4d68a21241
Instruction Fuzzy Hash: 2F212EB4E00604AFEB10DF6AC881B9EB7F8EB44705F10857AB401F7297D6789A45CA58

Function 00455A8C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(0000003C), ref: 00455B28
GetLastError.KERNEL32(0000003C,00000000,00455B71,?,?,?), ref: 00455B39

Part of subcall function 0042DD54: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD67

Strings

<, xrefs: 00455AE2

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: DirectoryErrorExecuteLastShellSystem
String ID: <
API String ID: 893404051-4251816714
Opcode ID: fe043af41199d25c702c797a5de229c3b7f151799ff9fa06225379e612d0e5f8
Instruction ID: 999fafdfd618aac71dabfb14027d48496d6343d42a6da5b956ec7361bda3743f
Opcode Fuzzy Hash: fe043af41199d25c702c797a5de229c3b7f151799ff9fa06225379e612d0e5f8
Instruction Fuzzy Hash: 48216570A00609AFDB10DF65D8926AE7BF8EF05345F50443BF844E7291D7789E49CB58

Function 00402584 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049E420,00000000,)), ref: 004025C7
RtlLeaveCriticalSection.KERNEL32(0049E420,0040263D), ref: 00402630

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049E420,00000000,00401A82,?,?,0040222E,022E4560,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049E420,0049E420,00000000,00401A82,?,?,0040222E,022E4560,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049E420,00000000,00401A82,?,?,0040222E,022E4560,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049E420,00401A89,00000000,00401A82,?,?,0040222E,022E4560,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Strings

), xrefs: 004025AE

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: )
API String ID: 2227675388-1084416617
Opcode ID: 7dbb052fb751fd5d5774343fd83a230ce0bee245d9a1b11dd3e2b6497a9f202c
Instruction ID: 917976a40c8b6a40365e5f884633a4dcf06f5f23cdaa1afef62ceea8ee6a87c6
Opcode Fuzzy Hash: 7dbb052fb751fd5d5774343fd83a230ce0bee245d9a1b11dd3e2b6497a9f202c
Instruction Fuzzy Hash: F61101317042046FEB25EB7A9F1A62A6AD4D795758B24087FF404F33D2D9FD9C02826C

Function 0049974A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 00499785

Strings

/INITPROCWND=$%x , xrefs: 004997B0
@, xrefs: 00499750

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Window
String ID: /INITPROCWND=$%x $@
API String ID: 2353593579-4169826103
Opcode ID: be06f8662adbe903243f227ed1ba1ac6f813ece3a77f461f016152c0142cbab7
Instruction ID: be0a348badf78dcf29b2eeb392d1d3044e1cc80287194ba8ae507c16e88b9e41
Opcode Fuzzy Hash: be06f8662adbe903243f227ed1ba1ac6f813ece3a77f461f016152c0142cbab7
Instruction Fuzzy Hash: BA11A571A142458FDF41EFA9D841BAEBFF8EB49304F50847FE404E7292D63C9D058A59

Function 00447904 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

SysFreeString.OLEAUT32(?), ref: 004479B6

Strings

NIL Interface Exception, xrefs: 00447958
Unknown Method, xrefs: 0044798F

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: String$AllocByteCharFreeMultiWide
String ID: NIL Interface Exception$Unknown Method
API String ID: 3952431833-1023667238
Opcode ID: d7c63457d166a350f53d970eb0409965f77a8d21c5a8cfae6addd8da613f3b75
Instruction ID: 6ea0978f5b97d4648a43087cb94c4cadf7395b3a3abdd2f7dcac649bd3e58428
Opcode Fuzzy Hash: d7c63457d166a350f53d970eb0409965f77a8d21c5a8cfae6addd8da613f3b75
Instruction Fuzzy Hash: A6119371A04244AFEB10DFA58C92AAEBBACEB49704F91407EF504E7281D7789D01CB69

Function 00498FBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00499084,?,00499078,00000000,0049905F), ref: 0049902A
CloseHandle.KERNEL32(004990C4,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00499084,?,00499078,00000000), ref: 00499041

Part of subcall function 00498F14: GetLastError.KERNEL32(00000000,00498FAC,?,?,?,?), ref: 00498F38

Strings

D, xrefs: 00499004

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcess
String ID: D
API String ID: 3798668922-2746444292
Opcode ID: 22f89f64033b9666124c1f5aaee9449a3f6a74274ca647eac37673928b7438a5
Instruction ID: bd5c1fcaa48bd7234035680a4efd5e6cd18aa75d8fcc368c7ce5b5bc1c3507fe
Opcode Fuzzy Hash: 22f89f64033b9666124c1f5aaee9449a3f6a74274ca647eac37673928b7438a5
Instruction Fuzzy Hash: 9F0161B1604248AFDF10DBA6CC42F9FBBACDF49714F51403BB614E72D1D6785E048629

Function 0042E1F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,Inno Setup: No Icons,00000000,00000000,00000000,00000000), ref: 0042E208
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,Inno Setup: No Icons,00000000,00000000,00000000), ref: 0042E248

Strings

Inno Setup: No Icons, xrefs: 0042E206

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Value$EnumQuery
String ID: Inno Setup: No Icons
API String ID: 1576479698-2016326496
Opcode ID: bd0511ca20757f211e757699c0c9aa78b94ac5dafba73a7c2283d1bafa6b3c91
Instruction ID: a539eabee655ef144818f3097a210d44f5522b7a792cb7edb349fa40b75ec101
Opcode Fuzzy Hash: bd0511ca20757f211e757699c0c9aa78b94ac5dafba73a7c2283d1bafa6b3c91
Instruction Fuzzy Hash: 8C01DB3178D371E9F73545637D42B7B578C9B42B60F64027BF941BA2C0DA589C04927E

Function 0049A498 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00455E14: GetCurrentProcess.KERNEL32(00000028), ref: 00455E23
Part of subcall function 00455E14: OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00455E29

SetForegroundWindow.USER32(?), ref: 0049A4CA

Strings

Restarting Windows., xrefs: 0049A4A7
Not restarting Windows because Uninstall is being run from the debugger., xrefs: 0049A4F5

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Process$CurrentForegroundOpenTokenWindow
String ID: Not restarting Windows because Uninstall is being run from the debugger.$Restarting Windows.
API String ID: 3179053593-4147564754
Opcode ID: 5ae3659e29603af3f37deaa9bde6abc0ac90c7cba3db1da514f50be9f334bd90
Instruction ID: fa2aef3d7146953502e8d774936668133d53f8452f62b1426e7685e54132e652
Opcode Fuzzy Hash: 5ae3659e29603af3f37deaa9bde6abc0ac90c7cba3db1da514f50be9f334bd90
Instruction Fuzzy Hash: 7601FC70614180AFEB00FB69D846B5D6FD89B94309F40443FF400A72D3DB7C9959875E

Function 0049AC38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0047F0B0: FreeLibrary.KERNEL32(00000000,00483B77), ref: 0047F0C6

Part of subcall function 0047ED88: GetTickCount.KERNEL32 ref: 0047EDD2

Part of subcall function 00457B24: SendMessageA.USER32(00000000,00000B01,00000000,00000000), ref: 00457B43

GetCurrentProcess.KERNEL32(00000001,?,?,?,?,0049B58F), ref: 0049AC8D
TerminateProcess.KERNEL32(00000000,00000001,?,?,?,?,0049B58F), ref: 0049AC93

Strings

Detected restart. Removing temporary directory., xrefs: 0049AC47

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
String ID: Detected restart. Removing temporary directory.
API String ID: 1717587489-3199836293
Opcode ID: 669bb26a73299a922d8610ff7c2879a5849b13244f8bbc5c04e097d4e6791dc7
Instruction ID: f77dd1952adf4ad1b1de6503e2587466da12494fe8c90789bcc07dbc78659400
Opcode Fuzzy Hash: 669bb26a73299a922d8610ff7c2879a5849b13244f8bbc5c04e097d4e6791dc7
Instruction Fuzzy Hash: 4AE0E5722086402FEA127BBBBC1696B7B8CE78632C7A2447BF40495552D82C5824C67E

Function 00403344 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,0049B7EA), ref: 0040334B
GetCommandLineA.KERNEL32(00000000,0049B7EA), ref: 00403356

Strings

x6p, xrefs: 0040335B

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: x6p
API String ID: 2123368496-2092564659
Opcode ID: 507b3439899aadcda4e4dd714f17469bdfd07b248e46d296d00f93cf4dba3756
Instruction ID: 98797e2be282b29c5dcb55f6b27639491d6d1699e35d5459d8823e2e9957d9fe
Opcode Fuzzy Hash: 507b3439899aadcda4e4dd714f17469bdfd07b248e46d296d00f93cf4dba3756
Instruction Fuzzy Hash: 72C002609012159AE750EF7758467152A949751349F80447FB104BE1E1D6BD82055BDE

Function 00455EA4 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 00455EC3
Sleep.KERNEL32(?), ref: 00455ED3
GetLastError.KERNEL32 ref: 00455EE6
GetLastError.KERNEL32 ref: 00455EF0

Memory Dump Source

Source File: 00000001.00000002.2479223785.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2479095986.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479630679.000000000049C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479774454.000000000049D000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479823084.000000000049E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2479874938.00000000004AE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ps11.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: da2b381436a55afe2457d076de9ecc874b748ae1ab6014debfc1a5afcf0e6964
Instruction ID: 9465cf589d0d0c12c73eacd3b1eef521cbdc8b34a4c5067471d78d0fd9128cb0
Opcode Fuzzy Hash: da2b381436a55afe2457d076de9ecc874b748ae1ab6014debfc1a5afcf0e6964
Instruction Fuzzy Hash: 08F02B32B05A14774F20A7BB989357FA28CDE44376710512BFD04D7343D939DE4586A8

Analysis Process: _setup64.tmpPID: 5260, Parent PID: 6252COMMON

Execution Graph

Execution Coverage:	56.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	33
Total number of Limit Nodes:	5

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00000001400012A4 Relevance: 25.6, APIs: 17, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012AF
SetErrorMode.KERNELBASE(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012BA
GetSystemDirectoryW.KERNEL32 ref: 00000001400012CC
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012D9
SetProcessShutdownParameters.KERNEL32(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012E6
SetConsoleCtrlHandler.KERNEL32(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012F5
GetCommandLineW.KERNEL32(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012FB
CommandLineToArgvW.SHELL32(?,?,?,?,?,?,00000001400014E9), ref: 0000000140001309
GetLastError.KERNEL32(?,?,?,?,?,?,00000001400014E9), ref: 0000000140001317
CloseHandle.KERNEL32 ref: 00000001400014AD
GetLastError.KERNEL32 ref: 00000001400014C5

Memory Dump Source

Source File: 00000005.00000002.2472151131.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2472054693.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2472195877.0000000140002000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2472244388.0000000140025000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000__setup64.jbxd

Similarity

API ID: Error$CommandDirectoryLastLine$ArgvCloseConsoleCtrlCurrentHandleHandlerModeParametersProcessShutdownSystem
String ID:
API String ID: 1351133944-0
Opcode ID: 9d6e473d000c958ab654ea6524e99b93636dd2550909cc2fdf2d0baeb0bae34d
Instruction ID: bed22989135500286ff082a5b8534ee6a98307118f748591786f601728a80f93
Opcode Fuzzy Hash: 9d6e473d000c958ab654ea6524e99b93636dd2550909cc2fdf2d0baeb0bae34d
Instruction Fuzzy Hash: 435106B160464686EB13DF27F8843E963A1F78C7C5F904125FB4A476B5CB3C8989CB50

Function 0000000140001000 Relevance: 12.1, APIs: 8, Instructions: 120
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNamedSecurityInfoW.ADVAPI32 ref: 0000000140001079
AllocateAndInitializeSid.ADVAPI32 ref: 00000001400010DE
SetEntriesInAclW.ADVAPI32 ref: 0000000140001131
SetNamedSecurityInfoW.ADVAPI32 ref: 000000014000115F
LocalFree.KERNEL32 ref: 000000014000116C
FreeSid.ADVAPI32 ref: 0000000140001187
LocalFree.KERNEL32 ref: 000000014000119C
GetLastError.KERNEL32 ref: 00000001400011C5

Memory Dump Source

Source File: 00000005.00000002.2472151131.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2472054693.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2472195877.0000000140002000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2472244388.0000000140025000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000__setup64.jbxd

Similarity

API ID: Free$InfoLocalNamedSecurity$AllocateEntriesErrorInitializeLast
String ID:
API String ID: 1336570144-0
Opcode ID: b35f34b64a9d6aa6b81e16b13b2f1c0d38c8c3b1546899b34faa1a97c6582e21
Instruction ID: 9ad65f9ffd8baecdb197e09b536dbb51b96e9a581e15e5332d3d6b3fb358d4f4
Opcode Fuzzy Hash: b35f34b64a9d6aa6b81e16b13b2f1c0d38c8c3b1546899b34faa1a97c6582e21
Instruction Fuzzy Hash: A35147B2614B8186E765CF12F88078EB7E6F7887D4F504425EB8943B64DF38D9A5CB00

Function 00000001400014E0 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400012A4: #17.COMCTL32(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012AF
Part of subcall function 00000001400012A4: SetErrorMode.KERNELBASE(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012BA
Part of subcall function 00000001400012A4: GetSystemDirectoryW.KERNEL32 ref: 00000001400012CC
Part of subcall function 00000001400012A4: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012D9
Part of subcall function 00000001400012A4: SetProcessShutdownParameters.KERNEL32(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012E6
Part of subcall function 00000001400012A4: SetConsoleCtrlHandler.KERNEL32(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012F5
Part of subcall function 00000001400012A4: GetCommandLineW.KERNEL32(?,?,?,?,?,?,00000001400014E9), ref: 00000001400012FB
Part of subcall function 00000001400012A4: CommandLineToArgvW.SHELL32(?,?,?,?,?,?,00000001400014E9), ref: 0000000140001309
Part of subcall function 00000001400012A4: GetLastError.KERNEL32(?,?,?,?,?,?,00000001400014E9), ref: 0000000140001317

ExitProcess.KERNEL32 ref: 00000001400014EB

Memory Dump Source

Source File: 00000005.00000002.2472151131.0000000140001000.00000020.00000001.01000000.00000009.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000005.00000002.2472054693.0000000140000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2472195877.0000000140002000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2472244388.0000000140025000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_140000000__setup64.jbxd

Similarity

API ID: CommandDirectoryErrorLineProcess$ArgvConsoleCtrlCurrentExitHandlerLastModeParametersShutdownSystem
String ID:
API String ID: 596749235-0
Opcode ID: d409c78e300c7577bde50c236e3745e62975251c616abf16af35a2c2feadab5b
Instruction ID: 20a652f16b87ba7830b4ae42eb4563c7e1ed9e0c7b0ce7c62722bbd31286e835
Opcode Fuzzy Hash: d409c78e300c7577bde50c236e3745e62975251c616abf16af35a2c2feadab5b
Instruction Fuzzy Hash: CEA001B0E2168282EA0ABBB6695A3D911626FD8781F540414A242872A2DD7884698612

Analysis Process: PlanSwift.exePID: 416, Parent PID: 6252COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	103
Total number of Limit Nodes:	10

Executed Functions

Function 0040E218 Relevance: 3.1, APIs: 2, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,0040E2DA,?,?), ref: 0040E24A
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,0040E2DA,?,?), ref: 0040E253

Part of subcall function 0040E0C0: FindFirstFileW.KERNEL32(00000000,?,00000000,0040E120,?,?), ref: 0040E0F3
Part of subcall function 0040E0C0: FindClose.KERNEL32(00000000,00000000,?,00000000,0040E120,?,?), ref: 0040E103

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: 5e8c7b6bfa53dc2b409d17a441cef21124a354dbd5d98009618145497913c33b
Instruction ID: ce478f91fe273f6fa9a390c995df9e97f7a047921afb44b9b657b0e98ae89ea1
Opcode Fuzzy Hash: 5e8c7b6bfa53dc2b409d17a441cef21124a354dbd5d98009618145497913c33b
Instruction Fuzzy Hash: 2E113670A042099BDB04EB96C952AAEB3B9EF49304F50487EF504F73D1D7785E14CA69

Function 0040E0C0 Relevance: 3.0, APIs: 2, Instructions: 34
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040E120,?,?), ref: 0040E0F3
FindClose.KERNEL32(00000000,00000000,?,00000000,0040E120,?,?), ref: 0040E103

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 993212286c2df5424098968e096e535751f8b6073d4ab282ff9afd4bc915a4d3
Instruction ID: 54e1806b8698661048c2dc6b8c508eed4307c1a0bede51bc51777404de6bafd0
Opcode Fuzzy Hash: 993212286c2df5424098968e096e535751f8b6073d4ab282ff9afd4bc915a4d3
Instruction Fuzzy Hash: 0CF0BE31544708AEC710EB66CC1299EB3ACDB48324760097BB400F25C2EA3CAE209A68

Function 0040DCDC Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 175
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040DF05,?,?), ref: 0040DD15
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040DF05,?,?), ref: 0040DD5E
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040DF05,?,?), ref: 0040DD80
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 0040DD9E
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 0040DDBC
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 0040DDDA
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 0040DDF8
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,0040DEE6,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040DF05), ref: 0040DE38
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,0040DEE6,?,80000001), ref: 0040DE63
RegCloseKey.ADVAPI32(?,0040DEED,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0040DEE6,?,80000001,Software\Embarcadero\Locales), ref: 0040DEDE

Strings

Software\Embarcadero\Locales, xrefs: 0040DD54, 0040DD76
Software\Borland\Locales, xrefs: 0040DDD0
Software\Borland\Delphi\Locales, xrefs: 0040DDEE
Software\CodeGear\Locales, xrefs: 0040DD94, 0040DDB2

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: 00257e7f73a3ef19c20f315fb333b61fe6e52f2fcbcb2aa2ce92a1c4fde456f8
Instruction ID: e301cb2779f4f69262e0059234b1a7c9e8799f8fd5a03557ef3c88291aa86cc6
Opcode Fuzzy Hash: 00257e7f73a3ef19c20f315fb333b61fe6e52f2fcbcb2aa2ce92a1c4fde456f8
Instruction Fuzzy Hash: 6C512075E40609BEEB10DAD5CC42FAF77ACDF08704F60447BBA04F61C1D678AA45CAA9

Function 00409817 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0040983F

Strings

HQ@, xrefs: 0040985C
PQ@, xrefs: 00409866

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID: CurrentThread
String ID: HQ@$PQ@
API String ID: 2882836952-3812187175
Opcode ID: cd131b4ea203f51717759289ccb30eca6010b2956951e2f7f8450f39df22f792
Instruction ID: 18b22f79a86a808f36ade31f54930c1fd7cc75a42ec4c748960205a7c2e74846
Opcode Fuzzy Hash: cd131b4ea203f51717759289ccb30eca6010b2956951e2f7f8450f39df22f792
Instruction Fuzzy Hash: D32136B5900204CFCF18EF28D48069A7BA1FB59314B14D56EE80AAF396C739DD41CF58

Function 00406D6C Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNEL32(00606AD8,00000000,00008000), ref: 00406D8A
VirtualFree.KERNEL32(00608B7C,00000000,00008000), ref: 00406E06

Strings

xk`, xrefs: 00406DC5

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID: FreeVirtual
String ID: xk`
API String ID: 1263568516-1847079886
Opcode ID: 8c5d51678712dfd103a5b98a5eb2ba1ee577a5cb4900c962b744ef632db20499
Instruction ID: b2059ec17fd45d1636b2cb87ea4f44dff8c6f3abc93f150a60f6471c8d1a607f
Opcode Fuzzy Hash: 8c5d51678712dfd103a5b98a5eb2ba1ee577a5cb4900c962b744ef632db20499
Instruction Fuzzy Hash: 001182717406109FD7689F58D840B277BE1EB48710F16C07EE14AEB7C1D678AC118B98

Function 0040E2E8 Relevance: 3.1, APIs: 2, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,0040E401,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040E48A,00000000,?,00000105), ref: 0040E393
GetSystemDefaultUILanguage.KERNEL32(00000000,0040E401,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040E48A,00000000,?,00000105), ref: 0040E3BB

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: 33c58b91298bafa4e938b44770cfab1ae2ad07b19998497fa74c4d863357686c
Instruction ID: c5b139623584e9c8a436eaca1aca2cf86db1ae3ce9d6e3e1769aa58204507684
Opcode Fuzzy Hash: 33c58b91298bafa4e938b44770cfab1ae2ad07b19998497fa74c4d863357686c
Instruction Fuzzy Hash: 5A314170E102099FDB10EBA6C881AAEBBB5EF48304F50487BE840B73D1DB789D55CB59

Function 0040E410 Relevance: 3.1, APIs: 2, Instructions: 56
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040E4CC,?,?,00000000), ref: 0040E44C
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040E4CC,?,?,00000000), ref: 0040E49D

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: 0a4c36475c3d1e0fb70c01fbc4f0fe070a1a45e6cbb4880de799eeabeb228d85
Instruction ID: 9329a4d688e7cdd2c33f4ececd202dce77c43672eb9a98cc6c6f50343e4898b8
Opcode Fuzzy Hash: 0a4c36475c3d1e0fb70c01fbc4f0fe070a1a45e6cbb4880de799eeabeb228d85
Instruction Fuzzy Hash: 8F118231A4421CABDB14EB51CC86BDE73B8DB08304F5145BAB408F72C1DA785E848EA9

Function 0040D160 Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,?,0000020A), ref: 0040D17E

Part of subcall function 0040E410: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040E4CC,?,?,00000000), ref: 0040E44C
Part of subcall function 0040E410: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040E4CC,?,?,00000000), ref: 0040E49D

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: 0fa008b4d3fbaecb020027ebd69bd6ca7320cd4bd33cd7313f79e1f8cd26c99a
Instruction ID: 3e538cdb76f8227d956f39c40db0905d0aa17c5748080a6b776d158bdbc2bfbe
Opcode Fuzzy Hash: 0fa008b4d3fbaecb020027ebd69bd6ca7320cd4bd33cd7313f79e1f8cd26c99a
Instruction Fuzzy Hash: 4AE06D71A003109FCB10DE98C9C5A4373D4AB08714F0009A6FC18DF38AD375CD2487D1

Function 0040FE48 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32 ref: 0040FE4C

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: de8292ca15932d7318cf9a9a3e48783e150fe25b39319a317a2599aa1258d1fe
Instruction ID: 9eb204805f81a628c4fe9eca656eabf1f064acfa4ff6d1ed943c5db27331405a
Opcode Fuzzy Hash: de8292ca15932d7318cf9a9a3e48783e150fe25b39319a317a2599aa1258d1fe
Instruction Fuzzy Hash: 41A012204088000AC404A7194C4340B31805D40214FC40268745CA92C2E61985A40EDB

Function 00405664 Relevance: 1.3, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004), ref: 0040567B

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 589b615439f5529416fc54e4a00696b6869d843937b7fc1b59c1f69fbd4fda89
Instruction ID: 194b463243655a351fdcb8223ca4b5a3d56581d5a2f5db91baa3f42aee6902c2
Opcode Fuzzy Hash: 589b615439f5529416fc54e4a00696b6869d843937b7fc1b59c1f69fbd4fda89
Instruction Fuzzy Hash: 8DF08CB2B802114FD714AF78DD407037AD6E704314B10817EF90AFB795D7B588108B80

Non-executed Functions

Function 0040DAEC Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140
stringlibraryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?), ref: 0040DB09
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 0040DB1A
FindFirstFileW.KERNEL32(?,?,kernel32.dll,?,?,?), ref: 0040DC1A
FindClose.KERNEL32(?,?,?,kernel32.dll,?,?,?), ref: 0040DC2C
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,?,?,?), ref: 0040DC38
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,?,?,?), ref: 0040DC7D

Strings

\, xrefs: 0040DC4A
kernel32.dll, xrefs: 0040DB04
GetLongPathNameW, xrefs: 0040DB14

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: bd5511324fd24e70828a3ee036868bfc770ecc5b7afd36b0dd2b9f7a28521b39
Instruction ID: 446a6666705070bf617439557182dc402a8fe1df9001329157ac1ee8aafbec3c
Opcode Fuzzy Hash: bd5511324fd24e70828a3ee036868bfc770ecc5b7afd36b0dd2b9f7a28521b39
Instruction Fuzzy Hash: 5A418D31E006189BDB10EAE9CC85A9EB3B5AF44314F1845BAD505F72C1E77CAE49CB49

Function 00407AD4 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f1654813ed5821a00b8b7144780f614f73eea8c4dc557e3c0d17b55d1bda45a
Instruction ID: c1f34be03cf0569538104f0038f02cfb84df381903d0011f2ebedd3a3241928c
Opcode Fuzzy Hash: 1f1654813ed5821a00b8b7144780f614f73eea8c4dc557e3c0d17b55d1bda45a
Instruction Fuzzy Hash: 76C0E9B550D6066E975C8F1AB480815FBE5FAC8324364C22EA01C83644D73154518A64

Function 00412EB2 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de549f03bf411421195891d379a21cbd44ebec337e595aa8a632cb686cfec506
Instruction ID: b612c5e30a1bcf54ad835ee4561a0ae357d4d994c0a2bdc6c1dc89c8590ee27b
Opcode Fuzzy Hash: de549f03bf411421195891d379a21cbd44ebec337e595aa8a632cb686cfec506
Instruction Fuzzy Hash:

Function 00412F5A Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20769f57efba5eff8902debaf9bbb744884f027822c7dc3a3a075089cd141b53
Instruction ID: c770940037166a22bd2174d58e2262b487db3396bc8ac752eb1b96d88d6adcc8
Opcode Fuzzy Hash: 20769f57efba5eff8902debaf9bbb744884f027822c7dc3a3a075089cd141b53
Instruction Fuzzy Hash:

Function 0040D9A4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00608C10,00000000,0040DAAA,?,?,?,00000000,?,0040E3A0,00000000,0040E401,?,?,00000000,00000000,00000000), ref: 0040D9C2
LeaveCriticalSection.KERNEL32(00608C10,00608C10,00000000,0040DAAA,?,?,?,00000000,?,0040E3A0,00000000,0040E401,?,?,00000000,00000000), ref: 0040D9E6
LeaveCriticalSection.KERNEL32(00608C10,00608C10,00000000,0040DAAA,?,?,?,00000000,?,0040E3A0,00000000,0040E401,?,?,00000000,00000000), ref: 0040D9F5
IsValidLocale.KERNEL32(00000000,00000002,00608C10,00608C10,00000000,0040DAAA,?,?,?,00000000,?,0040E3A0,00000000,0040E401), ref: 0040DA07
EnterCriticalSection.KERNEL32(00608C10,00000000,00000002,00608C10,00608C10,00000000,0040DAAA,?,?,?,00000000,?,0040E3A0,00000000,0040E401), ref: 0040DA64
LeaveCriticalSection.KERNEL32(00608C10,00608C10,00000000,00000002,00608C10,00608C10,00000000,0040DAAA,?,?,?,00000000,?,0040E3A0,00000000,0040E401), ref: 0040DA8D

Strings

en-GB,en,en-US,, xrefs: 0040D9D2, 0040DA79

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-GB,en,en-US,
API String ID: 975949045-3021119265
Opcode ID: cc457a52c95f3e830cc3333776189c4993421793884cc5c2848482521a5c96bb
Instruction ID: 97dab218b0506501525701a99fe6bc0e0634cf3d93f4e4cbd0d8b84e3dd3bd17
Opcode Fuzzy Hash: cc457a52c95f3e830cc3333776189c4993421793884cc5c2848482521a5c96bb
Instruction Fuzzy Hash: 90215030F946106EEB14F7AA9C1271B2195DB49718FA1583BF440BB2C7DDBC8C858A7E

Function 004114A8 Relevance: 13.8, APIs: 9, Instructions: 258COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00411560

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 7576ae08a2e665afeb32a895b9f59c939a287345ff08e7946268467c9ff27dc4
Instruction ID: 5149e3ba07c77eea25534ad68e6a995e06473a110f8e705a47cf673fd3d7e1d5
Opcode Fuzzy Hash: 7576ae08a2e665afeb32a895b9f59c939a287345ff08e7946268467c9ff27dc4
Instruction Fuzzy Hash: F7A18175A002099FDB10DFE8D891BEEB7F6AF48300F14412AE615A73A1DB78A985CF54

Function 00409AC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,H_,00000000,?,00409B78,?,00608B98,00608B98,?,?,005FFC48,004114A7,005FEC48), ref: 00409AF9
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,H_,00000000,?,00409B78,?,00608B98,00608B98,?,?,005FFC48,004114A7,005FEC48), ref: 00409AFF
GetStdHandle.KERNEL32(000000F5,00000000,00000002,H_,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,H_,00000000,?,00409B78,?,00608B98,00608B98), ref: 00409B1A
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,H_,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,H_,00000000,?,00409B78,?,00608B98), ref: 00409B20

Strings

Runtime error at 00000000, xrefs: 00409AF2, 00409B37
H_, xrefs: 00409AEB, 00409B06, 00409AEF, 00409B0A
Error, xrefs: 00409B32

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID: FileHandleWrite
String ID: Error$H_$Runtime error at 00000000
API String ID: 3320372497-3722976593
Opcode ID: 07956a37d3ff1c724660eadbe1b6ef1f1b7ffa15f92cc942a6e5fff81eed5c81
Instruction ID: 25b9e8e12d0e11362dbd3037db93e590adee3714f79345003379c581f973263a
Opcode Fuzzy Hash: 07956a37d3ff1c724660eadbe1b6ef1f1b7ffa15f92cc942a6e5fff81eed5c81
Instruction Fuzzy Hash: 8FF068506C434475E72477A19D07F6F365C9B40B24F60913FB250754D2C6FC58849BA9

Function 00405EFC Relevance: 10.9, APIs: 7, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ca5d57a1de04ecf167f5ecf7919488e7353b55b2136c199517ba9ff3ca190a8
Instruction ID: b4e2ab0d59c26cd4818ef2125c7104dee944b50b200bf734a347046e6c6977fc
Opcode Fuzzy Hash: 6ca5d57a1de04ecf167f5ecf7919488e7353b55b2136c199517ba9ff3ca190a8
Instruction Fuzzy Hash: 65B12572740A004BD714EA6DDC8476BB386DBC4325F18823FE615EB3D6DA7CC8558B58

Function 004089F0 Relevance: 10.6, APIs: 7, Instructions: 130threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00408EB0: GetCurrentThreadId.KERNEL32 ref: 00408EB3

GetTickCount.KERNEL32 ref: 00408A27
GetTickCount.KERNEL32 ref: 00408A3F
GetCurrentThreadId.KERNEL32 ref: 00408A6E
GetTickCount.KERNEL32 ref: 00408A99
GetTickCount.KERNEL32 ref: 00408AD0
GetTickCount.KERNEL32 ref: 00408AFA
GetCurrentThreadId.KERNEL32 ref: 00408B6A

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: 1ce27751a52ce1b5aa9841ea58ceba68596f586c09b5a461f35c37d4f2b20303
Instruction ID: 31d7762ec1bcc9d97c6cb4adfab54d5a4368a1ab62600cb27de6faf6fbde6f1f
Opcode Fuzzy Hash: 1ce27751a52ce1b5aa9841ea58ceba68596f586c09b5a461f35c37d4f2b20303
Instruction Fuzzy Hash: C74175706087419ED721AE7CCA4471FBAE1AF94354F14893FE4D8A73C1EE7C98818B56

Function 0040875C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 64libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 00408771
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00408777
GetLastError.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00408797

Strings

@, xrefs: 00408817
kernel32.dll, xrefs: 0040876C
GetLogicalProcessorInformation, xrefs: 00408767

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 4275029093-79381301
Opcode ID: b226703034e9b9ccbabd54fc0e30c50fdad98cfe11ac73c36c13217fc22929ff
Instruction ID: b7457c22e5fd0ab83db127167b725af302e6690149aee62109a3d89ac8995f94
Opcode Fuzzy Hash: b226703034e9b9ccbabd54fc0e30c50fdad98cfe11ac73c36c13217fc22929ff
Instruction Fuzzy Hash: 9F112172D00604AEDF10EBA5CA45B5EB7A8DB44314F60C4BFE854F72C1DA7C9D408A59

Function 00406248 Relevance: 9.1, APIs: 6, Instructions: 51fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 0040626A
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000), ref: 00406270
GetStdHandle.KERNEL32(000000F4,004053B8,00000000,?,00000000,00000000,000000F4,?,00000000,?,00000000), ref: 0040628F
WriteFile.KERNEL32(00000000,000000F4,004053B8,00000000,?,00000000,00000000,000000F4,?,00000000,?,00000000), ref: 00406295
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,004053B8,00000000,?,00000000,00000000,000000F4,?,00000000,?), ref: 004062AC
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,004053B8,00000000,?,00000000,00000000,000000F4,?,00000000), ref: 004062B2

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID: FileHandleWrite
String ID:
API String ID: 3320372497-0
Opcode ID: cc82fe95fae00a2fe4fe3d8577e075e1c19fb4f6f0c316c3bb6dad9e94b10510
Instruction ID: ec616e4a7ec276bf1e9c9df4d0755d93393b8d460b4929f5fd9b8d4dc60f9c60
Opcode Fuzzy Hash: cc82fe95fae00a2fe4fe3d8577e075e1c19fb4f6f0c316c3bb6dad9e94b10510
Instruction Fuzzy Hash: CE01A9A12446103ED110F3AA9C8AF6F168CCF09764F10467F7118F21D2C97C5C549BBE

Function 00405980 Relevance: 9.0, APIs: 7, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,FFFFFFDC,0040594E), ref: 00405A37
Sleep.KERNEL32(0000000A,00000000,FFFFFFDC,0040594E), ref: 00405A4D
Sleep.KERNEL32(00000000,?,?,FFFFFFDC,0040594E), ref: 00405A7B
Sleep.KERNEL32(0000000A,00000000,?,?,FFFFFFDC,0040594E), ref: 00405A91

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: a589a648e64fe0d14fd105b49dcfb94df46539036ffd79c5efc51e5c087bbf4e
Instruction ID: ec1f61514dea765ed2dba929ffb8bcf557c4084dc31ac7de50beacea9e35791a
Opcode Fuzzy Hash: a589a648e64fe0d14fd105b49dcfb94df46539036ffd79c5efc51e5c087bbf4e
Instruction Fuzzy Hash: 74C14472640B418FDB15CF68D884317BBA2EB85310F1882BFE405AB3D5C7B8A851CF99

Function 00405D04 Relevance: 7.7, APIs: 6, Instructions: 196sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,?,00000000,00405976), ref: 00405D9A
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,00405976), ref: 00405DB4

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 4e408d843fb49dd08c23fced40fb8b07a040a8480eb9a35e5068483b2122d434
Instruction ID: 51795136c6503e1c47637f7d674257962c88a744558d61d92fffa6b80ed28c0b
Opcode Fuzzy Hash: 4e408d843fb49dd08c23fced40fb8b07a040a8480eb9a35e5068483b2122d434
Instruction Fuzzy Hash: E4619E31600A408FD715DB28D98871BBBD1EF85314F28C1BFE488AB3D6D6789845CF99

Function 0040D888 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 0040D899
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 0040D8F7
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 0040D954
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 0040D987

Part of subcall function 0040D844: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,0040D905), ref: 0040D85B
Part of subcall function 0040D844: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,0040D905), ref: 0040D878

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: 1fbc85ef0c902886a6c3cffee615f80f7da3d50029a41cf599b7df0a689529e5
Instruction ID: 7c9648857953f1106977b4c12d46b897a647c464cda3cfc1df42d20d4be6e87a
Opcode Fuzzy Hash: 1fbc85ef0c902886a6c3cffee615f80f7da3d50029a41cf599b7df0a689529e5
Instruction Fuzzy Hash: FC315A71E0021A9BDB10EFE9C884AAFB7B5EF44314F00417AE565E72D1DB789E09CB94

Function 00409236 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(?,00000000), ref: 0040930A

Strings

PQ@, xrefs: 00409366

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: PQ@
API String ID: 3192549508-1182915111
Opcode ID: f97432d9a74d48d1be6e453156aec8d8ec72d876d03e176ddb95ed7785d56fb8
Instruction ID: a388b93ee2e59f02e9cd86548b20e7f1050cae16c026a5c04725e6c76b8a22e6
Opcode Fuzzy Hash: f97432d9a74d48d1be6e453156aec8d8ec72d876d03e176ddb95ed7785d56fb8
Instruction Fuzzy Hash: C4416070604201AFD710DB14D884B6BB7E9EF88314F5589BEE945AB3E2C738EC45CB59

Function 0040910A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(00000006,00000000), ref: 00409176
UnhandledExceptionFilter.KERNEL32(?,?,?,Function_0000910C), ref: 004091B3

Strings

PQ@, xrefs: 004091DE

Memory Dump Source

Source File: 00000007.00000002.2339427011.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2339390899.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339599790.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339628951.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339658434.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339685896.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339719950.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339748928.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339775893.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339804181.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.2339830899.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_PlanSwift.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: PQ@
API String ID: 3192549508-1182915111
Opcode ID: c1dfdc0c1f8c991be7f58790e338967df81166a6b9db1fde4f31fe24091c169e
Instruction ID: 71fcfe12fed47acc81764c800648f1f93064c69da737eb2559b142173d817102
Opcode Fuzzy Hash: c1dfdc0c1f8c991be7f58790e338967df81166a6b9db1fde4f31fe24091c169e
Instruction Fuzzy Hash: 91315EB4644202AFE724DB14C888F2777E9EB88754F14C96EF4059B2A2C738EC45C72A

Analysis Process: PlanSwift.exePID: 3140, Parent PID: 6252COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	103
Total number of Limit Nodes:	10

Executed Functions

Function 0040E218 Relevance: 3.1, APIs: 2, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,0040E2DA,?,?), ref: 0040E24A
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,0040E2DA,?,?), ref: 0040E253

Part of subcall function 0040E0C0: FindFirstFileW.KERNEL32(00000000,?,00000000,0040E120,?,?), ref: 0040E0F3
Part of subcall function 0040E0C0: FindClose.KERNEL32(00000000,00000000,?,00000000,0040E120,?,?), ref: 0040E103

Memory Dump Source

Source File: 00000009.00000002.2428851279.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2428807409.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429066107.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429135797.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429209103.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429244195.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429278492.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429332239.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429467869.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429503887.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PlanSwift.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: 5e8c7b6bfa53dc2b409d17a441cef21124a354dbd5d98009618145497913c33b
Instruction ID: ce478f91fe273f6fa9a390c995df9e97f7a047921afb44b9b657b0e98ae89ea1
Opcode Fuzzy Hash: 5e8c7b6bfa53dc2b409d17a441cef21124a354dbd5d98009618145497913c33b
Instruction Fuzzy Hash: 2E113670A042099BDB04EB96C952AAEB3B9EF49304F50487EF504F73D1D7785E14CA69

Function 0040E0C0 Relevance: 3.0, APIs: 2, Instructions: 34
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040E120,?,?), ref: 0040E0F3
FindClose.KERNEL32(00000000,00000000,?,00000000,0040E120,?,?), ref: 0040E103

Memory Dump Source

Source File: 00000009.00000002.2428851279.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2428807409.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429066107.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429135797.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429209103.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429244195.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429278492.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429332239.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429467869.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429503887.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PlanSwift.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 993212286c2df5424098968e096e535751f8b6073d4ab282ff9afd4bc915a4d3
Instruction ID: 54e1806b8698661048c2dc6b8c508eed4307c1a0bede51bc51777404de6bafd0
Opcode Fuzzy Hash: 993212286c2df5424098968e096e535751f8b6073d4ab282ff9afd4bc915a4d3
Instruction Fuzzy Hash: 0CF0BE31544708AEC710EB66CC1299EB3ACDB48324760097BB400F25C2EA3CAE209A68

Function 0040DCDC Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 175
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040DF05,?,?), ref: 0040DD15
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040DF05,?,?), ref: 0040DD5E
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040DF05,?,?), ref: 0040DD80
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 0040DD9E
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 0040DDBC
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 0040DDDA
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 0040DDF8
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,0040DEE6,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040DF05), ref: 0040DE38
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,0040DEE6,?,80000001), ref: 0040DE63
RegCloseKey.ADVAPI32(?,0040DEED,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0040DEE6,?,80000001,Software\Embarcadero\Locales), ref: 0040DEDE

Strings

Software\Borland\Locales, xrefs: 0040DDD0
Software\Embarcadero\Locales, xrefs: 0040DD54, 0040DD76
Software\CodeGear\Locales, xrefs: 0040DD94, 0040DDB2
Software\Borland\Delphi\Locales, xrefs: 0040DDEE

Memory Dump Source

Source File: 00000009.00000002.2428851279.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2428807409.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429066107.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429135797.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429209103.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429244195.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429278492.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429332239.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429467869.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429503887.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PlanSwift.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: 00257e7f73a3ef19c20f315fb333b61fe6e52f2fcbcb2aa2ce92a1c4fde456f8
Instruction ID: e301cb2779f4f69262e0059234b1a7c9e8799f8fd5a03557ef3c88291aa86cc6
Opcode Fuzzy Hash: 00257e7f73a3ef19c20f315fb333b61fe6e52f2fcbcb2aa2ce92a1c4fde456f8
Instruction Fuzzy Hash: 6C512075E40609BEEB10DAD5CC42FAF77ACDF08704F60447BBA04F61C1D678AA45CAA9

Function 00409817 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0040983F

Strings

PQ@, xrefs: 00409866
HQ@, xrefs: 0040985C

Memory Dump Source

Source File: 00000009.00000002.2428851279.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2428807409.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429066107.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429135797.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429209103.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429244195.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429278492.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429332239.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429467869.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429503887.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PlanSwift.jbxd

Similarity

API ID: CurrentThread
String ID: HQ@$PQ@
API String ID: 2882836952-3812187175
Opcode ID: cd131b4ea203f51717759289ccb30eca6010b2956951e2f7f8450f39df22f792
Instruction ID: 18b22f79a86a808f36ade31f54930c1fd7cc75a42ec4c748960205a7c2e74846
Opcode Fuzzy Hash: cd131b4ea203f51717759289ccb30eca6010b2956951e2f7f8450f39df22f792
Instruction Fuzzy Hash: D32136B5900204CFCF18EF28D48069A7BA1FB59314B14D56EE80AAF396C739DD41CF58

Function 00406D6C Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNEL32(00606AD8,00000000,00008000), ref: 00406D8A
VirtualFree.KERNEL32(00608B7C,00000000,00008000), ref: 00406E06

Strings

xk`, xrefs: 00406DC5

Memory Dump Source

Source File: 00000009.00000002.2428851279.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2428807409.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429066107.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429135797.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429209103.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429244195.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429278492.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429332239.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429467869.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429503887.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PlanSwift.jbxd

Similarity

API ID: FreeVirtual
String ID: xk`
API String ID: 1263568516-1847079886
Opcode ID: 8c5d51678712dfd103a5b98a5eb2ba1ee577a5cb4900c962b744ef632db20499
Instruction ID: b2059ec17fd45d1636b2cb87ea4f44dff8c6f3abc93f150a60f6471c8d1a607f
Opcode Fuzzy Hash: 8c5d51678712dfd103a5b98a5eb2ba1ee577a5cb4900c962b744ef632db20499
Instruction Fuzzy Hash: 001182717406109FD7689F58D840B277BE1EB48710F16C07EE14AEB7C1D678AC118B98

Function 0040E2E8 Relevance: 3.1, APIs: 2, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,0040E401,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040E48A,00000000,?,00000105), ref: 0040E393
GetSystemDefaultUILanguage.KERNEL32(00000000,0040E401,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040E48A,00000000,?,00000105), ref: 0040E3BB

Memory Dump Source

Source File: 00000009.00000002.2428851279.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2428807409.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429066107.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429135797.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429209103.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429244195.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429278492.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429332239.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429467869.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429503887.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PlanSwift.jbxd

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: 33c58b91298bafa4e938b44770cfab1ae2ad07b19998497fa74c4d863357686c
Instruction ID: c5b139623584e9c8a436eaca1aca2cf86db1ae3ce9d6e3e1769aa58204507684
Opcode Fuzzy Hash: 33c58b91298bafa4e938b44770cfab1ae2ad07b19998497fa74c4d863357686c
Instruction Fuzzy Hash: 5A314170E102099FDB10EBA6C881AAEBBB5EF48304F50487BE840B73D1DB789D55CB59

Function 0040E410 Relevance: 3.1, APIs: 2, Instructions: 56
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040E4CC,?,?,00000000), ref: 0040E44C
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040E4CC,?,?,00000000), ref: 0040E49D

Memory Dump Source

Source File: 00000009.00000002.2428851279.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2428807409.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429066107.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429135797.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429209103.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429244195.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429278492.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429332239.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429467869.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429503887.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PlanSwift.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: 0a4c36475c3d1e0fb70c01fbc4f0fe070a1a45e6cbb4880de799eeabeb228d85
Instruction ID: 9329a4d688e7cdd2c33f4ececd202dce77c43672eb9a98cc6c6f50343e4898b8
Opcode Fuzzy Hash: 0a4c36475c3d1e0fb70c01fbc4f0fe070a1a45e6cbb4880de799eeabeb228d85
Instruction Fuzzy Hash: 8F118231A4421CABDB14EB51CC86BDE73B8DB08304F5145BAB408F72C1DA785E848EA9

Function 0040D160 Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,?,0000020A), ref: 0040D17E

Part of subcall function 0040E410: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040E4CC,?,?,00000000), ref: 0040E44C
Part of subcall function 0040E410: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040E4CC,?,?,00000000), ref: 0040E49D

Memory Dump Source

Source File: 00000009.00000002.2428851279.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2428807409.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429066107.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429135797.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429209103.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429244195.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429278492.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429332239.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429467869.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429503887.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PlanSwift.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: 0fa008b4d3fbaecb020027ebd69bd6ca7320cd4bd33cd7313f79e1f8cd26c99a
Instruction ID: 3e538cdb76f8227d956f39c40db0905d0aa17c5748080a6b776d158bdbc2bfbe
Opcode Fuzzy Hash: 0fa008b4d3fbaecb020027ebd69bd6ca7320cd4bd33cd7313f79e1f8cd26c99a
Instruction Fuzzy Hash: 4AE06D71A003109FCB10DE98C9C5A4373D4AB08714F0009A6FC18DF38AD375CD2487D1

Function 0040FE48 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32 ref: 0040FE4C

Memory Dump Source

Source File: 00000009.00000002.2428851279.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2428807409.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429066107.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429135797.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429209103.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429244195.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429278492.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429332239.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429467869.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429503887.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PlanSwift.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: de8292ca15932d7318cf9a9a3e48783e150fe25b39319a317a2599aa1258d1fe
Instruction ID: 9eb204805f81a628c4fe9eca656eabf1f064acfa4ff6d1ed943c5db27331405a
Opcode Fuzzy Hash: de8292ca15932d7318cf9a9a3e48783e150fe25b39319a317a2599aa1258d1fe
Instruction Fuzzy Hash: 41A012204088000AC404A7194C4340B31805D40214FC40268745CA92C2E61985A40EDB

Function 00405664 Relevance: 1.3, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004), ref: 0040567B

Memory Dump Source

Source File: 00000009.00000002.2428851279.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2428807409.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429066107.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429135797.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429209103.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429244195.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429278492.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429332239.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429467869.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429503887.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PlanSwift.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 589b615439f5529416fc54e4a00696b6869d843937b7fc1b59c1f69fbd4fda89
Instruction ID: 194b463243655a351fdcb8223ca4b5a3d56581d5a2f5db91baa3f42aee6902c2
Opcode Fuzzy Hash: 589b615439f5529416fc54e4a00696b6869d843937b7fc1b59c1f69fbd4fda89
Instruction Fuzzy Hash: 8DF08CB2B802114FD714AF78DD407037AD6E704314B10817EF90AFB795D7B588108B80

Non-executed Functions

Function 0040DAEC Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140
stringlibraryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?), ref: 0040DB09
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 0040DB1A
FindFirstFileW.KERNEL32(?,?,kernel32.dll,?,?,?), ref: 0040DC1A
FindClose.KERNEL32(?,?,?,kernel32.dll,?,?,?), ref: 0040DC2C
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,?,?,?), ref: 0040DC38
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,?,?,?), ref: 0040DC7D

Strings

GetLongPathNameW, xrefs: 0040DB14
kernel32.dll, xrefs: 0040DB04
\, xrefs: 0040DC4A

Memory Dump Source

Source File: 00000009.00000002.2428851279.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2428807409.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429066107.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429135797.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429209103.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429244195.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429278492.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429332239.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429467869.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429503887.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PlanSwift.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: bd5511324fd24e70828a3ee036868bfc770ecc5b7afd36b0dd2b9f7a28521b39
Instruction ID: 446a6666705070bf617439557182dc402a8fe1df9001329157ac1ee8aafbec3c
Opcode Fuzzy Hash: bd5511324fd24e70828a3ee036868bfc770ecc5b7afd36b0dd2b9f7a28521b39
Instruction Fuzzy Hash: 5A418D31E006189BDB10EAE9CC85A9EB3B5AF44314F1845BAD505F72C1E77CAE49CB49

Function 0040D9A4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00608C10,00000000,0040DAAA,?,?,?,00000000,?,0040E3A0,00000000,0040E401,?,?,00000000,00000000,00000000), ref: 0040D9C2
LeaveCriticalSection.KERNEL32(00608C10,00608C10,00000000,0040DAAA,?,?,?,00000000,?,0040E3A0,00000000,0040E401,?,?,00000000,00000000), ref: 0040D9E6
LeaveCriticalSection.KERNEL32(00608C10,00608C10,00000000,0040DAAA,?,?,?,00000000,?,0040E3A0,00000000,0040E401,?,?,00000000,00000000), ref: 0040D9F5
IsValidLocale.KERNEL32(00000000,00000002,00608C10,00608C10,00000000,0040DAAA,?,?,?,00000000,?,0040E3A0,00000000,0040E401), ref: 0040DA07
EnterCriticalSection.KERNEL32(00608C10,00000000,00000002,00608C10,00608C10,00000000,0040DAAA,?,?,?,00000000,?,0040E3A0,00000000,0040E401), ref: 0040DA64
LeaveCriticalSection.KERNEL32(00608C10,00608C10,00000000,00000002,00608C10,00608C10,00000000,0040DAAA,?,?,?,00000000,?,0040E3A0,00000000,0040E401), ref: 0040DA8D

Strings

en-GB,en,en-US,, xrefs: 0040D9D2, 0040DA79

Memory Dump Source

Source File: 00000009.00000002.2428851279.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2428807409.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429066107.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429135797.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429209103.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429244195.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429278492.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429332239.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429467869.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429503887.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PlanSwift.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-GB,en,en-US,
API String ID: 975949045-3021119265
Opcode ID: cc457a52c95f3e830cc3333776189c4993421793884cc5c2848482521a5c96bb
Instruction ID: 97dab218b0506501525701a99fe6bc0e0634cf3d93f4e4cbd0d8b84e3dd3bd17
Opcode Fuzzy Hash: cc457a52c95f3e830cc3333776189c4993421793884cc5c2848482521a5c96bb
Instruction Fuzzy Hash: 90215030F946106EEB14F7AA9C1271B2195DB49718FA1583BF440BB2C7DDBC8C858A7E

Function 004114A8 Relevance: 13.8, APIs: 9, Instructions: 258COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00411560

Memory Dump Source

Source File: 00000009.00000002.2428851279.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2428807409.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429066107.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429135797.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429209103.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429244195.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429278492.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429332239.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429467869.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429503887.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PlanSwift.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 7576ae08a2e665afeb32a895b9f59c939a287345ff08e7946268467c9ff27dc4
Instruction ID: 5149e3ba07c77eea25534ad68e6a995e06473a110f8e705a47cf673fd3d7e1d5
Opcode Fuzzy Hash: 7576ae08a2e665afeb32a895b9f59c939a287345ff08e7946268467c9ff27dc4
Instruction Fuzzy Hash: F7A18175A002099FDB10DFE8D891BEEB7F6AF48300F14412AE615A73A1DB78A985CF54

Function 00409AC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,H_,00000000,?,00409B78,?,00608B98,00608B98,?,?,005FFC48,004114A7,005FEC48), ref: 00409AF9
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,H_,00000000,?,00409B78,?,00608B98,00608B98,?,?,005FFC48,004114A7,005FEC48), ref: 00409AFF
GetStdHandle.KERNEL32(000000F5,00000000,00000002,H_,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,H_,00000000,?,00409B78,?,00608B98,00608B98), ref: 00409B1A
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,H_,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,H_,00000000,?,00409B78,?,00608B98), ref: 00409B20

Strings

Runtime error at 00000000, xrefs: 00409AF2, 00409B37
H_, xrefs: 00409AEB, 00409B06, 00409AEF, 00409B0A
Error, xrefs: 00409B32

Memory Dump Source

Source File: 00000009.00000002.2428851279.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2428807409.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429066107.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429135797.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429209103.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429244195.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429278492.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429332239.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429467869.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429503887.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PlanSwift.jbxd

Similarity

API ID: FileHandleWrite
String ID: Error$H_$Runtime error at 00000000
API String ID: 3320372497-3722976593
Opcode ID: 07956a37d3ff1c724660eadbe1b6ef1f1b7ffa15f92cc942a6e5fff81eed5c81
Instruction ID: 25b9e8e12d0e11362dbd3037db93e590adee3714f79345003379c581f973263a
Opcode Fuzzy Hash: 07956a37d3ff1c724660eadbe1b6ef1f1b7ffa15f92cc942a6e5fff81eed5c81
Instruction Fuzzy Hash: 8FF068506C434475E72477A19D07F6F365C9B40B24F60913FB250754D2C6FC58849BA9

Function 00405EFC Relevance: 10.9, APIs: 7, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2428851279.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2428807409.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429066107.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429135797.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429209103.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429244195.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429278492.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429332239.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429467869.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429503887.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ca5d57a1de04ecf167f5ecf7919488e7353b55b2136c199517ba9ff3ca190a8
Instruction ID: b4e2ab0d59c26cd4818ef2125c7104dee944b50b200bf734a347046e6c6977fc
Opcode Fuzzy Hash: 6ca5d57a1de04ecf167f5ecf7919488e7353b55b2136c199517ba9ff3ca190a8
Instruction Fuzzy Hash: 65B12572740A004BD714EA6DDC8476BB386DBC4325F18823FE615EB3D6DA7CC8558B58

Function 004089F0 Relevance: 10.6, APIs: 7, Instructions: 130threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00408EB0: GetCurrentThreadId.KERNEL32 ref: 00408EB3

GetTickCount.KERNEL32 ref: 00408A27
GetTickCount.KERNEL32 ref: 00408A3F
GetCurrentThreadId.KERNEL32 ref: 00408A6E
GetTickCount.KERNEL32 ref: 00408A99
GetTickCount.KERNEL32 ref: 00408AD0
GetTickCount.KERNEL32 ref: 00408AFA
GetCurrentThreadId.KERNEL32 ref: 00408B6A

Memory Dump Source

Source File: 00000009.00000002.2428851279.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2428807409.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429066107.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429135797.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429209103.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429244195.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429278492.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429332239.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429467869.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429503887.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PlanSwift.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: 1ce27751a52ce1b5aa9841ea58ceba68596f586c09b5a461f35c37d4f2b20303
Instruction ID: 31d7762ec1bcc9d97c6cb4adfab54d5a4368a1ab62600cb27de6faf6fbde6f1f
Opcode Fuzzy Hash: 1ce27751a52ce1b5aa9841ea58ceba68596f586c09b5a461f35c37d4f2b20303
Instruction Fuzzy Hash: C74175706087419ED721AE7CCA4471FBAE1AF94354F14893FE4D8A73C1EE7C98818B56

Function 0040875C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 64libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 00408771
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00408777
GetLastError.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00408797

Strings

@, xrefs: 00408817
kernel32.dll, xrefs: 0040876C
GetLogicalProcessorInformation, xrefs: 00408767

Memory Dump Source

Source File: 00000009.00000002.2428851279.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2428807409.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429066107.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429135797.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429209103.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429244195.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429278492.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429332239.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429467869.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429503887.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PlanSwift.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 4275029093-79381301
Opcode ID: b226703034e9b9ccbabd54fc0e30c50fdad98cfe11ac73c36c13217fc22929ff
Instruction ID: b7457c22e5fd0ab83db127167b725af302e6690149aee62109a3d89ac8995f94
Opcode Fuzzy Hash: b226703034e9b9ccbabd54fc0e30c50fdad98cfe11ac73c36c13217fc22929ff
Instruction Fuzzy Hash: 9F112172D00604AEDF10EBA5CA45B5EB7A8DB44314F60C4BFE854F72C1DA7C9D408A59

Function 00406248 Relevance: 9.1, APIs: 6, Instructions: 51fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 0040626A
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000), ref: 00406270
GetStdHandle.KERNEL32(000000F4,004053B8,00000000,?,00000000,00000000,000000F4,?,00000000,?,00000000), ref: 0040628F
WriteFile.KERNEL32(00000000,000000F4,004053B8,00000000,?,00000000,00000000,000000F4,?,00000000,?,00000000), ref: 00406295
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,004053B8,00000000,?,00000000,00000000,000000F4,?,00000000,?), ref: 004062AC
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,004053B8,00000000,?,00000000,00000000,000000F4,?,00000000), ref: 004062B2

Memory Dump Source

Source File: 00000009.00000002.2428851279.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2428807409.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429066107.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429135797.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429209103.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429244195.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429278492.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429332239.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429467869.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429503887.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PlanSwift.jbxd

Similarity

API ID: FileHandleWrite
String ID:
API String ID: 3320372497-0
Opcode ID: cc82fe95fae00a2fe4fe3d8577e075e1c19fb4f6f0c316c3bb6dad9e94b10510
Instruction ID: ec616e4a7ec276bf1e9c9df4d0755d93393b8d460b4929f5fd9b8d4dc60f9c60
Opcode Fuzzy Hash: cc82fe95fae00a2fe4fe3d8577e075e1c19fb4f6f0c316c3bb6dad9e94b10510
Instruction Fuzzy Hash: CE01A9A12446103ED110F3AA9C8AF6F168CCF09764F10467F7118F21D2C97C5C549BBE

Function 00405980 Relevance: 9.0, APIs: 7, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,FFFFFFDC,0040594E), ref: 00405A37
Sleep.KERNEL32(0000000A,00000000,FFFFFFDC,0040594E), ref: 00405A4D
Sleep.KERNEL32(00000000,?,?,FFFFFFDC,0040594E), ref: 00405A7B
Sleep.KERNEL32(0000000A,00000000,?,?,FFFFFFDC,0040594E), ref: 00405A91

Memory Dump Source

Source File: 00000009.00000002.2428851279.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2428807409.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429066107.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429135797.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429209103.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429244195.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429278492.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429332239.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429467869.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429503887.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PlanSwift.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: a589a648e64fe0d14fd105b49dcfb94df46539036ffd79c5efc51e5c087bbf4e
Instruction ID: ec1f61514dea765ed2dba929ffb8bcf557c4084dc31ac7de50beacea9e35791a
Opcode Fuzzy Hash: a589a648e64fe0d14fd105b49dcfb94df46539036ffd79c5efc51e5c087bbf4e
Instruction Fuzzy Hash: 74C14472640B418FDB15CF68D884317BBA2EB85310F1882BFE405AB3D5C7B8A851CF99

Function 00405D04 Relevance: 7.7, APIs: 6, Instructions: 196sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,?,00000000,00405976), ref: 00405D9A
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,00405976), ref: 00405DB4

Memory Dump Source

Source File: 00000009.00000002.2428851279.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2428807409.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429066107.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429135797.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429209103.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429244195.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429278492.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429332239.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429467869.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429503887.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PlanSwift.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 4e408d843fb49dd08c23fced40fb8b07a040a8480eb9a35e5068483b2122d434
Instruction ID: 51795136c6503e1c47637f7d674257962c88a744558d61d92fffa6b80ed28c0b
Opcode Fuzzy Hash: 4e408d843fb49dd08c23fced40fb8b07a040a8480eb9a35e5068483b2122d434
Instruction Fuzzy Hash: E4619E31600A408FD715DB28D98871BBBD1EF85314F28C1BFE488AB3D6D6789845CF99

Function 0040D888 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 0040D899
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 0040D8F7
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 0040D954
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 0040D987

Part of subcall function 0040D844: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,0040D905), ref: 0040D85B
Part of subcall function 0040D844: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,0040D905), ref: 0040D878

Memory Dump Source

Source File: 00000009.00000002.2428851279.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2428807409.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429066107.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429135797.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429209103.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429244195.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429278492.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429332239.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429467869.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429503887.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PlanSwift.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: 1fbc85ef0c902886a6c3cffee615f80f7da3d50029a41cf599b7df0a689529e5
Instruction ID: 7c9648857953f1106977b4c12d46b897a647c464cda3cfc1df42d20d4be6e87a
Opcode Fuzzy Hash: 1fbc85ef0c902886a6c3cffee615f80f7da3d50029a41cf599b7df0a689529e5
Instruction Fuzzy Hash: FC315A71E0021A9BDB10EFE9C884AAFB7B5EF44314F00417AE565E72D1DB789E09CB94

Function 00409236 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(?,00000000), ref: 0040930A

Strings

PQ@, xrefs: 00409366

Memory Dump Source

Source File: 00000009.00000002.2428851279.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2428807409.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429066107.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429135797.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429209103.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429244195.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429278492.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429332239.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429467869.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429503887.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PlanSwift.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: PQ@
API String ID: 3192549508-1182915111
Opcode ID: f97432d9a74d48d1be6e453156aec8d8ec72d876d03e176ddb95ed7785d56fb8
Instruction ID: a388b93ee2e59f02e9cd86548b20e7f1050cae16c026a5c04725e6c76b8a22e6
Opcode Fuzzy Hash: f97432d9a74d48d1be6e453156aec8d8ec72d876d03e176ddb95ed7785d56fb8
Instruction Fuzzy Hash: C4416070604201AFD710DB14D884B6BB7E9EF88314F5589BEE945AB3E2C738EC45CB59

Function 0040910A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(00000006,00000000), ref: 00409176
UnhandledExceptionFilter.KERNEL32(?,?,?,Function_0000910C), ref: 004091B3

Strings

PQ@, xrefs: 004091DE

Memory Dump Source

Source File: 00000009.00000002.2428851279.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2428807409.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429066107.00000000005FF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429135797.0000000000600000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429209103.0000000000601000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429244195.0000000000603000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429278492.0000000000606000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429332239.000000000060B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429467869.000000000060E000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429503887.000000000060F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000610000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2429589061.0000000000612000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_PlanSwift.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: PQ@
API String ID: 3192549508-1182915111
Opcode ID: c1dfdc0c1f8c991be7f58790e338967df81166a6b9db1fde4f31fe24091c169e
Instruction ID: 71fcfe12fed47acc81764c800648f1f93064c69da737eb2559b142173d817102
Opcode Fuzzy Hash: c1dfdc0c1f8c991be7f58790e338967df81166a6b9db1fde4f31fe24091c169e
Instruction Fuzzy Hash: 91315EB4644202AFE724DB14C888F2777E9EB88754F14C96EF4059B2A2C738EC45C72A

Analysis Process: PlanSwift.exePID: 5888, Parent PID: 6252COMMON

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	201
Total number of Limit Nodes:	11

Executed Functions

Function 00BAE218 Relevance: 3.1, APIs: 2, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,00BAE2DA,?,?), ref: 00BAE24A
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,00BAE2DA,?,?), ref: 00BAE253

Part of subcall function 00BAE0C0: FindFirstFileW.KERNEL32(00000000,?,00000000,00BAE120,?,?), ref: 00BAE0F3
Part of subcall function 00BAE0C0: FindClose.KERNEL32(00000000,00000000,?,00000000,00BAE120,?,?), ref: 00BAE103

Memory Dump Source

Source File: 0000000B.00000002.2915751656.0000000000BA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000B.00000002.2915686943.0000000000BA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916085519.0000000000D9F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916141535.0000000000DA0000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916210506.0000000000DA1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916275607.0000000000DA3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916339289.0000000000DA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916402927.0000000000DAB000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916467728.0000000000DAE000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916531022.0000000000DAF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB2000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ba0000_PlanSwift.jbxd

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: 609e4b0d6a7c8587aa224c2d21ae8309467db1b33ec07c52917c7b56b9f44008
Instruction ID: 8a285a7375cce82ba4e138cf313fc18e24b525254ef3905bdffade10c3f5b0b7
Opcode Fuzzy Hash: 609e4b0d6a7c8587aa224c2d21ae8309467db1b33ec07c52917c7b56b9f44008
Instruction Fuzzy Hash: 49117570A082099FDF04EFA4C992AADB3F9EF4A300F5044B5F514E7291DB749F08CA61

Function 00BAE0C0 Relevance: 3.0, APIs: 2, Instructions: 34
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,00BAE120,?,?), ref: 00BAE0F3
FindClose.KERNEL32(00000000,00000000,?,00000000,00BAE120,?,?), ref: 00BAE103

Memory Dump Source

Source File: 0000000B.00000002.2915751656.0000000000BA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000B.00000002.2915686943.0000000000BA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916085519.0000000000D9F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916141535.0000000000DA0000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916210506.0000000000DA1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916275607.0000000000DA3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916339289.0000000000DA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916402927.0000000000DAB000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916467728.0000000000DAE000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916531022.0000000000DAF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB2000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ba0000_PlanSwift.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: bac4c26fa32c448c0063aee0050bc4405673f9427d53e2c0a245f08502e0f2de
Instruction ID: e38840765e74e2811e6c10298b256d58ca3d9e395368c6e203e1e25893ab98f8
Opcode Fuzzy Hash: bac4c26fa32c448c0063aee0050bc4405673f9427d53e2c0a245f08502e0f2de
Instruction Fuzzy Hash: F5F05E71548608BEDB20EB64DD6399EB7ECDB4A72076009F1B414E2591EB34AE089564

Function 00BADCDC Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 175
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,00BADF05,?,?), ref: 00BADD15
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,00BADF05,?,?), ref: 00BADD5E
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,00BADF05,?,?), ref: 00BADD80
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 00BADD9E
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 00BADDBC
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 00BADDDA
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 00BADDF8
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,00BADEE6,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,00BADF05), ref: 00BADE38
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,00BADEE6,?,80000001), ref: 00BADE63
RegCloseKey.ADVAPI32(?,00BADEED,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,00BADEE6,?,80000001,Software\Embarcadero\Locales), ref: 00BADEDE

Strings

Software\Embarcadero\Locales, xrefs: 00BADD54, 00BADD76
Software\CodeGear\Locales, xrefs: 00BADD94, 00BADDB2
Software\Borland\Delphi\Locales, xrefs: 00BADDEE
Software\Borland\Locales, xrefs: 00BADDD0

Memory Dump Source

Source File: 0000000B.00000002.2915751656.0000000000BA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000B.00000002.2915686943.0000000000BA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916085519.0000000000D9F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916141535.0000000000DA0000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916210506.0000000000DA1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916275607.0000000000DA3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916339289.0000000000DA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916402927.0000000000DAB000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916467728.0000000000DAE000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916531022.0000000000DAF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB2000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ba0000_PlanSwift.jbxd

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: 70ff509470a46fb279bed3a7123f4a88648cc0a0650e691cdb4c4fabe1b5f2a1
Instruction ID: 3d949a7d3ccd6397f72b99f7d9bdffde5ed38db096e9437867a0fd4378102710
Opcode Fuzzy Hash: 70ff509470a46fb279bed3a7123f4a88648cc0a0650e691cdb4c4fabe1b5f2a1
Instruction Fuzzy Hash: 49513375A4830CBEEB20DA94CC42FEEB3FCDB1A700F5044E5BA05EA5D1E670AA45C765

Function 00BAE410 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,00BAE4CC,?,MZP,00D9FC2C), ref: 00BAE44C
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,00BAE4CC,?,MZP,00D9FC2C), ref: 00BAE49D

Strings

MZP, xrefs: 00BAE41A

Memory Dump Source

Source File: 0000000B.00000002.2915751656.0000000000BA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000B.00000002.2915686943.0000000000BA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916085519.0000000000D9F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916141535.0000000000DA0000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916210506.0000000000DA1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916275607.0000000000DA3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916339289.0000000000DA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916402927.0000000000DAB000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916467728.0000000000DAE000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916531022.0000000000DAF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB2000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ba0000_PlanSwift.jbxd

Similarity

API ID: FileLibraryLoadModuleName
String ID: MZP
API String ID: 1159719554-2889622443
Opcode ID: 8515c768e53b1fd541a77cb2d9dc572b303cbf0d35d23f0fa3510067a557db9a
Instruction ID: 0c6c0e40c8f65acaed0a02a7d3993d2e690c490c5046f39da9fd44824742a0e5
Opcode Fuzzy Hash: 8515c768e53b1fd541a77cb2d9dc572b303cbf0d35d23f0fa3510067a557db9a
Instruction Fuzzy Hash: 7A118F31A4821CAFDB24EB50CC86BDEB3F8DB0A700F5144E5F508A7291DA749F85CAA1

Function 00BAD160 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(MZP,?,0000020A), ref: 00BAD17E

Part of subcall function 00BAE410: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,00BAE4CC,?,MZP,00D9FC2C), ref: 00BAE44C
Part of subcall function 00BAE410: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,00BAE4CC,?,MZP,00D9FC2C), ref: 00BAE49D

Strings

MZP, xrefs: 00BAD161, 00BAD17D

Memory Dump Source

Source File: 0000000B.00000002.2915751656.0000000000BA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000B.00000002.2915686943.0000000000BA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916085519.0000000000D9F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916141535.0000000000DA0000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916210506.0000000000DA1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916275607.0000000000DA3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916339289.0000000000DA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916402927.0000000000DAB000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916467728.0000000000DAE000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916531022.0000000000DAF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB2000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ba0000_PlanSwift.jbxd

Similarity

API ID: FileModuleName$LibraryLoad
String ID: MZP
API String ID: 4113206344-2889622443
Opcode ID: 0fa008b4d3fbaecb020027ebd69bd6ca7320cd4bd33cd7313f79e1f8cd26c99a
Instruction ID: c382cd1dcdefe9b1420f92c7c6d3140384b1aeeb899ed6eb0817cb006f7f2cc5
Opcode Fuzzy Hash: 0fa008b4d3fbaecb020027ebd69bd6ca7320cd4bd33cd7313f79e1f8cd26c99a
Instruction Fuzzy Hash: 3CE0C971A053109BCB10DE58C9C5B5637D8AB09754F0449A1FD28DF246D371D91087D1

Function 00BAE2E8 Relevance: 3.1, APIs: 2, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,00BAE401,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00BAE48A,00000000,?,00000105), ref: 00BAE393
GetSystemDefaultUILanguage.KERNEL32(00000000,00BAE401,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00BAE48A,00000000,?,00000105), ref: 00BAE3BB

Memory Dump Source

Source File: 0000000B.00000002.2915751656.0000000000BA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000B.00000002.2915686943.0000000000BA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916085519.0000000000D9F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916141535.0000000000DA0000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916210506.0000000000DA1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916275607.0000000000DA3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916339289.0000000000DA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916402927.0000000000DAB000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916467728.0000000000DAE000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916531022.0000000000DAF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB2000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ba0000_PlanSwift.jbxd

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: cea94f174a0cb28e3962ef50ac285d3e41f87af1fe8ea476a28dabcbe7e8670d
Instruction ID: cf3f08d5399e4de043710c9475c13df7a3254f1b6285d1c914408ce1ed6bbd5c
Opcode Fuzzy Hash: cea94f174a0cb28e3962ef50ac285d3e41f87af1fe8ea476a28dabcbe7e8670d
Instruction Fuzzy Hash: A5314D30A18219AFDF11EB94C891BAEB7F9EF4A300F5044E6E420A7251DB74EE45CB55

Function 00BA9817 Relevance: 1.6, APIs: 1, Instructions: 59
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00BA983F

Memory Dump Source

Source File: 0000000B.00000002.2915751656.0000000000BA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000B.00000002.2915686943.0000000000BA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916085519.0000000000D9F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916141535.0000000000DA0000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916210506.0000000000DA1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916275607.0000000000DA3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916339289.0000000000DA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916402927.0000000000DAB000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916467728.0000000000DAE000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916531022.0000000000DAF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB2000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ba0000_PlanSwift.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: d1335bdbdd1032465a85e6b5b7a60ab6b926364fdc594f612f6253f9d1766413
Instruction ID: 1b2a9973d90c9c80dc59fe64a1b8c0aa88d1020b2218832aa11cf85bde04f71d
Opcode Fuzzy Hash: d1335bdbdd1032465a85e6b5b7a60ab6b926364fdc594f612f6253f9d1766413
Instruction Fuzzy Hash: 462103B5508204CFCF18CF68D8806997BE0FB5A310B5885AAE8199F356D735D982DB64

Function 00BAFE48 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32 ref: 00BAFE4C

Memory Dump Source

Source File: 0000000B.00000002.2915751656.0000000000BA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000B.00000002.2915686943.0000000000BA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916085519.0000000000D9F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916141535.0000000000DA0000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916210506.0000000000DA1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916275607.0000000000DA3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916339289.0000000000DA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916402927.0000000000DAB000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916467728.0000000000DAE000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916531022.0000000000DAF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB2000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ba0000_PlanSwift.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: de8292ca15932d7318cf9a9a3e48783e150fe25b39319a317a2599aa1258d1fe
Instruction ID: ad0181ab6d7ee51c697dfe85225be2ee274ea1ede3550e84654e799b0cb5043f
Opcode Fuzzy Hash: de8292ca15932d7318cf9a9a3e48783e150fe25b39319a317a2599aa1258d1fe
Instruction Fuzzy Hash: 60A0123040C9000AC404A7184C4354B31D01941210FC40250745C99282E60596A402D7

Function 00BA5664 Relevance: 1.3, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004), ref: 00BA567B

Memory Dump Source

Source File: 0000000B.00000002.2915751656.0000000000BA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000B.00000002.2915686943.0000000000BA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916085519.0000000000D9F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916141535.0000000000DA0000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916210506.0000000000DA1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916275607.0000000000DA3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916339289.0000000000DA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916402927.0000000000DAB000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916467728.0000000000DAE000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916531022.0000000000DAF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB2000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ba0000_PlanSwift.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6c9b5a8db3a5be1bb9e785b12dfa918c64e038a88451fa9ad4d9f64f52096c27
Instruction ID: b4fbc4d56477bed57a9cd19f3ab547837d2fb0741e7ef02b3af01f999bdcfe27
Opcode Fuzzy Hash: 6c9b5a8db3a5be1bb9e785b12dfa918c64e038a88451fa9ad4d9f64f52096c27
Instruction Fuzzy Hash: 0EF049F3B053218FD7249F789D41741BAE9E74A350F19827EE949EB794DBB1C8048BA0

Function 03D6C9A0 Relevance: .1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 542c247db0f167bcb31de85df75f0daed541b463d0f9d6ed33cc9aa2b9678f81
Instruction ID: 74226a74d85bcdf1bc40ec8dc696d37c6d5ee1ea28fda0677b2c03de7f7c2901
Opcode Fuzzy Hash: 542c247db0f167bcb31de85df75f0daed541b463d0f9d6ed33cc9aa2b9678f81
Instruction Fuzzy Hash: D9215EF6524301AFD710DAB1FCC1A6B374CEB1A210F09416AEDEADB201DB35D84A85F1

Function 03FF8580 Relevance: .1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07182ce1678c6037036f045c81a120cbbe28c99568daa367f75b90b700c0e79a
Instruction ID: e25333d2dcf9527724877a5f36d2ebae5d5a204d916cdb601c9ae05385a3830e
Opcode Fuzzy Hash: 07182ce1678c6037036f045c81a120cbbe28c99568daa367f75b90b700c0e79a
Instruction Fuzzy Hash: DA31FB31D0010A9FCF20DF58C9846ADB775BF413A4F1D82A4D9256B2A5D770AE41CF94

Function 03FE36F0 Relevance: .1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7e7794acb52784347656cdb3415140609369927540d5cf3aaff143e0d6077c0
Instruction ID: bf1e0a9f02d3daa9d3f8f8297cd089c784a8b701c11132ebab1679a54447a7f7
Opcode Fuzzy Hash: a7e7794acb52784347656cdb3415140609369927540d5cf3aaff143e0d6077c0
Instruction Fuzzy Hash: DA112B75F5430DABEB10EB91CC4ABAEBBB8EF45324F14405AE9017B281E77099408F95

Function 03D96974 Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f19849840fb79a3de8df6837af7ceb238c7f30fd481ea0529e2bfcda1f4d74b0
Instruction ID: 6ed0d3335c365f7775e8c1f2ec5cb93f27c0a91e6bed7433bcd22205baa05411
Opcode Fuzzy Hash: f19849840fb79a3de8df6837af7ceb238c7f30fd481ea0529e2bfcda1f4d74b0
Instruction Fuzzy Hash: 5C019EB2504310BAEF29EE19E880B67FB9C9F44A70F08419BEC088F286D630D951C7B1

Function 03D6C954 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8f7344a3f2b902ea30f12b5e56d232c65c35ab766358ca0d7256a928a53d1da
Instruction ID: f830844fe1a90799259c20b7a2fb40e66cb93b49b5231881e49773f0bdb2d8a8
Opcode Fuzzy Hash: f8f7344a3f2b902ea30f12b5e56d232c65c35ab766358ca0d7256a928a53d1da
Instruction Fuzzy Hash: E5E0E5EAA303193BAB20A9212C8087B670CC8628E77081023ECAE6B200E511D80642F1

Function 03E1B9CC Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 619cf464156506ac2e2c76c0961941f6d9e4f582d68298c9c523b5c61042b40b
Instruction ID: 55de0182678fc297493d6dc77165aa0fe2a1fa27d6355d46f38e81ec298adbe0
Opcode Fuzzy Hash: 619cf464156506ac2e2c76c0961941f6d9e4f582d68298c9c523b5c61042b40b
Instruction Fuzzy Hash: 81F05475A042098AC750DF99D9806EEBBF8EF48724F14527AE909B7340E7345D1086A9

Function 03D9690C Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5996966773e890e8b376135e61546f77766fbadb2a8089ebc9ad3b5f24b006a6
Instruction ID: 99b084ee17a4f3ef2cc3a8b16ba084a75187f577ccbe5e0e373ae6f0c11dd67f
Opcode Fuzzy Hash: 5996966773e890e8b376135e61546f77766fbadb2a8089ebc9ad3b5f24b006a6
Instruction Fuzzy Hash: BCE0D8757142043BEF18CE68A850B3FB3DD8780A30F1CC05BF40D8B241E531E80043A0

Function 03FD71E0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6d9d580a02dad6fdba3191fe1b239752b13d85f1d4a9f551a8197784e3e85a6
Instruction ID: 1a8883cad2e758a2454886fce1523c0a6e33b6794b20b54cc0fc681cc660c1a2
Opcode Fuzzy Hash: f6d9d580a02dad6fdba3191fe1b239752b13d85f1d4a9f551a8197784e3e85a6
Instruction Fuzzy Hash: BCD05E3660474D4BD610EE599DC0A5AF3DCAB49120F144365FD0CAA741EF25980144A9

Function 03FD71B8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e31d1700c1086e2a575521674e6c601902ceb6e24e2c1c36fdc646ffb6aabd8e
Instruction ID: 01cd2b85ce9e20b85d950977edcb2e0be6f885a5f3dcfcc7953726341661fe3e
Opcode Fuzzy Hash: e31d1700c1086e2a575521674e6c601902ceb6e24e2c1c36fdc646ffb6aabd8e
Instruction Fuzzy Hash: 1BD0C93A60464C8BC614EF98AD4269AB7A99789620F104359B90C9B780EE36A91186DE

Function 03FE36C8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10fb23386117772976ca22658b9acdd4f21e70cec59c546fd8102d47b5baaf55
Instruction ID: bf4a282c03361cc8030da99fba0433ce89cb6d07b4c1d4c88ab13a522ae9f576
Opcode Fuzzy Hash: 10fb23386117772976ca22658b9acdd4f21e70cec59c546fd8102d47b5baaf55
Instruction Fuzzy Hash: 52D01239A4470C4FC754FFA8AC45A9E73A8D749610F1043A9BD4C9B780EF35AD1146DE

Function 03FEC4B4 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e954c101fe49595463546b29f4174f07afc82987666fd74f5f214f9ba6be9e6
Instruction ID: b351c7071d449d8b3d5998a59dde3f93fa0dd2403ec331ab6ec28d9aa91f5d98
Opcode Fuzzy Hash: 6e954c101fe49595463546b29f4174f07afc82987666fd74f5f214f9ba6be9e6
Instruction Fuzzy Hash: 2FB0127214830C9B9E005BDCF40ECC537DCD6485217000001F50C83200DA35F88046A4

Function 03FEC4A4 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffc11a369a05fcba4b00303fd86378de1e4f477ca90c0f7f4fc54dd9302cf493
Instruction ID: dabe34e30d1459270ab986661478669363d962e0e608ba13bc319ec8e7232993
Opcode Fuzzy Hash: ffc11a369a05fcba4b00303fd86378de1e4f477ca90c0f7f4fc54dd9302cf493
Instruction Fuzzy Hash: 0DB0127214830C9B9F005BDCF40EC8577DCD6485117004001F50C83101DA35F8404694

Non-executed Functions

Function 00BADAEC Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?), ref: 00BADB09
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 00BADB1A
FindFirstFileW.KERNEL32(?,?,kernel32.dll,?,?,?), ref: 00BADC1A
FindClose.KERNEL32(?,?,?,kernel32.dll,?,?,?), ref: 00BADC2C
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,?,?,?), ref: 00BADC38
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,?,?,?), ref: 00BADC7D

Strings

GetLongPathNameW, xrefs: 00BADB14
kernel32.dll, xrefs: 00BADB04
\, xrefs: 00BADC4A

Memory Dump Source

Source File: 0000000B.00000002.2915751656.0000000000BA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000B.00000002.2915686943.0000000000BA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916085519.0000000000D9F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916141535.0000000000DA0000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916210506.0000000000DA1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916275607.0000000000DA3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916339289.0000000000DA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916402927.0000000000DAB000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916467728.0000000000DAE000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916531022.0000000000DAF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB2000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ba0000_PlanSwift.jbxd

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: 7efb17de8dea52400cfd664a6452991fa3a78da459232f72481d6b92ab15af0f
Instruction ID: 698387a6075fd76c2c9b5dc3cfeea0e7390ab72ff35992e9ecaf2bd7516e4a51
Opcode Fuzzy Hash: 7efb17de8dea52400cfd664a6452991fa3a78da459232f72481d6b92ab15af0f
Instruction Fuzzy Hash: 01419F31E086189BCB10EBA8CC85ADEB3F5EF46320F9449E4D546E7650F774AE45CB50

Function 03951467 Relevance: 2.5, APIs: 2, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,000000BC), ref: 0395148B
HeapAlloc.KERNEL32(00000000,00000008,000000BC), ref: 03951491

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 50f7028c35a1b61bbe13217ff4a7012edc3c4f4fc288c4976b6d2222d74047b4
Instruction ID: 0aecf2acc596a45d5850b7063f5658adf88a0d03dac0203c4e0356bc73ea4ba0
Opcode Fuzzy Hash: 50f7028c35a1b61bbe13217ff4a7012edc3c4f4fc288c4976b6d2222d74047b4
Instruction Fuzzy Hash: 88E012146543056FEE64FE75EC15F3A354EDF8075AF041039FE05986F8CA544C815722

Function 0395520C Relevance: 1.5, APIs: 1, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a32928bfe03afc054996ef89c6eb11bf3321eb5fcdef7b74521f72c749c047a5
Instruction ID: 7332d249d5552b87d8243fd2f54826506536a4b67fdea7a32a004b8e64b55c7b
Opcode Fuzzy Hash: a32928bfe03afc054996ef89c6eb11bf3321eb5fcdef7b74521f72c749c047a5
Instruction Fuzzy Hash:

Function 03955214 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

$, xrefs: 03955236

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 3d0ecf980193afa18108046e7d9ededf159eb702405c5e2ff797d1e63bb3346e
Instruction ID: d46fc7e106b7270a99bafa3482e5e566b219ea7bbf4e7576d52f5e82aa353572
Opcode Fuzzy Hash: 3d0ecf980193afa18108046e7d9ededf159eb702405c5e2ff797d1e63bb3346e
Instruction Fuzzy Hash: 1BF01C75E14609DFCB10CFD9C880A9EB7F8EF19700F108169EA05AB350EB755A148B95

Function 03955504 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e059b712c0c180db383de19315e9de6b22f5fd69dce81654c3328f1ec28175e4
Instruction ID: d918fae9f2e21b06256a230f806757bae8acd670e099b66ec584f5d6fe8ba7ce
Opcode Fuzzy Hash: e059b712c0c180db383de19315e9de6b22f5fd69dce81654c3328f1ec28175e4
Instruction Fuzzy Hash: F7E092722242186BDB10DD64AC80AA7338EDF06190F074865FD0BD7202E561D98247B0

Function 039553C0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fe6b744086aca4bd46417ea872f0823f9dcb8d10b9e7cbdb1819dd9c30a271f
Instruction ID: 060dad0856ba9bc2d798e089835f9e36e70b79c7d8b14a9381fdbb6632bca130
Opcode Fuzzy Hash: 1fe6b744086aca4bd46417ea872f0823f9dcb8d10b9e7cbdb1819dd9c30a271f
Instruction Fuzzy Hash: 9BE04871618254EBDB10DA695D80AAB775CDF665E4B054875BD0B8B203E2F5D88047E0

Function 0395560C Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44ceb1d067af3574923224377556129f5b76340c6f77a55af53615fcb3e2341a
Instruction ID: b7d86e4c35d5f9b9ec8060d9b8a4e877e3ec89c9da50c3fe98157ad75f2c23d9
Opcode Fuzzy Hash: 44ceb1d067af3574923224377556129f5b76340c6f77a55af53615fcb3e2341a
Instruction Fuzzy Hash: 44E04871617395ABDB10EDA45CC0EBB734C9B066E0F164826BD03D7202D161DC8043E1

Function 03955544 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dabe77cf083483dcc45e3f8fbe9b90e702261555cd2f02d26dfc0deaf3db828f
Instruction ID: a84d9ff90df09ece65a454c1ab9d28e6ce7955949332d25303b2ba8846479748
Opcode Fuzzy Hash: dabe77cf083483dcc45e3f8fbe9b90e702261555cd2f02d26dfc0deaf3db828f
Instruction Fuzzy Hash: 2BE08071A252146BDB10DD78DC80FA7774DDF175D4B068825FD0797213D161E98243E0

Function 03955324 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ef5d84182367f99610fa49af7f578a355782a588d6b1eff1ef065c276bf6373
Instruction ID: 2682bd8c8c8e21e0e41adb1e7269d44bef890371d4371f381eee1074351c6f8e
Opcode Fuzzy Hash: 1ef5d84182367f99610fa49af7f578a355782a588d6b1eff1ef065c276bf6373
Instruction Fuzzy Hash: 07E086B2609225E79A10D9655C80AAB674CDB225E4F0E1831FD0F9B203E2B1E88483E4

Function 039552EC Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b991a3f0cab8c6dd6262521faabbef83141db8600f90361b07bb119e04350e0
Instruction ID: 83e98f8a1b5ab6fb8140091f4d4e66efe0a485ca9345683b4dea221f27c1c81e
Opcode Fuzzy Hash: 6b991a3f0cab8c6dd6262521faabbef83141db8600f90361b07bb119e04350e0
Instruction Fuzzy Hash: B6E08621638318A7DA20D9755C80AAB7B4C9B221E4F0A0861BC0FD7207D1B2D88453E0

Function 039556A4 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43a5ac6aece3ba0ef109c09d01131bc97853fbe24d815180d4e345381db99bbc
Instruction ID: 98484bc68d1d4964804789fb9b6f1d05524f9827a496572b650435e2b365c4f8
Opcode Fuzzy Hash: 43a5ac6aece3ba0ef109c09d01131bc97853fbe24d815180d4e345381db99bbc
Instruction Fuzzy Hash: F9E0866160B2A867DA50FA655C80AA7674CBB121F1B160C21FD079F302E191D88083E0

Function 039554CC Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cf27228b343c97063d0d10555fd3bc4b8ad077cf0132a12dfc7aaf742a39a2b
Instruction ID: 7338450f097ec4d3f3687c1a9a5190d33df05715f4aaea3d5f17f9184a47721c
Opcode Fuzzy Hash: 0cf27228b343c97063d0d10555fd3bc4b8ad077cf0132a12dfc7aaf742a39a2b
Instruction Fuzzy Hash: B8E086627182546ADA60DE6F5C80AAB774C9F035F3B068821BC079B703D111D89043E0

Function 0395538C Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bace827b1c932ef89f81b6a110161f43d23dee4baf0674646a114db66be0061
Instruction ID: cb5bf28bda481551d60358565d4d8cf4687901a8947c0cb2a4e104be42958dd0
Opcode Fuzzy Hash: 5bace827b1c932ef89f81b6a110161f43d23dee4baf0674646a114db66be0061
Instruction Fuzzy Hash: 63E0ECB2219205EBD700DE959C80E6BB75C9B651A4F458929BD0A87307E5B1D49087A0

Function 03955740 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec397fc81dc88827c67c3ad3cfd8fc20cd2a579ff0808064eea7a1521d7de782
Instruction ID: 611c5393cac051a2e9718cd2cfe6731f612832852b4a46d7ad81676de7aa739c
Opcode Fuzzy Hash: ec397fc81dc88827c67c3ad3cfd8fc20cd2a579ff0808064eea7a1521d7de782
Instruction Fuzzy Hash: 7DE01276214314EBD700DE59EDC0F6B775CAB56950F098929BD1BC7243F561EA908360

Function 039556DC Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d650f3e8fbf64bcaae360475f53cca4ff6f69d1b9f9c1cf545e90cfebf4b158d
Instruction ID: 52c6a48c7a093fc87279e238d17cce4bf6a48fef1819d5091e19605b615e036d
Opcode Fuzzy Hash: d650f3e8fbf64bcaae360475f53cca4ff6f69d1b9f9c1cf545e90cfebf4b158d
Instruction Fuzzy Hash: BDE0C271214204EBDB00DE99DCC0F6B738C9B05554F048829FD0687212F171E4908B60

Function 03955438 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3b14097c162e87bb88f951b86cdea19c035a3080621912ded8d883343448cf4
Instruction ID: 32e91c7fded3c4777c2d3662f24586326de41b9afe8ba0f3ef3cb9d79fd0e07a
Opcode Fuzzy Hash: c3b14097c162e87bb88f951b86cdea19c035a3080621912ded8d883343448cf4
Instruction Fuzzy Hash: D4E01272208244ABD700DE96ECC0FA7735CAB59656F494829BD0A8B203E575D89587A1

Function 0395579C Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c7bf2b33ada3ffbcfe3a0a166cfd9bda07825ee0ec4754ebc4f2100aff782f0
Instruction ID: ff74a09c7e7136e67c3a5a46a693d120788e197762baf68430871cdea12883d5
Opcode Fuzzy Hash: 1c7bf2b33ada3ffbcfe3a0a166cfd9bda07825ee0ec4754ebc4f2100aff782f0
Instruction Fuzzy Hash: 3BD05EB6208308AAEB00E9699CC0E67735C9756A90F058835BD0A8A202E562D48847A1

Function 03955710 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d003c123f7a5da288dd5456d757308f0c80de32866c22fd50574dbeba9fadd1
Instruction ID: 49a8893ca1dbf473f21af590b875f99dec446802f1aa82a5472e3071ea13f076
Opcode Fuzzy Hash: 6d003c123f7a5da288dd5456d757308f0c80de32866c22fd50574dbeba9fadd1
Instruction Fuzzy Hash: BBD0A575204314F7D740DD5DACC0E67774C9755174F468465FD0787603E121E7954371

Function 03955280 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2577b8e6ff4c0cdda8c131a408ab8e30d2b3c95b5942a8eeffbc351a47a2ac0
Instruction ID: b980e0c7d8290fbf11586a8de743549ea48b30267747364df9edb5829e1562a4
Opcode Fuzzy Hash: f2577b8e6ff4c0cdda8c131a408ab8e30d2b3c95b5942a8eeffbc351a47a2ac0
Instruction Fuzzy Hash: 50D022B120C3062ED600F8A6ECC0E23B34C87333E0B090832BD038AA03D992C2C04360

Function 03955774 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06aac5363fe06e030781d56046f9c9aba5fb65565c20a601f1ed95cef651db78
Instruction ID: 38b9c05c00ca7a2eb6afda3d43ac75bf6e947752c6867dbf3e7981e5e02ebb28
Opcode Fuzzy Hash: 06aac5363fe06e030781d56046f9c9aba5fb65565c20a601f1ed95cef651db78
Instruction Fuzzy Hash: 80D0C965258309AAD640D96D9CC0A66AB5D9B171A4B450876BD0B8A247E952D4C04670

Function 039555A0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd2d6beb317b7d8f3efefddd770a10261abb3544a8487510f041d2ad67009c35
Instruction ID: 34d5f5f268ed56064e74e7cbf69b4abefee837473a2c32e7834b7462a5ecf56e
Opcode Fuzzy Hash: dd2d6beb317b7d8f3efefddd770a10261abb3544a8487510f041d2ad67009c35
Instruction Fuzzy Hash: A9D05EB12117297BCB14DE49CCC4DAB376DAF496A0B09810CBE0657301DAB0FC4087F0

Function 0395546C Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61d6e4e88802e80629d85ed2bbf248e9fc34d584a689f700aef053ca893fb420
Instruction ID: 155f41a22a96aad192fe4f445248f5493479a753d24fbd05fb99a92a25f6d584
Opcode Fuzzy Hash: 61d6e4e88802e80629d85ed2bbf248e9fc34d584a689f700aef053ca893fb420
Instruction Fuzzy Hash: 14D022B12093093ED600DC7BACC0A33B34C87031E3B054A32BF038B203E512C0C04260

Function 039555E4 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf454b672dfab0893b91fc6fca454f923fde0de7fee1ccc1f531e46314f6b3ad
Instruction ID: a456f90372fbf349ed7f136c33cdadb710b8c62a3676aeb58f782a92373a8035
Opcode Fuzzy Hash: cf454b672dfab0893b91fc6fca454f923fde0de7fee1ccc1f531e46314f6b3ad
Instruction Fuzzy Hash: 39D05EB22002096B8B00DE99EC40C6B33AD9B88644B048908BD0A87202E230E86087A1

Function 039552A8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2036ca7b8216146a4c268c37841a9e0ef39b0fa75b2b8b9786fdca56e058ea2f
Instruction ID: fa96429be361ecd18e9e05f7c498dba9ab9caaf2356c9fe54b78139e196be0b4
Opcode Fuzzy Hash: 2036ca7b8216146a4c268c37841a9e0ef39b0fa75b2b8b9786fdca56e058ea2f
Instruction Fuzzy Hash: DED02230508309AAEB10DC659D48B7633AD8792754F49C023BC078E603E232E4C88BA2

Function 039553FC Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc8accdaf42dcca9bb49ecc5ea329e2b81d54ba1c6f570fd6084b0718c514e75
Instruction ID: da0cafd28249d8292194272cccaa3a8dc8e2efecf1376c02f15b8196062752ad
Opcode Fuzzy Hash: bc8accdaf42dcca9bb49ecc5ea329e2b81d54ba1c6f570fd6084b0718c514e75
Instruction Fuzzy Hash: 8AD0C9716113287B9B20DD568CC0DAB3B5CAE86AE5B098058FD055B202D670EC4087E0

Function 03955648 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af4bb7077998787c6864321ff43fc833e0c6ac9d31f1e2b28bad53ffe3595629
Instruction ID: a32a95cae6862f948902a27aa7d59c7441492e54143221a6226cfd03dd4c4854
Opcode Fuzzy Hash: af4bb7077998787c6864321ff43fc833e0c6ac9d31f1e2b28bad53ffe3595629
Instruction Fuzzy Hash: 77D0C9A16033687B9B10ED55CCC0DAB375C9F46AA075A8055BD152B202C6B0ED4047E0

Function 03955684 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e29684e61f994664b55592ee296ff31535862f85cf7cfc80f7fe2c877cef5415
Instruction ID: 374fe36c4bbf66a14441e9e81b2d4e01eedeaddc856321112e1213573f19077c
Opcode Fuzzy Hash: e29684e61f994664b55592ee296ff31535862f85cf7cfc80f7fe2c877cef5415
Instruction Fuzzy Hash: 24C08C7266230D6BDB00F9A89C41D2B73AC5B94AA0F05C821BD0ACB205F130F9A047B0

Function 03955580 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc8471ee38388d847dbb0bf5a3fb483c30895ddb46af2ac4baffac0b7bd1347a
Instruction ID: ed761b51d0755c8cafaab257a7209b9a6e6b4ddc88ce9a495ef5dd4d2a754e95
Opcode Fuzzy Hash: dc8471ee38388d847dbb0bf5a3fb483c30895ddb46af2ac4baffac0b7bd1347a
Instruction Fuzzy Hash: C1C0807162430C6BD700DD649C41C2733AD5754690714C861FD06CB201F130F55553F0

Function 03955494 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba9a60030061522f416ae02a65208b9ca992d3d9ec7db9d0858520ccb5314268
Instruction ID: 3548a982d13c92dc6351888a80d0adb71050907f3e112ef1febb9b5401d20174
Opcode Fuzzy Hash: ba9a60030061522f416ae02a65208b9ca992d3d9ec7db9d0858520ccb5314268
Instruction Fuzzy Hash: BCC002A56117287B9A61ED57C9C0E9B3B5DAE06AF670A8055BE062B2039660AD4086E0

Function 039552D0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58633952934008c28a84d785b252eb9ac1fed106f2d76382c863a5f12c06120d
Instruction ID: 12a0669a17a93981d13c6e27762119c1f088761b6b107fc8f24b9b3c813370df
Opcode Fuzzy Hash: 58633952934008c28a84d785b252eb9ac1fed106f2d76382c863a5f12c06120d
Instruction Fuzzy Hash: 21C02B3150C3080A8510DA7C7840C277BCC0B117F43148B13BD22C71C1E970F490535C

Function 0395535C Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c305cef7b487dd97b4b1b9783f2c17f7d0fc56965fae5c877b3f58eefb9e249
Instruction ID: da9f1c21c65bdf3e5eb81cc32faf1e6ccdde5e71d9132e0d2fd4439e9cf8f38b
Opcode Fuzzy Hash: 7c305cef7b487dd97b4b1b9783f2c17f7d0fc56965fae5c877b3f58eefb9e249
Instruction Fuzzy Hash: 09C09BB4204708779700EF56CDC0D5F775CAB59950B44C418FE090B203D574E94147F0

Function 00BAD9A4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00DA8C10,00000000,00BADAAA,?,?,?,00000000,?,00BAE3A0,00000000,00BAE401,?,?,00000000,00000000,00000000), ref: 00BAD9C2
LeaveCriticalSection.KERNEL32(00DA8C10,00DA8C10,00000000,00BADAAA,?,?,?,00000000,?,00BAE3A0,00000000,00BAE401,?,?,00000000,00000000), ref: 00BAD9E6
LeaveCriticalSection.KERNEL32(00DA8C10,00DA8C10,00000000,00BADAAA,?,?,?,00000000,?,00BAE3A0,00000000,00BAE401,?,?,00000000,00000000), ref: 00BAD9F5
IsValidLocale.KERNEL32(00000000,00000002,00DA8C10,00DA8C10,00000000,00BADAAA,?,?,?,00000000,?,00BAE3A0,00000000,00BAE401), ref: 00BADA07
EnterCriticalSection.KERNEL32(00DA8C10,00000000,00000002,00DA8C10,00DA8C10,00000000,00BADAAA,?,?,?,00000000,?,00BAE3A0,00000000,00BAE401), ref: 00BADA64
LeaveCriticalSection.KERNEL32(00DA8C10,00DA8C10,00000000,00000002,00DA8C10,00DA8C10,00000000,00BADAAA,?,?,?,00000000,?,00BAE3A0,00000000,00BAE401), ref: 00BADA8D

Strings

en-GB,en,en-US,, xrefs: 00BAD9D2, 00BADA79

Memory Dump Source

Source File: 0000000B.00000002.2915751656.0000000000BA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000B.00000002.2915686943.0000000000BA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916085519.0000000000D9F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916141535.0000000000DA0000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916210506.0000000000DA1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916275607.0000000000DA3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916339289.0000000000DA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916402927.0000000000DAB000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916467728.0000000000DAE000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916531022.0000000000DAF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB2000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ba0000_PlanSwift.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-GB,en,en-US,
API String ID: 975949045-3021119265
Opcode ID: 67c4a9cf504598597a740787be338d3ebe7de038038fc863bbe04e90fe1b706f
Instruction ID: 2541900c62fd69dc597c18bbf053200bc0358c9be00ad4cd28cafe7ea0ab1d4c
Opcode Fuzzy Hash: 67c4a9cf504598597a740787be338d3ebe7de038038fc863bbe04e90fe1b706f
Instruction Fuzzy Hash: 5321C62074C6007ADB20B768DC5376D21D4DB4B710F9048E1F502D6AD2EDB48D45DA72

Function 00BA875C Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 64libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 00BA8771
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00BA8777
GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00BA878A
GetLastError.KERNEL32(00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00BA8797
GetLogicalProcessorInformation.KERNEL32(?,?,00000000,00BA8810,?,00000000,?,00000000,kernel32.dll,GetLogicalProcessorInformation), ref: 00BA87C2

Strings

kernel32.dll, xrefs: 00BA876C
GetLogicalProcessorInformation, xrefs: 00BA8767
@, xrefs: 00BA8817

Memory Dump Source

Source File: 0000000B.00000002.2915751656.0000000000BA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000B.00000002.2915686943.0000000000BA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916085519.0000000000D9F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916141535.0000000000DA0000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916210506.0000000000DA1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916275607.0000000000DA3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916339289.0000000000DA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916402927.0000000000DAB000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916467728.0000000000DAE000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916531022.0000000000DAF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB2000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ba0000_PlanSwift.jbxd

Similarity

API ID: InformationLogicalProcessor$AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 1184211438-79381301
Opcode ID: a93e3521528773c51c5656e0b1e90ae03a7448f0172e7ba02be685309b4e1028
Instruction ID: 1a97d58791ede6b86d8445e7370e23bcd3b020f26be5c1440b19e321b96d5fa6
Opcode Fuzzy Hash: a93e3521528773c51c5656e0b1e90ae03a7448f0172e7ba02be685309b4e1028
Instruction Fuzzy Hash: 13118171D08208AEDB21EBA4C842BADB7F4EF46300F5484E6E414E3941EF788E40CB51

Function 00BB14A8 Relevance: 13.8, APIs: 9, Instructions: 258COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BB1560

Memory Dump Source

Source File: 0000000B.00000002.2915751656.0000000000BA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000B.00000002.2915686943.0000000000BA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916085519.0000000000D9F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916141535.0000000000DA0000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916210506.0000000000DA1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916275607.0000000000DA3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916339289.0000000000DA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916402927.0000000000DAB000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916467728.0000000000DAE000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916531022.0000000000DAF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB2000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ba0000_PlanSwift.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 31442451f6383d6e98b2fa5ce03c82a4205c21ad7ebdfe0fad95b1017a5cc83a
Instruction ID: e3aa0e5ea7feeb32159d222cb522fd1b175b42d0ec5c4b894d53fce73b79f982
Opcode Fuzzy Hash: 31442451f6383d6e98b2fa5ce03c82a4205c21ad7ebdfe0fad95b1017a5cc83a
Instruction Fuzzy Hash: 08A15C75A003099FDB10DFE8D8A1BEEB7F5EF98300F548569E915A7380DBB0A941CB60

Function 03FF979B Relevance: 12.6, Strings: 10, Instructions: 106COMMON

Download Yara Rule

Strings

(ctorMask & 0x0100) != 0 || (ctorMask & 0x0020) == 0, xrefs: 03FF97BE
xx.cpp, xrefs: 03FF97D5
xx.cpp, xrefs: 03FF983C
xx.cpp, xrefs: 03FF9892
!"what?", xrefs: 03FF9841
!"what?", xrefs: 03FF9897
(ctorMask & 0x0080) == 0, xrefs: 03FF97DA
what?, xrefs: 03FF982E
what?, xrefs: 03FF9884
xx.cpp, xrefs: 03FF97B9

Memory Dump Source

Source File: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID: !"what?"$!"what?"$(ctorMask & 0x0080) == 0$(ctorMask & 0x0100) != 0 || (ctorMask & 0x0020) == 0$what?$what?$xx.cpp$xx.cpp$xx.cpp$xx.cpp
API String ID: 0-3537565528
Opcode ID: d630f0753c8ffb029d54ec9509ebf00dd63693b127b67adb1b2b911a467c1275
Instruction ID: ea61729736a479de92e5e0902af763529238e9d68834f007d15190de63def077
Opcode Fuzzy Hash: d630f0753c8ffb029d54ec9509ebf00dd63693b127b67adb1b2b911a467c1275
Instruction Fuzzy Hash: AD21E632B65356FFDF109F258E4AB6B6A28AFC1618F8C0150FF15561E2E7F26400C99A

Function 00BA5EFC Relevance: 10.9, APIs: 7, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2915751656.0000000000BA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000B.00000002.2915686943.0000000000BA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916085519.0000000000D9F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916141535.0000000000DA0000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916210506.0000000000DA1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916275607.0000000000DA3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916339289.0000000000DA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916402927.0000000000DAB000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916467728.0000000000DAE000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916531022.0000000000DAF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB2000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ba0000_PlanSwift.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15b3be204a8e9046d0ce2288fe35ae68b71ccd2f2f511c99820b8497e42be1ce
Instruction ID: ed238927d006f744b0a90fcbd580ace717c71ad7069591ff3c49aaad942d2681
Opcode Fuzzy Hash: 15b3be204a8e9046d0ce2288fe35ae68b71ccd2f2f511c99820b8497e42be1ce
Instruction Fuzzy Hash: 63B1F5B2708B004FD7249A7CDC8576EB7C6DBC6321F2C82B9E254CB396DA79CA458350

Function 03FF9A0F Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 288COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(0EEDFADE,00000001,00000008,?,00000004,?,?,?,?,?,?,00000004,04278158,00000000,?), ref: 03FF9B89

Part of subcall function 03FEE620: RaiseException.KERNEL32(0EEDFAE6,00000000,8274C087,558BC68B,00000000,?,03FF9CDE,00000001,0000000B,-00000005,00000000,00000000,03FD7310,03FE3780,5317FF02,008D17E8), ref: 03FEE635

RaiseException.KERNEL32(0EEFFACE,00000001,00000003,00000000), ref: 03FF9D72

Strings

xx.cpp, xrefs: 03FF9A88
cctrAddr, xrefs: 03FF9CF7
xx.cpp, xrefs: 03FF9CF2
typeID || (reThrow && (flags & XDF_ISDELPHIEXCEPTION)), xrefs: 03FF9A8D

Memory Dump Source

Source File: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID: ExceptionRaise
String ID: cctrAddr$typeID || (reThrow && (flags & XDF_ISDELPHIEXCEPTION))$xx.cpp$xx.cpp
API String ID: 3997070919-2095381217
Opcode ID: 8d2d2be7e5f490c1e8da4d87d80bd924b851ba9e5dba7c05b5a0acc9221c2570
Instruction ID: 6f168ecb7a3efab0dba3af63abc1a8280755929979019c998020e5b8ccd8d86a
Opcode Fuzzy Hash: 8d2d2be7e5f490c1e8da4d87d80bd924b851ba9e5dba7c05b5a0acc9221c2570
Instruction Fuzzy Hash: 3EC15975A01209AFCB15DF54D884F9ABBB2BF48714F188158FE096B3A1D771E881CB90

Function 00BA89F0 Relevance: 10.6, APIs: 7, Instructions: 130threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA8EB0: GetCurrentThreadId.KERNEL32 ref: 00BA8EB3

GetTickCount.KERNEL32 ref: 00BA8A27
GetTickCount.KERNEL32 ref: 00BA8A3F
GetCurrentThreadId.KERNEL32 ref: 00BA8A6E
GetTickCount.KERNEL32 ref: 00BA8A99
GetTickCount.KERNEL32 ref: 00BA8AD0
GetTickCount.KERNEL32 ref: 00BA8AFA
GetCurrentThreadId.KERNEL32 ref: 00BA8B6A

Memory Dump Source

Source File: 0000000B.00000002.2915751656.0000000000BA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000B.00000002.2915686943.0000000000BA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916085519.0000000000D9F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916141535.0000000000DA0000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916210506.0000000000DA1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916275607.0000000000DA3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916339289.0000000000DA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916402927.0000000000DAB000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916467728.0000000000DAE000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916531022.0000000000DAF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB2000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ba0000_PlanSwift.jbxd

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: 02ee0b916bcabbbe579f8552b9f39f5c7729f7680f5f595ebead496e0b1343b8
Instruction ID: a1321aafb0a7fd3f886d6b35703c692adc72c655e0562625a02e956f35d496f9
Opcode Fuzzy Hash: 02ee0b916bcabbbe579f8552b9f39f5c7729f7680f5f595ebead496e0b1343b8
Instruction Fuzzy Hash: 4C41907060D7419ED721AF7CC88432EBBD1EF82350F5889ADD4E887A91EF75D8848762

Function 00BA9AC0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,00D9EC48,00000000,?,00BA9B78,?,00DA8B98,00DA8B98,?,?,00D9FC48,00BB14A7,00D9EC48), ref: 00BA9AF9
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,00D9EC48,00000000,?,00BA9B78,?,00DA8B98,00DA8B98,?,?,00D9FC48,00BB14A7,00D9EC48), ref: 00BA9AFF
GetStdHandle.KERNEL32(000000F5,00000000,00000002,00D9EC48,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,00D9EC48,00000000,?,00BA9B78,?,00DA8B98,00DA8B98), ref: 00BA9B1A
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,00D9EC48,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,00D9EC48,00000000,?,00BA9B78,?,00DA8B98), ref: 00BA9B20

Strings

Runtime error at 00000000, xrefs: 00BA9AF2, 00BA9B37
Error, xrefs: 00BA9B32

Memory Dump Source

Source File: 0000000B.00000002.2915751656.0000000000BA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000B.00000002.2915686943.0000000000BA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916085519.0000000000D9F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916141535.0000000000DA0000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916210506.0000000000DA1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916275607.0000000000DA3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916339289.0000000000DA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916402927.0000000000DAB000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916467728.0000000000DAE000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916531022.0000000000DAF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB2000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ba0000_PlanSwift.jbxd

Similarity

API ID: FileHandleWrite
String ID: Error$Runtime error at 00000000
API String ID: 3320372497-2970929446
Opcode ID: 37229cf5cef527473d0f88bc8dd0780b0d1d4cfe36ebf79c28a5ad175cd36449
Instruction ID: 12495740986192cdbbb22ee13b505e824b516388b27b61905d63bf79e1659855
Opcode Fuzzy Hash: 37229cf5cef527473d0f88bc8dd0780b0d1d4cfe36ebf79c28a5ad175cd36449
Instruction Fuzzy Hash: 0DF0BB6168C740BDEF30B3A4AC07F5A22DCC743B15F688297F510D51D2D6A495C9A7B2

Function 03FF7834 Relevance: 9.1, APIs: 6, Instructions: 95filewindowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000080,00000000,-000000F6,?,03FF7996,Abnormal program termination,03FF79F6,0427B418,00000000,-000000F6), ref: 03FF7873
MessageBoxA.USER32(00000000,00000000,00000001,00000000), ref: 03FF78BE
GetStdHandle.KERNEL32(000000F4,00000000,-000000F6,?,03FF7996,Abnormal program termination,03FF79F6,0427B418,00000000,-000000F6), ref: 03FF78CA
WriteFile.KERNEL32(00000000,0427B2FC,00000002,-000000F6,00000000,000000F4,00000000,-000000F6,?,03FF7996,Abnormal program termination,03FF79F6,0427B418,00000000,-000000F6), ref: 03FF78DF
WriteFile.KERNEL32(00000000,00000000,00000000,-000000F6,00000000,00000000,0427B2FC,00000002,-000000F6,00000000,000000F4,00000000,-000000F6,?,03FF7996,Abnormal program termination), ref: 03FF78F4
WriteFile.KERNEL32(00000000,0427B2FF,00000002,-000000F6,00000000,00000000,00000000,00000000,-000000F6,00000000,00000000,0427B2FC,00000002,-000000F6,00000000,000000F4), ref: 03FF7907

Memory Dump Source

Source File: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID: File$Write$HandleMessageModuleName
String ID:
API String ID: 1009477876-0
Opcode ID: 558bac1381a9f94b885a6a9525fe6ca62e9f5146d4c3cdfd278b0394c639dc95
Instruction ID: 316c05eee13a134512a484e554b6e18b9cd8476ff981ecc7c05f89939089880e
Opcode Fuzzy Hash: 558bac1381a9f94b885a6a9525fe6ca62e9f5146d4c3cdfd278b0394c639dc95
Instruction Fuzzy Hash: 4921F535A11307AEE620F6659C8DFAAB72CDF01364F144255FF14A90F0EFB4AD48CAA1

Function 00BA6248 Relevance: 9.1, APIs: 6, Instructions: 51fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00BA626A
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000), ref: 00BA6270
GetStdHandle.KERNEL32(000000F4,00BA53B8,00000000,?,00000000,00000000,000000F4,?,00000000,?,00000000), ref: 00BA628F
WriteFile.KERNEL32(00000000,000000F4,00BA53B8,00000000,?,00000000,00000000,000000F4,?,00000000,?,00000000), ref: 00BA6295
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,00BA53B8,00000000,?,00000000,00000000,000000F4,?,00000000,?), ref: 00BA62AC
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,00BA53B8,00000000,?,00000000,00000000,000000F4,?,00000000), ref: 00BA62B2

Memory Dump Source

Source File: 0000000B.00000002.2915751656.0000000000BA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000B.00000002.2915686943.0000000000BA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916085519.0000000000D9F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916141535.0000000000DA0000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916210506.0000000000DA1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916275607.0000000000DA3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916339289.0000000000DA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916402927.0000000000DAB000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916467728.0000000000DAE000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916531022.0000000000DAF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB2000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ba0000_PlanSwift.jbxd

Similarity

API ID: FileHandleWrite
String ID:
API String ID: 3320372497-0
Opcode ID: 3a02464dea23c26c81eeddf3bcb8753b64f9958f3a9d1b09b55532d8e38a842d
Instruction ID: 08e448e726d866263de537bba0d187485d4af92b209b432afcd2003942dfed72
Opcode Fuzzy Hash: 3a02464dea23c26c81eeddf3bcb8753b64f9958f3a9d1b09b55532d8e38a842d
Instruction Fuzzy Hash: 600168E124C7103EE630F3A89C86F6F66CC9B4B760F204695B918E21D3CA209D9483B6

Function 00BA5980 Relevance: 9.0, APIs: 7, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,FFFFFFDC,00BA594E), ref: 00BA5A37
Sleep.KERNEL32(0000000A,00000000,FFFFFFDC,00BA594E), ref: 00BA5A4D
Sleep.KERNEL32(00000000,?,?,FFFFFFDC,00BA594E), ref: 00BA5A7B
Sleep.KERNEL32(0000000A,00000000,?,?,FFFFFFDC,00BA594E), ref: 00BA5A91

Memory Dump Source

Source File: 0000000B.00000002.2915751656.0000000000BA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000B.00000002.2915686943.0000000000BA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916085519.0000000000D9F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916141535.0000000000DA0000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916210506.0000000000DA1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916275607.0000000000DA3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916339289.0000000000DA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916402927.0000000000DAB000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916467728.0000000000DAE000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916531022.0000000000DAF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB2000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ba0000_PlanSwift.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: c802f06c03a5c14cba380a10d5f195038bb4f8440d5ef72680ad1f68704449d2
Instruction ID: f7fe04d06c9d3197b2de922553923a3eb7a3886b4a6e9864c58af17e5545a0e2
Opcode Fuzzy Hash: c802f06c03a5c14cba380a10d5f195038bb4f8440d5ef72680ad1f68704449d2
Instruction Fuzzy Hash: 1AC10072609B518FCB25CF28D880356BBE1EB87320F1882EED419DB395D770DA81C7A1

Function 00BA5D04 Relevance: 7.7, APIs: 6, Instructions: 196sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,?,00000000,00BA5976), ref: 00BA5D9A
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,00BA5976), ref: 00BA5DB4

Memory Dump Source

Source File: 0000000B.00000002.2915751656.0000000000BA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000B.00000002.2915686943.0000000000BA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916085519.0000000000D9F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916141535.0000000000DA0000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916210506.0000000000DA1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916275607.0000000000DA3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916339289.0000000000DA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916402927.0000000000DAB000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916467728.0000000000DAE000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916531022.0000000000DAF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB2000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ba0000_PlanSwift.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 030bca990f4da84e349e321e44a3dd0f68df51d707c10de2d848033ef4e91dcd
Instruction ID: b5aff68df4f28ed71fda15d2897bdb17f5a9b750f472197a3d018d7883f6129b
Opcode Fuzzy Hash: 030bca990f4da84e349e321e44a3dd0f68df51d707c10de2d848033ef4e91dcd
Instruction Fuzzy Hash: C0617271609B408FD725CF28D989B5ABBD0EB57310F1881EEE8888B396D770DE85C791

Function 03AEC358 Relevance: 6.4, Strings: 5, Instructions: 118COMMON

Download Yara Rule

Strings

uri, xrefs: 03AEC432
name, xrefs: 03AEC40B
AddPerson, xrefs: 03AEC39C
$, xrefs: 03AEC3AC
email, xrefs: 03AEC459

Memory Dump Source

Source File: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID: $$AddPerson$email$name$uri
API String ID: 0-1373300219
Opcode ID: 3b19e3db1a6e318cc12c2b36b30a10b02b1db503ec258f140420e794e5c43720
Instruction ID: 3a79e0ab88be349241b575a8359d9cb04d432ef14fafe50cfb35a001c5f1ce1d
Opcode Fuzzy Hash: 3b19e3db1a6e318cc12c2b36b30a10b02b1db503ec258f140420e794e5c43720
Instruction Fuzzy Hash: E631C8B69403186BCB14FB64EC85EEF736CEF55310F5045A9F908AB240DF34AA588BE5

Function 00BAD888 Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 00BAD899
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 00BAD8F7
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 00BAD954
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 00BAD987

Part of subcall function 00BAD844: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,00BAD905), ref: 00BAD85B
Part of subcall function 00BAD844: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,00BAD905), ref: 00BAD878

Memory Dump Source

Source File: 0000000B.00000002.2915751656.0000000000BA1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00BA0000, based on PE: true

Associated: 0000000B.00000002.2915686943.0000000000BA0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916085519.0000000000D9F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916141535.0000000000DA0000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916210506.0000000000DA1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916275607.0000000000DA3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916339289.0000000000DA5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916402927.0000000000DAB000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916467728.0000000000DAE000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916531022.0000000000DAF000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.2916594353.0000000000DB2000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ba0000_PlanSwift.jbxd

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: c90388e61d617c4b1cb76f550c96addfc1cb7c74564f1403cba95d87c120b5e1
Instruction ID: c562a7b7324f80560082169e9ab77ad0b9c4215effa62bcb7ddceaeebe31b33c
Opcode Fuzzy Hash: c90388e61d617c4b1cb76f550c96addfc1cb7c74564f1403cba95d87c120b5e1
Instruction Fuzzy Hash: 19316F70E0421A9BDF10DFA8C884AAFB7F4FF45314F0041A5E566E7291EB749E05CB60

Function 03FF774C Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,0427B418,00000000,-000000F6,?,?,03FF7946,00000000,00000000,00000000), ref: 03FF776C
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,C0000000,00000000,00000000,00000002,00000080,00000000,0427B418,00000000,-000000F6), ref: 03FF7790
WriteFile.KERNEL32(00000000,?,00000000,?,00000000,00000000,00000000,00000000,?,00000000,?,C0000000,00000000,00000000,00000002,00000080), ref: 03FF77A5
CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,00000000,00000000,00000000,00000000,?,00000000,?,C0000000,00000000,00000000,00000002), ref: 03FF77AB

Memory Dump Source

Source File: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID: File$Write$CloseCreateHandle
String ID:
API String ID: 148219782-0
Opcode ID: e19c1613a6e31e813873fe8558e99d76f811c4841c391a596693a3c814155df3
Instruction ID: b5a30498f4a8d455a6bf149d88b438f80ea133cadd72088c67a24e6c8f9b608d
Opcode Fuzzy Hash: e19c1613a6e31e813873fe8558e99d76f811c4841c391a596693a3c814155df3
Instruction Fuzzy Hash: 56F0907A2403093DF210F2A5DC46FBBB76CCF40AA4F108115FF00AE0E1EAA0AD0086B4

Function 03FF76FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?,?,03FF777E,?,C0000000,00000000,00000000,00000002,00000080,00000000,0427B418,00000000,-000000F6), ref: 03FF7700
wsprintfA.USER32 ref: 03FF7739

Strings

%02d/%02d/%04d %02d:%02d:%02d.%03d , xrefs: 03FF772F

Memory Dump Source

Source File: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID: LocalTimewsprintf
String ID: %02d/%02d/%04d %02d:%02d:%02d.%03d
API String ID: 1577811021-3388318165
Opcode ID: 2fad13dcba8e48f2985d001863abe5d18de4a9b22b531ee0e85b0bbecdcc39a7
Instruction ID: 03956dc93aa3c6fb7d95ad7a062a623a68ca1c343a43305375de4f1cca423599
Opcode Fuzzy Hash: 2fad13dcba8e48f2985d001863abe5d18de4a9b22b531ee0e85b0bbecdcc39a7
Instruction Fuzzy Hash: B2E0ED9255C621B6D254DF4A8C0193FB2ECAD8CA11F44494DBAD4942D0F63CD484E33B

Function 03AEB958 Relevance: 5.2, Strings: 4, Instructions: 164COMMON

Download Yara Rule

Strings

text/xml, xrefs: 03AEBAE6
text/xml, xrefs: 03AEBA67
type, xrefs: 03AEBA6C
type, xrefs: 03AEBAEB

Memory Dump Source

Source File: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID: text/xml$text/xml$type$type
API String ID: 0-1440465865
Opcode ID: db3015bd03472ed7e622fb01cea20016060feae62d637dad87a2e3555dedae8d
Instruction ID: c2bf111f8c0f2884849649627e1b33f897a52c9058f18660f6730e036b293212
Opcode Fuzzy Hash: db3015bd03472ed7e622fb01cea20016060feae62d637dad87a2e3555dedae8d
Instruction Fuzzy Hash: 0451B9BA944308ABCB10EB64DC45FEF777CEB94710F148A2AF915EB241E67595408BF0

Function 03AEB788 Relevance: 5.2, Strings: 4, Instructions: 164COMMON

Download Yara Rule

Strings

application/xhtml+xml, xrefs: 03AEB897
application/xhtml+xml, xrefs: 03AEB916
type, xrefs: 03AEB89C
type, xrefs: 03AEB91B

Memory Dump Source

Source File: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID: application/xhtml+xml$application/xhtml+xml$type$type
API String ID: 0-3112332817
Opcode ID: 35d8dc747c15dbb095d65723821de20b067ec9cbd6b52fc27f0aa6a95b5098a1
Instruction ID: 84c86a0d20b4a25e3d11d31a4e7a8effc0e88d3996a1979dd8dd6c992393f69b
Opcode Fuzzy Hash: 35d8dc747c15dbb095d65723821de20b067ec9cbd6b52fc27f0aa6a95b5098a1
Instruction Fuzzy Hash: DC51D8BAD44309ABC710EB64DC85FEF777CEB94710F108A26F915EA241E67595408BF0

Function 03AFD274 Relevance: 5.1, Strings: 4, Instructions: 66COMMON

Download Yara Rule

Strings

Bz2, xrefs: 03AFD2C6
component, xrefs: 03AFD2CB
$, xrefs: 03AFD2A5
UnlockComponent, xrefs: 03AFD2AB

Memory Dump Source

Source File: 0000000B.00000002.2925882002.00000000039E3000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03950000, based on PE: true

Associated: 0000000B.00000002.2925847200.0000000003950000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.0000000003951000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2925882002.00000000039DE000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926300794.0000000003FFD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926354323.000000000404E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926393945.0000000004050000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926437470.0000000004070000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926474729.0000000004071000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926513093.000000000407F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926551949.0000000004081000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926591548.000000000408C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926629372.000000000408D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926668667.0000000004098000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926708311.000000000409A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926749643.00000000040B0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926783090.00000000040B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926820556.00000000040CC000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926855528.00000000040CD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926891150.00000000040DA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926929844.00000000040DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2926978925.000000000411D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927022214.0000000004147000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927057034.0000000004150000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927091517.0000000004156000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927126619.0000000004158000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927165602.0000000004161000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927203421.0000000004167000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927241362.0000000004168000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927281058.0000000004169000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927318481.000000000416B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927357375.0000000004171000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927398707.0000000004172000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927437390.000000000417A000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927476887.000000000417B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927515627.000000000417E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927559977.0000000004198000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927599525.000000000419F000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927637547.00000000041A0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927675131.00000000041A3000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927713920.00000000041A5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927752708.00000000041AA000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927789050.00000000041B1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927822624.00000000041B2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927866956.00000000041E5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927901942.00000000041F1000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927936375.00000000041F3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2927972340.0000000004202000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928006908.0000000004203000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928041259.000000000420C000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928076343.000000000420D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928110333.0000000004214000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928145318.0000000004215000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928186554.0000000004220000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928227605.0000000004223000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928267274.000000000422B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928305593.000000000422C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928343763.0000000004230000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928377348.0000000004231000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928412326.000000000423D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928447195.0000000004243000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928487280.0000000004251000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928526742.0000000004256000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928567811.0000000004262000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928606467.0000000004264000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928644973.0000000004269000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928684993.000000000426B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928726629.000000000427E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928766234.000000000428A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928804931.000000000428C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2928844348.000000000428D000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3950000_PlanSwift.jbxd

Similarity

API ID:
String ID: $$Bz2$UnlockComponent$component
API String ID: 0-3753152121
Opcode ID: 467f4944e15cf12c364d880b5771c5dfd615baa9be403c138e61a71bd929ce93
Instruction ID: 78bc1e5570851430ef64ceb6057478ed8f54b5954f70183a15547e2f39ccdba1
Opcode Fuzzy Hash: 467f4944e15cf12c364d880b5771c5dfd615baa9be403c138e61a71bd929ce93
Instruction Fuzzy Hash: 62117F7AD5021CABDB10EB94DC81EEEB378EF08214F008519FE047A251E77596098FE5

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ps11.0.0.129pro.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Bitcoin Miner

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\PlanSwift11\Data\Developers\Additional Help\Data.xml (copy)

C:\Program Files (x86)\PlanSwift11\Data\Developers\Additional Help\is-4OIJL.tmp

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\Data.xml (copy)

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\About\Data.xml (copy)

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\About\is-VVUUP.tmp

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\BeginFormulaUpdate\Data.xml (copy)

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\BeginFormulaUpdate\is-6QE92.tmp

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\BeginUpdate\Data.xml (copy)

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\BeginUpdate\is-S0L1M.tmp

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\CancelTool\Data.xml (copy)

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\CancelTool\is-OM1N5.tmp

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\CloseJob\Data.xml (copy)

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\CloseJob\is-EIV5N.tmp

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\CompareVersion\Data.xml (copy)

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\CompareVersion\is-I8GUR.tmp

C:\Program Files (x86)\PlanSwift11\Data\Developers\_PlanSwift Help\COM Object Model\IPlanSwift\CopyItem\Data.xml (copy)

Windows Analysis Report
ps11.0.0.129pro.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre