Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
ZPMC SCADA Setup v4.0.12737.zip

Overview

General Information

Sample name:ZPMC SCADA Setup v4.0.12737.zip
Analysis ID:1544383
MD5:8cec6cab7e45958bdda97ddc8bd32d9a
SHA1:dde365ea81f5dbde959633932a406bd57a3fd42d
SHA256:e4892a88830b8ff7b8ce8f702573ac331c814a1a7f7a9535f63ca83c53afb716
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

.NET source code contains potential unpacker
Modifies existing user documents (likely ransomware behavior)
Checks for available system drives (often done to infect USB drives)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to detect virtual machines (SGDT)
Contains functionality to detect virtual machines (SLDT)
Contains functionality to detect virtual machines (STR)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops certificate files (DER)
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May infect USB drives
May sleep (evasive loops) to hinder dynamic analysis
Modifies existing windows services
PE file contains strange resources
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64_ra
  • rundll32.exe (PID: 6668 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)
  • 7zG.exe (PID: 5504 cmdline: "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\" -spe -an -ai#7zMap15170:110:7zEvent13957 MD5: 50F289DF0C19484E970849AAC4E6F977)
  • setup.exe (PID: 3936 cmdline: "C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exe" MD5: 675A00CA73BAF388C0EBF90C0644E8E0)
  • setup.exe (PID: 3684 cmdline: "C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exe" MD5: 675A00CA73BAF388C0EBF90C0644E8E0)
    • setup.exe (PID: 980 cmdline: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exe /q"C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exe" /tempdisk1folder"C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}" /IS_temp MD5: 675A00CA73BAF388C0EBF90C0644E8E0)
      • ISBEW64.exe (PID: 1476 cmdline: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3C556304-8D46-41A1-A183-C63C96FA76B7} MD5: 82E1A9D1E3D0107F7E1253FA92F86B10)
      • ISBEW64.exe (PID: 6920 cmdline: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C68E9931-1A54-4D29-9A11-E2C1A6140D74} MD5: 82E1A9D1E3D0107F7E1253FA92F86B10)
      • ISBEW64.exe (PID: 1940 cmdline: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3C967A50-E90B-4AD5-B526-62683195C54F} MD5: 82E1A9D1E3D0107F7E1253FA92F86B10)
      • ISBEW64.exe (PID: 904 cmdline: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EB53D73A-7D41-467E-AF22-FA743D2E5BD2} MD5: 82E1A9D1E3D0107F7E1253FA92F86B10)
      • ISBEW64.exe (PID: 5852 cmdline: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0B631758-29DD-4B8E-9A12-949F140ACCEC} MD5: 82E1A9D1E3D0107F7E1253FA92F86B10)
      • ISBEW64.exe (PID: 1344 cmdline: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{58E35334-6736-4373-BC16-B19DB2B7F3E2} MD5: 82E1A9D1E3D0107F7E1253FA92F86B10)
      • ISBEW64.exe (PID: 3192 cmdline: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{66BF646F-C6CD-4823-BD3A-BBBE0CE92580} MD5: 82E1A9D1E3D0107F7E1253FA92F86B10)
      • ISBEW64.exe (PID: 3184 cmdline: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5DB750C9-5B1D-4912-9BBB-735073942453} MD5: 82E1A9D1E3D0107F7E1253FA92F86B10)
      • ISBEW64.exe (PID: 724 cmdline: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{85F4BC9B-9F30-4363-AD6D-FD00E62E44B7} MD5: 82E1A9D1E3D0107F7E1253FA92F86B10)
      • ISBEW64.exe (PID: 4956 cmdline: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D823CFD3-3D7A-4194-AD31-CD5AD6A26B55} MD5: 82E1A9D1E3D0107F7E1253FA92F86B10)
  • msiexec.exe (PID: 6716 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)
    • msiexec.exe (PID: 6480 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 77B4B6CB8D21758EFE216C05F17DCEE1 C MD5: 9D09DC1EDA745A5F87553048E57620CF)
    • msiexec.exe (PID: 6500 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding F52714C42576362BF3928B61AE156682 MD5: 9D09DC1EDA745A5F87553048E57620CF)
  • SrTasks.exe (PID: 4868 cmdline: C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:1 MD5: 2694D2D28C368B921686FE567BD319EB)
    • conhost.exe (PID: 876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results
Source: Binary string: "ZSNETE~2.PDB|zsNet.ElementBase.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l%ZSNETV~2.PDB|zsNet.ViewClient_WPF.pdb source: setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: lEFZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/Rcw.SdAPI.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZSSERV~1.PDB|zsServerHost.pdbB source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZISCAD~1.PDB|ZiSCADACLR.pdb source: setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2073363822.000000000149F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: RCWSER~1.PDB|RCW.ServerAPI.pdb\L source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: FmtTxt.pdb) source: setup.exe, 00000012.00000003.2073527832.0000000001475000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000146E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: !TCPCOM~1.PDB|TCPCommunication.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/Language.pdbgoD source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: t.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSNETE~1.PDB|zsNet.Element.pdb source: setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.DefStruct.pdbC source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: APPSER~1.PDB|AppServerBase.pdbTM source: setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl TCPDAS~1.PDB|TcpDaSvrWrapper.pdb source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\zsEventService.pdbJ+qiCyZvjnbf6NgG2PLaTivvNsVWVtqaQl+5WdtiswQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZISCAD~3.PDB|ziSCADAStudio.pdbo source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: APPSER~1.PDB|AppServerBase.pdb source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\Formulate.pdbbdNJ9XO409VVoHQY2NaV3Oy48oXLvow8yyNGoUKb/Mw= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/Formulate.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: l$ZSNETE~4.PDB|zsNet.EmtProperties.pdb source: setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l!ZSNETW~1.PDB|zsNet.WinFormsUI.pdb source: setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: NTCPMSG.pdb source: setup.exe, 00000012.00000003.2073527832.0000000001475000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000146E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl ZSNETB~1.PDB|zsNet.BaseClass.pdb source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: FZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/HFacility.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: 6HZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/DataAcsData.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsScada.Studio.Net.pdbg source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsAlmSvrAcs.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: .MZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/OPCDaServWrapper.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: l(ZSNETV~1.PDB|zsNet.VCMS3ScreenEditor.pdb source: setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\RunVBA.pdblTuhanUuBisWShxr799s8NkcZIcdTkIipcCxzkr4MmA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/Extend Dll/ProfiNet/ProfiNetWrapper.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: atl80.i386.pdb source: ATL80.dll1.10.dr, ATL80.dll.10.dr, ATL80.dll0.10.dr
Source: Binary string: program files\ZPMC\SCADA\Bin\AlarmServerCLR.pdb/Gq5O0+zk9sH+OZtYIpx1x/HLxXWkG9jwmb4MAIL5TA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ALARMS~2.PDB|AlarmServerCLR.pdb\L source: setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSNETE~1.PDB|zsNet.Element.pdb M6 source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: v4.0.12737/program files/ZPMC/SCADA/Bin/CApi.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: CApi.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l PROFIN~1.PDB|ProfiNetWrapper.pdb=Ita source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\UserControlBase.pdbzA4caz228yaAXsMa51+Jut2jqvnePUJQY8OI1mLNVlA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.WinFormsUI.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZISCAD~2.PDB|ziSCADAServer.pdb source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2494402472.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\ZCompEx.pdbYM+r8mUJr7CX9xMpIbOgiyNQ8xznIYL0BpfxMO7Stqg= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: program files\ZPMC\SCADA\Bin\ziSCADAView.pdbYJ/ZWsSsjwcJlA2nR3jUS7OpEyarnnIeZDM0ZeBRW6g= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: DATAAC~2.PDB|DataAcsData.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: RCWSER~1.PDB|RCW.ServerAPI.pdb source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZISCAD~3.PDB|ziSCADAStudio.pdb source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: lPData.pdb source: setup.exe, 00000012.00000003.2073527832.0000000001475000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000146E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSSERV~1.PDB|zsServerHost.pdbOM source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSUASV~1.PDB|zsUASvrAcs.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2073363822.000000000149F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: HQUERY~1.PDB|HQueryFacility.pdbTM source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.BaseClass.pdb source: 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZCompEx.pdb source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\HFacility.pdbpFcaEXMM/XHbFS/YZ5JICdPt42tRLQKTeAOfa1jE7bA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/PrjMan.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZSALAR~1.PDB|zsAlarmService.pdb source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/ZiSCADACLR.pdb source: 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: NTCPMSG.pdbh source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.WinFormsUI.pdbi source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\ziSCADAServer.pdbgVX6gmJpvf9H2sh93w886ZAXiy6mPON9AYfy7Jz3oHA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/NTCPMSG.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: +Pl!TCPCOM~1.PDB|TCPCommunication.pdbD source: setup.exe, 00000012.00000003.2401667791.000000000691D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/RCW.ServerAPI.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/OPCDaServWrapper.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: +Pl(ZSNETV~1.PDB|zsNet.VCMS3ScreenEditor.pdbJ source: setup.exe, 00000012.00000003.2397425178.00000000059C6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.Element.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/WndMan.pdbdbbo_ source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: RUNCSH~1.PDB|RunCSharp.pdb* source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: DZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/NTCPMSG.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/UserControlBase.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: Windows\winsxs\73t3z6j5.7agmfc80u.dll.pdb source: 7zG.exe, 0000000A.00000003.1972580949.000002239274A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 3GZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/DataAccess.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: MBZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/WData.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: program files\ZPMC\SCADA\Bin\zsNet.EmtProperties.pdb+i4oWQrULpuIq2T4TVcOBvHCmoT4ab4tmMH5jm/YKJA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: PROFIN~1.PDB|ProfiNetWrapper.pdb` source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/HQueryFacility.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: program files\ZPMC\SCADA\Bin\ziSCADAStudio.pdbGHAjeWSJJcvSIYR5Vu2jV8LtSX0Yu9ezGS9U7joxKOA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/RCW.ServerAPI.dllcation.pdb1i source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl USERCO~1.PDB|UserControlBase.pdb source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2494402472.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WndMan.pdb source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: CWSDA~1.PDB|Rcw.SdAPI.pdb-; source: setup.exe, 00000012.00000002.2452182848.0000000001426000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/HFacility.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: Language.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +`ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/Extend Dll/ProfiNet/ProfiNetWrapper.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/FmtTxt.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZSNETD~1.PDB|zsNet.DefHelp.pdb source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2494402472.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +CZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/FmtTxt.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: WData.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/Old Dll/TCPCommunication.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: !ZSNETE~3.PDB|zsNet.ElementRes.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\zsNet.Element.pdb3G73e+u5ywYmbKPiw+oatyW4KBQBlrG+zi3J6ZqammA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.ViewClient_WPF.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZIP.pdb source: setup.exe, 00000012.00000003.2407110679.000000000685B000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000146E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2494402472.000000000685B000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2402174868.000000000685B000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2073645541.000000000146E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \VCMS3.0\SCADA a\Source\Src\API\Rcw.ServerAPI\obj\Release\Rcw.ServerAPI.pdbXDnD `D_CorDllMainmscoree.dll source: Rcw.ServerAPI.dll.10.dr
Source: Binary string: program files\ZPMC\SCADA\Bin\Old Dll\TCPCommunication.pdb+renYCyyxeBD17JekMQ35RybL1om2tnfvcd5gpBeiWg= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/AlarmServerCLR.pdb source: 7zG.exe, 0000000A.00000003.1975989842.00000223926B1000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: program files\ZPMC\SCADA\Bin\zsNet.DefStruct.pdbXPvfZisQncM3jvRcRa2HWDFG795X/F9RD7mOOrJSNVQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: +Pl#ZSSCAD~1.PDB|zsScada.Studio.Net.pdbX source: setup.exe, 00000012.00000003.2401667791.000000000691D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSNETE~1.PDB|zsNet.Element.pdb3 source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsUASvrAcs.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: HFACIL~1.PDB|HFacility.pdbH source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l#OPCUAD~1.PDB|OPCUADaServWrapper.pdb source: setup.exe, 00000012.00000003.2073363822.000000000149D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\DataAcsData.pdbPTAMqTfcuARhovw8iXOa0w572DtBU5bVNVkYxTqBQ7Q= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/PData.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ALARMS~2.PDB|AlarmServerCLR.pdb source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZISCAD~4.PDB|ziSCADAView.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2494402472.0000000006800000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2073363822.000000000149F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: s.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\zsServerHost.pdbQDq+M91uG67t/KKC1j0QYAD4391dsz5GeH7DDXCH5eA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: l USERCO~1.PDB|UserControlBase.pdb source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSNETB~1.PDB|zsNet.BaseClass.pdb source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl%ZSNETV~2.PDB|zsNet.ViewClient_WPF.pdbV source: setup.exe, 00000012.00000003.2397425178.00000000059C6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\zsAlarmService.pdbNl3QEY4Zzk7S8xQABFrQJoYNlSjB9kSr5S0Z5gCOtPA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: +Pl!TCPCOM~1.PDB|TCPCommunication.pdb source: setup.exe, 00000012.00000003.2403686348.00000000059C7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: HQUERY~1.PDB|HQueryFacility.pdb source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcr80.i386.pdb source: 7zG.exe, 0000000A.00000003.1961246630.00000223932AA000.00000004.00000020.00020000.00000000.sdmp, msvcr80.dll0.10.dr
Source: Binary string: ZSEVEN~1.PDB|zsEventService.pdb source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: RCWSDA~1.PDB|Rcw.SdAPI.pdb6 source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\RCW.ServerAPI.pdbhVIZNbk7BHBi/sOgaWDgtrmJrawqcwMGntCJv1eoADQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: +PlZGTag.pdba source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/WData.pdbdll source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/RunCSharp.pdb{o0 source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZISCAD~1.PDB|ZiSCADACLR.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 2KZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/AlarmServerAPI.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZISCAD~3.PDB|ziSCADAStudio.pdbLr source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: e:\ft_code\drv_proj\drv_rockey4\src\32\vista\rockey4\objfre_wlh_x86\i386\Rockey4.pdb source: setup.exe, 00000012.00000002.2473155026.0000000006586000.00000002.00000001.00040000.00000013.sdmp
Source: Binary string: GZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/HDefStruct.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: program files\ZPMC\SCADA\Bin\OPCUADaServWrapper.pdbisgSc9OgGwW5q8YGr8NbplAset5LpDpXNDTb5exyt5Q= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ALARMS~1.PDB|AlarmServerAPI.pdb0 source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ALARMS~1.PDB|AlarmServerAPI.pdb source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\OPCUABrowse.pdbEpWKBLLKng8L1Z2hD+sBEA7sXeMuJawBU5s4IdgVEig= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: Windows\winsxs\vxgs54we.kj4\.pdbat source: 7zG.exe, 0000000A.00000003.1972809065.0000022392749000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975193758.0000022392749000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1972651086.0000022392737000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl!ZSNETW~1.PDB|zsNet.WinFormsUI.pdb( source: setup.exe, 00000012.00000003.2401667791.000000000691D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/ZiSCADACLR.pdb// source: 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/RunCSharp.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: RCWSER~1.PDB|RCW.ServerAPI.pdbaL source: setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +PlWData.pdb source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/ziSCADAServer.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl ZSNETD~2.PDB|zsNet.DefStruct.pdb source: setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2494402472.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: #OPCUAD~1.PDB|OPCUADaServWrapper.pdb/ source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\NTCPMSG.pdb+qbZtaSkqgRcLB6bBZIBDQUJkg6oTeqUkjDmukv0PDQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: $ZSNETE~4.PDB|zsNet.EmtProperties.pdbg source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\EventServerAPI.pdbywZs/mcSkSP7IEHxIrHlyyxHFpcP1u1C3q3ONqykC0w= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/DataAcsData.pdbl.dll source: 7zG.exe, 0000000A.00000003.1975989842.00000223926B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: v4.0.12737/program files/ZPMC/SCADA/Bin/Extend Dll/ProfiNet/ProfiNetWrapper.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSALAR~1.PDB|zsAlarmService.pdb6 source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.DefStruct.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: e:\ft_code\drv_proj\drv_rockey4\src\32\vista\rockey4usb\objfre_wlh_x86\i386\Rockey4Usb.pdb source: setup.exe, 00000012.00000002.2473155026.0000000006586000.00000002.00000001.00040000.00000013.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsServerHost.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 7BZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/PData.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Data/Lib_D3/Crane.Xt.pdb.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl!OPCDAS~1.PDB|OPCDaServWrapper.pdb source: setup.exe, 00000012.00000003.2401667791.000000000691D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2403686348.00000000059C7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.ViewClient_WPF.pdb[ source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSNETE~1.PDB|zsNet.Element.pdb{ source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 5JZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/RCW.ServerAPI.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: RCWSDA~1.PDB|Rcw.SdAPI.pdb$T source: setup.exe, 00000012.00000002.2494402472.0000000006800000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/OPCUABrowse.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: e:\ft_code\drv_proj\drv_rockey4\src\32\rockeynt\objfre_w2k_x86\i386\rockeynt.pdb source: 7zG.exe, 0000000A.00000003.1961246630.00000223935F0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2473155026.000000000656A000.00000002.00000001.00040000.00000013.sdmp
Source: Binary string: D:\Rockey4Drv\wdm\enduser\objfre\i386\RockUsb.pdb source: setup.exe, 00000012.00000002.2473155026.0000000006586000.00000002.00000001.00040000.00000013.sdmp
Source: Binary string: L.OZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/OPCUADaServWrapper.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: program files\ZPMC\SCADA\Bin\Language.pdbpSxGErW/ehL/cJe7dz/PAg7+Rir/s3VlJooESBZ0RMg= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: @EZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/Language.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: program files\ZPMC\SCADA\Bin\zsNet.ViewClient_WPF.pdb5Nc+GNw6xsin/aC2vxRJiG3ueNAszlwk3cV+m6Biyug= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZSEVEN~1.PDB|zsEventService.pdbpr source: setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl%ZSNETV~2.PDB|zsNet.ViewClient_WPF.pdb source: setup.exe, 00000012.00000002.2500922986.0000000006997000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2403207427.0000000006997000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.ElementRes.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 7FZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/RunCSharp.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsScada.Studio.Net.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/TcpDaSvrWrapper.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: WndMan.pdb1 source: setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/ziSCADAView.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: CoreAPI.pdb3 source: setup.exe, 00000012.00000002.2468744199.00000000059F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2403686348.00000000059FA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: EVENTS~1.PDB|EventServerAPI.pdb source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\ZGTag.pdb1nDOpP2UNJGYCH45/5DEe6GucGydAu1rBU2he5a6YoA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: L3FZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/Formulate.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: RunVBA.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ,0CZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/RunVBA.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: -UZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/Old Dll/TCPCommunication.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: CoreAPI.pdb/ source: setup.exe, 00000012.00000003.2397425178.00000000059FA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\Extend Dll\ProfiNet\ProfiNetWrapper.pdbSGqcu7bNm+yWW7wP0eLfvsjEREPP6odqYTcaWtwnNtQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: \VCMS3.0\SCADA a\Source\Src\API\Rcw.ServerAPI\obj\Release\Rcw.ServerAPI.pdb source: Rcw.ServerAPI.dll.10.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/RunVBA.pdbvoK source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\CodeBases\isdev\Redist\Language Independent\i386\ISSetup.pdb source: setup.exe, 00000012.00000002.2510020399.000000006CA06000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\zsAlmSvrAcs.pdb2awxTeEDHVYlsXpLWyKiz2mzq4nZm1MoWw9W7FMbyEA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: program files\ZPMC\SCADA\Bin\zsTrendAcs.pdbI+G7FfrUnOluYmYpbrbEnb4qiqR4WrNepkpF6Ev4JzQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: TCPDAS~1.PDB|TcpDaSvrWrapper.pdbl source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l1CZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/DaAPIU.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/FuncAPI.pdbl>j' source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\CoreAPI.pdbZsrngPsrAYw3dnALGcwBhnneFAw7yX3hZPIBa0BAF1w= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: program files\ZPMC\SCADA\Bin\HDefStruct.pdbCzX7CmJo3nndAcSKDd6IiwVm52t3gaZEeLL/fmDtX1w= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: %ZSNETV~2.PDB|zsNet.ViewClient_WPF.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l TCPDAS~1.PDB|TcpDaSvrWrapper.pdbd source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/UserControlBase.pdbll source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: PrjMan.pdbS source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +AZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/CApi.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZSTREN~1.PDB|zsTrendAcs.pdb4m source: setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2073363822.000000000149F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: h:\nt.obj.x86fre\base\wcp\tools\msmcustomaction\objfre\i386\msmcustomaction.pdb source: setup.exe, 00000012.00000002.2473155026.0000000006210000.00000002.00000001.00040000.00000013.sdmp
Source: Binary string: CApi.pdb% source: setup.exe, 00000012.00000003.2072971157.000000000146E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2073645541.000000000146E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.DefHelp.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsAlarmService.pdbn.batll source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: lWData.pdb source: setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.VCMS3ScreenEditor.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\PrjMan.pdbrDOLbU8cc1ml83UeTt0+XikyAvG2OQD0cGh0VGQIpCw= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/Language.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: 2DZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/CoreAPI.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: PrjMan.pdb source: setup.exe, 00000012.00000003.2073527832.0000000001475000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000146E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: RunVBA.pdbO source: setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: cation.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\PData.pdbA4Wy9NlEX/Q+rrpRP1jkZFKRsinnbvbcZReHO5xRnmA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/CoreAPI.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: program files\ZPMC\SCADA\Bin\zsUASvrAcs.pdb+214c6Z/f1zI9gpI5wZUr2M2qiKtaS8ks4HHBwKvF8Q= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/EventServerAPI.pdb source: 7zG.exe, 0000000A.00000003.1975989842.00000223926B1000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: +Pl"ZSNETE~2.PDB|zsNet.ElementBase.pdb source: setup.exe, 00000012.00000003.2401667791.000000000691D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2403686348.00000000059C7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsEventService.pdb source: 7zG.exe, 0000000A.00000003.1975989842.00000223926B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: :LZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/UserControlBase.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/OPCUADaServWrapper.pdbQi source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/HDefStruct.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/ZIP.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\DaAPIU.pdbm9rDqcA/83dViPdjMzeA6APZcL5pr7/EW4+Zs8bMbOg= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: PrjMan.pdbP source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsEventService.pdb/=a} source: 7zG.exe, 0000000A.00000003.1975989842.00000223926B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\Rockey4Drv\wdm\enduser\objfre\i386\RockUsb.pdbMZ source: setup.exe, 00000012.00000002.2473155026.0000000006586000.00000002.00000001.00040000.00000013.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/TcpDaSvrWrapper.pdbI.dll source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: !OPCDAS~1.PDB|OPCDaServWrapper.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: FuncAPI.pdb source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl(ZSNETV~1.PDB|zsNet.VCMS3ScreenEditor.pdb source: setup.exe, 00000012.00000002.2500922986.0000000006997000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2403207427.0000000006997000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: RunVBA.pdb- source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ALARMS~2.PDB|AlarmServerCLR.pdbJ source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSSERV~1.PDB|zsServerHost.pdb M6 source: setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2494402472.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\myprogram\CVSProj\ePassSvr\rock_usb\rocknt\objfre\i386\Rockey4.pdb source: 7zG.exe, 0000000A.00000003.1961246630.00000223935F0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2473155026.000000000656A000.00000002.00000001.00040000.00000013.sdmp
Source: Binary string: USERCO~1.PDB|UserControlBase.pdb source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: FmtTxt.pdb source: setup.exe, 00000012.00000002.2468744199.00000000059F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2403686348.00000000059FA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2397425178.00000000059FA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\myprogram\CVSProj\ePassSvr\rock_usb\RockeyCoinstall\objfre\i386\Ry4CoInst.pdbU source: setup.exe, 00000012.00000002.2473155026.0000000006586000.00000002.00000001.00040000.00000013.sdmp
Source: Binary string: lZGTag.pdb] source: setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl!ZSNETE~3.PDB|zsNet.ElementRes.pdb source: setup.exe, 00000012.00000003.2403686348.00000000059C7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/WData.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: CoreAPI.pdb source: setup.exe, 00000012.00000003.2073527832.0000000001475000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000146E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl!ZSNETW~1.PDB|zsNet.WinFormsUI.pdb{ source: setup.exe, 00000012.00000003.2403686348.00000000059C7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl ZSNETB~1.PDB|zsNet.BaseClass.pdbfr source: setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsTrendAcs.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSEVEN~1.PDB|zsEventService.pdb:M source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\RunCSharp.pdb/kBWtLYIdGFyw1TN8IvgppV+xPiyfiTKA37Fhqx8swA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: CApi.pdbc source: setup.exe, 00000012.00000003.2407110679.000000000685B000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2494402472.000000000685B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: OPCUAB~1.PDB|OPCUABrowse.pdbL source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l ZSNETD~2.PDB|zsNet.DefStruct.pdb source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: CApi.pdbW source: setup.exe, 00000012.00000003.2402174868.000000000685B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\CodeBases\isdev\Src\Runtime\InstallScript\ISBEW64\x64\Release\ISBEW64.pdb source: ISBEW64.exe, 00000015.00000000.2082773856.00007FF79E177000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: v4.0.12737/program files/ZPMC/SCADA/Bin/CoreAPI.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: PData.pdbZ source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: DaAPIU.pdb source: setup.exe, 00000012.00000002.2468744199.00000000059F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2073527832.0000000001475000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2403686348.00000000059FA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000146E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2397425178.00000000059FA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 1CZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/PrjMan.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: l!OPCDAS~1.PDB|OPCDaServWrapper.pdb source: setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\WndMan.pdbHt0juaJkP9RWSyjP6ddh2NCwzQ51QPDN153JGmQlw1w= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsAlarmService.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/HDefStruct.pdbtjy source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl$ZSNETE~4.PDB|zsNet.EmtProperties.pdb source: setup.exe, 00000012.00000003.2401667791.000000000691D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2403686348.00000000059C7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 7CZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/WndMan.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: D:\myprogram\CVSProj\ePassSvr\rock_usb\enduser\objfre\i386\Rockey4Usb.pdb source: 7zG.exe, 0000000A.00000003.1961246630.00000223935F0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2473155026.000000000656A000.00000002.00000001.00040000.00000013.sdmp
Source: Binary string: l ZSNETB~1.PDB|zsNet.BaseClass.pdb~ source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\WData.pdbfw7DAyLwrZOpHKBugMNsn9PnzzKhy04OeGteCxLwodQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/DataAccess.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: D:\myprogram\CVSProj\ePassSvr\rock_usb\RockeyCoinstall\objfre\i386\Ry4CoInst.pdb source: setup.exe, 00000012.00000002.2473155026.0000000006586000.00000002.00000001.00040000.00000013.sdmp
Source: Binary string: \UCDemo\obj\Release\UCDemo.pdb source: UCDemo.dll.10.dr
Source: Binary string: program files\ZPMC\SCADA\Bin\zsNet.VCMS3ScreenEditor.pdbXOGvZYk0vlYeKtgbpFxATqKl5hRdaVEcyNu4VWZabpg= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: e:\ft_code\drv_proj\drv_rockey4\src\32\vista\coinstall\objfre_wlh_x86\i386\Ry4CoInst.pdb source: setup.exe, 00000012.00000002.2473155026.0000000006586000.00000002.00000001.00040000.00000013.sdmp
Source: Binary string: MFC80.i386.pdb source: mfc80.dll0.10.dr
Source: Binary string: EVENTS~1.PDB|EventServerAPI.pdb& source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl ZSNETD~2.PDB|zsNet.DefStruct.pdb-r3 source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\FmtTxt.pdbV8acwzpmdLhyzCZzHlY1SdBfnAX2m51uBTX08ZaJIkw= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: RCWSER~1.PDB|RCW.ServerAPI.pdbi source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/PrjMan.pdb$o source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/ziSCADAView.pdbResource/ii source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.ElementBase.pdb source: 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\zsNet.BaseClass.pdbSN7sf2B4S8hse3qg8x6TmaL+Bf/eSHmJZ5tJcuQ5j1Q= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/Rcw.SdAPI.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ,2KZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/EventServerAPI.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: program files\ZPMC\SCADA\Bin\Rcw.SdAPI.pdb40zK1l5r1IVdcrGQDHJ4iN46l4k8fYOzRIhRxxxnwzQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/ZGTag.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/DataAcsData.pdb source: 7zG.exe, 0000000A.00000003.1975989842.00000223926B1000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ,;JZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/AppServerBase.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: l!ZSNETE~3.PDB|zsNet.ElementRes.pdbsn source: setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: L0DZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/FuncAPI.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: program files\ZPMC\SCADA\Bin\FuncAPI.pdbWKZYnfZAIEWhGXdVyaiaSokHV5E7E7ZlmV6HYJegBtg= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ,<KZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/AlarmServerCLR.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZCompEx.pdbu source: setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSTREN~1.PDB|zsTrendAcs.pdbRT source: setup.exe, 00000012.00000002.2494402472.0000000006800000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/ziSCADAStudio.pdbb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l0KZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/HQueryFacility.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: e:\ft_code\drv_proj\drv_rockey4\src\32\vista\rockey4usb\objfre_wlh_x86\i386\Rockey4Usb.pdbN source: setup.exe, 00000012.00000002.2473155026.0000000006586000.00000002.00000001.00040000.00000013.sdmp
Source: Binary string: (ZSNETV~1.PDB|zsNet.VCMS3ScreenEditor.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSSERV~1.PDB|zsServerHost.pdb source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: atl80.i386.pdbP source: ATL80.dll1.10.dr, ATL80.dll.10.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/ziSCADAStudio.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\zsNet.ElementBase.pdbNiyjdKyX7a8HEC+YmrHhkuFzW3XVbkzXmkXmVaVVgJA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/AlarmServerCLR.pdb# source: 7zG.exe, 0000000A.00000003.1975989842.00000223926B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: !ZSNETW~1.PDB|zsNet.WinFormsUI.pdbS source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\zsNet.DefHelp.pdb0eWCDbSHO7JEy7YoXIT9P99O8c0y+5or4PYNh74/e7w= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: program files\ZPMC\SCADA\Bin\ZiSCADACLR.pdbEmspR26nVl/p6CjI+Ca88ZYZx98nCs2x/urO4shrWkQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: APPSER~1.PDB|AppServerBase.pdb8 source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.EmtProperties.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZGTag.pdb& source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/AlarmServerAPI.pdb source: 7zG.exe, 0000000A.00000003.1975989842.00000223926B1000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: HDEFST~1.PDB|HDefStruct.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\ZIP.pdbq5sfofa+Y2MFs2iOa00t1HaHzOIN98Ot9vwlDkRrk7Q= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: program files\ZPMC\SCADA\Bin\TcpDaSvrWrapper.pdbCnburEURX1XwTB0aPCr0gFXIZmgod04xa4BG75GQF1A= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: Windows\winsxs\7z1v718o.6n8\mfc80.dllLib_Net/ImageList/Image_Symbol/history alarm.png.pdb source: 7zG.exe, 0000000A.00000003.1972906042.000002239270E000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975694409.0000022392729000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZISCAD~1.PDB|ZiSCADACLR.pdbXT source: setup.exe, 00000012.00000002.2494402472.0000000006800000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: RUNCSH~1.PDB|RunCSharp.pdbnT source: setup.exe, 00000012.00000002.2494402472.0000000006800000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\zsNet.WinFormsUI.pdbZECxiRrmzu/5vdGi8uDFbC67nQJlgOV3eE2ny/2AE/A= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: program files\ZPMC\SCADA\Bin\CApi.pdbQp09apawCVncuo0Qwrqgb5Ol7evl+PVgV1vW4z5WqOQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/WndMan.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/ZCompEx.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl#ZSSCAD~1.PDB|zsScada.Studio.Net.pdb source: setup.exe, 00000012.00000003.2403686348.00000000059C7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\OPCDaServWrapper.pdbazo9K73ePJp5eaivAnbp6GfrzLa2jQv24ElpUYRYvQw= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZISCAD~2.PDB|ziSCADAServer.pdby source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +PlPData.pdby source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: APPSER~1.PDB|AppServerBase.pdb{L source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Language.pdbg source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/DaAPIU.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: program files\ZPMC\SCADA\Bin\AlarmServerAPI.pdb64kiymeQEXcIpRLov4R83UyJhdJQA+RO7a0jZkkoUxw= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/OPCUABrowse.pdb;i source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: FORMUL~1.PDB|Formulate.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l#ZSSCAD~1.PDB|zsScada.Studio.Net.pdbko source: setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: /HZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/OPCUABrowse.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/ziSCADAServer.pdbb#i source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSTREN~1.PDB|zsTrendAcs.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/ZGTag.pdb@oy source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\AppServerBase.pdbEvzWewnot2TPzs3oa7FUOhJptwLqpR1fenknJjugE4Q= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/RunVBA.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/AppServerBase.pdb source: 7zG.exe, 0000000A.00000003.1975989842.00000223926B1000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: +Pl#OPCUAD~1.PDB|OPCUADaServWrapper.pdb source: setup.exe, 00000012.00000003.2401667791.000000000691D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2403686348.00000000059C7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/CApi.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZSNETD~2.PDB|zsNet.DefStruct.pdb source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\CodeBases\isdev\redist\Language Independent\i386\setup.pdb source: setup.exe, 0000000E.00000000.2048637934.00000000000D5000.00000002.00000001.01000000.00000008.sdmp, setup.exe, 00000012.00000000.2057291118.0000000000435000.00000002.00000001.01000000.00000009.sdmp, setup.exe.10.dr, setup.exe.18.dr
Source: Binary string: FuncAPI.pdb3 source: setup.exe, 00000012.00000003.2073527832.0000000001475000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000146E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl PROFIN~1.PDB|ProfiNetWrapper.pdb source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2494402472.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: OPCUAB~1.PDB|OPCUABrowse.pdb source: setup.exe, 00000012.00000002.2494402472.0000000006800000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l!TCPCOM~1.PDB|TCPCommunication.pdbon source: setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/FuncAPI.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Data/Lib_D3/Chassis.Xs.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: DATAAC~1.PDB|DataAccess.pdb$ source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSALMS~1.PDB|zsAlmSvrAcs.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2494402472.0000000006800000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2073363822.000000000149F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\zsNet.ElementRes.pdb1X1+ibGSHroQM719tjh9nJh4Vp/tCeNtFrEy0BKyPRQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/Old Dll/TCPCommunication.pdb]i source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\DataAccess.pdbdIs9skEwDKWdooU/1ppvkiPmZwuv1nifzUBksCo/Axw= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: program files\ZPMC\SCADA\Bin\HQueryFacility.pdbvCGtZRJsYo5tHe26INmz+mZvUFXFxWORVGbcsdk6TqQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: +Pl!ZSNETE~3.PDB|zsNet.ElementRes.pdbp source: setup.exe, 00000012.00000003.2401667791.000000000691D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl TCPDAS~1.PDB|TcpDaSvrWrapper.pdbOM source: setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2494402472.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: #ZSSCAD~1.PDB|zsScada.Studio.Net.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/OPCUADaServWrapper.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: /LZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/TcpDaSvrWrapper.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: rp.pdb source: 7zG.exe, 0000000A.00000003.1972809065.0000022392749000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975193758.0000022392749000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1972651086.0000022392737000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: v4.0.12737/program files/ZPMC/SCADA/Bin/Extend Dll/ProfiNet/ProfiNetWrapper.pdb_k source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSUASV~1.PDB|zsUASvrAcs.pdbLT source: setup.exe, 00000012.00000002.2494402472.0000000006800000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l"ZSNETE~2.PDB|zsNet.ElementBase.pdb source: setup.exe, 00000012.00000003.2073363822.000000000149D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Language.pdb% source: setup.exe, 00000012.00000003.2073527832.0000000001475000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000146E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\zsScada.Studio.Net.pdb3B5Byrv6F2DG8fm0vnIpBJ1G7CmgtAdoWL9GaUK5NhQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsUASvrAcs.pdb#o source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: HQUERY~1.PDB|HQueryFacility.pdb{L source: setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Windows\System32\msiexec.exeFile opened: z:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: x:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: v:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: t:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: r:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: p:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: n:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: l:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: j:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: h:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: f:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: b:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: y:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: w:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: u:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: s:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: q:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: o:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: m:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: k:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: i:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: g:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: e:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: c:Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile opened: a:Jump to behavior
Source: 7zG.exe, 0000000A.00000003.1975989842.00000223926B1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ZPMC SCADA Setup v4.0.12737/Autorun.inf
Source: 7zG.exe, 0000000A.00000003.1975989842.00000223926B1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ZPMC SCADA Setup v4.0.12737/Autorun.infOal
Source: ZPMC SCADA Setup v4.0.12737.zipBinary or memory string: ZPMC SCADA Setup v4.0.12737/Autorun.inf[autorun]
Source: ZPMC SCADA Setup v4.0.12737.zipBinary or memory string: ZPMC SCADA Setup v4.0.12737/Autorun.inf[autorun]
Source: ZPMC SCADA Setup v4.0.12737.zipBinary or memory string: 'ZPMC SCADA Setup v4.0.12737/Autorun.inf[autorun]
Source: ZPMC SCADA Setup v4.0.12737.zipBinary or memory string: 'ZPMC SCADA Setup v4.0.12737/Autorun.inf[autorun]
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_1003C60E __EH_prolog3_GS,FindFirstFileW,18_2_1003C60E
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_100B86D3 __EH_prolog3_GS,FindFirstFileW,lstrcmpW,lstrcmpW,FindNextFileW,RemoveDirectoryW,__CxxThrowException@8,DeleteFileW,18_2_100B86D3
Source: C:\Program Files\7-Zip\7zG.exeFile opened: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Bin\Extend Dll\ProfiNetJump to behavior
Source: C:\Program Files\7-Zip\7zG.exeFile opened: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADAJump to behavior
Source: C:\Program Files\7-Zip\7zG.exeFile opened: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\BinJump to behavior
Source: C:\Program Files\7-Zip\7zG.exeFile opened: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMCJump to behavior
Source: C:\Program Files\7-Zip\7zG.exeFile opened: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Bin\Extend Dll\View ResourceJump to behavior
Source: C:\Program Files\7-Zip\7zG.exeFile opened: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Bin\Extend DllJump to behavior
Source: unknownDNS traffic detected: query: 206.23.85.13.in-addr.arpa replaycode: Name error (3)
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa
Source: mfc80.dll0.10.drString found in binary or memory: ftp://http://HTTP/1.0
Source: setup.exe, 00000012.00000003.2390078724.0000000004234000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.thawte.com/Tha
Source: setup.exe, 00000012.00000002.2473155026.00000000062E0000.00000002.00000001.00040000.00000013.sdmp, setup.exe, 00000012.00000002.2473155026.00000000062B6000.00000002.00000001.00040000.00000013.sdmp, MSIC44.tmp.19.dr, MSI8A62.tmp.18.drString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: setup.exe, 00000012.00000002.2473155026.00000000062E0000.00000002.00000001.00040000.00000013.sdmp, setup.exe, 00000012.00000002.2473155026.00000000062B6000.00000002.00000001.00040000.00000013.sdmp, MSIC44.tmp.19.dr, MSI8A62.tmp.18.drString found in binary or memory: http://ocsp.thawte.com0
Source: setup.exe, 00000012.00000002.2473155026.00000000062E0000.00000002.00000001.00040000.00000013.sdmp, setup.exe, 00000012.00000002.2473155026.00000000062B6000.00000002.00000001.00040000.00000013.sdmp, MSIC44.tmp.19.dr, MSI8A62.tmp.18.drString found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: setup.exe, 00000012.00000002.2473155026.00000000062E0000.00000002.00000001.00040000.00000013.sdmp, setup.exe, 00000012.00000002.2473155026.00000000062B6000.00000002.00000001.00040000.00000013.sdmp, MSIC44.tmp.19.dr, MSI8A62.tmp.18.drString found in binary or memory: http://s2.symcb.com0
Source: setup.exe, 00000012.00000002.2473155026.00000000062E0000.00000002.00000001.00040000.00000013.sdmp, setup.exe, 00000012.00000002.2473155026.00000000062B6000.00000002.00000001.00040000.00000013.sdmp, MSIC44.tmp.19.dr, MSI8A62.tmp.18.drString found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: setup.exe, 00000012.00000002.2473155026.00000000062E0000.00000002.00000001.00040000.00000013.sdmp, setup.exe, 00000012.00000002.2473155026.00000000062B6000.00000002.00000001.00040000.00000013.sdmp, MSIC44.tmp.19.dr, MSI8A62.tmp.18.drString found in binary or memory: http://sv.symcb.com/sv.crt0
Source: setup.exe, 00000012.00000002.2473155026.00000000062E0000.00000002.00000001.00040000.00000013.sdmp, setup.exe, 00000012.00000002.2473155026.00000000062B6000.00000002.00000001.00040000.00000013.sdmp, MSIC44.tmp.19.dr, MSI8A62.tmp.18.drString found in binary or memory: http://sv.symcd.com0&
Source: setup.exe, 00000012.00000002.2473155026.00000000062E0000.00000002.00000001.00040000.00000013.sdmp, setup.exe, 00000012.00000002.2473155026.00000000062B6000.00000002.00000001.00040000.00000013.sdmp, MSIC44.tmp.19.dr, MSI8A62.tmp.18.drString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: setup.exe, 00000012.00000002.2473155026.00000000062E0000.00000002.00000001.00040000.00000013.sdmp, setup.exe, 00000012.00000002.2473155026.00000000062B6000.00000002.00000001.00040000.00000013.sdmp, MSIC44.tmp.19.dr, MSI8A62.tmp.18.drString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: setup.exe, 00000012.00000002.2473155026.00000000062E0000.00000002.00000001.00040000.00000013.sdmp, setup.exe, 00000012.00000002.2473155026.00000000062B6000.00000002.00000001.00040000.00000013.sdmp, MSIC44.tmp.19.dr, MSI8A62.tmp.18.drString found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: setup.exe, 00000012.00000002.2473155026.00000000062E0000.00000002.00000001.00040000.00000013.sdmp, setup.exe, 00000012.00000002.2473155026.00000000062B6000.00000002.00000001.00040000.00000013.sdmp, MSIC44.tmp.19.dr, MSI8A62.tmp.18.drString found in binary or memory: http://www.flexerasoftware.com0
Source: setup.exe, 0000000E.00000000.2048637934.00000000000D5000.00000002.00000001.01000000.00000008.sdmp, setup.exe, 00000011.00000002.2073364727.00000000000D5000.00000002.00000001.01000000.00000008.sdmp, setup.exe, 00000012.00000002.2446987044.0000000000425000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000012.00000000.2057291118.0000000000425000.00000002.00000001.01000000.00000009.sdmp, setup.exe.10.dr, setup.exe.18.drString found in binary or memory: http://www.installshield.com/isetup/ProErrorCentral.asp?ErrorCode=%d
Source: setup.exe, 00000012.00000002.2473155026.00000000062E0000.00000002.00000001.00040000.00000013.sdmp, setup.exe, 00000012.00000002.2473155026.00000000062B6000.00000002.00000001.00040000.00000013.sdmp, MSIC44.tmp.19.dr, MSI8A62.tmp.18.drString found in binary or memory: http://www.symauth.com/cps0(
Source: setup.exe, 00000012.00000002.2473155026.00000000062E0000.00000002.00000001.00040000.00000013.sdmp, setup.exe, 00000012.00000002.2473155026.00000000062B6000.00000002.00000001.00040000.00000013.sdmp, MSIC44.tmp.19.dr, MSI8A62.tmp.18.drString found in binary or memory: http://www.symauth.com/rpa00
Source: setup.exe, 00000012.00000002.2452182848.00000000013FB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2073527832.0000000001475000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2402174868.00000000068C1000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2402174868.00000000068A1000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000146E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2407110679.00000000068A2000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2403394781.0000000006954000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2407110679.00000000068C1000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2401094319.0000000006950000.00000004.00000020.00020000.00000000.sdmp, String1033.txt.18.drString found in binary or memory: http://www.zpmc.com
Source: setup.exe, 00000012.00000003.2402174868.00000000068A1000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2407110679.00000000068A2000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2395352507.0000000006877000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2494402472.00000000068A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.zpmc.comVERSON
Source: setup.exe, 00000012.00000003.2395352507.0000000006877000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.zpmc.comall
Source: setup.exe, 00000012.00000002.2473155026.00000000062E0000.00000002.00000001.00040000.00000013.sdmp, setup.exe, 00000012.00000002.2473155026.00000000062B6000.00000002.00000001.00040000.00000013.sdmp, MSIC44.tmp.19.dr, MSI8A62.tmp.18.drString found in binary or memory: https://d.symcb.com/cps0%
Source: setup.exe, 00000012.00000002.2473155026.00000000062E0000.00000002.00000001.00040000.00000013.sdmp, setup.exe, 00000012.00000002.2473155026.00000000062B6000.00000002.00000001.00040000.00000013.sdmp, MSIC44.tmp.19.dr, MSI8A62.tmp.18.drString found in binary or memory: https://d.symcb.com/rpa0
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\j4auwzcy.rsh\8.0.50727.762.catJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Policies\i4auwzcy.rsh\8.0.50727.762.catJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\7z1v718o.6n8\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05.catJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Manifests\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05.catJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Policies\ed6uew4i.4ha\8.0.50727.762.catJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Policies\m3oqdoe3.l2\8.0.50727.762.catJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\vxgs54we.kj4\8.0.50727.762.catJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Manifests\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303.catJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\n3oqdoe3.l2\8.0.50727.762.catJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Policies\u1sw1o0k.9hi\8.0.50727.762.catJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\v1sw1o0k.9hi\8.0.50727.762.catJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\73t3z6j5.7ag\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474.catJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\fd6uew4i.4ha\8.0.50727.762.catJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Manifests\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474.catJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\b2rg91xw.1p4\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.catJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Policies\uxgs54we.kj4\8.0.50727.762.catJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303.catJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.catJump to dropped file

Spam, unwanted Advertisements and Ransom Demands

barindex
Modifies existing user documents (likely ransomware behavior)
Source: C:\Program Files\7-Zip\7zG.exeFile deleted: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_D3\SkyboxTop.jpgJump to behavior
Source: C:\Program Files\7-Zip\7zG.exeFile deleted: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\ImageList_1\pump1.jpgJump to behavior
Source: C:\Program Files\7-Zip\7zG.exeFile deleted: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\ImageList_1\naozhong2.jpgJump to behavior
Source: C:\Program Files\7-Zip\7zG.exeFile deleted: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\ImageList_1\truck2.jpgJump to behavior
Source: C:\Program Files\7-Zip\7zG.exeFile deleted: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\ImageList_1\monitor.jpgJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_100234D7 GetPropW,NtdllDefWindowProc_W,18_2_100234D7
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_1001C1DF NtdllDefWindowProc_W,18_2_1001C1DF
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_1001C207 NtdllDefWindowProc_W,GetSysColor,18_2_1001C207
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_1007C220 GetPropW,NtdllDefWindowProc_W,BeginPaint,BitBlt,EndPaint,CallWindowProcW,DeleteObject,DeleteDC,RemovePropW,SetWindowLongW,_memset,GetClassNameW,lstrcmpiW,GetWindowLongW,_memset,GetClassNameW,lstrcmpiW,SetBkMode,SetTextColor,lstrcmpiW,SetBkMode,SetTextColor,_memset,GetClassNameW,lstrcmpiW,SetBkMode,SetTextColor,GetStockObject,18_2_1007C220
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_1001C2D0 NtdllDefWindowProc_W,18_2_1001C2D0
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_100222F6 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,18_2_100222F6
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\420a40.msiJump to behavior
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIBD6.tmpJump to behavior
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIC44.tmpJump to behavior
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}Jump to behavior
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\inprogressinstallinfo.ipiJump to behavior
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI1221.tmpJump to behavior
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI1520.tmpJump to behavior
Source: C:\Windows\System32\msiexec.exeFile deleted: C:\Windows\Installer\MSIBD6.tmpJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_070A773018_2_070A7730
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_070B37B018_2_070B37B0
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_070A691018_2_070A6910
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_1008D03318_2_1008D033
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_100B112418_2_100B1124
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_100A535C18_2_100A535C
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_1004599618_2_10045996
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_100819A018_2_100819A0
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_100A5E6818_2_100A5E68
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_100A40CE18_2_100A40CE
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_1004C3B718_2_1004C3B7
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_1009C40718_2_1009C407
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_1008449018_2_10084490
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_10064A2018_2_10064A20
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: String function: 070A56E0 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: String function: 1008BF00 appears 55 times
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: String function: 1008ABD5 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: String function: 1008BECA appears 195 times
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: String function: 1008A218 appears 80 times
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: String function: 1008BE97 appears 174 times
Source: Rcw.ServerAPI.dll.10.drStatic PE information: Resource name: RT_VERSION type: MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"
Source: mfc80KOR.dll.10.drStatic PE information: No import functions for PE file found
Source: mfc80ESP.dll.10.drStatic PE information: No import functions for PE file found
Source: mfc80ITA.dll.10.drStatic PE information: No import functions for PE file found
Source: mfc80ENU.dll.10.drStatic PE information: No import functions for PE file found
Source: mfc80CHT.dll.10.drStatic PE information: No import functions for PE file found
Source: mfc80JPN.dll.10.drStatic PE information: No import functions for PE file found
Source: mfc80DEU.dll.10.drStatic PE information: No import functions for PE file found
Source: mfc80FRA.dll.10.drStatic PE information: No import functions for PE file found
Source: mfc80CHS.dll.10.drStatic PE information: No import functions for PE file found
Source: classification engineClassification label: mal48.rans.evad.winZIP@33/1053@1/0
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_1003DA79 GetLastError,FormatMessageW,18_2_1003DA79
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_1004A51B _memset,lstrcpyW,lstrcatW,GetDiskFreeSpaceExW,GetDiskFreeSpaceW,18_2_1004A51B
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_10060283 __EH_prolog3_GS,CreateToolhelp32Snapshot,GetLastError,Process32FirstW,Process32NextW,OpenProcess,18_2_10060283
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_1005E1FF __EH_prolog3_GS,GetModuleHandleW,GetProcAddress,LoadLibraryW,GetProcAddress,CoCreateInstance,18_2_1005E1FF
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_100452D3 __EH_prolog3,FindResourceW,LoadResource,LockResource,CreateDialogIndirectParamW,CreateDialogIndirectParamW,18_2_100452D3
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737Jump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:876:120:WilError_03
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeFile created: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}Jump to behavior
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeFile read: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Setup.iniJump to behavior
Source: C:\Windows\System32\rundll32.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: unknownProcess created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknownProcess created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknownProcess created: C:\Program Files\7-Zip\7zG.exe "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\" -spe -an -ai#7zMap15170:110:7zEvent13957
Source: unknownProcess created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exe "C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exe"
Source: unknownProcess created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exe "C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exe"
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exe C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exe /q"C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exe" /tempdisk1folder"C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}" /IS_temp
Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 77B4B6CB8D21758EFE216C05F17DCEE1 C
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3C556304-8D46-41A1-A183-C63C96FA76B7}
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C68E9931-1A54-4D29-9A11-E2C1A6140D74}
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3C967A50-E90B-4AD5-B526-62683195C54F}
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EB53D73A-7D41-467E-AF22-FA743D2E5BD2}
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0B631758-29DD-4B8E-9A12-949F140ACCEC}
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{58E35334-6736-4373-BC16-B19DB2B7F3E2}
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{66BF646F-C6CD-4823-BD3A-BBBE0CE92580}
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5DB750C9-5B1D-4912-9BBB-735073942453}
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{85F4BC9B-9F30-4363-AD6D-FD00E62E44B7}
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D823CFD3-3D7A-4194-AD31-CD5AD6A26B55}
Source: unknownProcess created: C:\Windows\System32\SrTasks.exe C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:1
Source: C:\Windows\System32\SrTasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding F52714C42576362BF3928B61AE156682
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exe C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exe /q"C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exe" /tempdisk1folder"C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}" /IS_tempJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3C556304-8D46-41A1-A183-C63C96FA76B7}Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C68E9931-1A54-4D29-9A11-E2C1A6140D74}Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3C967A50-E90B-4AD5-B526-62683195C54F}Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EB53D73A-7D41-467E-AF22-FA743D2E5BD2}Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0B631758-29DD-4B8E-9A12-949F140ACCEC}Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{58E35334-6736-4373-BC16-B19DB2B7F3E2}Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{66BF646F-C6CD-4823-BD3A-BBBE0CE92580}Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5DB750C9-5B1D-4912-9BBB-735073942453}Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{85F4BC9B-9F30-4363-AD6D-FD00E62E44B7}Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D823CFD3-3D7A-4194-AD31-CD5AD6A26B55}Jump to behavior
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 77B4B6CB8D21758EFE216C05F17DCEE1 CJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding F52714C42576362BF3928B61AE156682Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files\7-Zip\7zG.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Program Files\7-Zip\7zG.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Program Files\7-Zip\7zG.exeSection loaded: explorerframe.dllJump to behavior
Source: C:\Program Files\7-Zip\7zG.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Program Files\7-Zip\7zG.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Program Files\7-Zip\7zG.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Program Files\7-Zip\7zG.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Program Files\7-Zip\7zG.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Program Files\7-Zip\7zG.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Program Files\7-Zip\7zG.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Program Files\7-Zip\7zG.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeSection loaded: acgenral.dllJump to behavior
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeSection loaded: samcli.dllJump to behavior
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeSection loaded: msacm32.dllJump to behavior
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: acgenral.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: samcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: msacm32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: msi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: msi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: tsappcmp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: pcacli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: riched32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: riched20.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: usp10.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: msls31.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: explorerframe.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: sfc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: srclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: spp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: vssapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: vsstrace.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: sxproxy.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: srpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: rstrtmgr.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: pcacli.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\System32\msiexec.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeSection loaded: sxs.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: spp.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: srclient.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: srcore.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: vssapi.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: ktmw32.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: powrprof.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: vsstrace.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: wer.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: bcd.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: umpdc.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: ntmarta.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: dsrole.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: msxml3.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: vss_ps.dll
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wininet.dll
Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: iertutil.dll
Source: C:\Program Files\7-Zip\7zG.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exeFile written: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\0x0409.iniJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeFile opened: C:\Windows\SysWOW64\RICHED32.DLLJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: ZPMC SCADA Setup v4.0.12737.zipStatic file information: File size 75435301 > 1048576
Source: Binary string: "ZSNETE~2.PDB|zsNet.ElementBase.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l%ZSNETV~2.PDB|zsNet.ViewClient_WPF.pdb source: setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: lEFZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/Rcw.SdAPI.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZSSERV~1.PDB|zsServerHost.pdbB source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZISCAD~1.PDB|ZiSCADACLR.pdb source: setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2073363822.000000000149F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: RCWSER~1.PDB|RCW.ServerAPI.pdb\L source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: FmtTxt.pdb) source: setup.exe, 00000012.00000003.2073527832.0000000001475000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000146E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: !TCPCOM~1.PDB|TCPCommunication.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/Language.pdbgoD source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: t.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSNETE~1.PDB|zsNet.Element.pdb source: setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.DefStruct.pdbC source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: APPSER~1.PDB|AppServerBase.pdbTM source: setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl TCPDAS~1.PDB|TcpDaSvrWrapper.pdb source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\zsEventService.pdbJ+qiCyZvjnbf6NgG2PLaTivvNsVWVtqaQl+5WdtiswQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZISCAD~3.PDB|ziSCADAStudio.pdbo source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: APPSER~1.PDB|AppServerBase.pdb source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\Formulate.pdbbdNJ9XO409VVoHQY2NaV3Oy48oXLvow8yyNGoUKb/Mw= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/Formulate.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: l$ZSNETE~4.PDB|zsNet.EmtProperties.pdb source: setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l!ZSNETW~1.PDB|zsNet.WinFormsUI.pdb source: setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: NTCPMSG.pdb source: setup.exe, 00000012.00000003.2073527832.0000000001475000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000146E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl ZSNETB~1.PDB|zsNet.BaseClass.pdb source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: FZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/HFacility.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: 6HZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/DataAcsData.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsScada.Studio.Net.pdbg source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsAlmSvrAcs.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: .MZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/OPCDaServWrapper.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: l(ZSNETV~1.PDB|zsNet.VCMS3ScreenEditor.pdb source: setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\RunVBA.pdblTuhanUuBisWShxr799s8NkcZIcdTkIipcCxzkr4MmA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/Extend Dll/ProfiNet/ProfiNetWrapper.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: atl80.i386.pdb source: ATL80.dll1.10.dr, ATL80.dll.10.dr, ATL80.dll0.10.dr
Source: Binary string: program files\ZPMC\SCADA\Bin\AlarmServerCLR.pdb/Gq5O0+zk9sH+OZtYIpx1x/HLxXWkG9jwmb4MAIL5TA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ALARMS~2.PDB|AlarmServerCLR.pdb\L source: setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSNETE~1.PDB|zsNet.Element.pdb M6 source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: v4.0.12737/program files/ZPMC/SCADA/Bin/CApi.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: CApi.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l PROFIN~1.PDB|ProfiNetWrapper.pdb=Ita source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\UserControlBase.pdbzA4caz228yaAXsMa51+Jut2jqvnePUJQY8OI1mLNVlA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.WinFormsUI.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZISCAD~2.PDB|ziSCADAServer.pdb source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2494402472.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\ZCompEx.pdbYM+r8mUJr7CX9xMpIbOgiyNQ8xznIYL0BpfxMO7Stqg= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: program files\ZPMC\SCADA\Bin\ziSCADAView.pdbYJ/ZWsSsjwcJlA2nR3jUS7OpEyarnnIeZDM0ZeBRW6g= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: DATAAC~2.PDB|DataAcsData.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: RCWSER~1.PDB|RCW.ServerAPI.pdb source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZISCAD~3.PDB|ziSCADAStudio.pdb source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: lPData.pdb source: setup.exe, 00000012.00000003.2073527832.0000000001475000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000146E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSSERV~1.PDB|zsServerHost.pdbOM source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSUASV~1.PDB|zsUASvrAcs.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2073363822.000000000149F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: HQUERY~1.PDB|HQueryFacility.pdbTM source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.BaseClass.pdb source: 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZCompEx.pdb source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\HFacility.pdbpFcaEXMM/XHbFS/YZ5JICdPt42tRLQKTeAOfa1jE7bA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/PrjMan.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZSALAR~1.PDB|zsAlarmService.pdb source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/ZiSCADACLR.pdb source: 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: NTCPMSG.pdbh source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.WinFormsUI.pdbi source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\ziSCADAServer.pdbgVX6gmJpvf9H2sh93w886ZAXiy6mPON9AYfy7Jz3oHA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/NTCPMSG.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: +Pl!TCPCOM~1.PDB|TCPCommunication.pdbD source: setup.exe, 00000012.00000003.2401667791.000000000691D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/RCW.ServerAPI.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/OPCDaServWrapper.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: +Pl(ZSNETV~1.PDB|zsNet.VCMS3ScreenEditor.pdbJ source: setup.exe, 00000012.00000003.2397425178.00000000059C6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.Element.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/WndMan.pdbdbbo_ source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: RUNCSH~1.PDB|RunCSharp.pdb* source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: DZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/NTCPMSG.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/UserControlBase.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: Windows\winsxs\73t3z6j5.7agmfc80u.dll.pdb source: 7zG.exe, 0000000A.00000003.1972580949.000002239274A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 3GZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/DataAccess.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: MBZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/WData.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: program files\ZPMC\SCADA\Bin\zsNet.EmtProperties.pdb+i4oWQrULpuIq2T4TVcOBvHCmoT4ab4tmMH5jm/YKJA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: PROFIN~1.PDB|ProfiNetWrapper.pdb` source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/HQueryFacility.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: program files\ZPMC\SCADA\Bin\ziSCADAStudio.pdbGHAjeWSJJcvSIYR5Vu2jV8LtSX0Yu9ezGS9U7joxKOA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/RCW.ServerAPI.dllcation.pdb1i source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl USERCO~1.PDB|UserControlBase.pdb source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2494402472.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WndMan.pdb source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: CWSDA~1.PDB|Rcw.SdAPI.pdb-; source: setup.exe, 00000012.00000002.2452182848.0000000001426000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/HFacility.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: Language.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +`ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/Extend Dll/ProfiNet/ProfiNetWrapper.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/FmtTxt.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZSNETD~1.PDB|zsNet.DefHelp.pdb source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2494402472.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +CZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/FmtTxt.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: WData.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/Old Dll/TCPCommunication.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: !ZSNETE~3.PDB|zsNet.ElementRes.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\zsNet.Element.pdb3G73e+u5ywYmbKPiw+oatyW4KBQBlrG+zi3J6ZqammA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.ViewClient_WPF.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZIP.pdb source: setup.exe, 00000012.00000003.2407110679.000000000685B000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000146E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2494402472.000000000685B000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2402174868.000000000685B000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2073645541.000000000146E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \VCMS3.0\SCADA a\Source\Src\API\Rcw.ServerAPI\obj\Release\Rcw.ServerAPI.pdbXDnD `D_CorDllMainmscoree.dll source: Rcw.ServerAPI.dll.10.dr
Source: Binary string: program files\ZPMC\SCADA\Bin\Old Dll\TCPCommunication.pdb+renYCyyxeBD17JekMQ35RybL1om2tnfvcd5gpBeiWg= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/AlarmServerCLR.pdb source: 7zG.exe, 0000000A.00000003.1975989842.00000223926B1000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: program files\ZPMC\SCADA\Bin\zsNet.DefStruct.pdbXPvfZisQncM3jvRcRa2HWDFG795X/F9RD7mOOrJSNVQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: +Pl#ZSSCAD~1.PDB|zsScada.Studio.Net.pdbX source: setup.exe, 00000012.00000003.2401667791.000000000691D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSNETE~1.PDB|zsNet.Element.pdb3 source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsUASvrAcs.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: HFACIL~1.PDB|HFacility.pdbH source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l#OPCUAD~1.PDB|OPCUADaServWrapper.pdb source: setup.exe, 00000012.00000003.2073363822.000000000149D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\DataAcsData.pdbPTAMqTfcuARhovw8iXOa0w572DtBU5bVNVkYxTqBQ7Q= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/PData.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ALARMS~2.PDB|AlarmServerCLR.pdb source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZISCAD~4.PDB|ziSCADAView.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2494402472.0000000006800000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2073363822.000000000149F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: s.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\zsServerHost.pdbQDq+M91uG67t/KKC1j0QYAD4391dsz5GeH7DDXCH5eA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: l USERCO~1.PDB|UserControlBase.pdb source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSNETB~1.PDB|zsNet.BaseClass.pdb source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl%ZSNETV~2.PDB|zsNet.ViewClient_WPF.pdbV source: setup.exe, 00000012.00000003.2397425178.00000000059C6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\zsAlarmService.pdbNl3QEY4Zzk7S8xQABFrQJoYNlSjB9kSr5S0Z5gCOtPA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: +Pl!TCPCOM~1.PDB|TCPCommunication.pdb source: setup.exe, 00000012.00000003.2403686348.00000000059C7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: HQUERY~1.PDB|HQueryFacility.pdb source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcr80.i386.pdb source: 7zG.exe, 0000000A.00000003.1961246630.00000223932AA000.00000004.00000020.00020000.00000000.sdmp, msvcr80.dll0.10.dr
Source: Binary string: ZSEVEN~1.PDB|zsEventService.pdb source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: RCWSDA~1.PDB|Rcw.SdAPI.pdb6 source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\RCW.ServerAPI.pdbhVIZNbk7BHBi/sOgaWDgtrmJrawqcwMGntCJv1eoADQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: +PlZGTag.pdba source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/WData.pdbdll source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/RunCSharp.pdb{o0 source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZISCAD~1.PDB|ZiSCADACLR.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 2KZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/AlarmServerAPI.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZISCAD~3.PDB|ziSCADAStudio.pdbLr source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: e:\ft_code\drv_proj\drv_rockey4\src\32\vista\rockey4\objfre_wlh_x86\i386\Rockey4.pdb source: setup.exe, 00000012.00000002.2473155026.0000000006586000.00000002.00000001.00040000.00000013.sdmp
Source: Binary string: GZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/HDefStruct.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: program files\ZPMC\SCADA\Bin\OPCUADaServWrapper.pdbisgSc9OgGwW5q8YGr8NbplAset5LpDpXNDTb5exyt5Q= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ALARMS~1.PDB|AlarmServerAPI.pdb0 source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ALARMS~1.PDB|AlarmServerAPI.pdb source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\OPCUABrowse.pdbEpWKBLLKng8L1Z2hD+sBEA7sXeMuJawBU5s4IdgVEig= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: Windows\winsxs\vxgs54we.kj4\.pdbat source: 7zG.exe, 0000000A.00000003.1972809065.0000022392749000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975193758.0000022392749000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1972651086.0000022392737000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl!ZSNETW~1.PDB|zsNet.WinFormsUI.pdb( source: setup.exe, 00000012.00000003.2401667791.000000000691D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/ZiSCADACLR.pdb// source: 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/RunCSharp.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: RCWSER~1.PDB|RCW.ServerAPI.pdbaL source: setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +PlWData.pdb source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/ziSCADAServer.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl ZSNETD~2.PDB|zsNet.DefStruct.pdb source: setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2494402472.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: #OPCUAD~1.PDB|OPCUADaServWrapper.pdb/ source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\NTCPMSG.pdb+qbZtaSkqgRcLB6bBZIBDQUJkg6oTeqUkjDmukv0PDQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: $ZSNETE~4.PDB|zsNet.EmtProperties.pdbg source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\EventServerAPI.pdbywZs/mcSkSP7IEHxIrHlyyxHFpcP1u1C3q3ONqykC0w= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/DataAcsData.pdbl.dll source: 7zG.exe, 0000000A.00000003.1975989842.00000223926B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: v4.0.12737/program files/ZPMC/SCADA/Bin/Extend Dll/ProfiNet/ProfiNetWrapper.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSALAR~1.PDB|zsAlarmService.pdb6 source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.DefStruct.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: e:\ft_code\drv_proj\drv_rockey4\src\32\vista\rockey4usb\objfre_wlh_x86\i386\Rockey4Usb.pdb source: setup.exe, 00000012.00000002.2473155026.0000000006586000.00000002.00000001.00040000.00000013.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsServerHost.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 7BZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/PData.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Data/Lib_D3/Crane.Xt.pdb.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl!OPCDAS~1.PDB|OPCDaServWrapper.pdb source: setup.exe, 00000012.00000003.2401667791.000000000691D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2403686348.00000000059C7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.ViewClient_WPF.pdb[ source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSNETE~1.PDB|zsNet.Element.pdb{ source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 5JZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/RCW.ServerAPI.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: RCWSDA~1.PDB|Rcw.SdAPI.pdb$T source: setup.exe, 00000012.00000002.2494402472.0000000006800000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/OPCUABrowse.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: e:\ft_code\drv_proj\drv_rockey4\src\32\rockeynt\objfre_w2k_x86\i386\rockeynt.pdb source: 7zG.exe, 0000000A.00000003.1961246630.00000223935F0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2473155026.000000000656A000.00000002.00000001.00040000.00000013.sdmp
Source: Binary string: D:\Rockey4Drv\wdm\enduser\objfre\i386\RockUsb.pdb source: setup.exe, 00000012.00000002.2473155026.0000000006586000.00000002.00000001.00040000.00000013.sdmp
Source: Binary string: L.OZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/OPCUADaServWrapper.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: program files\ZPMC\SCADA\Bin\Language.pdbpSxGErW/ehL/cJe7dz/PAg7+Rir/s3VlJooESBZ0RMg= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: @EZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/Language.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: program files\ZPMC\SCADA\Bin\zsNet.ViewClient_WPF.pdb5Nc+GNw6xsin/aC2vxRJiG3ueNAszlwk3cV+m6Biyug= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZSEVEN~1.PDB|zsEventService.pdbpr source: setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl%ZSNETV~2.PDB|zsNet.ViewClient_WPF.pdb source: setup.exe, 00000012.00000002.2500922986.0000000006997000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2403207427.0000000006997000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.ElementRes.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 7FZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/RunCSharp.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsScada.Studio.Net.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/TcpDaSvrWrapper.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: WndMan.pdb1 source: setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/ziSCADAView.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: CoreAPI.pdb3 source: setup.exe, 00000012.00000002.2468744199.00000000059F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2403686348.00000000059FA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: EVENTS~1.PDB|EventServerAPI.pdb source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\ZGTag.pdb1nDOpP2UNJGYCH45/5DEe6GucGydAu1rBU2he5a6YoA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: L3FZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/Formulate.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: RunVBA.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ,0CZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/RunVBA.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: -UZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/Old Dll/TCPCommunication.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: CoreAPI.pdb/ source: setup.exe, 00000012.00000003.2397425178.00000000059FA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\Extend Dll\ProfiNet\ProfiNetWrapper.pdbSGqcu7bNm+yWW7wP0eLfvsjEREPP6odqYTcaWtwnNtQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: \VCMS3.0\SCADA a\Source\Src\API\Rcw.ServerAPI\obj\Release\Rcw.ServerAPI.pdb source: Rcw.ServerAPI.dll.10.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/RunVBA.pdbvoK source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\CodeBases\isdev\Redist\Language Independent\i386\ISSetup.pdb source: setup.exe, 00000012.00000002.2510020399.000000006CA06000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\zsAlmSvrAcs.pdb2awxTeEDHVYlsXpLWyKiz2mzq4nZm1MoWw9W7FMbyEA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: program files\ZPMC\SCADA\Bin\zsTrendAcs.pdbI+G7FfrUnOluYmYpbrbEnb4qiqR4WrNepkpF6Ev4JzQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: TCPDAS~1.PDB|TcpDaSvrWrapper.pdbl source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l1CZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/DaAPIU.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/FuncAPI.pdbl>j' source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\CoreAPI.pdbZsrngPsrAYw3dnALGcwBhnneFAw7yX3hZPIBa0BAF1w= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: program files\ZPMC\SCADA\Bin\HDefStruct.pdbCzX7CmJo3nndAcSKDd6IiwVm52t3gaZEeLL/fmDtX1w= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: %ZSNETV~2.PDB|zsNet.ViewClient_WPF.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l TCPDAS~1.PDB|TcpDaSvrWrapper.pdbd source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/UserControlBase.pdbll source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: PrjMan.pdbS source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +AZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/CApi.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZSTREN~1.PDB|zsTrendAcs.pdb4m source: setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2073363822.000000000149F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: h:\nt.obj.x86fre\base\wcp\tools\msmcustomaction\objfre\i386\msmcustomaction.pdb source: setup.exe, 00000012.00000002.2473155026.0000000006210000.00000002.00000001.00040000.00000013.sdmp
Source: Binary string: CApi.pdb% source: setup.exe, 00000012.00000003.2072971157.000000000146E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2073645541.000000000146E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.DefHelp.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsAlarmService.pdbn.batll source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: lWData.pdb source: setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.VCMS3ScreenEditor.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\PrjMan.pdbrDOLbU8cc1ml83UeTt0+XikyAvG2OQD0cGh0VGQIpCw= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/Language.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: 2DZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/CoreAPI.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: PrjMan.pdb source: setup.exe, 00000012.00000003.2073527832.0000000001475000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000146E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: RunVBA.pdbO source: setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: cation.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\PData.pdbA4Wy9NlEX/Q+rrpRP1jkZFKRsinnbvbcZReHO5xRnmA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/CoreAPI.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: program files\ZPMC\SCADA\Bin\zsUASvrAcs.pdb+214c6Z/f1zI9gpI5wZUr2M2qiKtaS8ks4HHBwKvF8Q= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/EventServerAPI.pdb source: 7zG.exe, 0000000A.00000003.1975989842.00000223926B1000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: +Pl"ZSNETE~2.PDB|zsNet.ElementBase.pdb source: setup.exe, 00000012.00000003.2401667791.000000000691D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2403686348.00000000059C7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsEventService.pdb source: 7zG.exe, 0000000A.00000003.1975989842.00000223926B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: :LZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/UserControlBase.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/OPCUADaServWrapper.pdbQi source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/HDefStruct.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/ZIP.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\DaAPIU.pdbm9rDqcA/83dViPdjMzeA6APZcL5pr7/EW4+Zs8bMbOg= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: PrjMan.pdbP source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsEventService.pdb/=a} source: 7zG.exe, 0000000A.00000003.1975989842.00000223926B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\Rockey4Drv\wdm\enduser\objfre\i386\RockUsb.pdbMZ source: setup.exe, 00000012.00000002.2473155026.0000000006586000.00000002.00000001.00040000.00000013.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/TcpDaSvrWrapper.pdbI.dll source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: !OPCDAS~1.PDB|OPCDaServWrapper.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: FuncAPI.pdb source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl(ZSNETV~1.PDB|zsNet.VCMS3ScreenEditor.pdb source: setup.exe, 00000012.00000002.2500922986.0000000006997000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2403207427.0000000006997000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: RunVBA.pdb- source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ALARMS~2.PDB|AlarmServerCLR.pdbJ source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSSERV~1.PDB|zsServerHost.pdb M6 source: setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2494402472.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\myprogram\CVSProj\ePassSvr\rock_usb\rocknt\objfre\i386\Rockey4.pdb source: 7zG.exe, 0000000A.00000003.1961246630.00000223935F0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2473155026.000000000656A000.00000002.00000001.00040000.00000013.sdmp
Source: Binary string: USERCO~1.PDB|UserControlBase.pdb source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: FmtTxt.pdb source: setup.exe, 00000012.00000002.2468744199.00000000059F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2403686348.00000000059FA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2397425178.00000000059FA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\myprogram\CVSProj\ePassSvr\rock_usb\RockeyCoinstall\objfre\i386\Ry4CoInst.pdbU source: setup.exe, 00000012.00000002.2473155026.0000000006586000.00000002.00000001.00040000.00000013.sdmp
Source: Binary string: lZGTag.pdb] source: setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl!ZSNETE~3.PDB|zsNet.ElementRes.pdb source: setup.exe, 00000012.00000003.2403686348.00000000059C7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/WData.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: CoreAPI.pdb source: setup.exe, 00000012.00000003.2073527832.0000000001475000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000146E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl!ZSNETW~1.PDB|zsNet.WinFormsUI.pdb{ source: setup.exe, 00000012.00000003.2403686348.00000000059C7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl ZSNETB~1.PDB|zsNet.BaseClass.pdbfr source: setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsTrendAcs.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSEVEN~1.PDB|zsEventService.pdb:M source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\RunCSharp.pdb/kBWtLYIdGFyw1TN8IvgppV+xPiyfiTKA37Fhqx8swA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: CApi.pdbc source: setup.exe, 00000012.00000003.2407110679.000000000685B000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2494402472.000000000685B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: OPCUAB~1.PDB|OPCUABrowse.pdbL source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l ZSNETD~2.PDB|zsNet.DefStruct.pdb source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: CApi.pdbW source: setup.exe, 00000012.00000003.2402174868.000000000685B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\CodeBases\isdev\Src\Runtime\InstallScript\ISBEW64\x64\Release\ISBEW64.pdb source: ISBEW64.exe, 00000015.00000000.2082773856.00007FF79E177000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: v4.0.12737/program files/ZPMC/SCADA/Bin/CoreAPI.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: PData.pdbZ source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: DaAPIU.pdb source: setup.exe, 00000012.00000002.2468744199.00000000059F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2073527832.0000000001475000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2403686348.00000000059FA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000146E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2397425178.00000000059FA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 1CZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/PrjMan.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: l!OPCDAS~1.PDB|OPCDaServWrapper.pdb source: setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\WndMan.pdbHt0juaJkP9RWSyjP6ddh2NCwzQ51QPDN153JGmQlw1w= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsAlarmService.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/HDefStruct.pdbtjy source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl$ZSNETE~4.PDB|zsNet.EmtProperties.pdb source: setup.exe, 00000012.00000003.2401667791.000000000691D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2403686348.00000000059C7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 7CZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/WndMan.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: D:\myprogram\CVSProj\ePassSvr\rock_usb\enduser\objfre\i386\Rockey4Usb.pdb source: 7zG.exe, 0000000A.00000003.1961246630.00000223935F0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2473155026.000000000656A000.00000002.00000001.00040000.00000013.sdmp
Source: Binary string: l ZSNETB~1.PDB|zsNet.BaseClass.pdb~ source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\WData.pdbfw7DAyLwrZOpHKBugMNsn9PnzzKhy04OeGteCxLwodQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/DataAccess.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: D:\myprogram\CVSProj\ePassSvr\rock_usb\RockeyCoinstall\objfre\i386\Ry4CoInst.pdb source: setup.exe, 00000012.00000002.2473155026.0000000006586000.00000002.00000001.00040000.00000013.sdmp
Source: Binary string: \UCDemo\obj\Release\UCDemo.pdb source: UCDemo.dll.10.dr
Source: Binary string: program files\ZPMC\SCADA\Bin\zsNet.VCMS3ScreenEditor.pdbXOGvZYk0vlYeKtgbpFxATqKl5hRdaVEcyNu4VWZabpg= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: e:\ft_code\drv_proj\drv_rockey4\src\32\vista\coinstall\objfre_wlh_x86\i386\Ry4CoInst.pdb source: setup.exe, 00000012.00000002.2473155026.0000000006586000.00000002.00000001.00040000.00000013.sdmp
Source: Binary string: MFC80.i386.pdb source: mfc80.dll0.10.dr
Source: Binary string: EVENTS~1.PDB|EventServerAPI.pdb& source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl ZSNETD~2.PDB|zsNet.DefStruct.pdb-r3 source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\FmtTxt.pdbV8acwzpmdLhyzCZzHlY1SdBfnAX2m51uBTX08ZaJIkw= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: RCWSER~1.PDB|RCW.ServerAPI.pdbi source: setup.exe, 00000012.00000003.2073645541.0000000001461000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/PrjMan.pdb$o source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/ziSCADAView.pdbResource/ii source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.ElementBase.pdb source: 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\zsNet.BaseClass.pdbSN7sf2B4S8hse3qg8x6TmaL+Bf/eSHmJZ5tJcuQ5j1Q= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/Rcw.SdAPI.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ,2KZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/EventServerAPI.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: program files\ZPMC\SCADA\Bin\Rcw.SdAPI.pdb40zK1l5r1IVdcrGQDHJ4iN46l4k8fYOzRIhRxxxnwzQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/ZGTag.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/DataAcsData.pdb source: 7zG.exe, 0000000A.00000003.1975989842.00000223926B1000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ,;JZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/AppServerBase.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: l!ZSNETE~3.PDB|zsNet.ElementRes.pdbsn source: setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: L0DZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/FuncAPI.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: program files\ZPMC\SCADA\Bin\FuncAPI.pdbWKZYnfZAIEWhGXdVyaiaSokHV5E7E7ZlmV6HYJegBtg= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ,<KZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/AlarmServerCLR.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZCompEx.pdbu source: setup.exe, 00000012.00000003.2072971157.000000000145B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSTREN~1.PDB|zsTrendAcs.pdbRT source: setup.exe, 00000012.00000002.2494402472.0000000006800000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/ziSCADAStudio.pdbb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l0KZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/HQueryFacility.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: e:\ft_code\drv_proj\drv_rockey4\src\32\vista\rockey4usb\objfre_wlh_x86\i386\Rockey4Usb.pdbN source: setup.exe, 00000012.00000002.2473155026.0000000006586000.00000002.00000001.00040000.00000013.sdmp
Source: Binary string: (ZSNETV~1.PDB|zsNet.VCMS3ScreenEditor.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSSERV~1.PDB|zsServerHost.pdb source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: atl80.i386.pdbP source: ATL80.dll1.10.dr, ATL80.dll.10.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/ziSCADAStudio.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\zsNet.ElementBase.pdbNiyjdKyX7a8HEC+YmrHhkuFzW3XVbkzXmkXmVaVVgJA= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/AlarmServerCLR.pdb# source: 7zG.exe, 0000000A.00000003.1975989842.00000223926B1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: !ZSNETW~1.PDB|zsNet.WinFormsUI.pdbS source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\zsNet.DefHelp.pdb0eWCDbSHO7JEy7YoXIT9P99O8c0y+5or4PYNh74/e7w= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: program files\ZPMC\SCADA\Bin\ZiSCADACLR.pdbEmspR26nVl/p6CjI+Ca88ZYZx98nCs2x/urO4shrWkQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: APPSER~1.PDB|AppServerBase.pdb8 source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsNet.EmtProperties.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZGTag.pdb& source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/AlarmServerAPI.pdb source: 7zG.exe, 0000000A.00000003.1975989842.00000223926B1000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: HDEFST~1.PDB|HDefStruct.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\ZIP.pdbq5sfofa+Y2MFs2iOa00t1HaHzOIN98Ot9vwlDkRrk7Q= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: program files\ZPMC\SCADA\Bin\TcpDaSvrWrapper.pdbCnburEURX1XwTB0aPCr0gFXIZmgod04xa4BG75GQF1A= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: Windows\winsxs\7z1v718o.6n8\mfc80.dllLib_Net/ImageList/Image_Symbol/history alarm.png.pdb source: 7zG.exe, 0000000A.00000003.1972906042.000002239270E000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975694409.0000022392729000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZISCAD~1.PDB|ZiSCADACLR.pdbXT source: setup.exe, 00000012.00000002.2494402472.0000000006800000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: RUNCSH~1.PDB|RunCSharp.pdbnT source: setup.exe, 00000012.00000002.2494402472.0000000006800000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\zsNet.WinFormsUI.pdbZECxiRrmzu/5vdGi8uDFbC67nQJlgOV3eE2ny/2AE/A= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: program files\ZPMC\SCADA\Bin\CApi.pdbQp09apawCVncuo0Qwrqgb5Ol7evl+PVgV1vW4z5WqOQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/WndMan.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/ZCompEx.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl#ZSSCAD~1.PDB|zsScada.Studio.Net.pdb source: setup.exe, 00000012.00000003.2403686348.00000000059C7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\OPCDaServWrapper.pdbazo9K73ePJp5eaivAnbp6GfrzLa2jQv24ElpUYRYvQw= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZISCAD~2.PDB|ziSCADAServer.pdby source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +PlPData.pdby source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: APPSER~1.PDB|AppServerBase.pdb{L source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Language.pdbg source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/DaAPIU.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: program files\ZPMC\SCADA\Bin\AlarmServerAPI.pdb64kiymeQEXcIpRLov4R83UyJhdJQA+RO7a0jZkkoUxw= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/OPCUABrowse.pdb;i source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: FORMUL~1.PDB|Formulate.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l#ZSSCAD~1.PDB|zsScada.Studio.Net.pdbko source: setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: /HZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/OPCUABrowse.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/ziSCADAServer.pdbb#i source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSTREN~1.PDB|zsTrendAcs.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/ZGTag.pdb@oy source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\AppServerBase.pdbEvzWewnot2TPzs3oa7FUOhJptwLqpR1fenknJjugE4Q= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/RunVBA.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/AppServerBase.pdb source: 7zG.exe, 0000000A.00000003.1975989842.00000223926B1000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: +Pl#OPCUAD~1.PDB|OPCUADaServWrapper.pdb source: setup.exe, 00000012.00000003.2401667791.000000000691D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2403686348.00000000059C7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/CApi.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZSNETD~2.PDB|zsNet.DefStruct.pdb source: setup.exe, 00000012.00000002.2462601860.0000000004180000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\CodeBases\isdev\redist\Language Independent\i386\setup.pdb source: setup.exe, 0000000E.00000000.2048637934.00000000000D5000.00000002.00000001.01000000.00000008.sdmp, setup.exe, 00000012.00000000.2057291118.0000000000435000.00000002.00000001.01000000.00000009.sdmp, setup.exe.10.dr, setup.exe.18.dr
Source: Binary string: FuncAPI.pdb3 source: setup.exe, 00000012.00000003.2073527832.0000000001475000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000146E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl PROFIN~1.PDB|ProfiNetWrapper.pdb source: setup.exe, 00000012.00000003.2402174868.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2494402472.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: OPCUAB~1.PDB|OPCUABrowse.pdb source: setup.exe, 00000012.00000002.2494402472.0000000006800000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l!TCPCOM~1.PDB|TCPCommunication.pdbon source: setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/FuncAPI.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Data/Lib_D3/Chassis.Xs.pdb source: 7zG.exe, 0000000A.00000002.1978052133.00000223926C2000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1974975153.00000223926BE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: DATAAC~1.PDB|DataAccess.pdb$ source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSALMS~1.PDB|zsAlmSvrAcs.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2494402472.0000000006800000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2073363822.000000000149F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\zsNet.ElementRes.pdb1X1+ibGSHroQM719tjh9nJh4Vp/tCeNtFrEy0BKyPRQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/Old Dll/TCPCommunication.pdb]i source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\DataAccess.pdbdIs9skEwDKWdooU/1ppvkiPmZwuv1nifzUBksCo/Axw= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: program files\ZPMC\SCADA\Bin\HQueryFacility.pdbvCGtZRJsYo5tHe26INmz+mZvUFXFxWORVGbcsdk6TqQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: +Pl!ZSNETE~3.PDB|zsNet.ElementRes.pdbp source: setup.exe, 00000012.00000003.2401667791.000000000691D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: +Pl TCPDAS~1.PDB|TcpDaSvrWrapper.pdbOM source: setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2494402472.000000000688C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: #ZSSCAD~1.PDB|zsScada.Studio.Net.pdb source: setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/OPCUADaServWrapper.pdb source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975880145.00000223926BB000.00000004.00000020.00020000.00000000.sdmp, ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: /LZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/TcpDaSvrWrapper.pdb source: ZPMC SCADA Setup v4.0.12737.zip
Source: Binary string: rp.pdb source: 7zG.exe, 0000000A.00000003.1972809065.0000022392749000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975193758.0000022392749000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1972651086.0000022392737000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: v4.0.12737/program files/ZPMC/SCADA/Bin/Extend Dll/ProfiNet/ProfiNetWrapper.pdb_k source: 7zG.exe, 0000000A.00000003.1975108571.00000223926B6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ZSUASV~1.PDB|zsUASvrAcs.pdbLT source: setup.exe, 00000012.00000002.2494402472.0000000006800000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: l"ZSNETE~2.PDB|zsNet.ElementBase.pdb source: setup.exe, 00000012.00000003.2073363822.000000000149D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072899743.0000000001497000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Language.pdb% source: setup.exe, 00000012.00000003.2073527832.0000000001475000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000146E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: program files\ZPMC\SCADA\Bin\zsScada.Studio.Net.pdb3B5Byrv6F2DG8fm0vnIpBJ1G7CmgtAdoWL9GaUK5NhQ= source: SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}.19.dr
Source: Binary string: ZPMC SCADA Setup v4.0.12737/program files/ZPMC/SCADA/Bin/zsUASvrAcs.pdb#o source: 7zG.exe, 0000000A.00000003.1975108571.00000223926BA000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 0000000A.00000003.1975061029.00000223926B9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: HQUERY~1.PDB|HQueryFacility.pdb{L source: setup.exe, 00000012.00000003.2407110679.000000000688C000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

barindex
.NET source code contains potential unpacker
Source: CSAssemblyLoader.dll.10.dr, AssReflector.cs.Net Code: Load System.Reflection.Assembly.Load(byte[])
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_070AA750 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,18_2_070AA750
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_070AA720 push eax; ret 18_2_070AA74E
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_10091A45 push ecx; ret 18_2_10091A58
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_1008BE65 push ecx; ret 18_2_1008BE78
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\msvcm80.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeFile created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\_isres_0x0409.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeFile created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISRT.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Program\Rcw.ServerAPI.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\7z1v718o.6n8\mfcm80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\Ansi\ATL80.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIBD6.tmpJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80ENU.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80ESP.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80KOR.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfcm80u.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\Server\AlarmServer\Program\CSProgram.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeFile created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\_isuser_0x0409.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80FRA.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80JPN.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\5z1v718o.6n8\mfc80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80ITA.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\b2rg91xw.1p4\msvcr80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\53t3z6j5.7ag\ATL80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80CHS.dllJump to dropped file
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeFile created: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\ISSetup.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\92rg91xw.1p4\msvcr80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80CHT.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80FRA.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\7z1v718o.6n8\mfcm80u.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Program\CSAssemblyLoader.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80ESP.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\msvcp80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfcm80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\UC\UCDemo.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80DEU.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80ENU.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\msvcr80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80CHS.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80CHT.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80DEU.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80ESP.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80FRA.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80ITA.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\73t3z6j5.7ag\ATL80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Program\CSProgram.dllJump to dropped file
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeFile created: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\7z1v718o.6n8\mfc80.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeFile created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exeJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\5z1v718o.6n8\mfcm80.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIC44.tmpJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\7z1v718o.6n8\mfc80u.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeFile created: C:\Users\user\AppData\Local\Temp\MSI8A92.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeFile created: C:\Users\user\AppData\Local\Temp\MSI8A62.tmpJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80ENU.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeFile created: C:\Users\user\AppData\Local\Temp\MSI89B5.tmpJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\b2rg91xw.1p4\msvcm80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\5z1v718o.6n8\mfcm80u.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\ATL80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\92rg91xw.1p4\msvcm80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80JPN.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80KOR.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80ITA.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80DEU.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80KOR.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI1221.tmpJump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\instdll.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80JPN.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80u.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\5z1v718o.6n8\mfc80u.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\92rg91xw.1p4\msvcp80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80CHT.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80CHS.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\Screen\Program\CSProgram.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeFile created: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\b2rg91xw.1p4\msvcp80.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeFile created: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\setup.exeJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIBD6.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI1221.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIC44.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestoreJump to behavior
Source: C:\Windows\System32\SrTasks.exeRegistry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_10041768 __EH_prolog3,LoadLibraryExW,IsIconic,ShowWindow,18_2_10041768
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_10045D87 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,18_2_10045D87
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_100B53B0 sgdt fword ptr [ebp-08h]18_2_100B53B0
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_100B53D0 sldt word ptr [ebp-08h]18_2_100B53D0
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_100B5400 str word ptr [ebp-04h]18_2_100B5400
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\_isres_0x0409.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\msvcm80.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISRT.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\7z1v718o.6n8\mfcm80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Program\Rcw.ServerAPI.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\Ansi\ATL80.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSIBD6.tmpJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80ESP.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80ENU.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80KOR.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\Server\AlarmServer\Program\CSProgram.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfcm80u.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\_isuser_0x0409.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80FRA.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80JPN.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\5z1v718o.6n8\mfc80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80ITA.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\b2rg91xw.1p4\msvcr80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\53t3z6j5.7ag\ATL80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80CHS.dllJump to dropped file
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\ISSetup.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80CHT.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80FRA.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\92rg91xw.1p4\msvcr80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\7z1v718o.6n8\mfcm80u.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Program\CSAssemblyLoader.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80ESP.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\msvcp80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfcm80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\UC\UCDemo.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80DEU.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80ENU.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\msvcr80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80CHS.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80CHT.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80DEU.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80ESP.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80ITA.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80FRA.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\73t3z6j5.7ag\ATL80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Program\CSProgram.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\7z1v718o.6n8\mfc80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\5z1v718o.6n8\mfcm80.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSIC44.tmpJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\7z1v718o.6n8\mfc80u.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI8A92.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI8A62.tmpJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80ENU.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI89B5.tmpJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\b2rg91xw.1p4\msvcm80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\5z1v718o.6n8\mfcm80u.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\ATL80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\92rg91xw.1p4\msvcm80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80JPN.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80KOR.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80ITA.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80DEU.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80KOR.dllJump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\instdll.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\MSI1221.tmpJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80JPN.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\5z1v718o.6n8\mfc80u.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80u.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\92rg91xw.1p4\msvcp80.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80CHT.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80CHS.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\Screen\Program\CSProgram.dllJump to dropped file
Source: C:\Program Files\7-Zip\7zG.exeDropped PE file which has not been started: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\b2rg91xw.1p4\msvcp80.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeAPI coverage: 4.9 %
Source: C:\Windows\System32\SrTasks.exe TID: 5076Thread sleep time: -110000s >= -30000s
Source: C:\Windows\System32\SrTasks.exeLast function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeFile Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeFile Volume queried: C:\Windows FullSizeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_1003C60E __EH_prolog3_GS,FindFirstFileW,18_2_1003C60E
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_100B86D3 __EH_prolog3_GS,FindFirstFileW,lstrcmpW,lstrcmpW,FindNextFileW,RemoveDirectoryW,__CxxThrowException@8,DeleteFileW,18_2_100B86D3
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_10064701 GetModuleHandleW,GetProcAddress,GetSystemInfo,GetNativeSystemInfo,18_2_10064701
Source: C:\Program Files\7-Zip\7zG.exeFile opened: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Bin\Extend Dll\ProfiNetJump to behavior
Source: C:\Program Files\7-Zip\7zG.exeFile opened: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADAJump to behavior
Source: C:\Program Files\7-Zip\7zG.exeFile opened: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\BinJump to behavior
Source: C:\Program Files\7-Zip\7zG.exeFile opened: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMCJump to behavior
Source: C:\Program Files\7-Zip\7zG.exeFile opened: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Bin\Extend Dll\View ResourceJump to behavior
Source: C:\Program Files\7-Zip\7zG.exeFile opened: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Bin\Extend DllJump to behavior
Source: SrTasks.exe, 00000022.00000003.2442781701.000002463890A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963
Source: setup.exe, setup.exe, 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpBinary or memory string: _GetVirtualMachineType
Source: setup.exe, 00000012.00000003.2391093452.0000000005A36000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 0_GetVirtualMachineType
Source: SrTasks.exe, 00000022.00000003.2409334323.0000024638907000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:w
Source: setup.exe, 00000012.00000003.2390078724.0000000004234000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2399754573.0000000004234000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 0bIsVirtualMachineWindowPowerI*
Source: setup.exe, setup.exe, 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmp, setup.exe, 00000012.00000002.2494402472.0000000006800000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: _IsVirtualMachine
Source: setup.exe, 00000012.00000003.2391093452.0000000005A36000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 0bIsVirtualMachine=%ldSu
Source: setup.exe, 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpBinary or memory string: AddIconCallDLLFnComponentViewCreateWindowComponentViewDestroyComponentViewRefreshComponentViewSelectAllComponentViewSetInfoComponentViewSetInfoExCreateFolderDeleteFolderDeleteIconEnableHourGlassEnumFoldersItemsGetCPUTypeGetFontSubGetHandleGetPortsGetSelectedItemStateIsEmptyIsNTAdminIsOSTypeNTIsObjectIsPowerUserLangLoadStringMessageBeepPPathCompactPathPixelPathCrackUrlPathGetDirPathGetDrivePathGetFilePathGetFileExtPathGetFileNamePathGetLongFromShortPathGetPathPathIsValidSyntaxQueryIconReadArrayPropertyReadBoolPropertyReadNumberPropertyReplaceIconShowFolderTextSubSubstituteVerGetFileVersionWriteArrayPropertyWriteBoolPropertyWriteNumberPropertyWriteStringProperty_AppSearch_BrowseForFolder_CCPSearch_CHARArrayToWCHARArray_CalculateAndAddFileCost_CleanupInet_CloseFile_CmdGetHwndDlg_CmdGetMsg_CmdGetParam1_CmdGetParam2_CoGetObject_CompareDWORD_ComponentAddItem_ComponentCompareSizeRequired_ComponentError_ComponentErrorInfo_ComponentFileEnum_ComponentFileInfo_ComponentFilterLanguage_ComponentFilterOS_ComponentGetCost_ComponentGetCostEx_ComponentGetData_ComponentGetItemSize_ComponentGetTotalCost_ComponentGetTotalCostEx_ComponentInitialize_ComponentIsItemSelected_ComponentListItems_ComponentLoadTarget_ComponentMoveData_ComponentPatch_ComponentReinstall_ComponentRemoveAll_ComponentRemoveAllInLogOnly_ComponentSaveTarget_ComponentSelectItem_ComponentSelectNew_ComponentSetData_ComponentSetupTypeEnum_ComponentSetupTypeGetData_ComponentSetupTypeSet_ComponentTotalSize_ComponentTransferData_ComponentUpdate_ComponentValidate_ComponentViewCreate_ComponentViewQueryInfo_CopyBytes_CreateDir_CreateObject_CreateRegistrySet_CreateShellObjects_CtrlGetNotificationCode_CtrlGetParentWindowHelper_CtrlGetSubCommand_CtrlGetUrlForLinkClicked_CtrlSetHtmlContent_CtrlSetMLERichText_DIFxDriverPackageGetPath_DIFxDriverPackageInstall_DIFxDriverPackagePreinstall_DIFxDriverPackageUninstall_DefineDialog_DeleteCHARArray_DialogSetFont_DisableBranding_DisableStatus_Divide_DoInstall_DoSprintf_DotNetCoCreateObject_DotNetUnloadAppDomain_EnableDialogCache_EnablePrevDialog_EnableSkins_EnableStatus_EnableWow64FsRedirection_EndDialog_ExistsDir_ExistsDisk_ExistsFile_ExitInstall_FeatureAddCost_FeatureAddUninstallCost_FeatureGetCost_FeatureInitialize_FeatureSpendCost_FeatureSpendUninstallCost_FileCopy_FloatingPointOperation_GenerateFileMD5SignatureHex_GetByte_GetCurrentDialogName_GetDiskInfo_GetDiskSpaceEx_GetDiskSpaceExEx_GetFont_GetGlobalFlags_GetGlobalMemorySize_GetInetFileSize_GetInetFileTime_GetLine_GetLineSize_GetObject_GetObjectByIndex_GetObjectCount_GetProcessorInfo_GetRunningChildProcess_GetRunningChildProcessEx_GetRunningChildProcessEx2_GetSelectedTreeComponent_GetStandardLangId_GetSupportDir_GetSystemDpi_GetTrueTypeFontFileInfo_GetVirtualMachineType_InetEndofTransfer_InetGetLastError_InetGetNextDisk_InitInstall_IsFontTypefaceNameAvailable_IsInAdminGroup_IsLangSupported_IsSkinLoaded_IsVirtualMachine_IsWindowsME_IsWow64_KillProcesses_ListAddItem_ListAddString_ListCount_ListCreate_ListCurrentIte
Source: setup.exe, 00000012.00000003.2391093452.0000000005A36000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2390078724.0000000004234000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2399754573.0000000004234000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 0bIsVirtualMachine
Source: setup.exe, 00000012.00000003.2391093452.0000000005A36000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 0_IsVirtualMachineu
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeAPI call chain: ExitProcess graph end nodegraph_18-57818
Source: C:\Windows\System32\msiexec.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_100959E2 _memset,IsDebuggerPresent,18_2_100959E2
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_100A2FF8 RtlEncodePointer,RtlEncodePointer,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,18_2_100A2FF8
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_070AA750 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,18_2_070AA750
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_100522A9 mov esi, dword ptr fs:[00000030h]18_2_100522A9
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_100521D0 GetProcessHeap,RtlAllocateHeap,RtlInterlockedPopEntrySList,RtlInterlockedPopEntrySList,VirtualAlloc,RaiseException,RtlInterlockedPopEntrySList,VirtualFree,RtlInterlockedPushEntrySList,18_2_100521D0
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_10092707 SetUnhandledExceptionFilter,UnhandledExceptionFilter,18_2_10092707
Source: C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exe C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exe /q"C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exe" /tempdisk1folder"C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}" /IS_tempJump to behavior
Source: setup.exe, 00000012.00000000.2057291118.0000000000425000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: <Shell_TrayWnd0x0409
Source: setup.exe, 00000012.00000002.2511374840.000000006CA73000.00000002.00000001.01000000.0000000B.sdmp, setup.exe, 00000012.00000002.2491949919.0000000006630000.00000002.00000001.00040000.0000000B.sdmpBinary or memory string: ?OPTYPE_PROGMAN_FIELDSWWW
Source: setup.exe, 00000012.00000002.2472742914.0000000005D10000.00000004.00000800.00040000.00000012.sdmpBinary or memory string: OPTYPE_PROGMAN
Source: setup.exe, 00000012.00000003.2391093452.00000000059C0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2468744199.00000000059EB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OPTYPE_PROGMANaa>t>U
Source: setup.exe, 00000012.00000002.2468744199.00000000059E8000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2391093452.00000000059C0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OPTYPE_PROGMANt.
Source: setup.exe, 0000000E.00000000.2048637934.00000000000D5000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: Shell_TrayWnd0x0409
Source: setup.exe, 00000012.00000003.2397425178.00000000059EA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2468744199.00000000059E8000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2391093452.00000000059C0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OPTYPE_PROGMAN
Source: setup.exe, 00000012.00000002.2510020399.000000006CA06000.00000002.00000001.01000000.0000000B.sdmpBinary or memory string: lISLOG_VERSION_INFO..\..\..\Shared\LogServices2\LogDB.cppOPTYPE_PROGMANISLOGDB_USER_PROPERTIEST
Source: setup.exe.10.dr, setup.exe.18.drBinary or memory string: AShell_TrayWnd0x0409
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_100B5450 cpuid 18_2_100B5450
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: GetLocaleInfoA,IsValidCodePage,IsValidLocale,18_2_070B0380
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: EnumSystemLocalesA,18_2_070B0BA0
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: EnumSystemLocalesA,18_2_070B0A00
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: EnumSystemLocalesA,18_2_070B0610
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,18_2_070B3E50
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: GetLocaleInfoA,18_2_070B0EA0
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoA,MultiByteToWideChar,MultiByteToWideChar,18_2_070B3CB0
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,GetLocaleInfoW,18_2_100A1A52
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: EnumSystemLocalesEx,EnumSystemLocalesW,18_2_100A2787
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: GetLocaleInfoEx,GetLocaleInfoW,18_2_100A280D
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: GetLocaleInfoW,18_2_100A1C14
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: EnumSystemLocalesW,18_2_100A1CC2
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: _GetPrimaryLen,EnumSystemLocalesW,18_2_100A1D1E
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: _GetPrimaryLen,EnumSystemLocalesW,18_2_100A1D9B
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,18_2_100A1E1E
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: GetLocaleInfoW,18_2_100A2011
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,18_2_100A2139
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: GetLocaleInfoW,_GetPrimaryLen,18_2_100A21E6
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: _memset,_TranslateName,_TranslateName,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,18_2_100A22BA
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_070B33D0 GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,__malloc_dbg,18_2_070B33D0
Source: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exeCode function: 18_2_070A1040 GetVersion,GetCommandLineA,18_2_070A1040

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure2
Replication Through Removable Media		1
Native API		2
Windows Service		2
Windows Service		21
Masquerading		OS Credential Dumping1
System Time Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network Medium1
Data Encrypted for Impact
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading		12
Process Injection		4
Virtualization/Sandbox Evasion		LSASS Memory31
Security Software Discovery		Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
DLL Side-Loading		12
Process Injection		Security Account Manager4
Virtualization/Sandbox Evasion		SMB/Windows Admin SharesData from Network Shared Drive1
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
Deobfuscate/Decode Files or Information		NTDS3
Process Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script2
Obfuscated Files or Information		LSA Secrets1
Application Window Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
Rundll32		Cached Domain Credentials11
Peripheral Device Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
Software Packing		DCSync4
File and Directory Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
DLL Side-Loading		Proc Filesystem35
System Information Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
File Deletion		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1544383 Sample: ZPMC SCADA Setup v4.0.12737.zip Startdate: 29/10/2024 Architecture: WINDOWS Score: 48 63 206.23.85.13.in-addr.arpa 2->63 65 .NET source code contains potential unpacker 2->65 8 7zG.exe 1001 2->8         started        12 setup.exe 6 2->12         started        14 msiexec.exe 3 13 2->14         started        16 3 other processes 2->16 signatures3 process4 file5 45 C:\Users\user\Desktop\...\truck2.jpg, JPEG 8->45 dropped 47 C:\Users\user\Desktop\...\pump1.jpg, JPEG 8->47 dropped 49 C:\Users\user\Desktop\...\naozhong2.jpg, JPEG 8->49 dropped 61 61 other files (2 malicious) 8->61 dropped 67 Modifies existing user documents (likely ransomware behavior) 8->67 51 C:\Users\user\AppData\Local\...\setup.exe, PE32 12->51 dropped 53 C:\Users\user\AppData\Local\...\ISSetup.dll, PE32 12->53 dropped 18 setup.exe 9 61 12->18         started        55 C:\Windows\Installer\MSIC44.tmp, PE32 14->55 dropped 57 C:\Windows\Installer\MSIBD6.tmp, PE32 14->57 dropped 59 C:\Windows\Installer\MSI1221.tmp, PE32 14->59 dropped 21 msiexec.exe 9 14->21         started        23 msiexec.exe 14->23         started        25 conhost.exe 16->25         started        signatures6 process7 file8 35 C:\Users\user\AppData\Local\...\setup.exe, PE32 18->35 dropped 37 C:\Users\user\AppData\...\_isuser_0x0409.dll, PE32 18->37 dropped 39 C:\Users\user\AppData\...\_isres_0x0409.dll, PE32 18->39 dropped 43 5 other files (none is malicious) 18->43 dropped 27 ISBEW64.exe 18->27         started        29 ISBEW64.exe 18->29         started        31 ISBEW64.exe 18->31         started        33 7 other processes 18->33 41 C:\Users\user\AppData\Local\...\instdll.dll, PE32 21->41 dropped process9

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\MSI89B5.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI8A62.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI8A92.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\ISSetup.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISRT.dll4%ReversingLabs
C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\_isres_0x0409.dll2%ReversingLabs
C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\instdll.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\setup.exe0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\ATL80.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\Ansi\ATL80.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80CHS.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80CHT.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80DEU.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80ENU.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80ESP.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80FRA.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80ITA.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80JPN.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80KOR.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80u.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfcm80.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfcm80u.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\msvcm80.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\msvcp80.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\msvcr80.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\53t3z6j5.7ag\ATL80.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\5z1v718o.6n8\mfc80.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\5z1v718o.6n8\mfc80u.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\5z1v718o.6n8\mfcm80.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\5z1v718o.6n8\mfcm80u.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\73t3z6j5.7ag\ATL80.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\7z1v718o.6n8\mfc80.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\7z1v718o.6n8\mfc80u.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\7z1v718o.6n8\mfcm80.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\7z1v718o.6n8\mfcm80u.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\92rg91xw.1p4\msvcm80.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\92rg91xw.1p4\msvcp80.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\92rg91xw.1p4\msvcr80.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\b2rg91xw.1p4\msvcm80.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\b2rg91xw.1p4\msvcp80.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\b2rg91xw.1p4\msvcr80.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80CHS.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80CHT.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80DEU.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80ENU.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80ESP.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80FRA.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80ITA.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80JPN.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80KOR.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80CHS.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80CHT.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80DEU.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80ENU.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80ESP.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80FRA.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80ITA.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80JPN.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80KOR.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Program\CSAssemblyLoader.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Program\Rcw.ServerAPI.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\UC\UCDemo.dll0%ReversingLabs
C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exe0%ReversingLabs
C:\Windows\Installer\MSI1221.tmp0%ReversingLabs
C:\Windows\Installer\MSIBD6.tmp0%ReversingLabs
C:\Windows\Installer\MSIC44.tmp0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://crl.thawte.com/ThawteTimestampingCA.crl00%URL Reputationsafe
http://www.symauth.com/cps0(0%URL Reputationsafe
http://www.symauth.com/rpa000%URL Reputationsafe
http://ocsp.thawte.com00%URL Reputationsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
206.23.85.13.in-addr.arpa
unknown
unknownfalse
    		unknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://www.zpmc.comVERSONsetup.exe, 00000012.00000003.2402174868.00000000068A1000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2407110679.00000000068A2000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2395352507.0000000006877000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2494402472.00000000068A1000.00000004.00000020.00020000.00000000.sdmpfalse
      		unknown
      http://crl.thawte.com/Thasetup.exe, 00000012.00000003.2390078724.0000000004234000.00000004.00000020.00020000.00000000.sdmpfalse
        		unknown
        http://www.zpmc.comsetup.exe, 00000012.00000002.2452182848.00000000013FB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2073527832.0000000001475000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2402174868.00000000068C1000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000002.2452182848.0000000001480000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2402174868.00000000068A1000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2072971157.000000000146E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2407110679.00000000068A2000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2403394781.0000000006954000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2407110679.00000000068C1000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000012.00000003.2401094319.0000000006950000.00000004.00000020.00020000.00000000.sdmp, String1033.txt.18.drfalse
          		unknown
          http://www.installshield.com/isetup/ProErrorCentral.asp?ErrorCode=%dsetup.exe, 0000000E.00000000.2048637934.00000000000D5000.00000002.00000001.01000000.00000008.sdmp, setup.exe, 00000011.00000002.2073364727.00000000000D5000.00000002.00000001.01000000.00000008.sdmp, setup.exe, 00000012.00000002.2446987044.0000000000425000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000012.00000000.2057291118.0000000000425000.00000002.00000001.01000000.00000009.sdmp, setup.exe.10.dr, setup.exe.18.drfalse
            		unknown
            ftp://http://HTTP/1.0mfc80.dll0.10.drfalse
              		unknown
              http://crl.thawte.com/ThawteTimestampingCA.crl0setup.exe, 00000012.00000002.2473155026.00000000062E0000.00000002.00000001.00040000.00000013.sdmp, setup.exe, 00000012.00000002.2473155026.00000000062B6000.00000002.00000001.00040000.00000013.sdmp, MSIC44.tmp.19.dr, MSI8A62.tmp.18.drfalse
              • URL Reputation: safe
              		unknown
              http://www.flexerasoftware.com0setup.exe, 00000012.00000002.2473155026.00000000062E0000.00000002.00000001.00040000.00000013.sdmp, setup.exe, 00000012.00000002.2473155026.00000000062B6000.00000002.00000001.00040000.00000013.sdmp, MSIC44.tmp.19.dr, MSI8A62.tmp.18.drfalse
                		unknown
                http://www.symauth.com/cps0(setup.exe, 00000012.00000002.2473155026.00000000062E0000.00000002.00000001.00040000.00000013.sdmp, setup.exe, 00000012.00000002.2473155026.00000000062B6000.00000002.00000001.00040000.00000013.sdmp, MSIC44.tmp.19.dr, MSI8A62.tmp.18.drfalse
                • URL Reputation: safe
                		unknown
                http://www.symauth.com/rpa00setup.exe, 00000012.00000002.2473155026.00000000062E0000.00000002.00000001.00040000.00000013.sdmp, setup.exe, 00000012.00000002.2473155026.00000000062B6000.00000002.00000001.00040000.00000013.sdmp, MSIC44.tmp.19.dr, MSI8A62.tmp.18.drfalse
                • URL Reputation: safe
                		unknown
                http://ocsp.thawte.com0setup.exe, 00000012.00000002.2473155026.00000000062E0000.00000002.00000001.00040000.00000013.sdmp, setup.exe, 00000012.00000002.2473155026.00000000062B6000.00000002.00000001.00040000.00000013.sdmp, MSIC44.tmp.19.dr, MSI8A62.tmp.18.drfalse
                • URL Reputation: safe
                		unknown
                http://www.zpmc.comallsetup.exe, 00000012.00000003.2395352507.0000000006877000.00000004.00000020.00020000.00000000.sdmpfalse
                  		unknown

                  World Map of Contacted IPs

                  ⊘No contacted IP infos

                  General Information

                  Joe Sandbox version:41.0.0 Charoite
                  Analysis ID:1544383
                  Start date and time:2024-10-29 10:53:25 +01:00
                  Joe Sandbox product:CloudBasic
                  Overall analysis duration:0h 10m 0s
                  Hypervisor based Inspection enabled:false
                  Report type:full
                  Cookbook file name:defaultwindowsinteractivecookbook.jbs
                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                  Number of analysed new started processes analysed:36
                  Number of new started drivers analysed:0
                  Number of existing processes analysed:0
                  Number of existing drivers analysed:0
                  Number of injected processes analysed:1
                  Technologies:
                  • HCA enabled
                  • EGA enabled
                  • AMSI enabled
                  Analysis Mode:default
                  Analysis stop reason:Timeout
                  Sample name:ZPMC SCADA Setup v4.0.12737.zip
                  Detection:MAL
                  Classification:mal48.rans.evad.winZIP@33/1053@1/0
                  EGA Information:
                  • Successful, ratio: 100%
                  HCA Information:
                  • Successful, ratio: 70%
                  • Number of executed functions: 39
                  • Number of non-executed functions: 294
                  Cookbook Comments:
                  • Found application associated with file extension: .zip

                  Warnings

                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, consent.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, VSSVC.exe, svchost.exe
                  • Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                  • Not all processes where analyzed, report is missing behavior information
                  • Reached maximum number of file to list during submission archive extraction
                  • Report size exceeded maximum capacity and may have missing behavior information.
                  • Report size getting too big, too many NtCreateFile calls found.
                  • Report size getting too big, too many NtOpenFile calls found.
                  • Report size getting too big, too many NtOpenKeyEx calls found.
                  • Report size getting too big, too many NtQueryValueKey calls found.
                  • Report size getting too big, too many NtReadFile calls found.
                  • Report size getting too big, too many NtSetInformationFile calls found.
                  • VT rate limit hit for: ZPMC SCADA Setup v4.0.12737.zip

                  Simulations

                  Behavior and APIs

                  TimeTypeDescription
                  05:55:56API Interceptor11x Sleep call for process: SrTasks.exe modified

                  Joe Sandbox View / Context

                  IPs

                  ⊘No context

                  Domains

                  ⊘No context

                  ASNs

                  ⊘No context

                  JA3 Fingerprints

                  ⊘No context

                  Dropped Files

                  ⊘No context

                  Created / dropped Files

                  C:\Users\user\AppData\Local\Temp\8C29.tmp

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exe
                  File Type:Composite Document File V2 Document, Cannot read section info
                  Category:dropped
                  Size (bytes):32768
                  Entropy (8bit):2.472588577829592
                  Encrypted:false
                  SSDEEP:192:JBeBls+7BFlZjzhRsZwnx6233A4wVRsZwXM+6kYKLR49B9g6EJD95yewR+x62338:YBnyMRKLR49LWDT4URKLR49LWD
                  MD5:15A17F29E26E12A306E1615DCF4C70D6
                  SHA1:91E25D400C504B7963CB33135A5BF3ECD87C7E4B
                  SHA-256:65A61D9857453B56625A8E9D250249169CBAF3C47ABBE562BF892B04B3734A89
                  SHA-512:6736413FB91B9518E6F014470D4A48809C5B2FCFE0C195761E7B1A84220D25ACADB713BF01CBFE59FDF2F872CC26470A4E5926319F9B9E05F7ADA25FF19FC721
                  Malicious:false
                  Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Temp\MSI89B5.tmp

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exe
                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):175304
                  Entropy (8bit):6.228940130762618
                  Encrypted:false
                  SSDEEP:3072:mpnAfE+giQ322hTQxecDHudFJhIA+iM7kD5zZPE5TbY/9:mRUQth08oa7JsOJsUl
                  MD5:CC283BCD66F3E37994C1549CE8319BF1
                  SHA1:F66F0BDAEA978DB52FEE7029CE86C20596D11FAF
                  SHA-256:DC546032B595CF94AC0567D5DAB019BAC83EA518BFBFADF8F3DF95D19CB3CCE1
                  SHA-512:E0018853EC305D25DBE7EC43E2FD4A613273C6E4D0CD3D5E607FD1CA7D83C4BAF7502785AB33DC8AC3CAC21804DF6BA617106D9D9D3A7528D630DE5BAFFC7661
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h`....S...S...S...S...SA..S...S...S...S...S...S.~.S...S...S...S.~.S...SA..S...SA..S...SA..S...S...S...SA..S...SRich...S........PE..L.....]Z...........!.....................................................................@..........................B..a...t5..........................................................................@............................................text............................... ..`.rdata..............................@..@.data...41...P......................@....rsrc................@..............@..@.reloc..pH.......J...F..............@..B........................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Temp\MSI8A62.tmp

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):156880
                  Entropy (8bit):6.0277354830634895
                  Encrypted:false
                  SSDEEP:3072:D44gTeAYO7IXGNTCZuoeNw+aqj0FlWUEPK:E4rAYYIXGxoeKr9EC
                  MD5:1A42FF9FF5945CB3A3589A74EB683DE1
                  SHA1:A463B74E1919C3C60A9DAF5462DE9338B426DE9E
                  SHA-256:CDE61E213903F7BFB46EFE6DB64E5946D01CFB169A6859358DF20C3302DCD2ED
                  SHA-512:B485A878E43A39934C9715A271F7D5D1612257EF508817FEFFDF759DFC890BD31ED3C6051A84982F73D3D5915B4739FD3557635B7CE30AFDC7B9D29AEB9020BF
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{..7?..d?..d?..d..#d...d.. d9..d.. d>..d..!d...d.. dL..d6.md<..d6.}d ..d?..d-..d..!d)..d..$d>..d..'d>..d?.yd>..d.."d>..dRich?..d........................PE..L...R.]Z...........!.....J..........v........`.......................................H..................................E............@...............H.......P..H...................................P...@............`...............................text...II.......J.................. ..`.rdata......`.......N..............@..@.data....1..........................@....rsrc........@......................@..@.reloc...J...P...L..................@..B................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Temp\MSI8A92.tmp

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exe
                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):175304
                  Entropy (8bit):6.228940130762618
                  Encrypted:false
                  SSDEEP:3072:mpnAfE+giQ322hTQxecDHudFJhIA+iM7kD5zZPE5TbY/9:mRUQth08oa7JsOJsUl
                  MD5:CC283BCD66F3E37994C1549CE8319BF1
                  SHA1:F66F0BDAEA978DB52FEE7029CE86C20596D11FAF
                  SHA-256:DC546032B595CF94AC0567D5DAB019BAC83EA518BFBFADF8F3DF95D19CB3CCE1
                  SHA-512:E0018853EC305D25DBE7EC43E2FD4A613273C6E4D0CD3D5E607FD1CA7D83C4BAF7502785AB33DC8AC3CAC21804DF6BA617106D9D9D3A7528D630DE5BAFFC7661
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h`....S...S...S...S...SA..S...S...S...S...S...S.~.S...S...S...S.~.S...SA..S...SA..S...SA..S...S...S...SA..S...SRich...S........PE..L.....]Z...........!.....................................................................@..........................B..a...t5..........................................................................@............................................text............................... ..`.rdata..............................@..@.data...41...P......................@....rsrc................@..............@..@.reloc..pH.......J...F..............@..B........................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\0x0409.ini

                  Download File
                  Process:C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exe
                  File Type:Unicode text, UTF-16, little-endian text, with very long lines (308), with CRLF line terminators
                  Category:dropped
                  Size (bytes):22480
                  Entropy (8bit):3.4851320007899904
                  Encrypted:false
                  SSDEEP:384:CTmyuV//BiTbh/YgAwC2WrP2DBWa/Oa0Mhs+XVgv:CT6V//BiXh/t/lWr0aa0Mhs+XVgv
                  MD5:A108F0030A2CDA00405281014F897241
                  SHA1:D112325FA45664272B08EF5E8FF8C85382EBB991
                  SHA-256:8B76DF0FFC9A226B532B60936765B852B89780C6E475C152F7C320E085E43948
                  SHA-512:D83894B039316C38915A789920758664257680DCB549A9B740CF5361ADDBEE4D4A96A3FF2999B5D8ACFB1D9336DA055EC20012D29A9F83EE5459F103FBEEC298
                  Malicious:false
                  Preview:..[.0.x.0.4.0.9.].....1.1.0.0.=.S.e.t.u.p. .I.n.i.t.i.a.l.i.z.a.t.i.o.n. .E.r.r.o.r.....1.1.0.1.=.%.s.....1.1.0.2.=.%.1. .S.e.t.u.p. .i.s. .p.r.e.p.a.r.i.n.g. .t.h.e. .%.2.,. .w.h.i.c.h. .w.i.l.l. .g.u.i.d.e. .y.o.u. .t.h.r.o.u.g.h. .t.h.e. .p.r.o.g.r.a.m. .s.e.t.u.p. .p.r.o.c.e.s.s... . .P.l.e.a.s.e. .w.a.i.t.......1.1.0.3.=.C.h.e.c.k.i.n.g. .O.p.e.r.a.t.i.n.g. .S.y.s.t.e.m. .V.e.r.s.i.o.n.....1.1.0.4.=.C.h.e.c.k.i.n.g. .W.i.n.d.o.w.s.(.R.). .I.n.s.t.a.l.l.e.r. .V.e.r.s.i.o.n.....1.1.0.5.=.C.o.n.f.i.g.u.r.i.n.g. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r.....1.1.0.6.=.C.o.n.f.i.g.u.r.i.n.g. .%.s.....1.1.0.7.=.S.e.t.u.p. .h.a.s. .c.o.m.p.l.e.t.e.d. .c.o.n.f.i.g.u.r.i.n.g. .t.h.e. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r. .o.n. .y.o.u.r. .s.y.s.t.e.m... .T.h.e. .s.y.s.t.e.m. .n.e.e.d.s. .t.o. .b.e. .r.e.s.t.a.r.t.e.d. .i.n. .o.r.d.e.r. .t.o. .c.o.n.t.i.n.u.e. .w.i.t.h. .t.h.e. .i.n.s.t.a.l.l.a.t.i.o.n... .P.l.e.a.s.e. .c.l.i.c.k. .R.e.s.t.a.r.t. .t.o. .r.e.b.o.o.t. .t.h.e. .s.y.s.t.e.m.......1.1.0.8.

                  C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\ISSetup.dll

                  Download File
                  Process:C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):3084932
                  Entropy (8bit):7.223047730252205
                  Encrypted:false
                  SSDEEP:49152:opLRCjqjmPep4H1RL5aIzhXa6vWTrFREOKtPMdl2Vw/gPUTwSqzsJiSnzjOid3hA:odRCjqjmPep4VRLBZgR8VpSqgfzj/3hA
                  MD5:03B8F7FF4AC1ABF8A74CC1F5B4687545
                  SHA1:542C68B89D99832466B93FB49425FD5861DCA19D
                  SHA-256:443BED7954DDDC0123351E756ACDE09577B11265364473259D4FD9526FE28783
                  SHA-512:49EC207739B49C2514F03BD693FAC35F2D1E6D1CFAFF070FE1838A544E4717F24C9BE5736CAB2E3B728AA906D6702F170D1E0B54D27A15770122C10273FFBED8
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A..] ..] ..] ....E.W ....[.E ....X.\ ....X.. ....Y.. ...W*.Z ...W(.\ ...~..X ...W/.J ..] ..."....Y.% ....\.\ ...._.\ ..] ..\ ....Z.\ ..Rich] ..........PE..L.../.]Z...........!.....:...........1.......`...............................@............@..........................E..g;...........0...........................4...g..8...........................X...@............`..0...x........................text....5.......6.................. ..`.orpc... ....P.......:.............. ..`.rdata...!...`..."...>..............@..@.data................`..............@....rsrc........0.......L..............@..@.reloc...!......."...*..............@..B........................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\Setup.INI

                  Download File
                  Process:C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exe
                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):5232
                  Entropy (8bit):3.7310266108721994
                  Encrypted:false
                  SSDEEP:96:rEhkM6EuaE+ubb/dON/XsEbFWaEPRhS+gWPQPgWRGTwQbPrvnp6kY05w7tCYOvlU:YhceELb0cuQaEZhdxoIWRGcQbPr/p008
                  MD5:F38C84CAE82C4F521CAC69DE1C9D662B
                  SHA1:5330D69483E8743EA684F0A9596ECC17EA014F1A
                  SHA-256:22BD9FF4B1F429F453DE8258AF2EF9875F2B8BE2B0858B88DEAF094A1CDF7531
                  SHA-512:B9EBB1F51182FFE29E0165C024050B83884567101A87D4691F2B100FEE16288639994CEE5B81F5CCBB4D467B3AE01FA982154B1205A7BB415D360A97EAB9ECDC
                  Malicious:false
                  Preview:..[.I.n.f.o.].....N.a.m.e.=.I.N.T.L.....V.e.r.s.i.o.n.=.1...0.0...0.0.0.....D.i.s.k.S.p.a.c.e.=.8.0.0.0...;.D.i.s.k.S.p.a.c.e. .r.e.q.u.i.r.e.m.e.n.t. .i.n. .K.B.........[.S.t.a.r.t.u.p.].....C.m.d.L.i.n.e.=.....S.u.p.p.r.e.s.s.W.r.o.n.g.O.S.=.Y.....S.c.r.i.p.t.D.r.i.v.e.n.=.1.....S.c.r.i.p.t.V.e.r.=.2.4...0...0...4.3.8.....D.o.t.N.e.t.O.p.t.i.o.n.a.l.I.n.s.t.a.l.l.I.f.S.i.l.e.n.t.=.N.....O.n.U.p.g.r.a.d.e.=.1.....P.r.o.d.u.c.t.=.S.C.A.D.A. .4...0...1.2...7.3.7.....P.a.c.k.a.g.e.N.a.m.e.=.S.C.A.D.A. .4...0...1.2...7.3.7...m.s.i.....E.n.a.b.l.e.L.a.n.g.D.l.g.=.N.....L.o.g.R.e.s.u.l.t.s.=.N.....D.o.M.a.i.n.t.e.n.a.n.c.e.=.Y.....P.r.o.d.u.c.t.C.o.d.e.=.{.D.F.C.4.8.0.2.4.-.1.A.7.F.-.4.A.F.4.-.A.9.B.D.-.1.9.E.1.C.9.D.E.7.F.5.5.}.....P.r.o.d.u.c.t.V.e.r.s.i.o.n.=.4...0...1.2.7.3.7.....U.p.g.r.a.d.e.C.o.d.e.=.{.8.E.9.9.2.D.6.7.-.4.D.9.9.-.4.1.3.6.-.B.A.C.1.-.1.9.C.1.6.F.8.E.4.0.3.C.}.....L.a.u.n.c.h.e.r.N.a.m.e.=.s.e.t.u.p...e.x.e.....P.a.c.k.a.g.e.C.o.d.e.=.{.6.6.D.F.9.F.5.8.-.4.C.8.9.-.4.E.

                  C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\_ISMSIDEL.INI

                  Download File
                  Process:C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exe
                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):776
                  Entropy (8bit):3.639209440091725
                  Encrypted:false
                  SSDEEP:12:Q+s23EuQ1FuCuWvCTUuQ1FuCuWvCrwuQ1FuCuWvCr4uQ1FuCuWvCU:Q+EnTvvC4nTvvCrQnTvvCrYnTvvCU
                  MD5:C8DED95D1ADD808DFB8065D855481DB4
                  SHA1:643B82A90348B03E8A6895A1A15F3B7DD19BE9B5
                  SHA-256:4BFF7C63694D9C6DED1209B844ABE278B891A3D9CF0042A7BB21D01F0471D05C
                  SHA-512:D4CDC69867C8BC5DDB9B7FC7D4D747897CD4B0721C1CF489EEA254A05DEC0E6852A151CB8F70DCEEC51E41A710622DB94A930C9D633FAB264E2FF18E361702A8
                  Malicious:false
                  Preview:..[.F.i.l.e.s.].....0.x.0.4.0.9...i.n.i.=.C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.{.5.5.0.D.5.6.F.5.-.B.A.1.3.-.4.4.7.E.-.8.3.6.D.-.F.7.C.9.1.8.7.A.5.9.A.9.}.\.0.x.0.4.0.9...i.n.i.....I.S.S.e.t.u.p...d.l.l.=.C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.{.5.5.0.D.5.6.F.5.-.B.A.1.3.-.4.4.7.E.-.8.3.6.D.-.F.7.C.9.1.8.7.A.5.9.A.9.}.\.I.S.S.e.t.u.p...d.l.l.....s.e.t.u.p...e.x.e.=.C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.{.5.5.0.D.5.6.F.5.-.B.A.1.3.-.4.4.7.E.-.8.3.6.D.-.F.7.C.9.1.8.7.A.5.9.A.9.}.\.s.e.t.u.p...e.x.e.....S.e.t.u.p...I.N.I.=.C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.{.5.5.0.D.5.6.F.5.-.B.A.1.3.-.4.4.7.E.-.8.3.6.D.-.F.7.C.9.1.8.7.A.5.9.A.9.}.\.S.e.t.u.p...I.N.I.....

                  C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exe

                  Download File
                  Process:C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exe
                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):1070080
                  Entropy (8bit):6.27053414036148
                  Encrypted:false
                  SSDEEP:12288:HYguHdb3baVXt1S3nQf63mRxJwGxfILBFKTUZAhV2gqbPoAsSmNlK9:4gK3baVdI3WDMCgL6TUCVCbqJl
                  MD5:675A00CA73BAF388C0EBF90C0644E8E0
                  SHA1:53F78A7277FD61BC82FD7A30742D031E51FCD684
                  SHA-256:6CFA520F9F9F92C5616DDFB9E41B1432D83CF3E75A132AE2040BF156F059807C
                  SHA-512:9D89B12E8D8DA04E278517EF64BCB78DA15A7C4AC385EC1C012098B66C77B76F0CD02BC7B16287FEDFDF9FBA46CF9CEBF077D748B0AE4CC6AE48787D68C41176
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N....w.E....j.O...i.V...j......M...k......]..N.......k.y....m.O..N.3.O....h.O..RichN..........PE..L....?]Z.................:...........I.......P....@.......................................@.................................P........p..............................pX..8............................f..@............P......4........................text...I9.......:.................. ..`.rdata...c...P...d...>..............@..@.data...p........$..................@....rsrc........p......................@..@.reloc..<............`..............@..B........................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exe
                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                  Category:dropped
                  Size (bytes):181960
                  Entropy (8bit):5.744053982128781
                  Encrypted:false
                  SSDEEP:3072:eIFNKUw8ALJ+C2T0FSmmiYQT4bF2E+JYGdeZ2bgA/q3QJ:qUn0mT8Sc/T4Z1bIxg8n
                  MD5:82E1A9D1E3D0107F7E1253FA92F86B10
                  SHA1:F8CAE61E8D474BA1279BABA932B76DC3003CCAB6
                  SHA-256:7D6A80AD2527B9769742749D091F17865C700452A2CD192B7C6CCAC6580A9235
                  SHA-512:DC569B11C4E22A075A22C6EF0D2F86B8989E76D30DBCB63FC46BFA77F50861B8F8B80E40D49A02F608FFE16FB94681FB0667FDF4BDD3ECFE0E11B40B81BAC400
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.*.!.D.!.D.!.D../..D.D../..(.D../....D.... .D.!.E.[.D......D.....%.D..... .D.!.. .D..... .D.Rich!.D.........................PE..d.....]Z.........."......X...v.................@..........................................`..................................................J..................$...................`t..8...............................p............p...............................text....W.......X.................. ..`.rdata.......p.......\..............@..@.data... B...`.......D..............@....pdata..$............`..............@..@.rsrc................v..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISRT.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
                  Category:dropped
                  Size (bytes):433856
                  Entropy (8bit):7.973559194327128
                  Encrypted:false
                  SSDEEP:6144:dERGlN8w32rovGse1vxweQCz6HLYwNk+4gsDIG/LxcVwrs7wFNfBjpZ:dE6+oHCHF1iNkqvoFcVwrFfBz
                  MD5:25DDB7E609D08FE8BC83D452E38BFEE1
                  SHA1:E7F34C41B9BA7DDD18F7821AA93C305075C53BDF
                  SHA-256:E6DAF03F2814583E163372B873A938829F57782D581EE931214C92350D18E903
                  SHA-512:99EABDCB2BD1EC77EE5A0A30194B25CA2889BB810572B26B89460CAAB4DFAD7CF65189D2D08054D00723E286188A1004620CF31AA94D8B632DC3D8B65D292C60
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 4%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C.f.C.f.C.f.dp..E.f.p.._.f...b.A.f..q..B.f.p...f.p....f....B.f....G.f.C.g..f....T.f..q....f..q..B.f..q..B.f.C...B.f..q..B.f.RichC.f.........PE..L...K.]Z...........!.....n...<............................................... .......=..................................n...t...........................................8...................................................L@..@....................text............H......PEC2MO...... ....rsrc....@.......4...L.............. ....reloc..............................@...................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\String1033.txt

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exe
                  File Type:Unicode text, UTF-16, little-endian text, with very long lines (332), with CRLF line terminators
                  Category:dropped
                  Size (bytes):194350
                  Entropy (8bit):3.6655967395654456
                  Encrypted:false
                  SSDEEP:1536:AuOLR6/K41VBrChTHB8Ido2hWA/Kr+wuUZU6rPsHnQvvOuyMJice1VOL27p3:AJLu1UTh86WNCCoeO
                  MD5:33A569D7B8E4E915BB7AA8F8424E9ACF
                  SHA1:01CAE7882BACEDCCD066876EF840C4B278115C51
                  SHA-256:6EBA1B9897A2C411C1DC6C720C757D92E046B24A689C68F972A376E3C315DCA4
                  SHA-512:11D6488E85F588659BDA464A7C841958B46C608EF255C26FFCCE11BD1A52D4222CE6E07F50BE43BC07C920CDC670B540F5869BE815D89C0FAB95EF51E48EAC18
                  Malicious:false
                  Preview:..C.O.M.P.A.N.Y._.N.A.M.E.=.S.h.a.n.g.h.a.i. .Z.P.M.C. .E.l.e.c.t.r.i.c. .C.o...L.t.d.....D.N._.A.l.w.a.y.s.I.n.s.t.a.l.l.=.A.l.w.a.y.s. .I.n.s.t.a.l.l.....I.D.P.R.O.P._.E.X.P.R.E.S.S._.L.A.U.N.C.H._.C.O.N.D.I.T.I.O.N._.A.C.R.O.B.A.T.5.F.O.L.D.E.R.=. . . .A.d.o.b.e. .A.c.r.o.b.a.t. .5. .n.e.e.d.s. .t.o. .b.e. .i.n.s.t.a.l.l.e.d. .f.o.r. .t.h.i.s. .i.n.s.t.a.l.l.a.t.i.o.n. .t.o. .c.o.n.t.i.n.u.e.......I.D.P.R.O.P._.E.X.P.R.E.S.S._.L.A.U.N.C.H._.C.O.N.D.I.T.I.O.N._.A.D.O.B.E.R.E.A.D.E.R.1.0.F.O.L.D.E.R.=.A.d.o.b.e. .R.e.a.d.e.r. .1.0. .n.e.e.d.s. .t.o. .b.e. .i.n.s.t.a.l.l.e.d. .f.o.r. .t.h.i.s. .i.n.s.t.a.l.l.a.t.i.o.n. .t.o. .c.o.n.t.i.n.u.e.......I.D.P.R.O.P._.E.X.P.R.E.S.S._.L.A.U.N.C.H._.C.O.N.D.I.T.I.O.N._.A.D.O.B.E.R.E.A.D.E.R.1.1.F.O.L.D.E.R.=.A.d.o.b.e. .R.e.a.d.e.r. .1.1. .n.e.e.d.s. .t.o. .b.e. .i.n.s.t.a.l.l.e.d. .f.o.r. .t.h.i.s. .i.n.s.t.a.l.l.a.t.i.o.n. .t.o. .c.o.n.t.i.n.u.e.......I.D.P.R.O.P._.E.X.P.R.E.S.S._.L.A.U.N.C.H._.C.O.N.D.I.T.I.O.N._.A.D.O.B.E.R.E.A.D.E.R.6.F.O.

                  C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\_isres_0x0409.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):1855595
                  Entropy (8bit):5.675428366439763
                  Encrypted:false
                  SSDEEP:12288:Os4d9dfaOdW4IopJCPtjvntnSb8COevQonCLPub+7PPk:QhrWxoDCPtjvntnSb8COevQonCfjk
                  MD5:44E2F5CBE502DDBED61242CEEA3CC0EA
                  SHA1:5A605766691AA8E8675ED33653C7D4E11067D80A
                  SHA-256:9D205047F66BD5BE0E631FDD1E8ADF244E6927C95FDC080F13AEDB1E558CEBAD
                  SHA-512:1A3F227A3FFC3B96912D74D3C3EBA0A09CB5043E8F3E84CB44DEDD325ECAD3CE8470065E915EEC2209C441A429614FB79DF5AE682CA71714B9C78A01A4D30A44
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 2%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^..(...{...{...{...{...{,..{J..{...{P..{..{...{,..{...{..{...{Rich...{........PE..L...'D]Z...........!.........................................................p...............................................@..(....P..s....................@.......................................................A...............................text...@........................... ..`.rdata........... ..................@..@.data....f.......P..................@....idata.......@....... ..............@....rsrc...s....P.......0..............@..@.reloc...)...@...0... ..............@..B................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\_isuser_0x0409.dll

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):167936
                  Entropy (8bit):6.7467463632949585
                  Encrypted:false
                  SSDEEP:1536:rYrrrrrrrr+rrrrrrrrv9rrrrrrP1KkMaHuJxeMS7qDKhAOV73M/iS/R+o8e2:rtKVaHuJcMSeDKhAOV73M/iS
                  MD5:E34E29935F166A01C2082A1A8C48BA21
                  SHA1:8D59ECC54C7882519C779DF15FE72DB809654307
                  SHA-256:3B5CEAE9715EF4B16B0D9C4D7139CB895BB0500EF6FF00C65F618E61319560C6
                  SHA-512:FA492BF243ACCA69F35BC8671133434E14FF8D82127C27CD2AE365A621F91CD6BFA648BD7A549A0CB285674640001FDC9522D1C9FB1F992542136650F3A60550
                  Malicious:false
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ 5.A[..A[..A[.hG]..A[.Rich.A[.................PE..L...4..\...........!.....................................................................................................................m...........................................................................................................rsrc....m.......p..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\banner.bmp

                  Download File
                  Process:C:\Windows\SysWOW64\msiexec.exe
                  File Type:PC bitmap, Windows 3.x format, 499 x 58 x 24, image size 87002, resolution 5904 x 5904 px/m, cbSize 87056, bits offset 54
                  Category:dropped
                  Size (bytes):87056
                  Entropy (8bit):1.771348664195735
                  Encrypted:false
                  SSDEEP:192:nSpR+hh3ODQJtOdpKQyLYrNXviuFIShoH20vISmtMzk:S30h3/Qfm8Xv7RhC22I
                  MD5:7CDD0F55A4F0076CE8B4F86EF0DC3147
                  SHA1:D7964942569E9D62C36A4F1C9CE43465E6E46E75
                  SHA-256:1B9B8CF8BC110E6C0E70233C526457FD0832EFD5A2CEF5127DE13B71EA54E749
                  SHA-512:CCBF3561527AA7C20FD37EF3040B9C36B8464AAD2079493FBE32261E7ADB6C44D8B50CB9A17AF00517EC46C61E61470BBC3E2BDA73DE09587511C867F8E00E34
                  Malicious:false
                  Preview:BM.T......6...(.......:............S....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\instdll.dll

                  Download File
                  Process:C:\Windows\SysWOW64\msiexec.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):421888
                  Entropy (8bit):5.8211833122934635
                  Encrypted:false
                  SSDEEP:6144:UB9smqYtPKGc3diXLKcK8Wpu9+3VBhn3nOywgya9bUQa9rOPdeI52pietiN2YCB:UWUINoLKcxj9+5nOywgB9bTYFticY
                  MD5:B19941D6B958BCF6A01C5CAAD513CA46
                  SHA1:C1AE529C3D4F4552EF721A706E2B93B3D9CE786A
                  SHA-256:83BC4ADE3C44E082179516BE67061FA5112C8C5FF6CA52B4DD2DCED6EB57AEDB
                  SHA-512:FBFD1CBDD0AB04AA53EEF469DF66FC8418FD2C90AC3F4532ED1930A4CF9E8D5559D1DAA500836749CFA6D664C53B4EA3AECAE02C75D3C37547EBB53C2D9CF962
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............................................................I......q......Rich............................PE..L.....F...........!.....@...@...............P......................................................................Pl.......b..x............................p..0....................................................P...............................text...6:.......@.................. ..`.rdata..^....P... ...P..............@..@.data....T...p...@...p..............@....rsrc...............................@..@.reloc.......p... ...P..............@..B................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\setup.exe

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exe
                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):1070080
                  Entropy (8bit):6.27053414036148
                  Encrypted:false
                  SSDEEP:12288:HYguHdb3baVXt1S3nQf63mRxJwGxfILBFKTUZAhV2gqbPoAsSmNlK9:4gK3baVdI3WDMCgL6TUCVCbqJl
                  MD5:675A00CA73BAF388C0EBF90C0644E8E0
                  SHA1:53F78A7277FD61BC82FD7A30742D031E51FCD684
                  SHA-256:6CFA520F9F9F92C5616DDFB9E41B1432D83CF3E75A132AE2040BF156F059807C
                  SHA-512:9D89B12E8D8DA04E278517EF64BCB78DA15A7C4AC385EC1C012098B66C77B76F0CD02BC7B16287FEDFDF9FBA46CF9CEBF077D748B0AE4CC6AE48787D68C41176
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N....w.E....j.O...i.V...j......M...k......]..N.......k.y....m.O..N.3.O....h.O..RichN..........PE..L....?]Z.................:...........I.......P....@.......................................@.................................P........p..............................pX..8............................f..@............P......4........................text...I9.......:.................. ..`.rdata...c...P...d...>..............@..@.data...p........$..................@....rsrc........p......................@..@.reloc..<............`..............@..B........................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\setup.inx

                  Download File
                  Process:C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):266279
                  Entropy (8bit):7.346526216522207
                  Encrypted:false
                  SSDEEP:3072:jEvKZuE4KOsnuJyHN6hRrM+zzQ9bB2nETfy+CEkf4XtQZYG6r0oX02XmuBJDNSnj:jEKZuE4jyU1s9g6YoXRmouXONTtEp
                  MD5:FFDDCAEFB29B9C60D28E7D0C9C57EEE1
                  SHA1:89686A1BC03134E418166139833842A0C8AB21F4
                  SHA-256:CBCECD2203214DCF0873CAE0A8333FE0D83B6C2918FEAE55DD111A9137E82CF9
                  SHA-512:3BBDAEA76FDB7CE91AF8A068F64508F5C511C6EFA9331EF5ECFB5284F31B237177E788A714882D099264C9E92E5392F162B12D230886610791A8FA2243C4FDCB
                  Malicious:false
                  Preview:t.,....(... <$.M. .=..........l.............o.c...gWSl..SW..WS[//d.d l$.XX%.......................q.y}aK!mQ.Y]A..M1..-!.)........................................}...m..q]}}aMm.U=].E-M.5.=.%.-.......................}.......W.....v.@....qeymee1m.......c.)!!.)g..?.....K.7.+.OH..... .D@..0....e..dXH......P..(..]UU-]......kS.kk.....C.WO7'.[.<X44....,..$.8... ...}..\......@.5km!U.gL.8..g....-....._..k#+G##.LP8.H.@......0...T.......Y..D.........1II.1.o.s..Cg..G.....O.Og.CL<L.P.......p.d$........Y..L......<.. ...III.1..k_.....o.oGO?.....H.,@.X.P. ......p..,...\......m..<.....]YMEE.M..w[..[..{os.....O.C_G.t$l.D8\..........,.......}..]..`.........)5M.5.o.W_...sO3.SGk....h$.`,...4.L.$.<..........@...d...e}}1e.D.....o...S)!!.)g.GsK?..0.....#.h$P(.\\...........x(..am.I...p....H.......=9.!S3.wgksK.......3[C ......(.......,...........q.ayyaa.YQQYYc9E%11%9._.......W{7;wSo.......`(h<......L.4..........ay.q...a}Qii]Q....5MM!5.wSl.-.....w'.+k3/..+d.....

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\0x0409.ini

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:Unicode text, UTF-16, little-endian text, with very long lines (308), with CRLF line terminators
                  Category:dropped
                  Size (bytes):22480
                  Entropy (8bit):3.4851320007899904
                  Encrypted:false
                  SSDEEP:384:CTmyuV//BiTbh/YgAwC2WrP2DBWa/Oa0Mhs+XVgv:CT6V//BiXh/t/lWr0aa0Mhs+XVgv
                  MD5:A108F0030A2CDA00405281014F897241
                  SHA1:D112325FA45664272B08EF5E8FF8C85382EBB991
                  SHA-256:8B76DF0FFC9A226B532B60936765B852B89780C6E475C152F7C320E085E43948
                  SHA-512:D83894B039316C38915A789920758664257680DCB549A9B740CF5361ADDBEE4D4A96A3FF2999B5D8ACFB1D9336DA055EC20012D29A9F83EE5459F103FBEEC298
                  Malicious:false
                  Preview:..[.0.x.0.4.0.9.].....1.1.0.0.=.S.e.t.u.p. .I.n.i.t.i.a.l.i.z.a.t.i.o.n. .E.r.r.o.r.....1.1.0.1.=.%.s.....1.1.0.2.=.%.1. .S.e.t.u.p. .i.s. .p.r.e.p.a.r.i.n.g. .t.h.e. .%.2.,. .w.h.i.c.h. .w.i.l.l. .g.u.i.d.e. .y.o.u. .t.h.r.o.u.g.h. .t.h.e. .p.r.o.g.r.a.m. .s.e.t.u.p. .p.r.o.c.e.s.s... . .P.l.e.a.s.e. .w.a.i.t.......1.1.0.3.=.C.h.e.c.k.i.n.g. .O.p.e.r.a.t.i.n.g. .S.y.s.t.e.m. .V.e.r.s.i.o.n.....1.1.0.4.=.C.h.e.c.k.i.n.g. .W.i.n.d.o.w.s.(.R.). .I.n.s.t.a.l.l.e.r. .V.e.r.s.i.o.n.....1.1.0.5.=.C.o.n.f.i.g.u.r.i.n.g. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r.....1.1.0.6.=.C.o.n.f.i.g.u.r.i.n.g. .%.s.....1.1.0.7.=.S.e.t.u.p. .h.a.s. .c.o.m.p.l.e.t.e.d. .c.o.n.f.i.g.u.r.i.n.g. .t.h.e. .W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r. .o.n. .y.o.u.r. .s.y.s.t.e.m... .T.h.e. .s.y.s.t.e.m. .n.e.e.d.s. .t.o. .b.e. .r.e.s.t.a.r.t.e.d. .i.n. .o.r.d.e.r. .t.o. .c.o.n.t.i.n.u.e. .w.i.t.h. .t.h.e. .i.n.s.t.a.l.l.a.t.i.o.n... .P.l.e.a.s.e. .c.l.i.c.k. .R.e.s.t.a.r.t. .t.o. .r.e.b.o.o.t. .t.h.e. .s.y.s.t.e.m.......1.1.0.8.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Autorun.inf

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:Microsoft Windows Autorun file
                  Category:dropped
                  Size (bytes):27
                  Entropy (8bit):4.1804513908921015
                  Encrypted:false
                  SSDEEP:3:It1qQdh49:e1qQb49
                  MD5:C14C468795575BCE73D84989262479B4
                  SHA1:D0B67C20ED1B09A741D1A5B55A32DA0BA029E6C4
                  SHA-256:B23D74C6CC9B268B523710E07FC3AD27E5EE20FF072D66B4140069884AEB2395
                  SHA-512:7CF4D224DDEDFF3E6859E4B341E8EC86918E15EB2A943AE48A23BDC90251D9F87D12B1F222FE8B1F69258F5F0B21414B2B6D69A11A78BC98666C54E4BF6365EB
                  Malicious:false
                  Preview:[autorun]..OPEN=setup.exe..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\SCADA 4.0.12.737.msi

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: Installation Database, Comments: Contact: Your local administrator, Keywords: Installer,MSI,Database, Subject: Blank Project Template, Author: Shanghai ZPMC Electric Co.Ltd, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2018 - Professional Edition 24, Last Saved Time/Date: Wed Jun 5 02:57:46 2019, Create Time/Date: Wed Jun 5 02:57:46 2019, Last Printed: Wed Jun 5 02:57:46 2019, Revision Number: {66DF9F58-4C89-4E3E-AF81-ABF197C1156B}, Code page: 1252, Template: Intel;1033
                  Category:dropped
                  Size (bytes):3905024
                  Entropy (8bit):6.133000677779072
                  Encrypted:false
                  SSDEEP:98304:x6a1SmKbjgRzVW8iy9zpplkVW8iy9zpGa4Yi:x2IzVW8iy9zppKVW8iy9zpGDYi
                  MD5:32F1FFD5853059FE0D14CA8897DA9BE5
                  SHA1:AD6B641D75F4596C2B7A1812CE78A315A65EA8AB
                  SHA-256:F39C1E9DA463FB7B7791B3DC9C0FBD0FD4528E51BA59212113C1B36994B74762
                  SHA-512:56457F8F049A46A8455A2636BF35746D046B2D38C398F7038F7A15027064456E9E65D142C3422710BB273F0FB346D5A07271E0C0BABEE4C250C61C2833D9535C
                  Malicious:false
                  Preview:......................>...................<...............8...................................Q.......................................................................................................................................................................................................................................................................................................................................................................................................................................;.......................?.......)................................................................................... ......."...#...$...%...&...'...(.......*...+...,...-......./...0...1...2...3...4...5...6...7...>...M...:...<.......=.......A...@...T...B...C...D...E...F...G...H...I...J...K...L...N...>...O...P...Q...R...S...V...U...d...W...X...Y...Z...[...\...]...^..._...`...a...b...c...f...e...t...g...h...i...j...k...l...m...n...o...p...q...r...s...v...u.......w...x...y...z...

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Setup.ini

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):5232
                  Entropy (8bit):3.7310266108721994
                  Encrypted:false
                  SSDEEP:96:rEhkM6EuaE+ubb/dON/XsEbFWaEPRhS+gWPQPgWRGTwQbPrvnp6kY05w7tCYOvlU:YhceELb0cuQaEZhdxoIWRGcQbPr/p008
                  MD5:F38C84CAE82C4F521CAC69DE1C9D662B
                  SHA1:5330D69483E8743EA684F0A9596ECC17EA014F1A
                  SHA-256:22BD9FF4B1F429F453DE8258AF2EF9875F2B8BE2B0858B88DEAF094A1CDF7531
                  SHA-512:B9EBB1F51182FFE29E0165C024050B83884567101A87D4691F2B100FEE16288639994CEE5B81F5CCBB4D467B3AE01FA982154B1205A7BB415D360A97EAB9ECDC
                  Malicious:false
                  Preview:..[.I.n.f.o.].....N.a.m.e.=.I.N.T.L.....V.e.r.s.i.o.n.=.1...0.0...0.0.0.....D.i.s.k.S.p.a.c.e.=.8.0.0.0...;.D.i.s.k.S.p.a.c.e. .r.e.q.u.i.r.e.m.e.n.t. .i.n. .K.B.........[.S.t.a.r.t.u.p.].....C.m.d.L.i.n.e.=.....S.u.p.p.r.e.s.s.W.r.o.n.g.O.S.=.Y.....S.c.r.i.p.t.D.r.i.v.e.n.=.1.....S.c.r.i.p.t.V.e.r.=.2.4...0...0...4.3.8.....D.o.t.N.e.t.O.p.t.i.o.n.a.l.I.n.s.t.a.l.l.I.f.S.i.l.e.n.t.=.N.....O.n.U.p.g.r.a.d.e.=.1.....P.r.o.d.u.c.t.=.S.C.A.D.A. .4...0...1.2...7.3.7.....P.a.c.k.a.g.e.N.a.m.e.=.S.C.A.D.A. .4...0...1.2...7.3.7...m.s.i.....E.n.a.b.l.e.L.a.n.g.D.l.g.=.N.....L.o.g.R.e.s.u.l.t.s.=.N.....D.o.M.a.i.n.t.e.n.a.n.c.e.=.Y.....P.r.o.d.u.c.t.C.o.d.e.=.{.D.F.C.4.8.0.2.4.-.1.A.7.F.-.4.A.F.4.-.A.9.B.D.-.1.9.E.1.C.9.D.E.7.F.5.5.}.....P.r.o.d.u.c.t.V.e.r.s.i.o.n.=.4...0...1.2.7.3.7.....U.p.g.r.a.d.e.C.o.d.e.=.{.8.E.9.9.2.D.6.7.-.4.D.9.9.-.4.1.3.6.-.B.A.C.1.-.1.9.C.1.6.F.8.E.4.0.3.C.}.....L.a.u.n.c.h.e.r.N.a.m.e.=.s.e.t.u.p...e.x.e.....P.a.c.k.a.g.e.C.o.d.e.=.{.6.6.D.F.9.F.5.8.-.4.C.8.9.-.4.E.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\ATL80.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):96256
                  Entropy (8bit):6.55872219718069
                  Encrypted:false
                  SSDEEP:1536:RCYlLTNQQ/Nucs4hRKF+HnLoRsV1TlWh8XhylIjwaCi6imXmwxCU4tkm:R7LTNzNup4hAQHnLP+VXmwxCtk
                  MD5:3C7DEF3CBBCA6284867AA4621D5D8A54
                  SHA1:4BD9852F1F063B9FD1E1829B756D381E14609FA7
                  SHA-256:DB18738202DCDA842DCE505ECD0B858D7B4C55886CAC29827305F0DC3839143A
                  SHA-512:1F9E89114A579BBB0C175D5FB587D58A923A0F556361B2F6C5AE3FFEB139539733E46EDB3DF1627FA630D5BC80CDF5FF311CA75754CA306345569CD48F51F2C4
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."..xft.+ft.+ft.+.{.+dt.+A..+mt.+.{.+et.+ft.+.t.+A..+}t.+A..+mt.+A..+gt.+A..+gt.+A..+gt.+Richft.+................PE..L...V#qE...........!..............................c|................................Xe....@..........................G......<A..(....`..H#..........................`...............................84..@...............(....5.......................text............................... ..`.rdata...N.......P..................@..@.data........P.......:..............@....rsrc...H#...`...$...>..............@..@.reloc...............b..............@..B........................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\Ansi\ATL80.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):114688
                  Entropy (8bit):6.0388652367568465
                  Encrypted:false
                  SSDEEP:1536:bXZ+Tor/Emj1j7yVBKj+yG0o776WXQKYoz/TEItEL6rXmwasUJ:bXHrMmj1jWVB9yG0mPTgIXmwaR
                  MD5:EAA7C9B3EA2BF53914A06A6549455123
                  SHA1:B1839B53B06040786F3BF9D798E63863F8FCD0CC
                  SHA-256:529970B1CC56BF8A9C3675E80A16F840A3EA1B7D999E7000AB399C033731731B
                  SHA-512:3B814A01BCC73C2F55581B8F8446F8452ACC63787F8B063A5D2720B09401353D2F95AD1A392F887725A1DA2E391879D7279AF557E03316BAFB36A6F989075E17
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o7...d...d...dT.^d...d.$|d...dT.\d...d...dU..d.$ld...d.$od...d.${d...d.$}d...d.$yd...dRich...d................PE..L...]#qE...........!..............................c|......................................@.........................PV.......O..(....p..@#......................\...p................................B..@...............4....D.......................text............................... ..`.rdata..-M.......P..................@..@.data........`.......`..............@....rsrc...@#...p...0...p..............@..@.reloc..`........ ..................@..B........................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):1101824
                  Entropy (8bit):6.52190273109876
                  Encrypted:false
                  SSDEEP:24576:Tp2G61fY62if0Vra3QSNhJK6hIAloY3XjrN/:TcGifY6tOaASNhJK6hPaG/R
                  MD5:1B7524806D0270B81360C63A2FA047CB
                  SHA1:D688D77F0CAA897E6EC2ED2C789E77B48304701F
                  SHA-256:CEEF5AA7F9E6504BCE15B72B29DBEE6430370BAA6A52F82CF4F2857568D11709
                  SHA-512:B34539FBDA2A2162EFA2F6BB5A513D1BB002073FA63B3FF85AA3ADE84A6B275E396893DF5AB3A0A215CADE1F068E2A0A1BBD8895595E31D5A0708B65ACEC8C73
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........t..'..'..'3..'..'n..'..'3..'..'3..'...'..'...'.r.'..'gp.'..'.r.'...'.r.'..'.r.'...'.r.'/..'.r.'..'.r.'..'.r.'..'Rich..'................PE..L....3qE...........!.....p...p......yT.............x................................P@....@..............................e......x...................................0...................................@...............@............................text....o.......p.................. ..`.data...xi.......P..................@....rsrc...............................@..@.reloc..f8.......@..................@..B........................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80CHS.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):40960
                  Entropy (8bit):3.7202246676917885
                  Encrypted:false
                  SSDEEP:384:PODNemsol/tAGqyVUIrvxW24WRqJwxV0fwItnFiHyt6S26r81Jd5AJd:POZXsKAGDTrvfTx4wItnFfL26r81nE
                  MD5:AFA7E91C8C9566E03FB1620F95230B93
                  SHA1:75057A0E936032EC9CBC77559241720F58BFAB84
                  SHA-256:4EAF1750A573BAB5C853E7714EFCC84FF2FCF992AD935FD01AF9E2A5BD01A93A
                  SHA-512:B9C34166555F42D4A4E754131FD2868B4FC2965AC8519A6EEED8A32F6C67E1E6E5B4DAA93175967F5F687D8333CA53C4D183A2177191A81BC01E89B7CBDC9BB3
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L..._4qE...........!..............................6].................................@....@..............................................~...........................................................................................................rsrc....~..........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80CHT.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):45056
                  Entropy (8bit):3.527823884757394
                  Encrypted:false
                  SSDEEP:384:PvDNumStwO/tAGqyVB+dvEQW23WRcMUn5xm9za2JokMw6TERPB1ECA:PvZHSGMAGDadv6On5x4pqwPPB1EC
                  MD5:2DCA32742F80BB37E159B651F8EEF44B
                  SHA1:DCD0265FBE8EFD63C235ED4611AECC4B935C057C
                  SHA-256:A7EAF2B5DF991654500FFED95D3950A46DD0FE05CDDCCCD77490F125E22B80D6
                  SHA-512:40E1533F6989955F537D556AB28FF0BE44658309EEF5D40093BF3FCEC39AD85EA14BB2B880FF5C067CCFC257A35361C25AAC087E0463BAFE39FB265B8A0825EE
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L..._4qE...........!..............................6]................................Mp....@..........................................................................................................................................................rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80DEU.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):65536
                  Entropy (8bit):3.09089382778059
                  Encrypted:false
                  SSDEEP:1536:v1AGDh+vfxzesi870vYtNerHI4Lhp0vcsjsr:v1AGDhuxzesi870hLhp0vcsjsr
                  MD5:1E6719EBEB1D368E09899A9D0DDFAD70
                  SHA1:FC510A6DBE0D9180F203AF651E186979B628675F
                  SHA-256:734EB909C54A0A1C53AA5177727660B1C64F3D261B222FEAEC76FC5853300661
                  SHA-512:C5753B79D97204C130A2C0A46D7717E74C140D207A446918DF113A6C460F538AFE0A48AF52360D8A501104283311667CE8DD23B4D3E65B7EE99939A791C25AD6
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L...^4qE...........!..............................6]................................?.....@..........................................................................................................................................................rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80ENU.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):57344
                  Entropy (8bit):3.050363341730474
                  Encrypted:false
                  SSDEEP:384:PODNXnSkNsq/tAGqyV5KOvxW2+WR1BrxiFc+hV9RLNq/HRK/+nnWT59Dl:POZX3s4AGDCOvJ1B4V9RLNqfRKGnWHB
                  MD5:9090454E6772F7CFBCE240BF4DC5F7E8
                  SHA1:3AFD27AF1FBB5D2EFDE463869A1E6465AFFBCDD8
                  SHA-256:A532044DFD1FA6463516125EA74C250762DE4DACBE613F8AD2FF72D50C0B9585
                  SHA-512:4691138B2E32447A6300A17967C1221153B5B514EE0EDCD25A135DCE2A6EEFEA9CC7F3FC516A9B3482FEB62DC190A7F4192BCF15D9793832F828078557E24CDF
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L..._4qE...........!..............................6].................................g....@.............................................(............................................................................................................rsrc...(...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80ESP.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):61440
                  Entropy (8bit):3.0964773972990574
                  Encrypted:false
                  SSDEEP:768:PsZTQAGDf3vr0or0GBFCDCLhedUPYVbS/:AQAGDPvr0or0GBFMkhedUkS
                  MD5:D47599748B3ECF645C47CAA0BC24A7CD
                  SHA1:2F47846B9308FE4B444363F0863F394A1B13C938
                  SHA-256:10FD5EEBE39ACD996309DA073B247B365CBC0F48F43DA3062463EA9F712319CA
                  SHA-512:30B0F056123657EACA8F97138E1CA5C2981575420938EE7ED645E4D62F2A159C011EFF08C2EE20AC68504BD59D890DBC030718A9BA185871B07DEE9851CF2608
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L..._4qE...........!..............................6]......................................@..........................................................................................................................................................rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80FRA.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):61440
                  Entropy (8bit):3.1658595093754625
                  Encrypted:false
                  SSDEEP:768:xZweyAGDSRvjZrkh2A6NTi7e3RAaTaPCeyGdZmBSg3T1SyyyyyyyyyyyyyyyafyL:7yAGD+vjZbA2SCeB0Ug4
                  MD5:EEC2F9E4D790BCCDBC542715AB613579
                  SHA1:8993E9F0CC4657E40866EFBA0CAB7E077060CEA8
                  SHA-256:E283B055A0B9F522FF415B78F100542255AA07CB17C1EEB3885E75326D9DBC66
                  SHA-512:89C083C820798872F3FEECFFCCC1A5CCEF9A367C8AF2170EC06B04A64A234DD03CDFE250B31B5969F87CAA8E7EA8393FBCBBCBF16D83C35105814501B6BE08E8
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L...^4qE...........!..............................6].................................E....@.............................................(............................................................................................................rsrc...(...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80ITA.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):61440
                  Entropy (8bit):3.1028777863172503
                  Encrypted:false
                  SSDEEP:768:OZ0odoAGDI6vuoG57PxtINJ8Il8QcPOCeFO/:5o+AGDHvuoc7PxtINJ8gIPp
                  MD5:CB23B162AC655F24C6711A5F5DF348C6
                  SHA1:E4E0E803B9297B0937824C53F227598998229463
                  SHA-256:6498EE1449B61B40E2DAB46F0B3DFA15F17590D7AA87919580748EC9D4BC2C55
                  SHA-512:460D235818CD83D9020A13F47B24AADC777E4BDC81A6387D8BB59DAF37EAF930C70ACE5E238FE2FA34491A03B3972F11A4BDB8D30FF98801ACFF82630B6D24A2
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L...^4qE...........!..............................6].....................................@.............................................(............................................................................................................rsrc...(...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80JPN.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):49152
                  Entropy (8bit):3.7900346517730297
                  Encrypted:false
                  SSDEEP:384:VDNCysmq/tAGqyVVp7vhedW20WR2JkQbXDr10Jh8I2Bb4:VZXsPAGDN7vQv2Jkkr10IIc4
                  MD5:012031B19F0A9F6431997C79E1893822
                  SHA1:2265C92B3ED9EC169E2C362E448B0E3F449528A3
                  SHA-256:ED296B3DD004C8845A7015A3A5EF3A92331E30535204A02995323681CBD342AB
                  SHA-512:B4CCA371481B349546AD09C40461258A99E5AD6CF7B66FE040A37F90071C420CC41E74F495141A490B4848B66DA876AD8B91AC7C14A328CF5C4CCAADFD3E226E
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L...^4qE...........!..............................6]......................................@.............................................8............................................................................................................rsrc...8...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80KOR.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):49152
                  Entropy (8bit):3.724944556618916
                  Encrypted:false
                  SSDEEP:384:PUDNSnxGr/tAGqyV0/NvbW2OWRFKu/KV0YfmtT2XYm66tHggFK417RTNbU/Ltl3h:PUZSE5AGD0NvrDriHqN
                  MD5:FEC4610F1174136B1D3DB2AE37924CE8
                  SHA1:BA94E77BB29B9B74EA8E2A8FD005DC3083166F3C
                  SHA-256:A6D0B3D20E67C26F7C247F2EEB8DBA723B396B118A1B9EAA4568C474826EA740
                  SHA-512:9144A0243E41EC17628A740913A745261346EFA2DFF3F61D48CCF186F30A1527F6A4F5CB3F7F7727D7BFD4103E9FC90CAE1E0CEFBC1D8D042218D9D2EA869A36
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L..._4qE...........!..............................6]................................b.....@.........................................................................................................................................................rsrc..............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfc80u.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):1093120
                  Entropy (8bit):6.517624141841358
                  Encrypted:false
                  SSDEEP:12288:o5lk6KUYmYRP6vAt9+J51r64f22JhPeEiz8F+p/xoOTa+S9XqNNw2ohW3:UyUaP64t9+JfrRJiz8F+p/N2/cmW
                  MD5:CCC2E312486AE6B80970211DA472268B
                  SHA1:025B52FF11627760F7006510E9A521B554230FEE
                  SHA-256:18BE5D3C656236B7E3CD6D619D62496FE3E7F66BF2859E460F8AC3D1A6BDAA9A
                  SHA-512:D6892ABB1A85B9CF0FC6ABE1C3ACA6C46FC47541DFFC2B75F311E8D2C9C1D367F265599456BD77BE0E2B6D20C6C22FF5F0C46E7D9BA22C847AD1CBEDC8CA3EFF
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................R..............R.......R...............l......n......l......l......l......l.L....l......l......l.....Rich............PE..L...84qE...........!.....p...\.......U.............x......................................@.........................@....e..4...x.......................................................................@...............4...<........................text...'n.......p.................. ..`.data....k.......J...t..............@....rsrc...............................@..@.reloc..R7.......8...v..............@..B................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfcm80.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                  Category:dropped
                  Size (bytes):69632
                  Entropy (8bit):5.417242053474202
                  Encrypted:false
                  SSDEEP:768:j8a7gcNrNDnQrZ6dOyOi9aBlrkY+qkJlyQA10y0ECL8IRO03VmOAPqixji4GY:j8CbQraAk3qkSqhRrODOACixji4T
                  MD5:C84E4ECE0D210489738B2F0ADB2723E8
                  SHA1:63C1FA652F7F5BD1FCCBE3618163B119A79A391C
                  SHA-256:ED1DCDD98DAC80716B2246D7760F0608C59E566424AC1A562090A3342C22B0A7
                  SHA-512:3EE1DA854E7D615FA4072140E823A3451DF5D8BEBF8064CC9A399DEC1FB35588F2A17C0620389441CA9EDD1944C9649002FE4E897C743FE8069B79A5AA079FE2
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z#Z..M...M...M.......M.......M...L.v.M...6...M.O.3...M... ...M...0...M...#...M...7...M...1...M...5...M.Rich..M.................PE..L....4qE...........!.........@....................U|......................... ............@.............................................................................................................@...............<...............H............text............................... ..`.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\mfcm80u.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                  Category:dropped
                  Size (bytes):57856
                  Entropy (8bit):6.049264994442299
                  Encrypted:false
                  SSDEEP:768:nxSa8B2TJIS8uM07yOi9aBlv0J4Wrk7lyQQz4tzIdcRVS0aWNclFnzmOA7q3PWM:ga88R8n40eWrkMst0qS2KlFaOAm3PW
                  MD5:DDAD68E160C58D22B49FF039BB9B6751
                  SHA1:C6C3B3AF37F202025EE3B9CC477611C6C5FB47C2
                  SHA-256:F3A65BFC7FCE2D93FDF57CF88F083F690BC84B9A7706699D4098D18F79F87AAA
                  SHA-512:47665672627E34AD9EA3FD21814697D083EEEAFC873407E07B9697C8AB3C18743D9FCB76E0A08A57652EA5FB4396D891E82C7FDE2146FC8B636D202E68843CF4
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_...>._.>._.>._.1._.>._.1._.>._.>._A>._..._.>._E.._.>._..._.>._..._.>._..._.>._..._.>._..._.>._..._.>._Rich.>._........................PE..L....4qE...........!.........,....................e|......................... ......~.....@.........................`...................................................................................@...............,...............H............text...!........................... ..`.data...h...........................@....rsrc...............................@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\msvcm80.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                  Category:dropped
                  Size (bytes):479232
                  Entropy (8bit):6.031745108754355
                  Encrypted:false
                  SSDEEP:6144:9Rj8Tfo4zrcq2FXOth6wsjb2fPzatjLhQeRW86ODl1KWOjPQeH:9So4zATQsjyWRhQ+W83D/6QO
                  MD5:CAE6861B19A2A7E5D42FEFC4DFDF5CCF
                  SHA1:609B81FBD3ACDA8C56E2663EDA80BFAFC9480991
                  SHA-256:C4C8C2D251B90D77D1AC75CBD39C3F0B18FC170D5A95D1C13A0266F7260B479D
                  SHA-512:C01D27F5A295B684C44105FCB62FB5F540A69D70A653AC9D14F2E5EF01295EF1DF136AE936273101739EB32EFF35185098A15F11D6C3293BBDCD9FCB98CB00A9
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-./.ihA.ihA.ihA..g..mhA.ih@..hA.N.:.lhA...?.hhA.N.<.hhA.N.,.fhA.N./..hA.N.;.hhA.N.=.hhA.N.9.hhA.RichihA.........................PE..L...."qE...........!.........@.......T............L|................................2.....@.............................c ..D...d.....................................................................@..............................H............text....x.......................... ..`.rdata..S[.......`..................@..@.data............ ..................@....rsrc...............................@..@.reloc..P$.......0... ..............@..B........................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\msvcp80.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):548864
                  Entropy (8bit):6.402420828464982
                  Encrypted:false
                  SSDEEP:12288:Q1HyurvZ0JPjuTtSu86th1n/hUgiW6QR7t5j3Ooc8NHkC2eo:Q1HyurvZ0liTwuhtjnj3Ooc8NHkC2eo
                  MD5:4C8A880EABC0B4D462CC4B2472116EA1
                  SHA1:D0A27F553C0FE0E507C7DF079485B601D5B592E6
                  SHA-256:2026F3C4F830DFF6883B88E2647272A52A132F25EB42C0D423E36B3F65A94D08
                  SHA-512:6A6CCE8C232F46DAB9B02D29BE5E0675CC1E968E9C2D64D0ABC008D20C0A7BAEB103A5B1D9B348FA1C4B3AF9797DBCB6E168B14B545FB15C2CCD926C3098C31C
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............y..y..y..fv..y..y..#y.....y..2...y.....y.....y......y.....y.....y.....y..Rich.y..........PE..L...."qE...........!.....@... ...............P....B|.........................p......u.....@.............................L...T...<............................ ..L2...S..............................Pe..@............P.. ............................text....;.......@.................. ..`.rdata......P.......P..............@..@.data...l&....... ..................@....rsrc...............................@..@.reloc..NA... ...P..................@..B........................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\system32\msvcr80.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):626688
                  Entropy (8bit):6.8397070634061174
                  Encrypted:false
                  SSDEEP:12288:6Fqi2VC1J7Zs7a5zchr46CIfsyZmGyYCqeC:6Ui2C1JdoiEdmGyYu
                  MD5:E4FECE18310E23B1D8FEE993E35E7A6F
                  SHA1:9FD3A7F0522D36C2BF0E64FC510C6EEA3603B564
                  SHA-256:02BDDE38E4C6BD795A092D496B8D6060CDBE71E22EF4D7A204E3050C1BE44FA9
                  SHA-512:2FB5F8D63A39BA5E93505DF3A643D14E286FE34B11984CBED4B88E8A07517C03EFB3A7BF9D61CF1EC73B0A20D83F9E6068E61950A61D649B8D36082BB034DDFC
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L.........@................!......;.............d.......................Rich...................PE..L...8"qE...........!.....0...p......+#.......@.....x......................................@..........................q...~..Pc..<....`.......................p..H3...B...............................F..@............@...............................text...*'.......0.................. ..`.rdata......@.......@..............@..@.data...Li.......P..................@....rsrc........`.......@..............@..@.reloc...7...p...@...P..............@..B........................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\53t3z6j5.7ag\ATL80.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):96256
                  Entropy (8bit):6.55872219718069
                  Encrypted:false
                  SSDEEP:1536:RCYlLTNQQ/Nucs4hRKF+HnLoRsV1TlWh8XhylIjwaCi6imXmwxCU4tkm:R7LTNzNup4hAQHnLP+VXmwxCtk
                  MD5:3C7DEF3CBBCA6284867AA4621D5D8A54
                  SHA1:4BD9852F1F063B9FD1E1829B756D381E14609FA7
                  SHA-256:DB18738202DCDA842DCE505ECD0B858D7B4C55886CAC29827305F0DC3839143A
                  SHA-512:1F9E89114A579BBB0C175D5FB587D58A923A0F556361B2F6C5AE3FFEB139539733E46EDB3DF1627FA630D5BC80CDF5FF311CA75754CA306345569CD48F51F2C4
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."..xft.+ft.+ft.+.{.+dt.+A..+mt.+.{.+et.+ft.+.t.+A..+}t.+A..+mt.+A..+gt.+A..+gt.+A..+gt.+Richft.+................PE..L...V#qE...........!..............................c|................................Xe....@..........................G......<A..(....`..H#..........................`...............................84..@...............(....5.......................text............................... ..`.rdata...N.......P..................@..@.data........P.......:..............@....rsrc...H#...`...$...>..............@..@.reloc...............b..............@..B........................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\5z1v718o.6n8\mfc80.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):1101824
                  Entropy (8bit):6.52190273109876
                  Encrypted:false
                  SSDEEP:24576:Tp2G61fY62if0Vra3QSNhJK6hIAloY3XjrN/:TcGifY6tOaASNhJK6hPaG/R
                  MD5:1B7524806D0270B81360C63A2FA047CB
                  SHA1:D688D77F0CAA897E6EC2ED2C789E77B48304701F
                  SHA-256:CEEF5AA7F9E6504BCE15B72B29DBEE6430370BAA6A52F82CF4F2857568D11709
                  SHA-512:B34539FBDA2A2162EFA2F6BB5A513D1BB002073FA63B3FF85AA3ADE84A6B275E396893DF5AB3A0A215CADE1F068E2A0A1BBD8895595E31D5A0708B65ACEC8C73
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........t..'..'..'3..'..'n..'..'3..'..'3..'...'..'...'.r.'..'gp.'..'.r.'...'.r.'..'.r.'...'.r.'/..'.r.'..'.r.'..'.r.'..'Rich..'................PE..L....3qE...........!.....p...p......yT.............x................................P@....@..............................e......x...................................0...................................@...............@............................text....o.......p.................. ..`.data...xi.......P..................@....rsrc...............................@..@.reloc..f8.......@..................@..B........................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\5z1v718o.6n8\mfc80u.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):1093120
                  Entropy (8bit):6.517624141841358
                  Encrypted:false
                  SSDEEP:12288:o5lk6KUYmYRP6vAt9+J51r64f22JhPeEiz8F+p/xoOTa+S9XqNNw2ohW3:UyUaP64t9+JfrRJiz8F+p/N2/cmW
                  MD5:CCC2E312486AE6B80970211DA472268B
                  SHA1:025B52FF11627760F7006510E9A521B554230FEE
                  SHA-256:18BE5D3C656236B7E3CD6D619D62496FE3E7F66BF2859E460F8AC3D1A6BDAA9A
                  SHA-512:D6892ABB1A85B9CF0FC6ABE1C3ACA6C46FC47541DFFC2B75F311E8D2C9C1D367F265599456BD77BE0E2B6D20C6C22FF5F0C46E7D9BA22C847AD1CBEDC8CA3EFF
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................R..............R.......R...............l......n......l......l......l......l.L....l......l......l.....Rich............PE..L...84qE...........!.....p...\.......U.............x......................................@.........................@....e..4...x.......................................................................@...............4...<........................text...'n.......p.................. ..`.data....k.......J...t..............@....rsrc...............................@..@.reloc..R7.......8...v..............@..B................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\5z1v718o.6n8\mfcm80.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                  Category:dropped
                  Size (bytes):69632
                  Entropy (8bit):5.417242053474202
                  Encrypted:false
                  SSDEEP:768:j8a7gcNrNDnQrZ6dOyOi9aBlrkY+qkJlyQA10y0ECL8IRO03VmOAPqixji4GY:j8CbQraAk3qkSqhRrODOACixji4T
                  MD5:C84E4ECE0D210489738B2F0ADB2723E8
                  SHA1:63C1FA652F7F5BD1FCCBE3618163B119A79A391C
                  SHA-256:ED1DCDD98DAC80716B2246D7760F0608C59E566424AC1A562090A3342C22B0A7
                  SHA-512:3EE1DA854E7D615FA4072140E823A3451DF5D8BEBF8064CC9A399DEC1FB35588F2A17C0620389441CA9EDD1944C9649002FE4E897C743FE8069B79A5AA079FE2
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z#Z..M...M...M.......M.......M...L.v.M...6...M.O.3...M... ...M...0...M...#...M...7...M...1...M...5...M.Rich..M.................PE..L....4qE...........!.........@....................U|......................... ............@.............................................................................................................@...............<...............H............text............................... ..`.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\5z1v718o.6n8\mfcm80u.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                  Category:dropped
                  Size (bytes):57856
                  Entropy (8bit):6.049264994442299
                  Encrypted:false
                  SSDEEP:768:nxSa8B2TJIS8uM07yOi9aBlv0J4Wrk7lyQQz4tzIdcRVS0aWNclFnzmOA7q3PWM:ga88R8n40eWrkMst0qS2KlFaOAm3PW
                  MD5:DDAD68E160C58D22B49FF039BB9B6751
                  SHA1:C6C3B3AF37F202025EE3B9CC477611C6C5FB47C2
                  SHA-256:F3A65BFC7FCE2D93FDF57CF88F083F690BC84B9A7706699D4098D18F79F87AAA
                  SHA-512:47665672627E34AD9EA3FD21814697D083EEEAFC873407E07B9697C8AB3C18743D9FCB76E0A08A57652EA5FB4396D891E82C7FDE2146FC8B636D202E68843CF4
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_...>._.>._.>._.1._.>._.1._.>._.>._A>._..._.>._E.._.>._..._.>._..._.>._..._.>._..._.>._..._.>._..._.>._Rich.>._........................PE..L....4qE...........!.........,....................e|......................... ......~.....@.........................`...................................................................................@...............,...............H............text...!........................... ..`.data...h...........................@....rsrc...............................@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\73t3z6j5.7ag\ATL80.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):96256
                  Entropy (8bit):6.55872219718069
                  Encrypted:false
                  SSDEEP:1536:RCYlLTNQQ/Nucs4hRKF+HnLoRsV1TlWh8XhylIjwaCi6imXmwxCU4tkm:R7LTNzNup4hAQHnLP+VXmwxCtk
                  MD5:3C7DEF3CBBCA6284867AA4621D5D8A54
                  SHA1:4BD9852F1F063B9FD1E1829B756D381E14609FA7
                  SHA-256:DB18738202DCDA842DCE505ECD0B858D7B4C55886CAC29827305F0DC3839143A
                  SHA-512:1F9E89114A579BBB0C175D5FB587D58A923A0F556361B2F6C5AE3FFEB139539733E46EDB3DF1627FA630D5BC80CDF5FF311CA75754CA306345569CD48F51F2C4
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."..xft.+ft.+ft.+.{.+dt.+A..+mt.+.{.+et.+ft.+.t.+A..+}t.+A..+mt.+A..+gt.+A..+gt.+A..+gt.+Richft.+................PE..L...V#qE...........!..............................c|................................Xe....@..........................G......<A..(....`..H#..........................`...............................84..@...............(....5.......................text............................... ..`.rdata...N.......P..................@..@.data........P.......:..............@....rsrc...H#...`...$...>..............@..@.reloc...............b..............@..B........................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\73t3z6j5.7ag\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474.cat

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):8335
                  Entropy (8bit):7.405163302183138
                  Encrypted:false
                  SSDEEP:192:920vxL/CldolM3bd59MYbz2uT+InugbyaAqjkKiTb29H8U:nJLCcUJvMYb6uT+qugeajCG1
                  MD5:D81E69280E14E0A97644AE0044DB662E
                  SHA1:C97DBE8DEB8E1762313C3E6613A6640F070DF4B1
                  SHA-256:A951D53950C367ACC37622F0DD619A954DF5DE2C4EC40296E6636605AA33714A
                  SHA-512:DCD8229EFD496735AAB49F6595AD545F082B0364E984346F76A6503425C84E82AF2D30684DFD302EF0C70FB65BC6B8E3731953728CF38637F7FE76580B82D490
                  Malicious:false
                  Preview:0. ...*.H........ |0. x...1.0...+......0..u..+.....7.....f0..b0...+.....7.....8..z*.\A..;.w.]..061202065600Z0...+.....7.....0...0....R0.5.2.F.1.8.9.7.A.2.9.9.F.B.3.C.3.3.C.F.A.8.E.B.3.E.3.7.C.8.D.5.6.5.4.F.3.1.7.9...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........./.....<3..>7..eO1y0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....M.i.c.r.o.s.o.f.t...V.C.8.0...A.T.L...m.a.n...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........./.....<3..>7..eO1y0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......{0...0..-.......G....RFC..mH.1.0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte Timestamping CA0...031204000000Z..131203235959Z0S1.0...U....US1.0...U....VeriSign, Inc.1+0)..U..."VeriSign Time Stamping Services CA0.."0...*.H........

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\73t3z6j5.7ag\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474.manifest

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):465
                  Entropy (8bit):5.355751983126569
                  Encrypted:false
                  SSDEEP:12:TMHdt7IBeBFJ3/3XO53SNK+yGuR/6gVuNnyEGBJfPeG:2dtMEDJ/eiNK+yr56g4NnYBJl
                  MD5:42D8BBE898B35473852D83F53EF6759D
                  SHA1:052F1897A299FB3C33CFA8EB3E37C8D5654F3179
                  SHA-256:5908E59BF26941730A1F3AB117A7D699984D39CD690FCA74DBE20030745E8ACB
                  SHA-512:3D871592D0FF3368306DF9372CB46754A818C5B0B3C1493AA9189030245CC44F4CE7F55C626C8B00704C1908FF84AE3EA82FA63B8EBEAEDAC1FAB6D758ED68B4
                  Malicious:false
                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright . 1981-2001 Microsoft Corporation -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable/>.. <assemblyIdentity type="win32" name="Microsoft.VC80.ATL" version="8.0.50727.762" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <file name="ATL80.dll" hash="6a91b897f1be0d40f032a8773630c4627cd18bf7" hashalg="SHA1"/>..</assembly>..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\7z1v718o.6n8\mfc80.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):1101824
                  Entropy (8bit):6.52190273109876
                  Encrypted:false
                  SSDEEP:24576:Tp2G61fY62if0Vra3QSNhJK6hIAloY3XjrN/:TcGifY6tOaASNhJK6hPaG/R
                  MD5:1B7524806D0270B81360C63A2FA047CB
                  SHA1:D688D77F0CAA897E6EC2ED2C789E77B48304701F
                  SHA-256:CEEF5AA7F9E6504BCE15B72B29DBEE6430370BAA6A52F82CF4F2857568D11709
                  SHA-512:B34539FBDA2A2162EFA2F6BB5A513D1BB002073FA63B3FF85AA3ADE84A6B275E396893DF5AB3A0A215CADE1F068E2A0A1BBD8895595E31D5A0708B65ACEC8C73
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........t..'..'..'3..'..'n..'..'3..'..'3..'...'..'...'.r.'..'gp.'..'.r.'...'.r.'..'.r.'...'.r.'/..'.r.'..'.r.'..'.r.'..'Rich..'................PE..L....3qE...........!.....p...p......yT.............x................................P@....@..............................e......x...................................0...................................@...............@............................text....o.......p.................. ..`.data...xi.......P..................@....rsrc...............................@..@.reloc..f8.......@..................@..B........................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\7z1v718o.6n8\mfc80u.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):1093120
                  Entropy (8bit):6.517624141841358
                  Encrypted:false
                  SSDEEP:12288:o5lk6KUYmYRP6vAt9+J51r64f22JhPeEiz8F+p/xoOTa+S9XqNNw2ohW3:UyUaP64t9+JfrRJiz8F+p/N2/cmW
                  MD5:CCC2E312486AE6B80970211DA472268B
                  SHA1:025B52FF11627760F7006510E9A521B554230FEE
                  SHA-256:18BE5D3C656236B7E3CD6D619D62496FE3E7F66BF2859E460F8AC3D1A6BDAA9A
                  SHA-512:D6892ABB1A85B9CF0FC6ABE1C3ACA6C46FC47541DFFC2B75F311E8D2C9C1D367F265599456BD77BE0E2B6D20C6C22FF5F0C46E7D9BA22C847AD1CBEDC8CA3EFF
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................R..............R.......R...............l......n......l......l......l......l.L....l......l......l.....Rich............PE..L...84qE...........!.....p...\.......U.............x......................................@.........................@....e..4...x.......................................................................@...............4...<........................text...'n.......p.................. ..`.data....k.......J...t..............@....rsrc...............................@..@.reloc..R7.......8...v..............@..B................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\7z1v718o.6n8\mfcm80.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                  Category:dropped
                  Size (bytes):69632
                  Entropy (8bit):5.417242053474202
                  Encrypted:false
                  SSDEEP:768:j8a7gcNrNDnQrZ6dOyOi9aBlrkY+qkJlyQA10y0ECL8IRO03VmOAPqixji4GY:j8CbQraAk3qkSqhRrODOACixji4T
                  MD5:C84E4ECE0D210489738B2F0ADB2723E8
                  SHA1:63C1FA652F7F5BD1FCCBE3618163B119A79A391C
                  SHA-256:ED1DCDD98DAC80716B2246D7760F0608C59E566424AC1A562090A3342C22B0A7
                  SHA-512:3EE1DA854E7D615FA4072140E823A3451DF5D8BEBF8064CC9A399DEC1FB35588F2A17C0620389441CA9EDD1944C9649002FE4E897C743FE8069B79A5AA079FE2
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z#Z..M...M...M.......M.......M...L.v.M...6...M.O.3...M... ...M...0...M...#...M...7...M...1...M...5...M.Rich..M.................PE..L....4qE...........!.........@....................U|......................... ............@.............................................................................................................@...............<...............H............text............................... ..`.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\7z1v718o.6n8\mfcm80u.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                  Category:dropped
                  Size (bytes):57856
                  Entropy (8bit):6.049264994442299
                  Encrypted:false
                  SSDEEP:768:nxSa8B2TJIS8uM07yOi9aBlv0J4Wrk7lyQQz4tzIdcRVS0aWNclFnzmOA7q3PWM:ga88R8n40eWrkMst0qS2KlFaOAm3PW
                  MD5:DDAD68E160C58D22B49FF039BB9B6751
                  SHA1:C6C3B3AF37F202025EE3B9CC477611C6C5FB47C2
                  SHA-256:F3A65BFC7FCE2D93FDF57CF88F083F690BC84B9A7706699D4098D18F79F87AAA
                  SHA-512:47665672627E34AD9EA3FD21814697D083EEEAFC873407E07B9697C8AB3C18743D9FCB76E0A08A57652EA5FB4396D891E82C7FDE2146FC8B636D202E68843CF4
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_...>._.>._.>._.1._.>._.1._.>._.>._A>._..._.>._E.._.>._..._.>._..._.>._..._.>._..._.>._..._.>._..._.>._Rich.>._........................PE..L....4qE...........!.........,....................e|......................... ......~.....@.........................`...................................................................................@...............,...............H............text...!........................... ..`.data...h...........................@....rsrc...............................@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\7z1v718o.6n8\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05.cat

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):8335
                  Entropy (8bit):7.40317276365929
                  Encrypted:false
                  SSDEEP:192:O09xL/CldolM3bd59MYbz2uT+InugbyaAqjkKiTb28uOJjC:VPLCcUJvMYb6uT+qugeajCdbJjC
                  MD5:7E5E3FE0342A776B1974BA1158B8E458
                  SHA1:7E2E14E2A0658441828DE084116AFDEC5CC63697
                  SHA-256:2D3CB7907B1336EA5889A2B731D5E97AD40903A4EFD2287C1C117BC30F208F46
                  SHA-512:9F0F1F1E6439F101B04888BE54A3711C8439D569B0DC962F29AC26C3637FE9A882C9B0D52D50E83B7562A302673F2D22428A56E6AAF60AD30FC873FFA256EFD2
                  Malicious:false
                  Preview:0. ...*.H........ |0. x...1.0...+......0..u..+.....7.....f0..b0...+.....7........>.B4M.EA..r....061202142259Z0...+.....7.....0...0....R2.5.9.3.A.D.7.2.1.D.7.B.E.3.8.2.1.F.D.0.B.4.0.6.1.1.A.4.6.7.D.B.9.7.B.E.8.5.4.7...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........%..r.{......g...G0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....M.i.c.r.o.s.o.f.t...V.C.8.0...M.F.C...m.a.n...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........%..r.{......g...G0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......{0...0..-.......G....RFC..mH.1.0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte Timestamping CA0...031204000000Z..131203235959Z0S1.0...U....US1.0...U....VeriSign, Inc.1+0)..U..."VeriSign Time Stamping Services CA0.."0...*.H........

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\7z1v718o.6n8\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05.manifest

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (504), with CRLF line terminators
                  Category:dropped
                  Size (bytes):2371
                  Entropy (8bit):5.376374702643811
                  Encrypted:false
                  SSDEEP:48:3SlK+x6g4m09kkKZzY09kkKSzdz09kkKWz+09kkK5e/zY:CltImXkEMXkvdXkHCXk648
                  MD5:97B859F11538BBE20F17DFB9C0979A1C
                  SHA1:2593AD721D7BE3821FD0B40611A467DB97BE8547
                  SHA-256:4ED3BA814DE7FD08B4E4C6143D144E603536C343602E1071803B86E58391BE36
                  SHA-512:905C7879DF47559AD271DC052EF8AE38555EAC49E8AC516BC011624BF9A622EB10EE5C6A06FBD3E5C0FA956A0D38F03F6808C1C58EE57813818FE8B8319A3541
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC80.MFC" version="8.0.50727.762" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="mfc80.dll" hash="8f53f3ce664dfb39cadf8ecb34dd49cbd8348227" hashalg="SHA1"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>1ojXfwyqiX5uwu0seJ53tIMEcB8=</dsig:DigestValue></asmv2:hash></file>.. <file name="mfc80u.dll" hash="db3a3bfed210d41af3579d948cace75cb74eee0a" hashalg="SHA1"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\92rg91xw.1p4\msvcm80.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                  Category:dropped
                  Size (bytes):479232
                  Entropy (8bit):6.031745108754355
                  Encrypted:false
                  SSDEEP:6144:9Rj8Tfo4zrcq2FXOth6wsjb2fPzatjLhQeRW86ODl1KWOjPQeH:9So4zATQsjyWRhQ+W83D/6QO
                  MD5:CAE6861B19A2A7E5D42FEFC4DFDF5CCF
                  SHA1:609B81FBD3ACDA8C56E2663EDA80BFAFC9480991
                  SHA-256:C4C8C2D251B90D77D1AC75CBD39C3F0B18FC170D5A95D1C13A0266F7260B479D
                  SHA-512:C01D27F5A295B684C44105FCB62FB5F540A69D70A653AC9D14F2E5EF01295EF1DF136AE936273101739EB32EFF35185098A15F11D6C3293BBDCD9FCB98CB00A9
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-./.ihA.ihA.ihA..g..mhA.ih@..hA.N.:.lhA...?.hhA.N.<.hhA.N.,.fhA.N./..hA.N.;.hhA.N.=.hhA.N.9.hhA.RichihA.........................PE..L...."qE...........!.........@.......T............L|................................2.....@.............................c ..D...d.....................................................................@..............................H............text....x.......................... ..`.rdata..S[.......`..................@..@.data............ ..................@....rsrc...............................@..@.reloc..P$.......0... ..............@..B........................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\92rg91xw.1p4\msvcp80.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):548864
                  Entropy (8bit):6.402420828464982
                  Encrypted:false
                  SSDEEP:12288:Q1HyurvZ0JPjuTtSu86th1n/hUgiW6QR7t5j3Ooc8NHkC2eo:Q1HyurvZ0liTwuhtjnj3Ooc8NHkC2eo
                  MD5:4C8A880EABC0B4D462CC4B2472116EA1
                  SHA1:D0A27F553C0FE0E507C7DF079485B601D5B592E6
                  SHA-256:2026F3C4F830DFF6883B88E2647272A52A132F25EB42C0D423E36B3F65A94D08
                  SHA-512:6A6CCE8C232F46DAB9B02D29BE5E0675CC1E968E9C2D64D0ABC008D20C0A7BAEB103A5B1D9B348FA1C4B3AF9797DBCB6E168B14B545FB15C2CCD926C3098C31C
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............y..y..y..fv..y..y..#y.....y..2...y.....y.....y......y.....y.....y.....y..Rich.y..........PE..L...."qE...........!.....@... ...............P....B|.........................p......u.....@.............................L...T...<............................ ..L2...S..............................Pe..@............P.. ............................text....;.......@.................. ..`.rdata......P.......P..............@..@.data...l&....... ..................@....rsrc...............................@..@.reloc..NA... ...P..................@..B........................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\92rg91xw.1p4\msvcr80.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):626688
                  Entropy (8bit):6.8397070634061174
                  Encrypted:false
                  SSDEEP:12288:6Fqi2VC1J7Zs7a5zchr46CIfsyZmGyYCqeC:6Ui2C1JdoiEdmGyYu
                  MD5:E4FECE18310E23B1D8FEE993E35E7A6F
                  SHA1:9FD3A7F0522D36C2BF0E64FC510C6EEA3603B564
                  SHA-256:02BDDE38E4C6BD795A092D496B8D6060CDBE71E22EF4D7A204E3050C1BE44FA9
                  SHA-512:2FB5F8D63A39BA5E93505DF3A643D14E286FE34B11984CBED4B88E8A07517C03EFB3A7BF9D61CF1EC73B0A20D83F9E6068E61950A61D649B8D36082BB034DDFC
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L.........@................!......;.............d.......................Rich...................PE..L...8"qE...........!.....0...p......+#.......@.....x......................................@..........................q...~..Pc..<....`.......................p..H3...B...............................F..@............@...............................text...*'.......0.................. ..`.rdata......@.......@..............@..@.data...Li.......P..................@....rsrc........`.......@..............@..@.reloc...7...p...@...P..............@..B........................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Manifests\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474.cat

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):8335
                  Entropy (8bit):7.405163302183138
                  Encrypted:false
                  SSDEEP:192:920vxL/CldolM3bd59MYbz2uT+InugbyaAqjkKiTb29H8U:nJLCcUJvMYb6uT+qugeajCG1
                  MD5:D81E69280E14E0A97644AE0044DB662E
                  SHA1:C97DBE8DEB8E1762313C3E6613A6640F070DF4B1
                  SHA-256:A951D53950C367ACC37622F0DD619A954DF5DE2C4EC40296E6636605AA33714A
                  SHA-512:DCD8229EFD496735AAB49F6595AD545F082B0364E984346F76A6503425C84E82AF2D30684DFD302EF0C70FB65BC6B8E3731953728CF38637F7FE76580B82D490
                  Malicious:false
                  Preview:0. ...*.H........ |0. x...1.0...+......0..u..+.....7.....f0..b0...+.....7.....8..z*.\A..;.w.]..061202065600Z0...+.....7.....0...0....R0.5.2.F.1.8.9.7.A.2.9.9.F.B.3.C.3.3.C.F.A.8.E.B.3.E.3.7.C.8.D.5.6.5.4.F.3.1.7.9...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........./.....<3..>7..eO1y0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....M.i.c.r.o.s.o.f.t...V.C.8.0...A.T.L...m.a.n...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........./.....<3..>7..eO1y0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......{0...0..-.......G....RFC..mH.1.0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte Timestamping CA0...031204000000Z..131203235959Z0S1.0...U....US1.0...U....VeriSign, Inc.1+0)..U..."VeriSign Time Stamping Services CA0.."0...*.H........

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Manifests\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474.manifest

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):465
                  Entropy (8bit):5.355751983126569
                  Encrypted:false
                  SSDEEP:12:TMHdt7IBeBFJ3/3XO53SNK+yGuR/6gVuNnyEGBJfPeG:2dtMEDJ/eiNK+yr56g4NnYBJl
                  MD5:42D8BBE898B35473852D83F53EF6759D
                  SHA1:052F1897A299FB3C33CFA8EB3E37C8D5654F3179
                  SHA-256:5908E59BF26941730A1F3AB117A7D699984D39CD690FCA74DBE20030745E8ACB
                  SHA-512:3D871592D0FF3368306DF9372CB46754A818C5B0B3C1493AA9189030245CC44F4CE7F55C626C8B00704C1908FF84AE3EA82FA63B8EBEAEDAC1FAB6D758ED68B4
                  Malicious:false
                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright . 1981-2001 Microsoft Corporation -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable/>.. <assemblyIdentity type="win32" name="Microsoft.VC80.ATL" version="8.0.50727.762" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <file name="ATL80.dll" hash="6a91b897f1be0d40f032a8773630c4627cd18bf7" hashalg="SHA1"/>..</assembly>..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.cat

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):8335
                  Entropy (8bit):7.405582810794059
                  Encrypted:false
                  SSDEEP:192:80XxL/CldolM3bd59MYbz2uT+InugbyaAqjkKiTb2LQ82:PBLCcUJvMYb6uT+qugeajCQ2
                  MD5:790ADAF5E825415E35AD65990E071AE0
                  SHA1:E23D182AB1EDFEF5FD3793313D90935FC034ABC8
                  SHA-256:88B03FE13D2710AD787D5D96CD0E5CBEDA3A61C2A0A2BDC0C0984A48365242E2
                  SHA-512:050BBAD3122CD0627ECACAF3FB24EBF1E1845F209C33ED6607B282D9DCD4F5D99E345DF3A99E4344AF2ABA6E7923C8483E8D5A8D709BF97F3CB37926D975FDAD
                  Malicious:false
                  Preview:0. ...*.H........ |0. x...1.0...+......0..u..+.....7.....f0..b0...+.....7..........MfN....O.....061202142259Z0...+.....7.....0...0....R2.E.1.2.C.6.D.F.7.3.5.2.C.3.E.D.3.C.6.1.A.4.5.B.A.F.6.8.E.A.C.E.1.C.C.9.5.4.6.E...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+............sR..<a.[.h....Tn0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....M.i.c.r.o.s.o.f.t...V.C.8.0...C.R.T...m.a.n...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+............sR..<a.[.h....Tn0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......{0...0..-.......G....RFC..mH.1.0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte Timestamping CA0...031204000000Z..131203235959Z0S1.0...U....US1.0...U....VeriSign, Inc.1+0)..U..."VeriSign Time Stamping Services CA0.."0...*.H........

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.manifest

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (504), with CRLF line terminators
                  Category:dropped
                  Size (bytes):1869
                  Entropy (8bit):5.395078491534145
                  Encrypted:false
                  SSDEEP:48:3SlK+hk6g4u09kkK23zWO09kkKFzv09kkKldSzY:Clth9uXkd3COXkgTXkX8
                  MD5:541423A06EFDCD4E4554C719061F82CF
                  SHA1:2E12C6DF7352C3ED3C61A45BAF68EACE1CC9546E
                  SHA-256:17AD1A64BA1C382ABF89341B40950F9B31F95015C6B0D3E25925BFEBC1B53EB5
                  SHA-512:11CF735DCDDBA72BABB9DE8F59E0C180A9FEC8268CBFCA09D17D8535F1B92C17BF32ACDA86499E420CBE7763A96D6067FEB67FA1ED745067AB326FD5B84188C6
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC80.CRT" version="8.0.50727.762" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="msvcr80.dll" hash="10f4cb2831f1e9288a73387a8734a8b604e5beaa" hashalg="SHA1"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>n9On8FItNsK/DmT8UQxu6jYDtWQ=</dsig:DigestValue></asmv2:hash></file>.. <file name="msvcp80.dll" hash="b2082dfd3009365c5b287448dcb3b4e2158a6d26" hashalg="SHA1"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xml

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Manifests\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303.cat

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):8348
                  Entropy (8bit):7.393940545952515
                  Encrypted:false
                  SSDEEP:192:BBGwxL/CldolM3bd59MYbz2uT+InugbyaAqjkKiTbmI0TYk:KcLCcUJvMYb6uT+qugeajCfEYk
                  MD5:DFE03B4FF0EF67F7A08A7D88B3E4BDE3
                  SHA1:BF907A1B27DB3BF3C10DA685D9CB4CBFF9155E6B
                  SHA-256:26340819D2EF86080D9001C6F2737D70FD6602DDF4B86B6C26B326EF81CC3342
                  SHA-512:3D1F6773A476B2F84F53A288F1A1EF0FC44A58F8A9C25F9773871CB4F4F9CB81CBE6C242665D1CBA8BA327C441FC5B13F254E1657258A841102CC571185D70BD
                  Malicious:false
                  Preview:0. ...*.H........ .0. ....1.0...+......0..|..+.....7.....m0..i0...+.....7......7qN.NqJ...E..8..061202082602Z0...+.....7.....0..&0....R8.3.0.D.6.4.5.9.3.5.0.D.D.1.A.B.3.B.1.F.0.7.0.1.3.5.4.2.5.A.9.3.3.9.5.7.8.2.B.1...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+..........dY5..;...5BZ.9W..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....4M.i.c.r.o.s.o.f.t...V.C.8.0...M.F.C.L.O.C...m.a.n...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+..........dY5..;...5BZ.9W..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......{0...0..-.......G....RFC..mH.1.0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte Timestamping CA0...031204000000Z..131203235959Z0S1.0...U....US1.0...U....VeriSign, Inc.1+0)..U..."VeriSign Time Stamping Services CA0.."0...*.H.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Manifests\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303.manifest

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):1239
                  Entropy (8bit):5.33259165949927
                  Encrypted:false
                  SSDEEP:24:2dtMEDJ/eiNK+EI56g4NnZCO/3QQvhONoajUCvBTmAmWG1YoSoFJF:ciEDJdK+v6g4H3strJnmW27
                  MD5:56613508687D065362302FF388CD5E82
                  SHA1:830D6459350DD1AB3B1F070135425A93395782B1
                  SHA-256:2F79707C5EA8937E8887B642CFA4CE682C52816C20207C1588FD5A1E39E88C1C
                  SHA-512:66C650CDCF5D15D313B7B0F3AFDAB717F075BC0AC560B75CF2EA5375C62EFEBE01A890204A3E74835B65B60113120815C7DD564F78564029D1F5170D63990814
                  Malicious:false
                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright . 1981-2001 Microsoft Corporation -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable/>.. <assemblyIdentity type="win32" name="Microsoft.VC80.MFCLOC" version="8.0.50727.762" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <file name="mfc80CHS.dll" hash="0ed99f840cfe11946fd5aa2002eff17451d441eb" hashalg="SHA1"/>.. <file name="mfc80CHT.dll" hash="3eb85cc7e931f885f2b91aa285432b740edaa6b1" hashalg="SHA1"/>.. <file name="mfc80DEU.dll" hash="5489f4037e83e03786e4c7842cc7599beafac96e" hashalg="SHA1"/>.. <file name="mfc80ENU.dll" hash="ed96ef26e683b48b4f04eefc75d873f863c993cf" hashalg="SHA1"/>.. <file name="mfc80ESP.dll" hash="b3d647f39f26b07f6014b40a9f511cfd4614bdf8" hashalg="SHA1"/>.. <file name="mfc80FRA.dll" hash="89d11dd75a1a74547cf94e0b66d742eb7fe909b2" hashalg="SHA1"/>.. <file name="mfc80ITA.dll" hash="e07b9360a90e74e4ab1bf4f3f9

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Manifests\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05.cat

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):8335
                  Entropy (8bit):7.40317276365929
                  Encrypted:false
                  SSDEEP:192:O09xL/CldolM3bd59MYbz2uT+InugbyaAqjkKiTb28uOJjC:VPLCcUJvMYb6uT+qugeajCdbJjC
                  MD5:7E5E3FE0342A776B1974BA1158B8E458
                  SHA1:7E2E14E2A0658441828DE084116AFDEC5CC63697
                  SHA-256:2D3CB7907B1336EA5889A2B731D5E97AD40903A4EFD2287C1C117BC30F208F46
                  SHA-512:9F0F1F1E6439F101B04888BE54A3711C8439D569B0DC962F29AC26C3637FE9A882C9B0D52D50E83B7562A302673F2D22428A56E6AAF60AD30FC873FFA256EFD2
                  Malicious:false
                  Preview:0. ...*.H........ |0. x...1.0...+......0..u..+.....7.....f0..b0...+.....7........>.B4M.EA..r....061202142259Z0...+.....7.....0...0....R2.5.9.3.A.D.7.2.1.D.7.B.E.3.8.2.1.F.D.0.B.4.0.6.1.1.A.4.6.7.D.B.9.7.B.E.8.5.4.7...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........%..r.{......g...G0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....M.i.c.r.o.s.o.f.t...V.C.8.0...M.F.C...m.a.n...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........%..r.{......g...G0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......{0...0..-.......G....RFC..mH.1.0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte Timestamping CA0...031204000000Z..131203235959Z0S1.0...U....US1.0...U....VeriSign, Inc.1+0)..U..."VeriSign Time Stamping Services CA0.."0...*.H........

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Manifests\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05.manifest

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (504), with CRLF line terminators
                  Category:dropped
                  Size (bytes):2371
                  Entropy (8bit):5.376374702643811
                  Encrypted:false
                  SSDEEP:48:3SlK+x6g4m09kkKZzY09kkKSzdz09kkKWz+09kkK5e/zY:CltImXkEMXkvdXkHCXk648
                  MD5:97B859F11538BBE20F17DFB9C0979A1C
                  SHA1:2593AD721D7BE3821FD0B40611A467DB97BE8547
                  SHA-256:4ED3BA814DE7FD08B4E4C6143D144E603536C343602E1071803B86E58391BE36
                  SHA-512:905C7879DF47559AD271DC052EF8AE38555EAC49E8AC516BC011624BF9A622EB10EE5C6A06FBD3E5C0FA956A0D38F03F6808C1C58EE57813818FE8B8319A3541
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC80.MFC" version="8.0.50727.762" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="mfc80.dll" hash="8f53f3ce664dfb39cadf8ecb34dd49cbd8348227" hashalg="SHA1"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>1ojXfwyqiX5uwu0seJ53tIMEcB8=</dsig:DigestValue></asmv2:hash></file>.. <file name="mfc80u.dll" hash="db3a3bfed210d41af3579d948cace75cb74eee0a" hashalg="SHA1"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Policies\ed6uew4i.4ha\8.0.50727.762.cat

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):8361
                  Entropy (8bit):7.40471492725501
                  Encrypted:false
                  SSDEEP:192:DCRxL/CldolM3bd59MYbz2uT+InugbyaAqjkKiTbmWDy:sLCcUJvMYb6uT+qugeajCQ
                  MD5:C664656654DAB45BEB0D352077A884FB
                  SHA1:5BDB2EE6D91EE321FEF177E534C324DF96BAEF9D
                  SHA-256:B3BEB16C28DB357E654A6B132F59CD48CB95CEE949D7B97587F8F02F233F3CE1
                  SHA-512:F9CE3655342A07A29B5338AB5B78BA0B6CBC94EEB1D0538967DD2C23CBBDA6797326763E16F609C179B43E67503A87F76D8C306F0AB449F1601F13D7F7173A15
                  Malicious:false
                  Preview:0. ...*.H........ .0. ....1.0...+......0..q..+.....7.....b0..^0...+.....7......Y.s.oON.h..(H^G..061202084644Z0...+.....7.....0...0...*8...0...5.0.7.2.7...7.6.2...p.o.l.i.c.y...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........\.-..9.l..Pu..r..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R9.D.8.2.F.A.5.C.E.1.2.D.D.F.E.6.3.9.A.F.6.C.8.9.C.7.5.0.7.5.8.D.8.E.7.2.A.2.0.A...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........\.-..9.l..Pu..r..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......{0...0..-.......G....RFC..mH.1.0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte Timestamping CA0...031204000000Z..131203235959Z0S1.0...U....US1.0...U....VeriSign, Inc.1+0)..U..."VeriSign Time Stamping Services CA0.."0...*.H............

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Policies\ed6uew4i.4ha\8.0.50727.762.policy

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):806
                  Entropy (8bit):5.200250853529196
                  Encrypted:false
                  SSDEEP:24:2dtMEDJ5iN+n856g4NnjiNK+wg4NnM23+LJ23sZQR:ciEDJw0I6g4EK+wg46HQR
                  MD5:11D6A2E757DA71254BFC61D26F06884D
                  SHA1:9D82FA5CE12DDFE639AF6C89C750758D8E72A20A
                  SHA-256:58AE1580121AFE06CE2B858B96B6AB893A8D105B17FE54D85711A969C3303DC4
                  SHA-512:0074430D25861B7B18CFA2C3E5BF728B51B676C5A30799986305BE94C40EE1DCA8E3C00A6279C801771F44D4ED551F73A0DC5C5792715C1C10361712D9EF8B29
                  Malicious:false
                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright . 1981-2001 Microsoft Corporation -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.... <assemblyIdentity type="win32-policy" name="policy.8.0.Microsoft.VC80.OpenMP" version="8.0.50727.762" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity type="win32" name="Microsoft.VC80.OpenMP" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <bindingRedirect oldVersion="8.0.41204.256-8.0.50608.0" newVersion="8.0.50727.762"/>.. <bindingRedirect oldVersion="8.0.50727.42-8.0.50727.762" newVersion="8.0.50727.762"/>.. </dependentAssembly>.. </dependency>....</assembly>..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Policies\i4auwzcy.rsh\8.0.50727.762.cat

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):8355
                  Entropy (8bit):7.401719031801445
                  Encrypted:false
                  SSDEEP:192:/NNxL/CldolM3bd59MYbz2uT+InugbyaAqjkKiTbWyVAz:xLCcUJvMYb6uT+qugeajCRVI
                  MD5:57FD064E95D299507600F6D80AA6B578
                  SHA1:9947DD086424ADB4D62FEB33FB9EBB52FA11C281
                  SHA-256:F7BF65CA621D8AD32EAD1500A08827BE239D0F49D83DC20DABF57D2EB17ADBD7
                  SHA-512:FD9E17009E0E88B725FC6AA014A95E9516543F54CADBB6A71C1C1F39F4DEF4AD0DF2D8F55720E8B1A54EB2EBCE6C42C8C899E33E490DD304EB014CCAB6DB9C44
                  Malicious:false
                  Preview:0. ...*.H........ .0. ....1.0...+......0..q..+.....7.....b0..^0...+.....7.....MrG.u..A......j..061202065600Z0...+.....7.....0...0...*8...0...5.0.7.2.7...7.6.2...p.o.l.i.c.y...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+............N....f.V....vf.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RE.4.8.A.1.E.B.7.8.4.4.E.C.8.1.D.C.C.0.A.6.6.9.0.5.6.1.9.A.F.E.E.E.6.7.6.6.6.A.5...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+............N....f.V....vf.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......{0...0..-.......G....RFC..mH.1.0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte Timestamping CA0...031204000000Z..131203235959Z0S1.0...U....US1.0...U....VeriSign, Inc.1+0)..U..."VeriSign Time Stamping Services CA0.."0...*.H............

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Policies\i4auwzcy.rsh\8.0.50727.762.policy

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):800
                  Entropy (8bit):5.197462113683958
                  Encrypted:false
                  SSDEEP:24:2dtMEDJ5iN+nyr56g4NnjiNK+2g4NnM23+LJ23sZQR:ciEDJw0yl6g4EK+2g46HQR
                  MD5:856BBF8E45A26C912BD447EC12DC17DB
                  SHA1:E48A1EB7844EC81DCC0A66905619AFEEE67666A5
                  SHA-256:863E67B018E99E1685F03D4FED538F8269332570887FC17534DD3637B7AA6A41
                  SHA-512:BB79BD9A3A06FB6CFD3312EDB766B8EF5C03AA250CCFA17ADD8799EEC06CCE88BE9369DB452D20B09519A910878E1840513404B5DF59289DD84BEDD01771AD01
                  Malicious:false
                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright . 1981-2001 Microsoft Corporation -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.... <assemblyIdentity type="win32-policy" name="policy.8.0.Microsoft.VC80.ATL" version="8.0.50727.762" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity type="win32" name="Microsoft.VC80.ATL" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <bindingRedirect oldVersion="8.0.41204.256-8.0.50608.0" newVersion="8.0.50727.762"/>.. <bindingRedirect oldVersion="8.0.50727.42-8.0.50727.762" newVersion="8.0.50727.762"/>.. </dependentAssembly>.. </dependency>....</assembly>..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Policies\m3oqdoe3.l2\8.0.50727.762.cat

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):8361
                  Entropy (8bit):7.402377797496622
                  Encrypted:false
                  SSDEEP:192:F9JFQmFxL/CldolM3bd59MYbz2uT+InugbyaAqjkKiTbm1:FnGmHLCcUJvMYb6uT+qugeajCA
                  MD5:93615FE0E4458E717BBA670C9B162E84
                  SHA1:CE99F878D2528EFC821D05462313C8EF99BE8C2F
                  SHA-256:D14225A52543AA5A9605B00DD7574812BF89C605EBC73A9730E1E386BFC965F8
                  SHA-512:F87BA88B0B2BF186872BDF226EA137463A773B710CD4505E50FD22E7E3E629BEAB26AF32313FE09BB4D1A0C621D95DF3E1D0A957D6D5A43868A1C4953CA3343F
                  Malicious:false
                  Preview:0. ...*.H........ .0. ....1.0...+......0..q..+.....7.....b0..^0...+.....7........1..lI.N.i..-...061202082602Z0...+.....7.....0...0...*8...0...5.0.7.2.7...7.6.2...p.o.l.i.c.y...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+..........V.XpV...L0.W1$....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RF.0.8.1.5.6.1.6.5.8.7.0.5.6.1.0.A.D.A.D.4.C.3.0.E.7.5.7.3.1.2.4.9.1.E.D.F.9.E.0...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+..........V.XpV...L0.W1$....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......{0...0..-.......G....RFC..mH.1.0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte Timestamping CA0...031204000000Z..131203235959Z0S1.0...U....US1.0...U....VeriSign, Inc.1+0)..U..."VeriSign Time Stamping Services CA0.."0...*.H............

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Policies\m3oqdoe3.l2\8.0.50727.762.policy

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):806
                  Entropy (8bit):5.222427128564631
                  Encrypted:false
                  SSDEEP:24:2dtMEDJ5iN+nEI56g4NnjiNK+3g4NnM23+LJ23sZQR:ciEDJw0v6g4EK+3g46HQR
                  MD5:53094430F66951325C1B88A4F0CA374D
                  SHA1:F081561658705610ADAD4C30E757312491EDF9E0
                  SHA-256:4594558E51587C0EDF1F3F95A0D4B8749B3EA3B6C8B76B31B13F1CA1D3E2F4AF
                  SHA-512:75EAD79C7392DE2BE0964D0399DA4B6B883BFC1E53CB099EC6BF2E4DA594B24B52E1C08AB6BA5B0B18DF7E64DAC0979C2A57E0B20EE6FDD5D54340FFF8F6D462
                  Malicious:false
                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright . 1981-2001 Microsoft Corporation -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.... <assemblyIdentity type="win32-policy" name="policy.8.0.Microsoft.VC80.MFCLOC" version="8.0.50727.762" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity type="win32" name="Microsoft.VC80.MFCLOC" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <bindingRedirect oldVersion="8.0.41204.256-8.0.50608.0" newVersion="8.0.50727.762"/>.. <bindingRedirect oldVersion="8.0.50727.42-8.0.50727.762" newVersion="8.0.50727.762"/>.. </dependentAssembly>.. </dependency>....</assembly>..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Policies\u1sw1o0k.9hi\8.0.50727.762.cat

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):8355
                  Entropy (8bit):7.401727457066723
                  Encrypted:false
                  SSDEEP:192:T9RpxL/CldolM3bd59MYbz2uT+InugbyaAqjkKiTbWTI:TnLCcUJvMYb6uT+qugeajC2I
                  MD5:98DC3A0DE986C24562CA071211F7DFBE
                  SHA1:1B016B20820EEF49E7BAECB93D19E0A0177110E8
                  SHA-256:91CA50CEC42075FFF02B366323BF3B45D2053B24544BD12B622B65621BD0EDD5
                  SHA-512:F76B8972E2175FD84A56B3139C31A87FBFAFD69E131DA46A96225BA9CCE9A4A726FB007B31DE08406C9B3F51D8FD0FD32827A485C668D9C92B54F24F1384BC53
                  Malicious:false
                  Preview:0. ...*.H........ .0. ....1.0...+......0..q..+.....7.....b0..^0...+.....7.........#.D.(...d.R..061202082602Z0...+.....7.....0...0....R0.9.1.0.5.C.8.8.6.A.8.3.6.7.7.E.4.9.C.E.6.E.F.4.7.F.8.C.F.1.A.0.4.7.2.1.4.A.E.D...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+..........\.j.g~I.n....G!J.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0...*8...0...5.0.7.2.7...7.6.2...p.o.l.i.c.y...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+..........\.j.g~I.n....G!J.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......{0...0..-.......G....RFC..mH.1.0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte Timestamping CA0...031204000000Z..131203235959Z0S1.0...U....US1.0...U....VeriSign, Inc.1+0)..U..."VeriSign Time Stamping Services CA0.."0...*.H............

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Policies\u1sw1o0k.9hi\8.0.50727.762.policy

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):800
                  Entropy (8bit):5.1940185043062534
                  Encrypted:false
                  SSDEEP:24:2dtMEDJ5iN+nf56g4NnjiNK+Rg4NnM23+LJ23sZQR:ciEDJw0x6g4EK+Rg46HQR
                  MD5:E7BF4CF966C7C8D01315DCB7AC64F31D
                  SHA1:09105C886A83677E49CE6EF47F8CF1A047214AED
                  SHA-256:8064287E17720B822F845352FE724595FDAFAF9DD2DBF21493327D8C50719A9E
                  SHA-512:6F6D05EBED3541BE650F0744F8978B88BB7699C60406AEEEBD9D0B3D28D4DC587633AD3A270964E05D96AFCD5EF47C333E7563EF79E44BB72B4670F5ACF84FBB
                  Malicious:false
                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright . 1981-2001 Microsoft Corporation -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.... <assemblyIdentity type="win32-policy" name="policy.8.0.Microsoft.VC80.MFC" version="8.0.50727.762" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity type="win32" name="Microsoft.VC80.MFC" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <bindingRedirect oldVersion="8.0.41204.256-8.0.50608.0" newVersion="8.0.50727.762"/>.. <bindingRedirect oldVersion="8.0.50727.42-8.0.50727.762" newVersion="8.0.50727.762"/>.. </dependentAssembly>.. </dependency>....</assembly>..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Policies\uxgs54we.kj4\8.0.50727.762.cat

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):8355
                  Entropy (8bit):7.399558553058028
                  Encrypted:false
                  SSDEEP:192:MjDVxL/CldolM3bd59MYbz2uT+InugbyaAqjkKiTbW/J/:83LCcUJvMYb6uT+qugeajCo
                  MD5:29C0897D5D709A2394960B26999126D0
                  SHA1:56501EDA82ECF05C4A90B035BE62B422A24C71C3
                  SHA-256:DD72F7AB2DEF5F75F58D01B24643B308750C38685DAAED50BCDDF61C18460DEE
                  SHA-512:75FB603D58105F0A2AACADE320E2EAB212DD6B3D6FCBDAB09CA137D123CC1DECB88C848B81E017BBDDD41D9591900FF723AED90FB0D6166E8C62E3C14D39166E
                  Malicious:false
                  Preview:0. ...*.H........ .0. ....1.0...+......0..q..+.....7.....b0..^0...+.....7......uU....L..F&.K....061202065436Z0...+.....7.....0...0...*8...0...5.0.7.2.7...7.6.2...p.o.l.i.c.y...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+..........@...@......_...."0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RD.1.0.4.4.0.9.3.0.C.C.9.9.4.4.0.9.E.9.2.0.D.9.4.C.7.C.4.5.F.0.4.0.5.D.6.0.4.2.2...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+..........@...@......_...."0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......{0...0..-.......G....RFC..mH.1.0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte Timestamping CA0...031204000000Z..131203235959Z0S1.0...U....US1.0...U....VeriSign, Inc.1+0)..U..."VeriSign Time Stamping Services CA0.."0...*.H............

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\Policies\uxgs54we.kj4\8.0.50727.762.policy

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):800
                  Entropy (8bit):5.192462113683958
                  Encrypted:false
                  SSDEEP:24:2dtMEDJ5iN+nhQ56g4NnjiNK+hcg4NnM23+LJ23sZQR:ciEDJw0hk6g4EK+hcg46HQR
                  MD5:A785CE93C7468DBCDFA7BC379F8FFDDC
                  SHA1:D10440930CC994409E920D94C7C45F0405D60422
                  SHA-256:3A131923C7403C1EEF33B59FDCA57D8272549B7912D2B522FC8A4C840CBCA735
                  SHA-512:8E514E11887F6A198756F4A4B1A584E0A337ABEF90F1A9330436E21E75CD5FFFE7E90A80424018C03EA55AE43758FCFA16F5A7C266D5476CE8F985F76CE5CADA
                  Malicious:false
                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright . 1981-2001 Microsoft Corporation -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.... <assemblyIdentity type="win32-policy" name="policy.8.0.Microsoft.VC80.CRT" version="8.0.50727.762" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity type="win32" name="Microsoft.VC80.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <bindingRedirect oldVersion="8.0.41204.256-8.0.50608.0" newVersion="8.0.50727.762"/>.. <bindingRedirect oldVersion="8.0.50727.42-8.0.50727.762" newVersion="8.0.50727.762"/>.. </dependentAssembly>.. </dependency>....</assembly>..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\b2rg91xw.1p4\msvcm80.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                  Category:dropped
                  Size (bytes):479232
                  Entropy (8bit):6.031745108754355
                  Encrypted:false
                  SSDEEP:6144:9Rj8Tfo4zrcq2FXOth6wsjb2fPzatjLhQeRW86ODl1KWOjPQeH:9So4zATQsjyWRhQ+W83D/6QO
                  MD5:CAE6861B19A2A7E5D42FEFC4DFDF5CCF
                  SHA1:609B81FBD3ACDA8C56E2663EDA80BFAFC9480991
                  SHA-256:C4C8C2D251B90D77D1AC75CBD39C3F0B18FC170D5A95D1C13A0266F7260B479D
                  SHA-512:C01D27F5A295B684C44105FCB62FB5F540A69D70A653AC9D14F2E5EF01295EF1DF136AE936273101739EB32EFF35185098A15F11D6C3293BBDCD9FCB98CB00A9
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-./.ihA.ihA.ihA..g..mhA.ih@..hA.N.:.lhA...?.hhA.N.<.hhA.N.,.fhA.N./..hA.N.;.hhA.N.=.hhA.N.9.hhA.RichihA.........................PE..L...."qE...........!.........@.......T............L|................................2.....@.............................c ..D...d.....................................................................@..............................H............text....x.......................... ..`.rdata..S[.......`..................@..@.data............ ..................@....rsrc...............................@..@.reloc..P$.......0... ..............@..B........................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\b2rg91xw.1p4\msvcp80.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):548864
                  Entropy (8bit):6.402420828464982
                  Encrypted:false
                  SSDEEP:12288:Q1HyurvZ0JPjuTtSu86th1n/hUgiW6QR7t5j3Ooc8NHkC2eo:Q1HyurvZ0liTwuhtjnj3Ooc8NHkC2eo
                  MD5:4C8A880EABC0B4D462CC4B2472116EA1
                  SHA1:D0A27F553C0FE0E507C7DF079485B601D5B592E6
                  SHA-256:2026F3C4F830DFF6883B88E2647272A52A132F25EB42C0D423E36B3F65A94D08
                  SHA-512:6A6CCE8C232F46DAB9B02D29BE5E0675CC1E968E9C2D64D0ABC008D20C0A7BAEB103A5B1D9B348FA1C4B3AF9797DBCB6E168B14B545FB15C2CCD926C3098C31C
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............y..y..y..fv..y..y..#y.....y..2...y.....y.....y......y.....y.....y.....y..Rich.y..........PE..L...."qE...........!.....@... ...............P....B|.........................p......u.....@.............................L...T...<............................ ..L2...S..............................Pe..@............P.. ............................text....;.......@.................. ..`.rdata......P.......P..............@..@.data...l&....... ..................@....rsrc...............................@..@.reloc..NA... ...P..................@..B........................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\b2rg91xw.1p4\msvcr80.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):626688
                  Entropy (8bit):6.8397070634061174
                  Encrypted:false
                  SSDEEP:12288:6Fqi2VC1J7Zs7a5zchr46CIfsyZmGyYCqeC:6Ui2C1JdoiEdmGyYu
                  MD5:E4FECE18310E23B1D8FEE993E35E7A6F
                  SHA1:9FD3A7F0522D36C2BF0E64FC510C6EEA3603B564
                  SHA-256:02BDDE38E4C6BD795A092D496B8D6060CDBE71E22EF4D7A204E3050C1BE44FA9
                  SHA-512:2FB5F8D63A39BA5E93505DF3A643D14E286FE34B11984CBED4B88E8A07517C03EFB3A7BF9D61CF1EC73B0A20D83F9E6068E61950A61D649B8D36082BB034DDFC
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L.........@................!......;.............d.......................Rich...................PE..L...8"qE...........!.....0...p......+#.......@.....x......................................@..........................q...~..Pc..<....`.......................p..H3...B...............................F..@............@...............................text...*'.......0.................. ..`.rdata......@.......@..............@..@.data...Li.......P..................@....rsrc........`.......@..............@..@.reloc...7...p...@...P..............@..B........................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\b2rg91xw.1p4\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.cat

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):8335
                  Entropy (8bit):7.405582810794059
                  Encrypted:false
                  SSDEEP:192:80XxL/CldolM3bd59MYbz2uT+InugbyaAqjkKiTb2LQ82:PBLCcUJvMYb6uT+qugeajCQ2
                  MD5:790ADAF5E825415E35AD65990E071AE0
                  SHA1:E23D182AB1EDFEF5FD3793313D90935FC034ABC8
                  SHA-256:88B03FE13D2710AD787D5D96CD0E5CBEDA3A61C2A0A2BDC0C0984A48365242E2
                  SHA-512:050BBAD3122CD0627ECACAF3FB24EBF1E1845F209C33ED6607B282D9DCD4F5D99E345DF3A99E4344AF2ABA6E7923C8483E8D5A8D709BF97F3CB37926D975FDAD
                  Malicious:false
                  Preview:0. ...*.H........ |0. x...1.0...+......0..u..+.....7.....f0..b0...+.....7..........MfN....O.....061202142259Z0...+.....7.....0...0....R2.E.1.2.C.6.D.F.7.3.5.2.C.3.E.D.3.C.6.1.A.4.5.B.A.F.6.8.E.A.C.E.1.C.C.9.5.4.6.E...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+............sR..<a.[.h....Tn0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....M.i.c.r.o.s.o.f.t...V.C.8.0...C.R.T...m.a.n...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+............sR..<a.[.h....Tn0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......{0...0..-.......G....RFC..mH.1.0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte Timestamping CA0...031204000000Z..131203235959Z0S1.0...U....US1.0...U....VeriSign, Inc.1+0)..U..."VeriSign Time Stamping Services CA0.."0...*.H........

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\b2rg91xw.1p4\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.manifest

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (504), with CRLF line terminators
                  Category:dropped
                  Size (bytes):1869
                  Entropy (8bit):5.395078491534145
                  Encrypted:false
                  SSDEEP:48:3SlK+hk6g4u09kkK23zWO09kkKFzv09kkKldSzY:Clth9uXkd3COXkgTXkX8
                  MD5:541423A06EFDCD4E4554C719061F82CF
                  SHA1:2E12C6DF7352C3ED3C61A45BAF68EACE1CC9546E
                  SHA-256:17AD1A64BA1C382ABF89341B40950F9B31F95015C6B0D3E25925BFEBC1B53EB5
                  SHA-512:11CF735DCDDBA72BABB9DE8F59E0C180A9FEC8268CBFCA09D17D8535F1B92C17BF32ACDA86499E420CBE7763A96D6067FEB67FA1ED745067AB326FD5B84188C6
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC80.CRT" version="8.0.50727.762" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="msvcr80.dll" hash="10f4cb2831f1e9288a73387a8734a8b604e5beaa" hashalg="SHA1"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>n9On8FItNsK/DmT8UQxu6jYDtWQ=</dsig:DigestValue></asmv2:hash></file>.. <file name="msvcp80.dll" hash="b2082dfd3009365c5b287448dcb3b4e2158a6d26" hashalg="SHA1"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xml

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\fd6uew4i.4ha\8.0.50727.762.cat

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):8361
                  Entropy (8bit):7.40471492725501
                  Encrypted:false
                  SSDEEP:192:DCRxL/CldolM3bd59MYbz2uT+InugbyaAqjkKiTbmWDy:sLCcUJvMYb6uT+qugeajCQ
                  MD5:C664656654DAB45BEB0D352077A884FB
                  SHA1:5BDB2EE6D91EE321FEF177E534C324DF96BAEF9D
                  SHA-256:B3BEB16C28DB357E654A6B132F59CD48CB95CEE949D7B97587F8F02F233F3CE1
                  SHA-512:F9CE3655342A07A29B5338AB5B78BA0B6CBC94EEB1D0538967DD2C23CBBDA6797326763E16F609C179B43E67503A87F76D8C306F0AB449F1601F13D7F7173A15
                  Malicious:false
                  Preview:0. ...*.H........ .0. ....1.0...+......0..q..+.....7.....b0..^0...+.....7......Y.s.oON.h..(H^G..061202084644Z0...+.....7.....0...0...*8...0...5.0.7.2.7...7.6.2...p.o.l.i.c.y...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........\.-..9.l..Pu..r..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R9.D.8.2.F.A.5.C.E.1.2.D.D.F.E.6.3.9.A.F.6.C.8.9.C.7.5.0.7.5.8.D.8.E.7.2.A.2.0.A...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........\.-..9.l..Pu..r..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......{0...0..-.......G....RFC..mH.1.0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte Timestamping CA0...031204000000Z..131203235959Z0S1.0...U....US1.0...U....VeriSign, Inc.1+0)..U..."VeriSign Time Stamping Services CA0.."0...*.H............

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\fd6uew4i.4ha\8.0.50727.762.policy

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):806
                  Entropy (8bit):5.200250853529196
                  Encrypted:false
                  SSDEEP:24:2dtMEDJ5iN+n856g4NnjiNK+wg4NnM23+LJ23sZQR:ciEDJw0I6g4EK+wg46HQR
                  MD5:11D6A2E757DA71254BFC61D26F06884D
                  SHA1:9D82FA5CE12DDFE639AF6C89C750758D8E72A20A
                  SHA-256:58AE1580121AFE06CE2B858B96B6AB893A8D105B17FE54D85711A969C3303DC4
                  SHA-512:0074430D25861B7B18CFA2C3E5BF728B51B676C5A30799986305BE94C40EE1DCA8E3C00A6279C801771F44D4ED551F73A0DC5C5792715C1C10361712D9EF8B29
                  Malicious:false
                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright . 1981-2001 Microsoft Corporation -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.... <assemblyIdentity type="win32-policy" name="policy.8.0.Microsoft.VC80.OpenMP" version="8.0.50727.762" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity type="win32" name="Microsoft.VC80.OpenMP" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <bindingRedirect oldVersion="8.0.41204.256-8.0.50608.0" newVersion="8.0.50727.762"/>.. <bindingRedirect oldVersion="8.0.50727.42-8.0.50727.762" newVersion="8.0.50727.762"/>.. </dependentAssembly>.. </dependency>....</assembly>..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\j4auwzcy.rsh\8.0.50727.762.cat

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):8355
                  Entropy (8bit):7.401719031801445
                  Encrypted:false
                  SSDEEP:192:/NNxL/CldolM3bd59MYbz2uT+InugbyaAqjkKiTbWyVAz:xLCcUJvMYb6uT+qugeajCRVI
                  MD5:57FD064E95D299507600F6D80AA6B578
                  SHA1:9947DD086424ADB4D62FEB33FB9EBB52FA11C281
                  SHA-256:F7BF65CA621D8AD32EAD1500A08827BE239D0F49D83DC20DABF57D2EB17ADBD7
                  SHA-512:FD9E17009E0E88B725FC6AA014A95E9516543F54CADBB6A71C1C1F39F4DEF4AD0DF2D8F55720E8B1A54EB2EBCE6C42C8C899E33E490DD304EB014CCAB6DB9C44
                  Malicious:false
                  Preview:0. ...*.H........ .0. ....1.0...+......0..q..+.....7.....b0..^0...+.....7.....MrG.u..A......j..061202065600Z0...+.....7.....0...0...*8...0...5.0.7.2.7...7.6.2...p.o.l.i.c.y...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+............N....f.V....vf.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RE.4.8.A.1.E.B.7.8.4.4.E.C.8.1.D.C.C.0.A.6.6.9.0.5.6.1.9.A.F.E.E.E.6.7.6.6.6.A.5...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+............N....f.V....vf.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......{0...0..-.......G....RFC..mH.1.0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte Timestamping CA0...031204000000Z..131203235959Z0S1.0...U....US1.0...U....VeriSign, Inc.1+0)..U..."VeriSign Time Stamping Services CA0.."0...*.H............

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\j4auwzcy.rsh\8.0.50727.762.policy

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):800
                  Entropy (8bit):5.197462113683958
                  Encrypted:false
                  SSDEEP:24:2dtMEDJ5iN+nyr56g4NnjiNK+2g4NnM23+LJ23sZQR:ciEDJw0yl6g4EK+2g46HQR
                  MD5:856BBF8E45A26C912BD447EC12DC17DB
                  SHA1:E48A1EB7844EC81DCC0A66905619AFEEE67666A5
                  SHA-256:863E67B018E99E1685F03D4FED538F8269332570887FC17534DD3637B7AA6A41
                  SHA-512:BB79BD9A3A06FB6CFD3312EDB766B8EF5C03AA250CCFA17ADD8799EEC06CCE88BE9369DB452D20B09519A910878E1840513404B5DF59289DD84BEDD01771AD01
                  Malicious:false
                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright . 1981-2001 Microsoft Corporation -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.... <assemblyIdentity type="win32-policy" name="policy.8.0.Microsoft.VC80.ATL" version="8.0.50727.762" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity type="win32" name="Microsoft.VC80.ATL" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <bindingRedirect oldVersion="8.0.41204.256-8.0.50608.0" newVersion="8.0.50727.762"/>.. <bindingRedirect oldVersion="8.0.50727.42-8.0.50727.762" newVersion="8.0.50727.762"/>.. </dependentAssembly>.. </dependency>....</assembly>..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\n3oqdoe3.l2\8.0.50727.762.cat

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):8361
                  Entropy (8bit):7.402377797496622
                  Encrypted:false
                  SSDEEP:192:F9JFQmFxL/CldolM3bd59MYbz2uT+InugbyaAqjkKiTbm1:FnGmHLCcUJvMYb6uT+qugeajCA
                  MD5:93615FE0E4458E717BBA670C9B162E84
                  SHA1:CE99F878D2528EFC821D05462313C8EF99BE8C2F
                  SHA-256:D14225A52543AA5A9605B00DD7574812BF89C605EBC73A9730E1E386BFC965F8
                  SHA-512:F87BA88B0B2BF186872BDF226EA137463A773B710CD4505E50FD22E7E3E629BEAB26AF32313FE09BB4D1A0C621D95DF3E1D0A957D6D5A43868A1C4953CA3343F
                  Malicious:false
                  Preview:0. ...*.H........ .0. ....1.0...+......0..q..+.....7.....b0..^0...+.....7........1..lI.N.i..-...061202082602Z0...+.....7.....0...0...*8...0...5.0.7.2.7...7.6.2...p.o.l.i.c.y...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+..........V.XpV...L0.W1$....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RF.0.8.1.5.6.1.6.5.8.7.0.5.6.1.0.A.D.A.D.4.C.3.0.E.7.5.7.3.1.2.4.9.1.E.D.F.9.E.0...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+..........V.XpV...L0.W1$....0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......{0...0..-.......G....RFC..mH.1.0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte Timestamping CA0...031204000000Z..131203235959Z0S1.0...U....US1.0...U....VeriSign, Inc.1+0)..U..."VeriSign Time Stamping Services CA0.."0...*.H............

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\n3oqdoe3.l2\8.0.50727.762.policy

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):806
                  Entropy (8bit):5.222427128564631
                  Encrypted:false
                  SSDEEP:24:2dtMEDJ5iN+nEI56g4NnjiNK+3g4NnM23+LJ23sZQR:ciEDJw0v6g4EK+3g46HQR
                  MD5:53094430F66951325C1B88A4F0CA374D
                  SHA1:F081561658705610ADAD4C30E757312491EDF9E0
                  SHA-256:4594558E51587C0EDF1F3F95A0D4B8749B3EA3B6C8B76B31B13F1CA1D3E2F4AF
                  SHA-512:75EAD79C7392DE2BE0964D0399DA4B6B883BFC1E53CB099EC6BF2E4DA594B24B52E1C08AB6BA5B0B18DF7E64DAC0979C2A57E0B20EE6FDD5D54340FFF8F6D462
                  Malicious:false
                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright . 1981-2001 Microsoft Corporation -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.... <assemblyIdentity type="win32-policy" name="policy.8.0.Microsoft.VC80.MFCLOC" version="8.0.50727.762" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity type="win32" name="Microsoft.VC80.MFCLOC" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <bindingRedirect oldVersion="8.0.41204.256-8.0.50608.0" newVersion="8.0.50727.762"/>.. <bindingRedirect oldVersion="8.0.50727.42-8.0.50727.762" newVersion="8.0.50727.762"/>.. </dependentAssembly>.. </dependency>....</assembly>..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80CHS.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):40960
                  Entropy (8bit):3.7202246676917885
                  Encrypted:false
                  SSDEEP:384:PODNemsol/tAGqyVUIrvxW24WRqJwxV0fwItnFiHyt6S26r81Jd5AJd:POZXsKAGDTrvfTx4wItnFfL26r81nE
                  MD5:AFA7E91C8C9566E03FB1620F95230B93
                  SHA1:75057A0E936032EC9CBC77559241720F58BFAB84
                  SHA-256:4EAF1750A573BAB5C853E7714EFCC84FF2FCF992AD935FD01AF9E2A5BD01A93A
                  SHA-512:B9C34166555F42D4A4E754131FD2868B4FC2965AC8519A6EEED8A32F6C67E1E6E5B4DAA93175967F5F687D8333CA53C4D183A2177191A81BC01E89B7CBDC9BB3
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L..._4qE...........!..............................6].................................@....@..............................................~...........................................................................................................rsrc....~..........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80CHT.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):45056
                  Entropy (8bit):3.527823884757394
                  Encrypted:false
                  SSDEEP:384:PvDNumStwO/tAGqyVB+dvEQW23WRcMUn5xm9za2JokMw6TERPB1ECA:PvZHSGMAGDadv6On5x4pqwPPB1EC
                  MD5:2DCA32742F80BB37E159B651F8EEF44B
                  SHA1:DCD0265FBE8EFD63C235ED4611AECC4B935C057C
                  SHA-256:A7EAF2B5DF991654500FFED95D3950A46DD0FE05CDDCCCD77490F125E22B80D6
                  SHA-512:40E1533F6989955F537D556AB28FF0BE44658309EEF5D40093BF3FCEC39AD85EA14BB2B880FF5C067CCFC257A35361C25AAC087E0463BAFE39FB265B8A0825EE
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L..._4qE...........!..............................6]................................Mp....@..........................................................................................................................................................rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80DEU.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):65536
                  Entropy (8bit):3.09089382778059
                  Encrypted:false
                  SSDEEP:1536:v1AGDh+vfxzesi870vYtNerHI4Lhp0vcsjsr:v1AGDhuxzesi870hLhp0vcsjsr
                  MD5:1E6719EBEB1D368E09899A9D0DDFAD70
                  SHA1:FC510A6DBE0D9180F203AF651E186979B628675F
                  SHA-256:734EB909C54A0A1C53AA5177727660B1C64F3D261B222FEAEC76FC5853300661
                  SHA-512:C5753B79D97204C130A2C0A46D7717E74C140D207A446918DF113A6C460F538AFE0A48AF52360D8A501104283311667CE8DD23B4D3E65B7EE99939A791C25AD6
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L...^4qE...........!..............................6]................................?.....@..........................................................................................................................................................rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80ENU.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):57344
                  Entropy (8bit):3.050363341730474
                  Encrypted:false
                  SSDEEP:384:PODNXnSkNsq/tAGqyV5KOvxW2+WR1BrxiFc+hV9RLNq/HRK/+nnWT59Dl:POZX3s4AGDCOvJ1B4V9RLNqfRKGnWHB
                  MD5:9090454E6772F7CFBCE240BF4DC5F7E8
                  SHA1:3AFD27AF1FBB5D2EFDE463869A1E6465AFFBCDD8
                  SHA-256:A532044DFD1FA6463516125EA74C250762DE4DACBE613F8AD2FF72D50C0B9585
                  SHA-512:4691138B2E32447A6300A17967C1221153B5B514EE0EDCD25A135DCE2A6EEFEA9CC7F3FC516A9B3482FEB62DC190A7F4192BCF15D9793832F828078557E24CDF
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L..._4qE...........!..............................6].................................g....@.............................................(............................................................................................................rsrc...(...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80ESP.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):61440
                  Entropy (8bit):3.0964773972990574
                  Encrypted:false
                  SSDEEP:768:PsZTQAGDf3vr0or0GBFCDCLhedUPYVbS/:AQAGDPvr0or0GBFMkhedUkS
                  MD5:D47599748B3ECF645C47CAA0BC24A7CD
                  SHA1:2F47846B9308FE4B444363F0863F394A1B13C938
                  SHA-256:10FD5EEBE39ACD996309DA073B247B365CBC0F48F43DA3062463EA9F712319CA
                  SHA-512:30B0F056123657EACA8F97138E1CA5C2981575420938EE7ED645E4D62F2A159C011EFF08C2EE20AC68504BD59D890DBC030718A9BA185871B07DEE9851CF2608
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L..._4qE...........!..............................6]......................................@..........................................................................................................................................................rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80FRA.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):61440
                  Entropy (8bit):3.1658595093754625
                  Encrypted:false
                  SSDEEP:768:xZweyAGDSRvjZrkh2A6NTi7e3RAaTaPCeyGdZmBSg3T1SyyyyyyyyyyyyyyyafyL:7yAGD+vjZbA2SCeB0Ug4
                  MD5:EEC2F9E4D790BCCDBC542715AB613579
                  SHA1:8993E9F0CC4657E40866EFBA0CAB7E077060CEA8
                  SHA-256:E283B055A0B9F522FF415B78F100542255AA07CB17C1EEB3885E75326D9DBC66
                  SHA-512:89C083C820798872F3FEECFFCCC1A5CCEF9A367C8AF2170EC06B04A64A234DD03CDFE250B31B5969F87CAA8E7EA8393FBCBBCBF16D83C35105814501B6BE08E8
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L...^4qE...........!..............................6].................................E....@.............................................(............................................................................................................rsrc...(...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80ITA.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):61440
                  Entropy (8bit):3.1028777863172503
                  Encrypted:false
                  SSDEEP:768:OZ0odoAGDI6vuoG57PxtINJ8Il8QcPOCeFO/:5o+AGDHvuoc7PxtINJ8gIPp
                  MD5:CB23B162AC655F24C6711A5F5DF348C6
                  SHA1:E4E0E803B9297B0937824C53F227598998229463
                  SHA-256:6498EE1449B61B40E2DAB46F0B3DFA15F17590D7AA87919580748EC9D4BC2C55
                  SHA-512:460D235818CD83D9020A13F47B24AADC777E4BDC81A6387D8BB59DAF37EAF930C70ACE5E238FE2FA34491A03B3972F11A4BDB8D30FF98801ACFF82630B6D24A2
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L...^4qE...........!..............................6].....................................@.............................................(............................................................................................................rsrc...(...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80JPN.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):49152
                  Entropy (8bit):3.7900346517730297
                  Encrypted:false
                  SSDEEP:384:VDNCysmq/tAGqyVVp7vhedW20WR2JkQbXDr10Jh8I2Bb4:VZXsPAGDN7vQv2Jkkr10IIc4
                  MD5:012031B19F0A9F6431997C79E1893822
                  SHA1:2265C92B3ED9EC169E2C362E448B0E3F449528A3
                  SHA-256:ED296B3DD004C8845A7015A3A5EF3A92331E30535204A02995323681CBD342AB
                  SHA-512:B4CCA371481B349546AD09C40461258A99E5AD6CF7B66FE040A37F90071C420CC41E74F495141A490B4848B66DA876AD8B91AC7C14A328CF5C4CCAADFD3E226E
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L...^4qE...........!..............................6]......................................@.............................................8............................................................................................................rsrc...8...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\pefn04mk.ve6\mfc80KOR.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):49152
                  Entropy (8bit):3.724944556618916
                  Encrypted:false
                  SSDEEP:384:PUDNSnxGr/tAGqyV0/NvbW2OWRFKu/KV0YfmtT2XYm66tHggFK417RTNbU/Ltl3h:PUZSE5AGD0NvrDriHqN
                  MD5:FEC4610F1174136B1D3DB2AE37924CE8
                  SHA1:BA94E77BB29B9B74EA8E2A8FD005DC3083166F3C
                  SHA-256:A6D0B3D20E67C26F7C247F2EEB8DBA723B396B118A1B9EAA4568C474826EA740
                  SHA-512:9144A0243E41EC17628A740913A745261346EFA2DFF3F61D48CCF186F30A1527F6A4F5CB3F7F7727D7BFD4103E9FC90CAE1E0CEFBC1D8D042218D9D2EA869A36
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L..._4qE...........!..............................6]................................b.....@.........................................................................................................................................................rsrc..............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80CHS.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):40960
                  Entropy (8bit):3.7202246676917885
                  Encrypted:false
                  SSDEEP:384:PODNemsol/tAGqyVUIrvxW24WRqJwxV0fwItnFiHyt6S26r81Jd5AJd:POZXsKAGDTrvfTx4wItnFfL26r81nE
                  MD5:AFA7E91C8C9566E03FB1620F95230B93
                  SHA1:75057A0E936032EC9CBC77559241720F58BFAB84
                  SHA-256:4EAF1750A573BAB5C853E7714EFCC84FF2FCF992AD935FD01AF9E2A5BD01A93A
                  SHA-512:B9C34166555F42D4A4E754131FD2868B4FC2965AC8519A6EEED8A32F6C67E1E6E5B4DAA93175967F5F687D8333CA53C4D183A2177191A81BC01E89B7CBDC9BB3
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L..._4qE...........!..............................6].................................@....@..............................................~...........................................................................................................rsrc....~..........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80CHT.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):45056
                  Entropy (8bit):3.527823884757394
                  Encrypted:false
                  SSDEEP:384:PvDNumStwO/tAGqyVB+dvEQW23WRcMUn5xm9za2JokMw6TERPB1ECA:PvZHSGMAGDadv6On5x4pqwPPB1EC
                  MD5:2DCA32742F80BB37E159B651F8EEF44B
                  SHA1:DCD0265FBE8EFD63C235ED4611AECC4B935C057C
                  SHA-256:A7EAF2B5DF991654500FFED95D3950A46DD0FE05CDDCCCD77490F125E22B80D6
                  SHA-512:40E1533F6989955F537D556AB28FF0BE44658309EEF5D40093BF3FCEC39AD85EA14BB2B880FF5C067CCFC257A35361C25AAC087E0463BAFE39FB265B8A0825EE
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L..._4qE...........!..............................6]................................Mp....@..........................................................................................................................................................rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80DEU.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):65536
                  Entropy (8bit):3.09089382778059
                  Encrypted:false
                  SSDEEP:1536:v1AGDh+vfxzesi870vYtNerHI4Lhp0vcsjsr:v1AGDhuxzesi870hLhp0vcsjsr
                  MD5:1E6719EBEB1D368E09899A9D0DDFAD70
                  SHA1:FC510A6DBE0D9180F203AF651E186979B628675F
                  SHA-256:734EB909C54A0A1C53AA5177727660B1C64F3D261B222FEAEC76FC5853300661
                  SHA-512:C5753B79D97204C130A2C0A46D7717E74C140D207A446918DF113A6C460F538AFE0A48AF52360D8A501104283311667CE8DD23B4D3E65B7EE99939A791C25AD6
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L...^4qE...........!..............................6]................................?.....@..........................................................................................................................................................rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80ENU.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):57344
                  Entropy (8bit):3.050363341730474
                  Encrypted:false
                  SSDEEP:384:PODNXnSkNsq/tAGqyV5KOvxW2+WR1BrxiFc+hV9RLNq/HRK/+nnWT59Dl:POZX3s4AGDCOvJ1B4V9RLNqfRKGnWHB
                  MD5:9090454E6772F7CFBCE240BF4DC5F7E8
                  SHA1:3AFD27AF1FBB5D2EFDE463869A1E6465AFFBCDD8
                  SHA-256:A532044DFD1FA6463516125EA74C250762DE4DACBE613F8AD2FF72D50C0B9585
                  SHA-512:4691138B2E32447A6300A17967C1221153B5B514EE0EDCD25A135DCE2A6EEFEA9CC7F3FC516A9B3482FEB62DC190A7F4192BCF15D9793832F828078557E24CDF
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L..._4qE...........!..............................6].................................g....@.............................................(............................................................................................................rsrc...(...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80ESP.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):61440
                  Entropy (8bit):3.0964773972990574
                  Encrypted:false
                  SSDEEP:768:PsZTQAGDf3vr0or0GBFCDCLhedUPYVbS/:AQAGDPvr0or0GBFMkhedUkS
                  MD5:D47599748B3ECF645C47CAA0BC24A7CD
                  SHA1:2F47846B9308FE4B444363F0863F394A1B13C938
                  SHA-256:10FD5EEBE39ACD996309DA073B247B365CBC0F48F43DA3062463EA9F712319CA
                  SHA-512:30B0F056123657EACA8F97138E1CA5C2981575420938EE7ED645E4D62F2A159C011EFF08C2EE20AC68504BD59D890DBC030718A9BA185871B07DEE9851CF2608
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L..._4qE...........!..............................6]......................................@..........................................................................................................................................................rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80FRA.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):61440
                  Entropy (8bit):3.1658595093754625
                  Encrypted:false
                  SSDEEP:768:xZweyAGDSRvjZrkh2A6NTi7e3RAaTaPCeyGdZmBSg3T1SyyyyyyyyyyyyyyyafyL:7yAGD+vjZbA2SCeB0Ug4
                  MD5:EEC2F9E4D790BCCDBC542715AB613579
                  SHA1:8993E9F0CC4657E40866EFBA0CAB7E077060CEA8
                  SHA-256:E283B055A0B9F522FF415B78F100542255AA07CB17C1EEB3885E75326D9DBC66
                  SHA-512:89C083C820798872F3FEECFFCCC1A5CCEF9A367C8AF2170EC06B04A64A234DD03CDFE250B31B5969F87CAA8E7EA8393FBCBBCBF16D83C35105814501B6BE08E8
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L...^4qE...........!..............................6].................................E....@.............................................(............................................................................................................rsrc...(...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80ITA.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):61440
                  Entropy (8bit):3.1028777863172503
                  Encrypted:false
                  SSDEEP:768:OZ0odoAGDI6vuoG57PxtINJ8Il8QcPOCeFO/:5o+AGDHvuoc7PxtINJ8gIPp
                  MD5:CB23B162AC655F24C6711A5F5DF348C6
                  SHA1:E4E0E803B9297B0937824C53F227598998229463
                  SHA-256:6498EE1449B61B40E2DAB46F0B3DFA15F17590D7AA87919580748EC9D4BC2C55
                  SHA-512:460D235818CD83D9020A13F47B24AADC777E4BDC81A6387D8BB59DAF37EAF930C70ACE5E238FE2FA34491A03B3972F11A4BDB8D30FF98801ACFF82630B6D24A2
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L...^4qE...........!..............................6].....................................@.............................................(............................................................................................................rsrc...(...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80JPN.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):49152
                  Entropy (8bit):3.7900346517730297
                  Encrypted:false
                  SSDEEP:384:VDNCysmq/tAGqyVVp7vhedW20WR2JkQbXDr10Jh8I2Bb4:VZXsPAGDN7vQv2Jkkr10IIc4
                  MD5:012031B19F0A9F6431997C79E1893822
                  SHA1:2265C92B3ED9EC169E2C362E448B0E3F449528A3
                  SHA-256:ED296B3DD004C8845A7015A3A5EF3A92331E30535204A02995323681CBD342AB
                  SHA-512:B4CCA371481B349546AD09C40461258A99E5AD6CF7B66FE040A37F90071C420CC41E74F495141A490B4848B66DA876AD8B91AC7C14A328CF5C4CCAADFD3E226E
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L...^4qE...........!..............................6]......................................@.............................................8............................................................................................................rsrc...8...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\mfc80KOR.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):49152
                  Entropy (8bit):3.724944556618916
                  Encrypted:false
                  SSDEEP:384:PUDNSnxGr/tAGqyV0/NvbW2OWRFKu/KV0YfmtT2XYm66tHggFK417RTNbU/Ltl3h:PUZSE5AGD0NvrDriHqN
                  MD5:FEC4610F1174136B1D3DB2AE37924CE8
                  SHA1:BA94E77BB29B9B74EA8E2A8FD005DC3083166F3C
                  SHA-256:A6D0B3D20E67C26F7C247F2EEB8DBA723B396B118A1B9EAA4568C474826EA740
                  SHA-512:9144A0243E41EC17628A740913A745261346EFA2DFF3F61D48CCF186F30A1527F6A4F5CB3F7F7727D7BFD4103E9FC90CAE1E0CEFBC1D8D042218D9D2EA869A36
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-T.L:..L:..L:...F..L:...B..L:.Rich.L:.........PE..L..._4qE...........!..............................6]................................b.....@.........................................................................................................................................................rsrc..............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303.cat

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):8348
                  Entropy (8bit):7.393940545952515
                  Encrypted:false
                  SSDEEP:192:BBGwxL/CldolM3bd59MYbz2uT+InugbyaAqjkKiTbmI0TYk:KcLCcUJvMYb6uT+qugeajCfEYk
                  MD5:DFE03B4FF0EF67F7A08A7D88B3E4BDE3
                  SHA1:BF907A1B27DB3BF3C10DA685D9CB4CBFF9155E6B
                  SHA-256:26340819D2EF86080D9001C6F2737D70FD6602DDF4B86B6C26B326EF81CC3342
                  SHA-512:3D1F6773A476B2F84F53A288F1A1EF0FC44A58F8A9C25F9773871CB4F4F9CB81CBE6C242665D1CBA8BA327C441FC5B13F254E1657258A841102CC571185D70BD
                  Malicious:false
                  Preview:0. ...*.H........ .0. ....1.0...+......0..|..+.....7.....m0..i0...+.....7......7qN.NqJ...E..8..061202082602Z0...+.....7.....0..&0....R8.3.0.D.6.4.5.9.3.5.0.D.D.1.A.B.3.B.1.F.0.7.0.1.3.5.4.2.5.A.9.3.3.9.5.7.8.2.B.1...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+..........dY5..;...5BZ.9W..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....4M.i.c.r.o.s.o.f.t...V.C.8.0...M.F.C.L.O.C...m.a.n...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+..........dY5..;...5BZ.9W..0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......{0...0..-.......G....RFC..mH.1.0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte Timestamping CA0...031204000000Z..131203235959Z0S1.0...U....US1.0...U....VeriSign, Inc.1+0)..U..."VeriSign Time Stamping Services CA0.."0...*.H.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\refn04mk.ve6\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303.manifest

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):1239
                  Entropy (8bit):5.33259165949927
                  Encrypted:false
                  SSDEEP:24:2dtMEDJ/eiNK+EI56g4NnZCO/3QQvhONoajUCvBTmAmWG1YoSoFJF:ciEDJdK+v6g4H3strJnmW27
                  MD5:56613508687D065362302FF388CD5E82
                  SHA1:830D6459350DD1AB3B1F070135425A93395782B1
                  SHA-256:2F79707C5EA8937E8887B642CFA4CE682C52816C20207C1588FD5A1E39E88C1C
                  SHA-512:66C650CDCF5D15D313B7B0F3AFDAB717F075BC0AC560B75CF2EA5375C62EFEBE01A890204A3E74835B65B60113120815C7DD564F78564029D1F5170D63990814
                  Malicious:false
                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright . 1981-2001 Microsoft Corporation -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable/>.. <assemblyIdentity type="win32" name="Microsoft.VC80.MFCLOC" version="8.0.50727.762" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <file name="mfc80CHS.dll" hash="0ed99f840cfe11946fd5aa2002eff17451d441eb" hashalg="SHA1"/>.. <file name="mfc80CHT.dll" hash="3eb85cc7e931f885f2b91aa285432b740edaa6b1" hashalg="SHA1"/>.. <file name="mfc80DEU.dll" hash="5489f4037e83e03786e4c7842cc7599beafac96e" hashalg="SHA1"/>.. <file name="mfc80ENU.dll" hash="ed96ef26e683b48b4f04eefc75d873f863c993cf" hashalg="SHA1"/>.. <file name="mfc80ESP.dll" hash="b3d647f39f26b07f6014b40a9f511cfd4614bdf8" hashalg="SHA1"/>.. <file name="mfc80FRA.dll" hash="89d11dd75a1a74547cf94e0b66d742eb7fe909b2" hashalg="SHA1"/>.. <file name="mfc80ITA.dll" hash="e07b9360a90e74e4ab1bf4f3f9

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\v1sw1o0k.9hi\8.0.50727.762.cat

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):8355
                  Entropy (8bit):7.401727457066723
                  Encrypted:false
                  SSDEEP:192:T9RpxL/CldolM3bd59MYbz2uT+InugbyaAqjkKiTbWTI:TnLCcUJvMYb6uT+qugeajC2I
                  MD5:98DC3A0DE986C24562CA071211F7DFBE
                  SHA1:1B016B20820EEF49E7BAECB93D19E0A0177110E8
                  SHA-256:91CA50CEC42075FFF02B366323BF3B45D2053B24544BD12B622B65621BD0EDD5
                  SHA-512:F76B8972E2175FD84A56B3139C31A87FBFAFD69E131DA46A96225BA9CCE9A4A726FB007B31DE08406C9B3F51D8FD0FD32827A485C668D9C92B54F24F1384BC53
                  Malicious:false
                  Preview:0. ...*.H........ .0. ....1.0...+......0..q..+.....7.....b0..^0...+.....7.........#.D.(...d.R..061202082602Z0...+.....7.....0...0....R0.9.1.0.5.C.8.8.6.A.8.3.6.7.7.E.4.9.C.E.6.E.F.4.7.F.8.C.F.1.A.0.4.7.2.1.4.A.E.D...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+..........\.j.g~I.n....G!J.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0...*8...0...5.0.7.2.7...7.6.2...p.o.l.i.c.y...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+..........\.j.g~I.n....G!J.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......{0...0..-.......G....RFC..mH.1.0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte Timestamping CA0...031204000000Z..131203235959Z0S1.0...U....US1.0...U....VeriSign, Inc.1+0)..U..."VeriSign Time Stamping Services CA0.."0...*.H............

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\v1sw1o0k.9hi\8.0.50727.762.policy

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):800
                  Entropy (8bit):5.1940185043062534
                  Encrypted:false
                  SSDEEP:24:2dtMEDJ5iN+nf56g4NnjiNK+Rg4NnM23+LJ23sZQR:ciEDJw0x6g4EK+Rg46HQR
                  MD5:E7BF4CF966C7C8D01315DCB7AC64F31D
                  SHA1:09105C886A83677E49CE6EF47F8CF1A047214AED
                  SHA-256:8064287E17720B822F845352FE724595FDAFAF9DD2DBF21493327D8C50719A9E
                  SHA-512:6F6D05EBED3541BE650F0744F8978B88BB7699C60406AEEEBD9D0B3D28D4DC587633AD3A270964E05D96AFCD5EF47C333E7563EF79E44BB72B4670F5ACF84FBB
                  Malicious:false
                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright . 1981-2001 Microsoft Corporation -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.... <assemblyIdentity type="win32-policy" name="policy.8.0.Microsoft.VC80.MFC" version="8.0.50727.762" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity type="win32" name="Microsoft.VC80.MFC" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <bindingRedirect oldVersion="8.0.41204.256-8.0.50608.0" newVersion="8.0.50727.762"/>.. <bindingRedirect oldVersion="8.0.50727.42-8.0.50727.762" newVersion="8.0.50727.762"/>.. </dependentAssembly>.. </dependency>....</assembly>..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\vxgs54we.kj4\8.0.50727.762.cat

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):8355
                  Entropy (8bit):7.399558553058028
                  Encrypted:false
                  SSDEEP:192:MjDVxL/CldolM3bd59MYbz2uT+InugbyaAqjkKiTbW/J/:83LCcUJvMYb6uT+qugeajCo
                  MD5:29C0897D5D709A2394960B26999126D0
                  SHA1:56501EDA82ECF05C4A90B035BE62B422A24C71C3
                  SHA-256:DD72F7AB2DEF5F75F58D01B24643B308750C38685DAAED50BCDDF61C18460DEE
                  SHA-512:75FB603D58105F0A2AACADE320E2EAB212DD6B3D6FCBDAB09CA137D123CC1DECB88C848B81E017BBDDD41D9591900FF723AED90FB0D6166E8C62E3C14D39166E
                  Malicious:false
                  Preview:0. ...*.H........ .0. ....1.0...+......0..q..+.....7.....b0..^0...+.....7......uU....L..F&.K....061202065436Z0...+.....7.....0...0...*8...0...5.0.7.2.7...7.6.2...p.o.l.i.c.y...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+..........@...@......_...."0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RD.1.0.4.4.0.9.3.0.C.C.9.9.4.4.0.9.E.9.2.0.D.9.4.C.7.C.4.5.F.0.4.0.5.D.6.0.4.2.2...1..0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+..........@...@......_...."0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......{0...0..-.......G....RFC..mH.1.0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U....Durbanville1.0...U....Thawte1.0...U....Thawte Certification1.0...U....Thawte Timestamping CA0...031204000000Z..131203235959Z0S1.0...U....US1.0...U....VeriSign, Inc.1+0)..U..."VeriSign Time Stamping Services CA0.."0...*.H............

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\Windows\winsxs\vxgs54we.kj4\8.0.50727.762.policy

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):800
                  Entropy (8bit):5.192462113683958
                  Encrypted:false
                  SSDEEP:24:2dtMEDJ5iN+nhQ56g4NnjiNK+hcg4NnM23+LJ23sZQR:ciEDJw0hk6g4EK+hcg46HQR
                  MD5:A785CE93C7468DBCDFA7BC379F8FFDDC
                  SHA1:D10440930CC994409E920D94C7C45F0405D60422
                  SHA-256:3A131923C7403C1EEF33B59FDCA57D8272549B7912D2B522FC8A4C840CBCA735
                  SHA-512:8E514E11887F6A198756F4A4B1A584E0A337ABEF90F1A9330436E21E75CD5FFFE7E90A80424018C03EA55AE43758FCFA16F5A7C266D5476CE8F985F76CE5CADA
                  Malicious:false
                  Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.. Copyright . 1981-2001 Microsoft Corporation -->..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.... <assemblyIdentity type="win32-policy" name="policy.8.0.Microsoft.VC80.CRT" version="8.0.50727.762" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity type="win32" name="Microsoft.VC80.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"/>.. <bindingRedirect oldVersion="8.0.41204.256-8.0.50608.0" newVersion="8.0.50727.762"/>.. <bindingRedirect oldVersion="8.0.50727.42-8.0.50727.762" newVersion="8.0.50727.762"/>.. </dependentAssembly>.. </dependency>....</assembly>..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_D3\SkyboxBack.jpg

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS3 Windows, datetime=2008:10:08 16:48:27], baseline, precision 8, 600x600, components 3
                  Category:dropped
                  Size (bytes):23220
                  Entropy (8bit):7.429579110391121
                  Encrypted:false
                  SSDEEP:384:v5OGcV5OGcNvI1uDCj9X6LwrV2B5Y4zh+UZOZpoS76RQO1:vsPsfAKCZKLwrVa5BwoC6RX
                  MD5:3FF313365B658A6F66F8C13A184204FB
                  SHA1:B08F454FD5F7E52D29E09FE278723CB2121BC644
                  SHA-256:C1027E2C5A2E0523F9B7AC68B2520148AC6737F03CEF4FB28EE407D1BFA86081
                  SHA-512:DB22B292C7DC5861D95E04BB1B11DE3C515D11AC1EC17B7A309A5A368A3CBB21A3D1C021E70FAE0D792077C44023D2B371F966D0FE738778D1A69BFC6EBCE651
                  Malicious:false
                  Preview:......JFIF.....`.`......Photoshop 3.0.8BIM................8BIM.%........\./....{g..d.8BIM./.....J.P..H...H...............@...............d................'....j.p.g.....c.8BIM.........`.......`......8BIM.&................?...8BIM............8BIM............8BIM..................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM..........8BIM................8BIM.0..........8BIM.-............8BIM...............@...@....8BIM............8BIM.......I...............X...X.....S.k.y.b.o.x.B.a.c.k...................................X...X...............................................null........boundsObjc..........Rct1........Top long........Leftlong........Btomlong...X....Rghtlong...X....slicesVlLs....Objc..........slice........sliceIDlong........groupIDlong........originenum....ESliceOrigin....auto

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_D3\SkyboxBottom.dds

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:Microsoft DirectDraw Surface (DDS): 256 x 256, 32-bit color, ARGB8888
                  Category:dropped
                  Size (bytes):262272
                  Entropy (8bit):2.667976319904894
                  Encrypted:false
                  SSDEEP:24:GZzqsTkU5oMUMMkkMIkM10UsEM1ApkMAFVVJts6uZMtAhcl/oEM9MM95MkAMMVAm:GZMu
                  MD5:2B2BC97C817022232BB23B17D357D484
                  SHA1:C937DBAE232AD9C11C55688FB6748D512F9706FF
                  SHA-256:CC063039B95021D4377A5FB2807A6E629EDAAB5C9E65EAC0050A33DE49D4C976
                  SHA-512:1E796D88CE64AE719CDA9B7E127FD4CC4D04DB275D372DA90CAAB57F6FA42160516DC6BB7DDE9F9A9A48EED71E408D7502F30EBD3E975F33B3B8861ECBF73072
                  Malicious:false
                  Preview:DDS |....................................................................... ...A....... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_D3\SkyboxBottom.jpg

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS3 Windows, datetime=2008:10:08 16:47:36], baseline, precision 8, 600x600, components 3
                  Category:dropped
                  Size (bytes):19490
                  Entropy (8bit):5.640498613868473
                  Encrypted:false
                  SSDEEP:96:i5b08K7oVQ5P1sP07EK7oTknmW1lO/692MWtmrjXhM1MHt9VdvvvvvvvvC:sR3sm13Tknrlt+tmr/to
                  MD5:E75DC83427E3786C5D98DABA86C9514C
                  SHA1:706815ABF25599A93798007D9A6E1FB9F556B040
                  SHA-256:C99D68C80361D440308862060A641804133B4BF5C0795E7576F39E4F2DBA3A52
                  SHA-512:29E3C60F32137CD58B8AE731CFDDCA467E03530818C519C42C4DAAA7CA65E2CEA7A03B998D504F0F6AEABB1C8A90A262B38C31A0E0608E2DEFBA7EF024FCE020
                  Malicious:false
                  Preview:......JFIF.....`.`.....,Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS3 Windows.2008:10:08 16:47:36............................X...........X...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..I$..YI$.JRI$...I$.$.I)I$.JRI$...I$.$.I)I$.J....I$..YI$.JRI$...I$.$.I)I$.JRI$...I$.$.I)I$.J....I$..YI$.JRI$...I$.$.I)I$.JRI$

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_D3\SkyboxFront.dds

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:Microsoft DirectDraw Surface (DDS): 256 x 256, 32-bit color, ARGB8888
                  Category:dropped
                  Size (bytes):262272
                  Entropy (8bit):5.3858310905250395
                  Encrypted:false
                  SSDEEP:3072:YTVI/X3/fE6PfYjnq29yrpma3ppoXXyeh8Wz+A:UVI/X3/fTF0LMWiA
                  MD5:00CCA79BAFCB6E73C3F83568705C7DC9
                  SHA1:19189037B1CBEB8EA6378CDD9DA5ED02CB1BFE0D
                  SHA-256:E6B0502D67D5D29F78ED08F624293AE1FD73781F51723A1B2CCE5FA7E1139739
                  SHA-512:0DFF0E468336FE0A2E316228D62DEFF8D415FE1F587C2C1AAF8759602FFFC7D9FB5DD4A266E6A2CB11F517EBBA56771C4BAF5A5552D4FDC03A2CFA6DFD2630D4
                  Malicious:false
                  Preview:DDS |....................................................................... ...A....... .......................................mB1.mB0.mB1.lA/.l@/.k@/.l@/.lA/.lA0.lA/.lA0.l@/.lA0.kA/.iA/.iA..jA/.iA..jA/.iA..jA/.iA..jA/.iA..jA/.iA..jA/.i@..iA..h@..h@..g?-.h?-.g?-.h?-.g?,.h?-.g>,.g?,.f>+.g?,.f>,.g>,.f>+.g>,.f>,.g>,.f>+.g>,.f>,.g>,.f=+.f>+.e=+.f=+.d<*.e=*.d<*.e=*.d<*.e=*.e<+.e<,.d;+.e;,.c9*.c:*.b9*.a;+.`;+.`<+._:*.^:).^9).^:)._;*.`;+.`;+._;+.^:*._:*._:*._:*.^:)._:*._:*._;*._:*._;*.^:*._;*.^:)._:*.^9).^:).^9).^:).^9).^9).^9).^:).^9).^:).]9).^:).^9).^:).^9).^:).^9).^:).^9).^:).^9).^9).^9).^:).^9).^:).^9).^:).^9).^:).]9).^:).^9).^:).^9).^:).]9).]9(.]8(.^8(._8).a9).a8)._9).^<+.nM<.pQ@.~_N..iX..o^..kX...t...r..kZ.rO?.c?..a;+.]9).];*.`;*.`9*.a8).a8).a9)._9).^9).^9).^:).^9).^:).]9(.^9(.]8(.]9(.]9(.^:).]9).^:)._:*._;*._:*._;*._:)._;*._;*._;*._:*._;*.^9).^:).^9).a9).a8).b9).b9).d;+.c:+.d:+.c;).d<).c;).d;).c;).d<).c;).d;).d<).f=+.e<*.f=+.kB0.pI7.uO=..ZH.~YG.pL:.rM:.nI7.hB0.f>,.e<*.h@-.jA/.jB/.iA/.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_D3\SkyboxFront.jpg

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS3 Windows, datetime=2008:10:08 16:46:41], baseline, precision 8, 600x600, components 3
                  Category:dropped
                  Size (bytes):19785
                  Entropy (8bit):7.319505048474344
                  Encrypted:false
                  SSDEEP:384:2WLIHLU+maXoxQ6ImdEfEwSy6avDM1tlX5s0Tk:VyU+mwCQ6ImGfEtavDulXa3
                  MD5:CB3315E12D87E73124DE4F810D4F32F6
                  SHA1:983C967055AF2DA77848D61C3299F6782311325A
                  SHA-256:C251A179FFADCA7A52D677B5831BE87DA7958391A3D84A2F6327A171D978C6C5
                  SHA-512:3FC1011802384ECC9F17FB1D1591DE768090800C58A0DB1EFEEDB450406E1F161E00E4C07ACEBF209C861EC788C451E34A02B23297DDCFCCC205F884FA3B5C70
                  Malicious:false
                  Preview:......JFIF.....`.`.....TPhotoshop 3.0.8BIM................8BIM.%........\./....{g..d.8BIM./.....J....H...H...............@...............d................'..t...j.p.g...c.8BIM.........`.......`......8BIM.&................?...8BIM............8BIM............8BIM..................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM..........8BIM..................8BIM.0............8BIM.-............8BIM...............@...@....8BIM............8BIM.......K...............X...X.....S.k.y.b.o.x.F.r.o.n.t...................................X...X...............................................null........boundsObjc..........Rct1........Top long........Leftlong........Btomlong...X....Rghtlong...X....slicesVlLs....Objc..........slice........sliceIDlong........groupIDlong........originenum....ESliceOrigin..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_D3\SkyboxLeft.dds

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:Microsoft DirectDraw Surface (DDS): 256 x 256, 32-bit color, ARGB8888
                  Category:dropped
                  Size (bytes):262272
                  Entropy (8bit):5.398094384121911
                  Encrypted:false
                  SSDEEP:1536:VVGG1eAjFG5GGZ9mGHu+8SW5AAlIuy14WAOuDlG1MBeCQodRANztIyKpdLXsO4+J:Vk70AAq1MBnLdRMtIdjsOxANp1A
                  MD5:AB1F4743F06829F6459A7EF9FFF55821
                  SHA1:0405ED7F35C13F57CBDD5048FE1E7847BE805BBB
                  SHA-256:73654A4C36F6E0A6097699D5A9CBA16424C58C7FE9C56B52B284B54D05EA9500
                  SHA-512:208E8C7D00F4ACC617F5EC3E37C0CC354C9C340D02A016DADE8C866430E3EACB2BCB9D5AF87EF5332604A07A26C12374C8B06EA26A509CB521B37525EBA78DEF
                  Malicious:false
                  Preview:DDS |....................................................................... ...A....... .......................................nF4.nF3.nF4.nF3.oG5.oG4.oG5.oG4.oG5.oF4.nE3.mD2.mE3.mD2.nE3.mD2.nE3.mE2.mE3.mE2.kE2.hD1.hD2.hD1.iD2.hD1.iD2.hC1.iD2.hD1.hD2.gC1.hC1.gB0.fB1.fB1.gC2.gB1.gB2.fB1.gB2.d@/.e@0.d@/.fA0.eA0.eA1.e@0.d?/.d?..d?/.e@0.fA1.eA0.d@0.a?..b?/.b?..b?/.b?..b@/.b?/.b>0.`<..`=..a=/.a>/.`=..a>/.a=..a=/.`=..b>/.a=/.a=/.`<-.`=..`<.._;-.^:+.^;,.^:,._;-.^;,._<-._;-._;-._;,._;-.]9+.]:+.\9*.^:,.^:+.^:,.^:+.^;,.^:,.^;,.^:,.^;,.^:,.^:,.^:,.^;,.^:,.^;,.^:,.^;,.^:,.^:,.^:,.^;,.^:,.^;,.]:+.^;,.^:,.^;,.^:+.^;,.^:,.^:,.^:,.^;,.^:,.^;,.^:+.^;,.^:,.^;,.^:,.^;,.^:,.^;,.]:+._;-._;,._;-._;,._<-._;-._<-._<,._=,._<,._<,._<+._=,._<,._=,._<+._<,._<,._=,._<,._=,.`<,.a<,.a<+.a=,.a<,.a=,.`<,.a<-.a;,.a<-.`;,.a;-.`;-.a<-.a<-.b<..a<-.b<..b<..b<..a<-.b<..b<..b=..b<..b<..b<..c>..c>-.c?..b>-.b=-.b=,.b>-.e<,.f=-.f<-.f=-.f=..g=..g=..g>,.f>,.g>,.f=+.f=+.e=*.f>,.g?-.g?-.g?,.h?-.g?,.g?-.g?,.h@-.g?-.g?-.g?-.h?-.g?-.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_D3\SkyboxLeft.jpg

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS3 Windows, datetime=2008:10:08 16:45:53], baseline, precision 8, 600x600, components 3
                  Category:dropped
                  Size (bytes):17829
                  Entropy (8bit):7.18935287028756
                  Encrypted:false
                  SSDEEP:192:AmV/YOyLXf/YOyLX5SSeVSlsTqTQEtEt2MZWiE0fuGXXLQqg93HWTZz2xTRewP5:/YpzYpcSPZyoH0fuYX4cTK5
                  MD5:D75B8FBBDB7EBA4350F1B87755794CBF
                  SHA1:890FCAC148BF169FF493A7FC9C7B12AFC45ED320
                  SHA-256:CAB9DB69535D28FA6189631BAD2ACA27278CDB4CB110FCE472003D5D242F8555
                  SHA-512:EC661AF035394ED013B23E0614ED0B22CAEDE94EA4F7F83D0E798E3FD9F2881879AF1D1F9BB77DEB5F24F454EBE489723F225ECB9E45DF5C06D7142F81031A73
                  Malicious:false
                  Preview:......JFIF.....`.`.....pPhotoshop 3.0.8BIM................8BIM.%........\./....{g..d.8BIM./.....J....H...H...............@...............d................'....j.p.g.....c.8BIM.........`.......`......8BIM.&................?...8BIM............8BIM............8BIM..................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM..........8BIM..................8BIM.0............8BIM.-............8BIM...............@...@....8BIM............8BIM.......I...............X...X.....S.k.y.b.o.x.L.e.f.t...................................X...X...............................................null........boundsObjc..........Rct1........Top long........Leftlong........Btomlong...X....Rghtlong...X....slicesVlLs....Objc..........slice........sliceIDlong........groupIDlong........originenum....ESliceOrigin....

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_D3\SkyboxRight.dds

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:Microsoft DirectDraw Surface (DDS): 256 x 256, 32-bit color, ARGB8888
                  Category:dropped
                  Size (bytes):262272
                  Entropy (8bit):5.4249354277673945
                  Encrypted:false
                  SSDEEP:3072:bdMrRwhht+AuO/7GbbeznM7uTzy5K77CqQyAU:bMwhhgceezCK77Cq4U
                  MD5:DDD0F47465DF582B655DABEDBC3B9507
                  SHA1:064805DD7875E6F7C461872AA883C40B739DD6DA
                  SHA-256:6A9F1ECDF3B1ADEB28AAA4692044BA443D03F87AC3B040A412F0CF1BF7E60568
                  SHA-512:1A7EEA33DB553598D73FE11C9EA02BD359ADD3583342E8F869DD8F0380E7D85336CD18E7243BBE148010AC78E692B36387CFE0EFDC8C690068D6BD9348A90985
                  Malicious:false
                  Preview:DDS |....................................................................... ...A....... .......................................lB/.lB..lB/.k@-.k@-.j@-.k@-.k@/.pD3.nC1.lA/.lA/.pD3.wI8.yH7.uH6..`M..{g...............s......................................................q..q]..hS..t`..zg..p].uS@.lJ6.gE2.wUB..]J.~WE..[H.tM;.qK8.e?,.d=+.e@..b>-.jE5.lE5.e<,.f<-.g<-.d;*.d=*.b=+.a>+._>+.]>+.[>*.`>,.b=-.c>-.b;,.c<,.d<-.d;,.d;,.e<,.e;,.e;,.d;+.e;,.d;,.b<,.a<+.a<,.a<,.a<,.a<,.a<,.`<,._=,._<+._=,._<,._<,.a<,.b:,.`9+.a;,.iE7.mJ;.uTD.~aQ..eU..n]..q`..td..n^.uZJ.lQA.hJ:.z\L.yYI.a@1.\;+.\9*._;-.]9+.^;,.]9+.^:,.]:+.^:,.^:,.^;,.^:,.^:,.]:+.]9+.\8*.]9+.]9*.^:+.]9+.]:+.]9*.]:+.]:*.];*.]:*.];*.]:*.];*.]:*.^;+.]:*.];*.]:*.];*.]:*.]:*.]:*.]:*.]:*.];*.]:*.^;*.^9).^9).]9).^:).^9).^9).^9).`;+._;+.`;+.`;+.`;+.`;+.`;+.`;*.`<+.`;+._;*._:)._;*.`;+.a=,.a<+.a=,.a<,.a<,.a<,.a<,.`<,.a<,.`<+.a=,.`<+.a<,.a=,.b=-.b=-.b=-.a=,.b=-.b=-.a=,.`<+.a<,.b=-.c>..b>-.c>..c>,.c>,.c>+.b>+.a=+.b=+.d=+.h?-.g?-.h?-.g?,.h?-.g?-.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_D3\SkyboxRight.jpg

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS3 Windows, datetime=2008:10:08 16:44:36], baseline, precision 8, 600x600, components 3
                  Category:dropped
                  Size (bytes):26444
                  Entropy (8bit):7.540912205385847
                  Encrypted:false
                  SSDEEP:384:WTXaCCAXaCCMrMQp3avCEC7SaGQAsIzcgtbmEvXKkyEz2PI7U9lQr+mW:wqrAqrMr1RbNGh/zHbmW2Ll11
                  MD5:D86BA186CC9FB5E68A5E4D2656D79AA8
                  SHA1:0DFB6A8CE93E9C8D638EDF260B92AFBD260B081E
                  SHA-256:7431A0157C4C6D5B03794EBB5775F405EA97E8642E4CF48ECD1013B2A99D299E
                  SHA-512:3844D783EB2C856723077D2D7F4239222E1D72589AD8750C79E4664FDAD09110FB85CF5283A6418B152B57F9EAD69D0599597FB338918A47D00550BD2D66FDA9
                  Malicious:false
                  Preview:......JFIF.....`.`......Photoshop 3.0.8BIM................8BIM.%........\./....{g..d.8BIM./.....J....H...H...............@...............d................'..t...j.p.g...c.8BIM.........`.......`......8BIM.&................?...8BIM............8BIM............8BIM..................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM..........8BIM................8BIM.0..........8BIM.-............8BIM...............@...@....8BIM............8BIM.......K...............X...X.....S.k.y.b.o.x.R.i.g.h.t...................................X...X...............................................null........boundsObjc..........Rct1........Top long........Leftlong........Btomlong...X....Rghtlong...X....slicesVlLs....Objc..........slice........sliceIDlong........groupIDlong........originenum....ESliceOrigin....au

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_D3\SkyboxTop.dds

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:Microsoft DirectDraw Surface (DDS): 256 x 256, 32-bit color, ARGB8888
                  Category:dropped
                  Size (bytes):262272
                  Entropy (8bit):5.31983527913825
                  Encrypted:false
                  SSDEEP:3072:hmnoWQuooooCzoSINIhoboooooUPo0ooooT2x2oooiQotG+IIgSotV++o02FSooy:ArQTINIiLekTIIM+lBF4qX/hGkNaKL
                  MD5:795513FF7A655CC2E2AE03F7A5C68491
                  SHA1:308F6088F8AB99C1EB4C368605E37A14CB0E36C2
                  SHA-256:97D69ED3EFBAFF05F4B51CEE27FE6A20852F09C76E7529C6065DC30008BA61AB
                  SHA-512:6C9D1B7412854BFA4C8E59EC4CD40DC1460F47070289B17A0FB0EFAD219CEAE62FD307F0B73AE80E2F9DBC062A44CA48A30202D93462ED962F533D8B004440EF
                  Malicious:false
                  Preview:DDS |....................................................................... ...A....... .......................................jA/.iA/.jA/.i@..i@..h@..hA..e@..eA..d@..eA/.eA/.fA/.e@/.d@/.c?/.d@/.c?/.d?/.c?/.d?/.c?/.d?/.c?/.c?..c>..c>..a>-.a>..`>..a>..`>-.a>..a>..`>-._=,.`=-._=-.`=-._=-.`=-.`>..a>..`>..`=-.^<,._<,.^<,._=,.^<,._<,.^<,._=,.^<,.^<,.];+.];+.];+.];+.];+.^;+.]:+.^:,.]:+.^;,.]:,.]:,.]:,.]:,.\9+.\9+.\9+.]:,.]:,.^:,.Z9*.[9*.Z9*.[9*.Z9*.[9*.Z9*.Z9*.Z9*.Z9*.[9*.[:+.[:+.[:+.Z9*.[9*.Z9*.Z9).Y8).Z8).Y8).Z9).Y8).Z8).Y8).Z8).Z8).Z8).Y8).Z9*.Y8).Y8).Y8).Z9).Y8).Y8).Y8).Y8).X7(.X7(.X7(.Y7(.X7(.Y7(.X7(.Y8(.X7(.X7(.X7(.Y7(.X7(.X7(.X7(.Y7(.X7(.Y7(.X7(.Y8(.X7(.Y7(.X7(.X7(.X7(.Y8).X7(.Z9*.[:+.\:+.[:+.]<-.[:+.[9*.Z9*.Y7(.X7(.Y7(.X7(.Y7(.X7(.Y7(.X7(.Y7(.X7(.Y7(.X7(.Y7(.X7(.Y7(.X6(.Z6(.Y6(.Z7(.Y6(.Z7(.Y6(.Z7).Z7).[7).Z7).[7).Z7).Z7).Z7(.[8(.Z8(.[9).Z8(.Z8(.Z8(.Z8(.Z8(.[9).Z8(.[9).Z8(.[8(.Z8(.[9).[9).[9).Z8(.[9(.Z8(.\9).[9).\9).[9).\9).[9).]:*.^:*.`<,._;+.^:*.^:*._;*.^:*.`<+.`;+.`;+.^:*._;*._:*.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_D3\SkyboxTop.jpg

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS3 Windows, datetime=2008:10:08 16:54:51], baseline, precision 8, 600x600, components 3
                  Category:dropped
                  Size (bytes):15440
                  Entropy (8bit):7.036701221852067
                  Encrypted:false
                  SSDEEP:192:Gm8QenwmQenwUScYxQQrE2Fy6IHBK4yvOuXREpaz58Xp9Lw1BRdlBabxvAy:/Ow9Ow/cYx1YBhK4yvuatGvLwt7BaVD
                  MD5:2986625A3997C51ED93CD73082AAD826
                  SHA1:F72CD4A7A286E18A3808D280747C7FEB5F61B95E
                  SHA-256:134751951EBB694DB0DC9BE88520FA8191B611176D6A607AC026AA2728B88AB3
                  SHA-512:18E37B559DD5E995DDEAD785A18176A20482DE3CC02E4DB3B0F14E71CE66FF1339334238A06568766AD2AFCED62E805B76985C6A6B6F65C67E5FFC2EEC1CF106
                  Malicious:true
                  Preview:......JFIF.....`.`.....~Photoshop 3.0.8BIM................8BIM.%........\./....{g..d.8BIM./.....J....H...H...............@...............d................'..j.p.g...e...c.8BIM.........`.......`......8BIM.&................?...8BIM............8BIM............8BIM..................8BIM..........8BIM'.................8BIM.......H./ff...lff........./ff...............2.....Z...........5.....-..........8BIM.......p................................................................................................................8BIM..........8BIM....................8BIM.0............8BIM.-............8BIM...............@...@....8BIM............8BIM.......G...............X...X.....S.k.y.b.o.x.T.o.p...................................X...X...............................................null........boundsObjc..........Rct1........Top long........Leftlong........Btomlong...X....Rghtlong...X....slicesVlLs....Objc..........slice........sliceIDlong........groupIDlong........originenum....ESliceOrigin....

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_D3\Spreader1.X

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):4213
                  Entropy (8bit):3.892840631000665
                  Encrypted:false
                  SSDEEP:48:PBfwNLcrxEx6LXc0hWFhz7/EH3OPBHgT03rQvFFFFFFFvI:PBYNLGGuWdBH00MFFFFFFFvI
                  MD5:0966B2D6371A37F73A0D515AEC45173B
                  SHA1:01002C69F05CCA9228912842A1C035D183AA1905
                  SHA-256:BA85C2CF79564CA18AB892ABB40C1471D04229D10A9B468120DD18830F5CB793
                  SHA-512:110CCCEEC55F9BE0D1F455AE203D131E569F51DD38EEE88CA245D77299C2369621FF4B3E17B72D343B925214BD4B565954FBEA652D054D2B350F87BF58E6E680
                  Malicious:false
                  Preview:xof 0303bin 0032........FVFData..........N.....H.).......dwFVF..).......nDWords..4.).......data........nDWords..............EffectInstance......1.Y..L.....W..1.......EffectFilename......................EffectParamFloats.......0.b.G...NA.1.......ParamName..).......nFloats..4.*.......Floats........nFloats..............EffectParamString.....L.....F.v,(....1.......ParamName..1.......Value............EffectParamDWord.....c9.Q.]L.....|.1.......ParamName..).......Value..........Material......M1........333?...>...>...?....................................Mesh......spreader........P..........}>@.f?.....}>@.f?...?.}>..f?.....}>..f?...?.}>@uU.?.....}>@uU.?...?.}>.uU.?.....}>.uU.?...?_.(@..$?...?_.(@..$?a.g?h.(...$?...?h.(...$?P.g?_.(@.f?...?_.(@.f?a.g?h.(..f?...?h.(..f?P.g?_.(@..$?a.g._.(@..$?....h.(...$?a.g.h.(...$?...._.(@.f?a.g._.(@.f?....h.(..f?a.g.h.(..f?......)@..|>Y.j...)@..|>Y.j?..)...|>Y.j...)...|>Y.j?..)@..#?Y.j...)@..#?Y.j?..)...#?Y.j...)...#?Y.j?.}>@.f?.....}>@uU.?...

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_D3\Spreader2.X

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):4193
                  Entropy (8bit):3.9097666217805314
                  Encrypted:false
                  SSDEEP:48:PBfwNLcRTaLZshT7/EH3OPBHgT03tvFFFFFFFlq:PBYNLsOWdBH001FFFFFFFc
                  MD5:3676EC3C4850253AD83830E6D0FF0DDA
                  SHA1:CF17EAF90B9D92741E1E40F4630B95DFCCF5A640
                  SHA-256:5EE93C332F8823E026C8942A193881D1338EF7A2975A29E50D3501CB4A88C000
                  SHA-512:0BF2A91E1EE68F578B2F389296A53E0C805694E7AB86628D8F31F10B34760C1258E3EB702D6C8C411198D95EDB8D69FFE7564E0E1C82F0088F64A792BF9A31E1
                  Malicious:false
                  Preview:xof 0303bin 0032........FVFData..........N.....H.).......dwFVF..).......nDWords..4.).......data........nDWords..............EffectInstance......1.Y..L.....W..1.......EffectFilename......................EffectParamFloats.......0.b.G...NA.1.......ParamName..).......nFloats..4.*.......Floats........nFloats..............EffectParamString.....L.....F.v,(....1.......ParamName..1.......Value............EffectParamDWord.....c9.Q.]L.....|.1.......ParamName..).......Value..........Material......blue...........=...=333?...?....................................Mesh......objBox01........P..........}.@.f?.....}.@.f?...?.}...f?.....}...f?...?.}.@uU.?.....}.@uU.?...?.}..uU.?.....}..uU.?...?_..@..$?...?_..@..$?a.g?h.....$?...?h.....$?P.g?_..@.f?...?_..@.f?a.g?h....f?...?h....f?P.g?_..@..$?a.g._..@..$?....h.....$?a.g.h.....$?...._..@.f?a.g._..@.f?....h....f?a.g.h....f?.......@..|>Y.j....@..|>Y.j?......|>Y.j.......|>Y.j?...@..#?Y.j....@..#?Y.j?......#?Y.j.......#?Y.j?.}.@.f?.....}.@uU.?.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_D3\Spreader40.X

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):108686
                  Entropy (8bit):4.792043006443343
                  Encrypted:false
                  SSDEEP:1536:7bn/0jrF3IIgxMklogor2wJUIgRZTCDw8wvOEY:7b/KRguKogor2pT4
                  MD5:CDD6D6595FF24FE40AE88CA3E25C1E83
                  SHA1:ED95709F76721D7B1E51C23AB501A19565DB43A0
                  SHA-256:8ECF606AD7DE9F8C3A4A40F6EB46D88F6FCCE21DA4AD6D1935145D18D06496E4
                  SHA-512:7907340D3D95D6E0E5FAA8DB18FA1B3F94C7D0AD5048182C1C2ABB6F99EDCB68A70ED57C08FE46DCD2B09C711C3B31ABD2A3BD7E6049256C500A1BE9FD0A7939
                  Malicious:false
                  Preview:xof 0303bin 0032........FVFData..........N.....H.).......dwFVF..).......nDWords..4.).......data........nDWords..............EffectInstance......1.Y..L.....W..1.......EffectFilename......................EffectParamFloats.......0.b.G...NA.1.......ParamName..).......nFloats..4.*.......Floats........nFloats..............EffectParamString.....L.....F.v,(....1.......ParamName..1.......Value............EffectParamDWord.....c9.Q.]L.....|.1.......ParamName..).......Value..........Material......Material__6484_M1Sub0........333?...>...>...?....................................Material..!...Material__6484_Material__6451Sub1..........5?..5?..5?...?..A................................Frame......objBox01........FrameTransformMatrix...........?...................?...................?...................?........Mesh.........................}>@.f?...}>@.f?..?.}>..f?...}>..f?..?.}>@T.?...}>@V.?..?.}>.T.?...}>.V.?..?_.(@..$?...?_.(@..$?a.g?h.(...$?...?h.(...$?P.g?_.(@.f?...?_.(@.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_D3\Thumbs.db

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:Composite Document File V2 Document, Cannot read section info
                  Category:dropped
                  Size (bytes):13312
                  Entropy (8bit):6.605246022553713
                  Encrypted:false
                  SSDEEP:192:dOjEtMfiFkGuRiPuCGyN33gPXabUK1Xdazuv55AeRYAP:kjEtwiFkFRiPZGyNHIqbUK1tVHj
                  MD5:D3D71E6E74E286E558517AACC78AF720
                  SHA1:A4F46003FBFDA292B5D912D74A0942BC63BB3DFC
                  SHA-256:21347655777E2A94E7C34F8396BBFA56CF5C9957E1C7FDB1FBF2C28064C39128
                  SHA-512:9C09BB4176C16CFA98CFFC5D73D443F8680F1FDFF7BBD218B712188861586DF2627FFF27651BB861C43287BB13F345A62A39B83DBE8EA1886B7D4C4D098F8564
                  Malicious:false
                  Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_D3\water.dds

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:Microsoft DirectDraw Surface (DDS): 256 x 256, compressed using DXT1
                  Category:dropped
                  Size (bytes):32896
                  Entropy (8bit):6.6004795148018
                  Encrypted:false
                  SSDEEP:768:TifgsO/z+48X7HJeZUrBf/z0HVLnEUi9USBKS2:TNzz+h7HSiBf/z0JEj9UAF2
                  MD5:B683E9C960979491A2319433D06F5CA5
                  SHA1:C3800D800D38970AFB6C0B321A6C4DB31254980F
                  SHA-256:5FA973C059D0CA7E0E078279BA6B6599DE0339CAF63DC5B03CB2610E521A80DB
                  SHA-512:F0095194F4B77F8FE27DAEB270BCA4243050E68C58067609516BADB99260D4114A46DCF378CCF0D49A3AFD861053D48700C55F6F18EA4DD4D8EC8252A63881B9
                  Malicious:false
                  Preview:DDS |....................................................................... .......DXT1........................................r<.+.zU.q<.3..-+.DP<.....D.4...z.<.4...-.DP<.xx.\qL....L.+..^V.<.3*.U].D.+...U04.#.~_U.+n#.~~^.+m#.++..+.#..~..+.#}w...+m#../.#M#.....#M......#n#?..U.#M.....#M#+..~Q4M#?==..L,#pxp.#,#.+!..3m#_...+m#.kj`m#...~~^m#../.-.m#,.\....+.._...M#......3.../.-#../%.*m#,#W.+.+M#..bzm+...._..+L#.y{.+,#..1D,#....QD.+..^~.3m#|z{zn#....^^M#.....}n#..*?...3n#...+.#-...04.+....q<.,...W.L.3p...PL.+....PD.3..=..C.<._WU.Dq<.....<.+.x...D.+/-=..Dq<|zz..DqD..-..Dq<...D04..**.D.C`. ..L.+u....;.#W_...3M#....Q<.+....q<.+..\VQ<.3..}.q<.4...%.D.4^....D0<...U.<P<./..T0<...rPD.3^....4.+.....3.#z...+n#.....#M....m#M.....+m#.....#n#...x.+m#.....+m#.b`..#M../.~.#M.....m#,....'.+M#.++.4M#5?**.D.3B....l,#UW.(.\l+]}..pTm+]U_..+..^..\.+,.....m#.....zn+....n#...W...+....}.n+... .^.;.....5.Dm+.+..<.3.*..D.3..._qL.+...U.L.3.....Dm#..WV.3-.`.zZ,......-#....M#....-..<m#--%.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\Button\Back.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 24 x 24 x 24, image size 1728, resolution 2834 x 2834 px/m, cbSize 1782, bits offset 54
                  Category:dropped
                  Size (bytes):1782
                  Entropy (8bit):5.552308586508331
                  Encrypted:false
                  SSDEEP:24:kWphsEc9RsPPN5s5q9y2JSk5kLGxabDCPYS+Y06bWG5:hpsr+5XpPaPCP+YNV
                  MD5:65F1AE5DD475FE2FB8DA36B989DA80D3
                  SHA1:603F23A3AF1A1A028C32450D6A45D808AB7F2100
                  SHA-256:869CB709EFD62AD6C62112E228FB6072238740493D65AD4445DCC01A2386918A
                  SHA-512:08C09CFBC725705F2BD2667A9EDC61C2CB1C29CECBFE54BCA18708704BF4413FDAD31AC800F1D9AF5D478ADB34F7717AF67E961FB8E6B8CF43873EA715487949
                  Malicious:false
                  Preview:BM........6...(....................................................................................................................................j.mi.k9.<9.?.e.@.D=.?;k<0b2...........................................t......&..%.."................L..T!..............................L.N.}...3..:..4../..+..#..!.............}..E.................................G..G..B..<..9..1.....(.."................E.........................$.U#.T!.P..I..F..?D.`......L.`..$..!.............N...................%.U).a(.^%.W#.S .MH.j............./..)..#..........w.Z.]..............*/.l/.k+.d).`&.[M.u............5.T..7..1..-..%..".......Q............!&.X/.l/.l/.l..iR.............H.k..E..=..:..4../..+..#..!.x............./.l/.l/.l/.lV.............M.v".R..K..G..B..<..8..1.....(...p.q......:.G/.l/.l/.lV.............................R.l..5..0..#"s%......:.G/.l/.lV............................................=..:../.f.......:.G/.l/.lV............................................F..@..4.n.......2.;4.o/

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\Button\Close.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 21 x 21 x 24, image size 1344, cbSize 1398, bits offset 54
                  Category:dropped
                  Size (bytes):1398
                  Entropy (8bit):5.973070571780367
                  Encrypted:false
                  SSDEEP:24:Cqtp4bdogkDHH8K7t0qk9ah1e8Mv+GUY1xkGAu3pp7vbo0B37CO:Cqb4bxkDHh7tE4re9mYFZ5bBLCO
                  MD5:59B3180BB0AEAAD13DB57C059E34F291
                  SHA1:BEDA54A99C5C9EBB8A55F06927DA0A18AC0A7570
                  SHA-256:1A5B7209E588D38C87B83F934697677579F369BAD1129E6C1DACF700C56BB03F
                  SHA-512:0382F7066B36AF7DD90194A62322FE874C5DE1ED7737C927E09AB060D2B956F15E1811D10EDA5D488BA3ECEA10404AD52AA429EFD20A8F9C882F08A6C9322B41
                  Malicious:false
                  Preview:BMv.......6...(...................@.........................................................................................(D..+..0..1..2..0..2..2..1..0.....-..*..(..'..$..<...........(I..8..>.!D.%G.&G.$F.#G.!F..E..E..B..@..=..9..5..0..*..<.........7..C.(L./R.3U.4W.1U.1V..V.*U.%S..P..L..H..C..>..8../..#.........<.%K.1T.9[.=^.=_.;^.9^.7^.2].,[.%W..T..P..J..D..=..3..&.........@..Q.:\.Bb......Ce.Ae.=d.8b.2`.*\.$Y........H..@..6..'.........E.6X.Bb.Ig..........Eh.Ag.;d.5b.-^...........J..D..;..+........%K.=^.Hg.Nl.Pm..........Bh.<e.6b...........P..L..G..?..-........+O.Dc.Nk.Ro.So.Qn..........=e..........!T..P..M..J..B..1........2T.Ki.Tp.Vq.Up.Ro.Ml................&U.!R..N..M..L..F..3........7Y.Qm.Wr.Ys.Wq.Rn.Mj.Gg..........,W.&S."P..M..M.!N.!I..5........<].Yt.]w.]v.Yr.So.Nk................'Q.#O. L."M.%O.%J..7........Fe.`z.b|.`z.[t.Tn..........:\..........$M."K.%M.)P.)L..9........Fe.h..j..e~.^w..........Ca.=].6X..........'N.*P.,Q.*M..9........Mj.n..p..j...........Mh.Gd.@_.:[.4V..........-R

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\Button\Diagnose.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 30 x 30 x 24, image size 2760, resolution 3780 x 3780 px/m, cbSize 2814, bits offset 54
                  Category:dropped
                  Size (bytes):2814
                  Entropy (8bit):1.7977811078134005
                  Encrypted:false
                  SSDEEP:24:9EjFFFFboKoqif7vXUuc7XsCxX+8M7vqqqqqqqqqqqqqqqqqqqqqqqqX:H
                  MD5:54D1BDC1C94B8B210B79CB881DC9AF11
                  SHA1:1F2B1922ED6823CFEC3974AA8A89373DCFC891A3
                  SHA-256:839B0B5316BA82B04F4F1B6159DBA2E965131BFB2C6B7B15D0B0768E878FB93D
                  SHA-512:482304F6DBE372D7055A39FD242E4DB4FC3DEB0573772F77AF2E650B3E5F8518D54C6D89A540168FC190FBC5719D76399FB3BE33D0851116A62C05282C39C337
                  Malicious:false
                  Preview:BM........6...(.......................................@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@............@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@..@@@....................................................................................@@@..@@@....................................................................................@@@..@@@....................................................................................@@@..@@@....................................................................................@@@..@@@....................................................................................@@@..@@@....................................................................................@@@..@@@....................................................................................@@@..@@@....................................................................................@@@..@@@....................................................................................@@@..@@@.......................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\Button\E-Stop_Normal.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 35 x 32 x 24, image size 3456, resolution 3780 x 3780 px/m, cbSize 3510, bits offset 54
                  Category:dropped
                  Size (bytes):3510
                  Entropy (8bit):1.9304467402627519
                  Encrypted:false
                  SSDEEP:24:Hg0A/qqqqvA/qqqqqqqvA/qqqqqqqqqPA/qqqiiqUA/qqfqqqq8A/qqf5f/A/qqU:A0AbAYAqAGASAPARyqjvrP1tS
                  MD5:2DA75F4A5674EA41F9777C560B900BD6
                  SHA1:CCBE30B66AD36DB88A22038F305C415B34D9C930
                  SHA-256:DC5D86903E62852AA5B670CDF9CBF65FB65DFB89D3B274AF5949810DC919D60B
                  SHA-512:593AC2274B856BA8059688E145E3E84225B00C527DB9E4F3EA42962F89016FB1AFDDE3C923C2BEBF6AF4E0D7B4741F9ABCC9B7492276DB6C3E01F40E16A1ECCA
                  Malicious:false
                  Preview:BM........6...(...#... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................@.`............`.`.......................................................................................`....................`.`.............................................................................................`..... ....... ................................................................................`........`................................................................................... ............`........@.............

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\Button\E-Stop_Pushed.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 35 x 32 x 24, image size 3456, resolution 3780 x 3780 px/m, cbSize 3510, bits offset 54
                  Category:dropped
                  Size (bytes):3510
                  Entropy (8bit):1.9206480050562003
                  Encrypted:false
                  SSDEEP:24:HgGCqqqlKxqqqq9qqqqqK/qSwqqqqfqKi9qqqfqqfDqqqqq1qq0qqffqq4qIq4qG:ABaUluRijDMtS
                  MD5:74A36E89602326E32CD478CF8E743180
                  SHA1:1F3F3B9D5F8560E63576EFD5DD3360FBCDE21A0E
                  SHA-256:69678361FDA73469CEF4CDE5F66137ACB601EAC8FAD6405E109561A32DE638AF
                  SHA-512:A09C80BB9E972CD1A5110CF3FEE73A07E9C5958F7177415F16F510E6D96B034746C22679B12DA25225D9C45B03C6587DE79E0E309A1AFE740B5702D2DA9382DA
                  Malicious:false
                  Preview:BM........6...(...#... ................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................ ........................................................................................................... .. ....................................................................................................................... ..................................................................................................................`......................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\Button\GPS.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 19 x 34 x 24, image size 2040, resolution 3780 x 3780 px/m, cbSize 2094, bits offset 54
                  Category:dropped
                  Size (bytes):2094
                  Entropy (8bit):1.7713231764655695
                  Encrypted:false
                  SSDEEP:24:jFSrZNZNZNDnBtRXtRtRXtRXtRXXtr3Ty:orPPPDnnH3HHXr3Ty
                  MD5:4D968392B4C9B96F9307B20BC15EFE0E
                  SHA1:26BA84592286902F9CF05166FEB526DB84AC095C
                  SHA-256:663E71AC501AE911D7A93306993C2D459B874DF30917F195BFE546AC2C0D3450
                  SHA-512:0ED16BE78C656B371962571CD084FE62BCCB49A5DBE62E8238E2B2019374DF48E5D639705A0E077576008B649232B00DCE36D7FC66615EE04466FF66999152CD
                  Malicious:false
                  Preview:BM........6...(......."........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................@@@@@@...@@@@@@.........................................................................................................@@@@@@...@@@@@@.............................................@@@@@@...@@@@@@......................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\Button\Gantry.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 30 x 33 x 24, image size 3036, resolution 3780 x 3780 px/m, cbSize 3090, bits offset 54
                  Category:dropped
                  Size (bytes):3090
                  Entropy (8bit):1.4770148884036158
                  Encrypted:false
                  SSDEEP:48:GddhbZXxl9jVV1BdrVLBNTx7nvlxDxhnVfRz3HgPcnKrnHrK:s
                  MD5:BE4CA54D0AA194233380D0CFB4ED5C73
                  SHA1:AA8BCD254490B9655C2B9641EFCBFDC04B0AE05C
                  SHA-256:1623B1E623810A7978F946023A2F2457C92AEF8D3730E966CBFDC1EBBFAEBBA4
                  SHA-512:22652B747E8D0AA886ADBF43FE308013E3F7A7DBDEDA389259F3E9EE60249EDDBDA47BF79B214A73D657094FFFB257BD97991EF451F89744E338C56964CA7BCF
                  Malicious:false
                  Preview:BM........6...(.......!.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\Button\Help.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 30 x 31 x 24, image size 2852, resolution 3780 x 3780 px/m, cbSize 2906, bits offset 54
                  Category:dropped
                  Size (bytes):2906
                  Entropy (8bit):1.3630658167752048
                  Encrypted:false
                  SSDEEP:12:rkxwR9frmwEO5XD24D/gQFKbuagQ2BBh2WrraB/QcMzFm:3TLB5HDtFBX17h/rrapQfc
                  MD5:630D387B41E546559FBA719591DC38A0
                  SHA1:E341370721B8ACBAFFF8B026E162A12524EB39F3
                  SHA-256:56328C5AE370AB84B8FC7444715D791FD57B52124F468D1F7AE9276EB5A7808C
                  SHA-512:74A28B38DB7FD7BDFA073F3BAD88AF137B3F908EEDEDD3E4406080CA3450FF9FC3149BE00BD0562F7141DEE40C4013DE40C69A421B01AC10C5F71D61FBC94EFD
                  Malicious:false
                  Preview:BMZ.......6...(...................$.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\Button\Hoist.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 42 x 34 x 24, image size 4352, resolution 3780 x 3780 px/m, cbSize 4406, bits offset 54
                  Category:dropped
                  Size (bytes):4406
                  Entropy (8bit):2.444782681549251
                  Encrypted:false
                  SSDEEP:48:cf73f/n67IUP70XfdCXNPInvG/5/hTL/nTr/nrXq:u8y
                  MD5:68E5D08F6FED6DBC6456A4A9142CE448
                  SHA1:A1E7FA611B1DA7E4822DF234C8A8268F4096E00F
                  SHA-256:49F9D4C8A212426EBCD8D45E17412B605EFEE73BF61282199E1B1C20C0D3C3C0
                  SHA-512:246F2A6DA21E8F9813DC78DCC4248EEF177B8B93D530696303B6C756293270011F32F58DDD82ECD9B87EE7A648E05023413D6BADEC6BC2A11A99A21335B0B44B
                  Malicious:false
                  Preview:BM6.......6...(...*..."....................................................................................................................................................................................@ .@``.......................................................................................................................@@@.....@@@..................@@@@``@@@@``@@@@``@@@@``@@@@``@@@@``@@@@``@@@..................................................@ ............@@@...............@``.......................................@@@@``@``@@@@``@@@@@@@``@@@.......................@@@....``....``.....@``............@@@.........@ ....`..............................................@@@@``.................@ ........................@@@.........@``...@ .`.. @.`.@ .................@.........@. @@ ...@. .@.@. ...@@@.................@@@@@@@``.......``@ .@``@@@@@@.........@@@.... @.``...............@. ...@@ . ...@@@ . ...@.....@. ..` . ...@@@@...................................@``..................@@

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\Button\Home.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 24 x 24 x 24, image size 1728, resolution 2834 x 2834 px/m, cbSize 1782, bits offset 54
                  Category:dropped
                  Size (bytes):1782
                  Entropy (8bit):5.530229322397937
                  Encrypted:false
                  SSDEEP:24:kWU7zfdIvNZVBwNGDoIO2PDCvv8KI7xxhrVX3a1C8NMJL:hoVWPEOoIOiDohClrVX3a1pNMJL
                  MD5:10BE57EE4DB626CB819B9BF4F1D7829F
                  SHA1:AA6BD3F954262A55F6B533CE09A6865933B1BB95
                  SHA-256:D4D410B9CDB962BA85A2E43D23F938C88BF1AC9E9E5E03D5148E5B75F5A1723D
                  SHA-512:9C0128E1EEBC345FE77504D2427A302FB828CE03F78C9FC8D079FD4B09DF8114E83B7D6ECCB4492E3F88B892A38E0E42050A4BB1FF07CD2236F6364931CD6CB4
                  Malicious:false
                  Preview:BM........6...(............................................................................................................................................................................................................................................................................................................................................................rr.xx.||....................................................gg.ii.nn...................................................gg.gg.gg..|...............................................gg.gg.gg..}...............................................gg.gg.gg..~.............................................gg.gg.gg...............................6..E......................................................u..C..9..5..F.....................................................j..Y..O..E..;..5..E................................................_..g

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\Button\Inverter.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 18 x 33 x 24, image size 1848, resolution 3780 x 3780 px/m, cbSize 1902, bits offset 54
                  Category:dropped
                  Size (bytes):1902
                  Entropy (8bit):2.7379121852158503
                  Encrypted:false
                  SSDEEP:24:2otXttZt5tZtZtZtf/5tf5tbFt/5tZtZt/BtB/s1:HXT/f///f/fffbr/f///nB/s1
                  MD5:C7A3801D79420340BAFD01BD3A8C4CE0
                  SHA1:E4AA902067EDD58B891093A2FD83774315B3E009
                  SHA-256:785C0DC9524C78F0A092AD6E1C9E533C09F84675EE2474368F9E1A319E3DBDB3
                  SHA-512:0C05979856C4BEF80FF14E5EF3CB92AB2A78B7428D474B0F2A81477558FA40A53EA9404099825BAD0A5425DE2207BC10F85744D67377E1D3CCA3A9EAFA223FB2
                  Malicious:false
                  Preview:BMn.......6...(.......!...........8....................................................................................@@@.@`......@`.......@@@@@@.@`@``.......................@@@@@@@@@.............``@ `@@@@@@...............@`@@@.@`.@`@@@...............@@@.@`@@@.@`.@`@@@...........@@@@@@@@@@@@....@`.@`.@`@ `@@@@@@.@`.@`@@@@@@...........@@@.@`@@@@@@@@@@``@`.@@@.@`.@`@@@@@@.@`@@@@@@............@`@``.@`@@@......@@@@@@@@@.@`@@@@ `.@`@@@@@@............@`.@`.@`@@@.``@``@``@`.@``.``@@@@@@.@`@@@@@@@`.........@@@@``@@@.@`@`..``@`.....@`.@`.@`@@@.@`@@@@@@...........@@@@@@@@@.@`.``............@``@@@@@@@@@@@@@@@...........@@@@@@@@@@`..``.``.......``....@`@@@.@`@@@@@@...........@@@@``@``@`..``...@`..``@`.@``@`..@`@`..@`@@@...........@ `.@`@@@.@`@``@`.@@@.@`@@@.@`@@@.@`@@@.@`@@@...........@@@@``@`.@@@@``@`.@..@..@`.@``@``.@`@@@@@@@@@...........@@@@@@@@@@``@ `.@`.@`@@@.@`@@@@`.@`.@@@.@`@@@............@`@@@@@@@@@...@`.......@`....@@@@@@. @@@@@@@............@`@``@``@@@......@`..........@`.@``@@@@@@.@`..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\Button\Maint_Normal.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 37 x 36 x 24, image size 4032, resolution 3780 x 3780 px/m, cbSize 4086, bits offset 54
                  Category:dropped
                  Size (bytes):4086
                  Entropy (8bit):1.743301642252104
                  Encrypted:false
                  SSDEEP:12:0rcXVp1p1p1nt+GwOYhePljeHI634rWnw7E6zi/rK9zw92w95w98w9cQ9mdw98wE:BXXXnYr7kPlCo6IywGzI78Wu
                  MD5:505EB3975503D470C8167ED2A5D7E15A
                  SHA1:75EC0BAB18CFC58E8758626F0D46906C9A1CE007
                  SHA-256:099DA5B9C788158A25160635A6D08E6E35FA4072F2938AFA64C4FDEEF25EEC72
                  SHA-512:E50063833EAE1EACC185F2C5D472C86B88AEC3CD311D9CCDD179069038B9FC814F17E859E35F1D8DC55C6327A8CBDA3254318FB6022FAEB96BABC0C4E68BEA47
                  Malicious:false
                  Preview:BM........6...(...%...$.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................@``......@``@``....................................................................................................@``......@``@``..............................................................................................@``@``@``......@``@``...........................................................................................@``@``@``@``......@``@``...........................................................................................@``@``@``@``.....

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\Button\Maint_Red.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 37 x 36 x 24, image size 4032, resolution 3780 x 3780 px/m, cbSize 4086, bits offset 54
                  Category:dropped
                  Size (bytes):4086
                  Entropy (8bit):1.6128263699961203
                  Encrypted:false
                  SSDEEP:24:BXXX8q1/qtAqVUqNVgPKqtLqV3GqNLjn7C4VbmqqqqqqqqKqNXG1rGpIE32Kqqqe:BXXX5ONh2P7E/H3kkcdrnIzIpd
                  MD5:79FF57DABE95F15EFF077840B25A5E21
                  SHA1:3BA24A3EF98E8BE1D7C5F3A2BB43704D8F9993C3
                  SHA-256:BEBF39E43389DCCC0E9E3368874D1F6108A7ED7229CEAC3F557BF4A25343830B
                  SHA-512:AD0D491D4B82D23B7BAB476252A570E0C3B8F8DCF67C3C44AB51EA078E6E56F6B8DE19BC1B7FE228DD6E51C3939EB9B7AF4B3CEB340ECB3D604B3DEE421561A5
                  Malicious:false
                  Preview:BM........6...(...%...$.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................. ........ .. ...................................................................................................... ........ .. ................................................................................................ .. .. ........ .. ............................................................................................. .. .. .. ........ .. ............................................................................................. .. .. .. ......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\Button\Maint_Yellow.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 37 x 36 x 24, image size 4032, resolution 3780 x 3780 px/m, cbSize 4086, bits offset 54
                  Category:dropped
                  Size (bytes):4086
                  Entropy (8bit):1.472963399098441
                  Encrypted:false
                  SSDEEP:24:BXXXKA/NuCCw4agwWbgw4Pvw+RgwoHgwmEwIXg9Tgw+n4PD4r4BgJgvgwDCvCXCZ:BXXXfAjjcPN6GUWag42nsy0
                  MD5:B10FE35D23A1AA97B1FFF2F15F3002E2
                  SHA1:C1EE55EBB02A900DC356B7F6165165E90C6314BD
                  SHA-256:379410C865AA39E7C8EEA4F0D79416191FF2591C25CA3F79717DCC9429939582
                  SHA-512:29FD1184EC2527E61AB94D2847F7F6C1653645FCD8B505407730FF7509D5C7F26DE196CB5B66446FAB96DEF09FABB0EA3D7C56614F63BA49DC34A9353A979611
                  Malicious:false
                  Preview:BM........6...(...%...$.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\Button\Menu.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 32 x 32 x 24, image size 3072, resolution 3780 x 3780 px/m, cbSize 3126, bits offset 54
                  Category:dropped
                  Size (bytes):3126
                  Entropy (8bit):1.1312570028666173
                  Encrypted:false
                  SSDEEP:24:AqqqqqqqqqqYqqqqqqqqqqYqqdAqdqYbqqdAqdqYDqqdAqdqYbqqdAqdqYbqqdAV:/L
                  MD5:A46392E3C3A7F180B6B14E922ADA4742
                  SHA1:613E1B5B626C15E9CD1E1F4C26550BB2C3FFABF2
                  SHA-256:298AC41C5270AB513F5524CD835691D1BB691717C0DE6FC494F8DC1F54D1A0FC
                  SHA-512:9C057E8535A90F4A48D633F69DEBF3E80C8FF16CCFCC082AFA6D4B971128F4DAB1368C49217850AB0CCB156BEE240FB0EB9D6260666394BE71C7C55711430325
                  Malicious:false
                  Preview:BM6.......6...(... ... .................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\Button\Minimize.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 21 x 21 x 24, image size 1344, cbSize 1398, bits offset 54
                  Category:dropped
                  Size (bytes):1398
                  Entropy (8bit):6.159233395899512
                  Encrypted:false
                  SSDEEP:24:CeAIxtg5dunszkXHCGll4rxkZoGRyRUlQ/AWJbZIz9qJThgzGO:Cgxtg5MXHDH4riZcRB/AWRZIzsJOzGO
                  MD5:99099560565B7E5B0DB936DC65260727
                  SHA1:DE621D48457F2303173748A4EA20AF852C152560
                  SHA-256:E03C98BE15184249C8A54CE169CA1709881568315727E2B3FDB15689CC28BABB
                  SHA-512:8433C11AA7AB192636176E1D2601EF5F50C8A950F3CE2CC9F3A2672F24583061020396C5BCD139A580D9C6B57F20B5FB371A4BCF5BB58B8550FF63547F56A424
                  Malicious:false
                  Preview:BMv.......6...(...................@..........................................................................................V(.?..D..E..E..D..E..F..E..E..E..D..A..?..?..;..N............^(.O..U..Z!.\%.]&.\$.^#.^!.^.._..^..]..[..X..T..N..E..N.........P..[..c(.h/.k3.l4.l1.m1.o..p*.p%.o..m..j..f..`..Z..M..:.........V..b%.k1.q9.t=.t=.u;.v9.w7.x2.x,.w%.v..r..n..h..`..S..=.........Y..h..q:.wB......................|*.z$.w..s..l..c..V..?.........]..n6.vB.{I......................}-.z%.w..s..m..f..Y..A.........b%.s=.{H..N......................|-.y&.w .s..o..i..]..D.........f+.xD..N..R..S..Q..M..H..C.~=.|5.z-.w&.t!.q..n..j.._..G.........k2.}K..T..V..U..R..M.}H.|B.z<.x4.v-.s&.q!.o..m..j..a..H.........n7..Q..W..Y..W..R.~M.{G.yA.w;.t4.r,.o&.m".k..j..j!.b!.I.........r<..Y..]..]..Y..S.~N.zG.xA.t:.r4.o,.l'.j#.i .h".i%.b%.K.........yF..`..b..`..[..T.|N.xG.tA.q:.n4.k-.i(.g$.f".g%.h).c).K.........yF..h..j..e..^..W.~P.yJ.uC.q=.n6.k/.i+.g(.f'.h*.i,.b*.L.........~M..n..p..j..b..[..T.{M.wG.r@.o:.m4.k0.i-.i,.i

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\Button\Spreader.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 42 x 34 x 24, image size 4352, resolution 3780 x 3780 px/m, cbSize 4406, bits offset 54
                  Category:dropped
                  Size (bytes):4406
                  Entropy (8bit):2.019254607267353
                  Encrypted:false
                  SSDEEP:12:i5vtFvfNV1Vvf/lRl5l9///lB/flZ/lRfl5nnl1XlVl9ltlFlFlFlFlFlK:MthNPNftD7ZtBlZtHrTPHXfffffK
                  MD5:18BBC943DC27D1577C6CCB54DD88C73B
                  SHA1:F0ADE9491296260557B67FFB6D278C8E57B400F9
                  SHA-256:7DB1F3FF8D5AE2EA23F12C5025D2D29F2A8B1CCCEF46B85CE94BDAD4700E876F
                  SHA-512:86E40AFA70B83354E0532A8C0280C406830AC87657B2CC3DA6C2B5B62CB57904BA1C3104E94D7699EADE27151EB63FE0F6D829F53633EE686A5D9943B81C0886
                  Malicious:false
                  Preview:BM6.......6...(...*..."..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................@``............................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\Button\Thumbs.db

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:Composite Document File V2 Document, Cannot read section info
                  Category:dropped
                  Size (bytes):37376
                  Entropy (8bit):6.904583369373733
                  Encrypted:false
                  SSDEEP:768:Ywux4Epd90oby9qhLHIFH3gosAKklsjYp31HYMEipOP8/:Y3x4EaobuqhLHIFHQosAZsjo3pZdpO2
                  MD5:23049FAE95BA6B988EFA0290ECD5CCB1
                  SHA1:E1A9F65C5BC51AA5EA22E92D897B07116919DB68
                  SHA-256:1276A5E4753149E6E8C691500F06ACDFF015FA6F602A71CD287CD95B04A5A1F7
                  SHA-512:79FB906B716E068BCC7F94DA9477307255059995FFADF559EF801BA46A6CFFAF15048AA7244EB56451F6745B9A61564F1647089F8FF9880CEDE2AC6F4AA3EC19
                  Malicious:false
                  Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................&..............."................................... ...!...#.../...$...%...'...7...(...)...*...+...,...-.......0...=...1...2...3...4...5...6...8.......9...:...;...<...>.......?...@...A...B...C...D...E...F...G...............................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\Button\Trend_1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 32 x 32 x 24, image size 3072, resolution 3780 x 3780 px/m, cbSize 3126, bits offset 54
                  Category:dropped
                  Size (bytes):3126
                  Entropy (8bit):1.6212602774458815
                  Encrypted:false
                  SSDEEP:3:Shl/3c/l7XFFttttttttttttttttttttttttttttFtttttttttttttttttttttt6:/gsI8yIwtsu4NIyIwtsuUNIAAAAXsX
                  MD5:53C0B00BBFB5C638576968A6F76A9790
                  SHA1:B55C7CE7EEAC767089A01BBD8C8313296A401E57
                  SHA-256:E5A79ADB978FE734F55D6D78F3840674A27DA76219ADDEA426148518BE6B97CA
                  SHA-512:B9E87FBC63624562015B84F4726D7424FD45D0D86CE05D796C6FF3717447D6015FE681D6DC5A498292EB19E71E691A3076B4CA07A1BAD71DBCB2915E8E0B93B9
                  Malicious:false
                  Preview:BM6.......6...(... ... .................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\Button\Trolley.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 42 x 34 x 24, image size 4352, resolution 3780 x 3780 px/m, cbSize 4406, bits offset 54
                  Category:dropped
                  Size (bytes):4406
                  Entropy (8bit):2.3556305019011496
                  Encrypted:false
                  SSDEEP:48:EHHPXLTXHP3rTXXXHnHef37/bb/v/H3LT/3Li:c
                  MD5:3A7F4E79B07814EF2A7767ABB3CDBBED
                  SHA1:D64F1ED211816801C4ABF3D0E96CF45ECC814D02
                  SHA-256:6ADB16F3B42C9FBC40880F9C4B93A88E1981CBADC2FB6E9C42A7A9E6D89EA591
                  SHA-512:EAA273EF952BA289453FB661AC1374FA28847B5091B6375D2EE4FDDFD950845CD91AE594B44C5D77A08C7868D571451DD3A863BD4FBD2C8B046DFD8BB3CFCF90
                  Malicious:false
                  Preview:BM6.......6...(...*...".......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................@@@@``@@@@@@@``@@@@@@@``@@@@@@@``@@@@@@@``@@@@@@@``@@@@@@@``@@@@@@@``@@@........................................................@``..................................................................@@@........................................................@@@.``@` .``.@ .``.`..@..............................................@@@............................................@``.@.......@@@@` .@ @` .``@` .@ .``..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\Button\User.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 31 x 25 x 24, image size 2400, resolution 3780 x 3780 px/m, cbSize 2454, bits offset 54
                  Category:dropped
                  Size (bytes):2454
                  Entropy (8bit):3.2962804563094856
                  Encrypted:false
                  SSDEEP:12:peVhblx/llX33QOI3szBuGlJflBlRr/DvHLMIPUmIat2wIelS:peXltllX339oqBRlZlBlRr/DoIPtllS
                  MD5:8502D8370D0C0BE0543EDA3D8ED4A845
                  SHA1:C163765C02BA1194345DA95A999850E54890123E
                  SHA-256:59F5CB761C731112C1DFBADBA35A37BBEB1A3124F71A79E3C55869353C51B39C
                  SHA-512:8F5B74A78158E0B24374102C2A9AC12106AF3B54AA7F967CB1A4D924C4BF6B857DB7A717EF091947D4FBFEB3E7CF07565F9CD9D8F5AE4B7B80D6D0B9F666149C
                  Malicious:false
                  Preview:BM........6...(...................`..........................................................................................................................``.` .` .` .` .` .` .` .` @``.``..............................................................@.`...@..@.``.``.``.``.``.`...@..@.@..` @@@.........................``.........................`...@..@.``.``.``.``....``..`..@.``.``.``.`.@@@@` @.`......@.`..................@@@.............`...@.``.``.``...........@....@.``.``.``.``.`.@.`..@@.`@. @.`@....@..@@.`@.`@.`....``..........`..``.``.``...........@.......``....``.``.`@@..@....@.....@@..@..@....@..@@.`...@.`.............``.``..............@........@....``.``.`@@....@.....@.`...@..@..@....@..@....................@.``...........@..........@.......``.``..`..@.........@.`......@....@..@.......................@........@..............``.......`...`.....@............@....`@..@....@.........................`@.`.@@`. `. `. `. `.``..@..@...@....`....................@@..@....@@

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\Button\Wheel.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 54 x 32 x 24, image size 5248, resolution 3780 x 3780 px/m, cbSize 5302, bits offset 54
                  Category:dropped
                  Size (bytes):5302
                  Entropy (8bit):1.230589334813767
                  Encrypted:false
                  SSDEEP:48:MQ93zfTQ3zfsV3zfX53zfc3zLnDzLnHLnfPLnfXLnLDL3TzLqnDjLEk7rLrnfLPF:F
                  MD5:1B0595D3B591FEB315685E2F58407ADE
                  SHA1:9D9BCF82AF0E99DE7D4C68A1C12B50D6B7FE72E4
                  SHA-256:B94F7BEBD31802279D75C1F2BEBD7A4B74566C41A07E9B1D8E729BC1E9E03E4E
                  SHA-512:851926318B315A1F793EFD7E4C1E8219281B80952A7519693A97E9083FE29F8993EA11CA3435099CD4FE1706ADD7526676B0AC447A9319BF20684009C72DF4D4
                  Malicious:false
                  Preview:BM........6...(...6... .................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\ImageList.xml

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):17538
                  Entropy (8bit):4.380846698765198
                  Encrypted:false
                  SSDEEP:96:FavYDzZeABOUboSLTlFs8yFZrRwID9O16CS6p:FaizZx8UboSLzPyyq9OH
                  MD5:26B9C0C26C9EBBADCFADEF9E72996D1C
                  SHA1:7C97B8BB40F127BE1A071487ABC471E1ADEBA3F8
                  SHA-256:8E28C7818B56EA91581505087E60CF5F65FBB0B342E31DAA46504A8000BBD9DC
                  SHA-512:49427E661DEE3AF9756C2CAF284D22ED1F67DCF7F052D6E5845E8634D1972E0D83B6D32AAEFE402709C9B55AF393A72075AA446944FF8CBD4BABD6278E70AA75
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<List>.. <FileType>ImageListMgr</FileType>.. <Code>20081230164732890</Code>.. <ImageListMgr>.. .<ImageList>.. <Name>ImageList_1</Name>.. <TransparentColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <Images>.. <Image>motor1.jpg</Image>.. <Image>motor2.jpg</Image>.. <Image>naozhong2.jpg</Image>.. <Image>naozhong3.jpg</Image>.. <Image>naozhong4.jpg</Image>.. <Image>naozhong.jpg</Image>.. <Image>pump1.jpg</Image>.. <Image>trafficlight2.jpg</Image>.. <Image>trafficlight.jpg</Image>.. <Image>truck2.jpg</Image>.. <Image>truck.jpg</Image>.. <Image>monitor.jpg</Image>.. <Image>SysClose.bmp</Image>.. <Image>vul5.jpg</Image>.. <Image>vu.gif</Image>.. <Image>12.png</Image>.. </Images>.. </ImageList>.. <ImageList>.. <Name>Button</Name>.. <TransparentColor Name="Fuchsia" Red="" Green="" Blue="" Alpha=

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\ImageList_1\12.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):9508
                  Entropy (8bit):7.916338760252182
                  Encrypted:false
                  SSDEEP:192:WSHIIHUCD4waTc7U68du+Q0ljHHPcTwXn+jURjQPDpHw9mLyLcsBXF:550wi6nyrv+wujCjQlpyAk1
                  MD5:623C471279A659E2167E35DA345719B1
                  SHA1:E3F04C83EBF2CD63D33A6A1AC63F1C825D5435F7
                  SHA-256:6FC9E2E5A607D2C341570D2983E893C8BDED1CDC2B7DB702C57E2B118ECA39FD
                  SHA-512:A46AAAE78902FB3430D06F1E685E1EFD48922E8D0FE53A3AC8EA928B7B8054222AE939B8BA54CEC853F760FC8CF214EB1A98659C2C246CAB8A18F87B7AA4884D
                  Malicious:false
                  Preview:.PNG........IHDR..............>a.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\ImageList_1\SysClose.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 128 x 128 x 32, image size 65538, resolution 2834 x 2834 px/m, cbSize 65592, bits offset 54
                  Category:dropped
                  Size (bytes):65592
                  Entropy (8bit):3.760417658649602
                  Encrypted:false
                  SSDEEP:384:pTyn/SGWFCDfhbQN+YsEGws/cYE0DjgYKK6BVuzYDkYKFVJ07OKA5VIJbJJn:Fy/Sbypb4+Y+z/c9VYNy/A5CJb/
                  MD5:B53241A290A68F4B1A5A03B4D23ACDB5
                  SHA1:674AA675903EBB87A5995479CC6E7D25BBCC25D5
                  SHA-256:0143C6DCAA1D15702B99ADAD89BD6D3ED6AEC1BA33FEDA02323A7024F752A1BC
                  SHA-512:A23FB5C9D42D8B25A0D68595A4FCCEAC22C424B01F3E6D750E7BB3DD9D46B9D2B022D0C8CCC369761584CF1D0C02152626A8C8B8B751187810B9B28D28159130
                  Malicious:false
                  Preview:BM8.......6...(............. ..............................................................................................................i..dEn.U3`.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.U3`.dEn..i..........................................................................................................................................................P-[.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.8.*.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\ImageList_1\monitor.jpg

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:JPEG image data, JFIF standard 1.00, resolution (DPI), density 96x96, segment length 16, comment: "LEAD Technologies Inc. V1.01", baseline, precision 8, 130x114, components 3
                  Category:dropped
                  Size (bytes):2885
                  Entropy (8bit):7.55133297356129
                  Encrypted:false
                  SSDEEP:48:1LFWuIuESA6rd3XnxOroBPSLAXyDATm6T69bAKsjVypTiewwLk2bdAUhx4ccLm:CuzEg3XxEoBPSLAXyDAKsjsTi26cca
                  MD5:AAB1567829F41C6BFAFBCA1A1764B706
                  SHA1:263303EFC91A2211BABB6D2AAFA71BD9D8D8EEBE
                  SHA-256:026F67B7CD2EEEC8D9EFB8A5767F6A3ACB9C0EFE2D597C24A53218B86A8DAFB9
                  SHA-512:B483B60D504463A6171ADD2D75976FFCA3AA98FE2231DD648749F8822D06585B5BC21FF4BA05AF5A40A7E55183B76DDB9D9BE97D1DEBBB3802A39F54CC414A46
                  Malicious:true
                  Preview:......JFIF.....`.`......LEAD Technologies Inc. V1.01........................................ $.' "+"..(6(+/1343.&8<82<.231...........1!.!11111111111111111111111111111111111111111111111111..............................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.........................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................r........................?....(......(......(......(......(....%%.H....$....tu.....k..|..j.....@......r.=2....V........v....f.E9.3..Dm.23..d.~_.o.,....>1x"B...5bp..d..;{...].j]...m.'......Y?.Yw'.].......O....(.p.p............d...9e.9e.?.m.'......Y?.Yw.Yw........6;5.....9e.j2]G...../.....1[C.......|....Y.a...............;H..<.n.x.;....h.}.tw~...G.E.i.. ...UU.=AS...N...

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\ImageList_1\motor1.jpg

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:JPEG image data, JFIF standard 1.00, resolution (DPI), density 96x96, segment length 16, comment: "LEAD Technologies Inc. V1.01", baseline, precision 8, 214x130, components 3
                  Category:dropped
                  Size (bytes):9054
                  Entropy (8bit):7.885527694001813
                  Encrypted:false
                  SSDEEP:192:12RqVF1Kdxi4C9mxQfS8OVm4x971HYKL/SROvSKYxO37f5H4BgEHMmE08aLe:1yqVF1IxHAEO7zKL3TyTzR8aK
                  MD5:9C1DF9830B3E3B9DDDB73AE9A634D897
                  SHA1:1F711513DD45F77075FE9A192828D087813C5388
                  SHA-256:8041CD69274DB256A5D7630861596B9B73C17D49170B334C8496A7A966F7C903
                  SHA-512:6DD73C29CF77A962D9F682C30B810D6EF92197AFC45A37EEF62E88B7C0348E04F8781D4307E9A840D4B8691F614065B2764705F4C0101A29A287E5EDDA230354
                  Malicious:false
                  Preview:......JFIF.....`.`......LEAD Technologies Inc. V1.01........................................ $.' "+"..(6(+/1343.&8<82<.231...........1!.!11111111111111111111111111111111111111111111111111..............................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.........................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................................................................................?....(......(......(......(......(......(......(......(......(......(......(......(......(......(....2.I.='..){.]}..IDJ.[.\.@.z)..e%.vL.....m^..^#..u..k.]..!..U....}k..U..O..V...,X#..H..2+.......lv...7p.7S]..;.zj..V.O..&.mgq....iV8.7../...^.:.._..{.....{.eX.4....N....E'.........-.o....:..u.r.'..y.T.*.1$..d...+.....+n=..b..........K. &b.<..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\ImageList_1\motor2.jpg

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:JPEG image data, JFIF standard 1.00, resolution (DPI), density 96x96, segment length 16, comment: "LEAD Technologies Inc. V1.01", baseline, precision 8, 211x116, components 3
                  Category:dropped
                  Size (bytes):7089
                  Entropy (8bit):7.868658776363848
                  Encrypted:false
                  SSDEEP:192:1dyZzCYppx+qH1PE7mtdUsSs3ClSOywEhsn:1dyZTpp0k1M6LlSsQBX
                  MD5:44608D68542D600263F6BC224E2C9E3D
                  SHA1:039E6C5F8E9E183AB2B4D3E090C7965E2AEB84ED
                  SHA-256:9B608AB11FDD5D5047D55D76EC4C4DAFF4432E9F18D2AD4F8A4D21216BE1462C
                  SHA-512:627F3BE5ABA29CBE5FD9CB38785E3E402508492BAFCBAC5DF3D4FCC9BB918C063213F656F801005548BE484D6D311D7A4E0D7E505AE76C8B5E387166A8F74047
                  Malicious:false
                  Preview:......JFIF.....`.`......LEAD Technologies Inc. V1.01........................................ $.' "+"..(6(+/1343.&8<82<.231...........1!.!11111111111111111111111111111111111111111111111111..............................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.........................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................t........................?....(......(......(......(......(......(......(......(......(......(......(......(......(......(..........a..*mGT.!.%b...J.KlM.e...<..J*.q...<.....Au.......4..-.......OS.jW......J.[koS;......d....H0?..oS.....r.cO......!..........^.,.-^.=....t....:=......w<1.P.P...=.v......R.....V..I.^&.o..z.8...I..'.<....P.*.&tG/......t~-x.m#Z8.......e^.s.`...k

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\ImageList_1\naozhong.jpg

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:JPEG image data, JFIF standard 1.00, resolution (DPI), density 96x96, segment length 16, comment: "LEAD Technologies Inc. V1.01", baseline, precision 8, 211x209, components 3
                  Category:dropped
                  Size (bytes):8722
                  Entropy (8bit):7.578887565034165
                  Encrypted:false
                  SSDEEP:192:1kmrip8O6P1+aAzC8Sg1mUBBFDLw0CizEFurh:1kWipTuSzAg1m+f3B+urh
                  MD5:6C111337435CCFADE2F5D9E91691A4B9
                  SHA1:D903A1843C4D82E816890E0253E74E44B095A767
                  SHA-256:81E7930BC761AA53523C58AF4F4B5F15B10B8E130327ADE5C111725B62E1C836
                  SHA-512:EC9A08A5A5908E71771CF7FC6410DA67B2534104F4A9F4E4D06860CA4DED8FC5065B0CB8B01225BDAC3B8D283FF5C55F172F68434951B7641045A5F2E6D64C94
                  Malicious:false
                  Preview:......JFIF.....`.`......LEAD Technologies Inc. V1.01........................................ $.' "+"..(6(+/1343.&8<82<.231...........1!.!11111111111111111111111111111111111111111111111111..............................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.........................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................................................................................?....(......(......(......(......(......(......(......(......(......(......(......(......(......(........_..r^jWpY...O ..$..<....@.m.../...j.W..{.[Q..|.;...i6..Q.'.....&..c..C.O..B....2...4.....!.'...sW..........w..C.O..B....2...4].2.v?...G..t.W..}..[..u..-.1..w;..Y..<..z....sO.g..;.....iW.Rgd0^G#..'..N.'.3...ay..-.l..I....6C.fGlO.8Q......... .0...

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\ImageList_1\naozhong2.jpg

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:JPEG image data, JFIF standard 1.00, resolution (DPI), density 96x96, segment length 16, comment: "LEAD Technologies Inc. V1.01", baseline, precision 8, 159x165, components 3
                  Category:dropped
                  Size (bytes):6010
                  Entropy (8bit):7.598719764389838
                  Encrypted:false
                  SSDEEP:96:CuzEUnRXhqlji5fs0VwnLb4pClK2HUBrbn94xBKmjHmIQ6KRICXvs:11hoWglE3n9eomx3KRx0
                  MD5:FE4AADA9CA16522D8C531C762B89503A
                  SHA1:C3A514968DE8AE37AA6A25FE8679B0834FE07820
                  SHA-256:D00A93F7BA594674BC2AD063F83CE34E73ACE1546C8F89DA76A1E18CA4DA6B8D
                  SHA-512:FD137DD90EC086C09A020A01E0FE9BD8426410BA0DBCFAECDFB5B5A5A50B29D9B89C781B623DBFBA3CBC86B855759904C1229F16196D83A1432ED34CAE754B3D
                  Malicious:true
                  Preview:......JFIF.....`.`......LEAD Technologies Inc. V1.01........................................ $.' "+"..(6(+/1343.&8<82<.231...........1!.!11111111111111111111111111111111111111111111111111..............................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.........................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................................................................................?....(......(......(......(......(......(......(... .s...;.....#.m.......y{.F..|..n.^......M...../..@..4..J?.R...T...M...../..@..4..J?.R...T...M...../..@..4..J?.R...T...M...../..@..4..J?.R...T...M...../..@.........C.i?..y.o.......{..,g..2(..(......(........1?..ht...........%..p..K..F....z.q..........x........Z.....H..*..f>s.......A<...B.........

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\ImageList_1\naozhong3.jpg

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:JPEG image data, JFIF standard 1.00, resolution (DPI), density 96x96, segment length 16, comment: "LEAD Technologies Inc. V1.01", baseline, precision 8, 149x145, components 3
                  Category:dropped
                  Size (bytes):5807
                  Entropy (8bit):7.666822908194118
                  Encrypted:false
                  SSDEEP:96:CuzEPWPG3sQ7U+AfXQCR07los7jtsj1mdxxVMjO0Spx7lhSIzHIyRf:1HGavQCy7lVXtssdxUjLSvlhZzHIy9
                  MD5:E94FF42D4BE097167DECE7F0315CBCA4
                  SHA1:97DC6D42F07E2BAD5720CE95ABAD7AA4B544D694
                  SHA-256:6A2EBCD29EE4212E57802C6532402230CFB5F687389D58E0EE11340219993E1A
                  SHA-512:F160CB7047E2EC21CBDB673A10302D4FCE1C01EF89046E35BE5E01D48FD00FD9E6155B2E3EB1495C2BC4F73E6D8621DF1F6CDBCCBCC9D802A71A553AC85D32ED
                  Malicious:false
                  Preview:......JFIF.....`.`......LEAD Technologies Inc. V1.01........................................ $.' "+"..(6(+/1343.&8<82<.231...........1!.!11111111111111111111111111111111111111111111111111..............................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.........................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................................................................................?....(......(......(......(......(......(.....]K.~...4.-&.k.e.Fe.RF...s...h..?.a..@....M...h........t?..7.......;...........v.=..u/..V.T..xo^.V..T.H.$31.\.......(......(......(....<....N.......z..wRj..?..e.r.0...?*...... .>+k.h^>....m..(|..l...D...#...zp+...._...L<...=,...(.J../.S.......M................c.GO..`...=.?........]..&i..?..X...{.v<[..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\ImageList_1\naozhong4.jpg

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:JPEG image data, JFIF standard 1.00, resolution (DPI), density 96x96, segment length 16, comment: "LEAD Technologies Inc. V1.01", baseline, precision 8, 166x174, components 3
                  Category:dropped
                  Size (bytes):7336
                  Entropy (8bit):7.7865866841348765
                  Encrypted:false
                  SSDEEP:192:1HalS/DPrAJhn9NP/rHApKZ/Xi3kVDUKLvW:1qOPrIN3/rYOtVhW
                  MD5:A2816332319E05AA3097CD711AD89EB2
                  SHA1:26449932376F33E5E70219779AF733CCC2BA2C04
                  SHA-256:1B9746DC1CC179A901571CF2F25B8781AD06409D9BE678CE6B0AF956AD8640DF
                  SHA-512:5D875EAF30D1BE3BDE882DB224E8B3C142356F9EE37F0D8C7C5883E4D333A2976831DDB6BF9FB9BA84FDF6CAA80C0E5361756CCBA6DF888E425EC062DF0422CE
                  Malicious:false
                  Preview:......JFIF.....`.`......LEAD Technologies Inc. V1.01........................................ $.' "+"..(6(+/1343.&8<82<.231...........1!.!11111111111111111111111111111111111111111111111111..............................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.........................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................................................................................?....(......(......(......(......(......(....<_.'.4..E..8. ..X....(.n..C.,.."l|.H.;&...6.........?....n........?...i..._.7G:.h...>-..'.K..Csyyw9.G.Ud.F..K.;..v.....Q..B...K.~..... ...f.vU*.E..s...i.x.....Z6.}.]_.......,sJX.)b.1...Q@...........c\..../..S..~.cj...s..........ZF.u..<.7..H..)b.....p=E.z.._..?...l._O...3.."#cf..s/..1.......s...4.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\ImageList_1\pump1.jpg

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:JPEG image data, JFIF standard 1.00, resolution (DPI), density 96x96, segment length 16, comment: "LEAD Technologies Inc. V1.01", baseline, precision 8, 274x165, components 3
                  Category:dropped
                  Size (bytes):16198
                  Entropy (8bit):7.835732948349005
                  Encrypted:false
                  SSDEEP:384:1TRGqGOErZeMha/3YJmgxdd/tjYq5TD9bJ001Umn2P:1T3WZeRYTndF9bJ0Dmn2P
                  MD5:2BE3792557CA0236D970185B784B61EA
                  SHA1:EACC00736817CC4B9DF800B3F6EBD89B2ADFBCEA
                  SHA-256:18994A0D89592F78DA705684F05F0C85291CD3D5214B2341665FAE3ECAF3E7AC
                  SHA-512:5FB32BF09464B299F946E502203A5D18B59C853E7C67DDEE7685E598263D0296759284FF5671A74E13C526987C467B0940085E92FA2F6DB99269E4E8DBB62FEA
                  Malicious:true
                  Preview:......JFIF.....`.`......LEAD Technologies Inc. V1.01........................................ $.' "+"..(6(+/1343.&8<82<.231...........1!.!11111111111111111111111111111111111111111111111111..............................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.........................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................................................................................?....(......(......(......(......(......(......(......(......(.......>(x.S..o.]...j.w....1..?.k.....[[S........o.4....PZ.[hy.......%8.^N.t.B...J..=..*k:s....?.x.+y....^.+...C.^..`.V.i...b..1=...i..F_......BvQ..4hV.@P.@....P.@....P.@....P.@..y.../..y.k......g\..V...7..rS..9................X.C.{F?..Q.k.Y.b....Y...,.4KJ..,..I|O..r.C....%...q.s.....

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\ImageList_1\trafficlight.jpg

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:JPEG image data, JFIF standard 1.00, resolution (DPI), density 96x96, segment length 16, comment: "LEAD Technologies Inc. V1.01", baseline, precision 8, 94x136, components 3
                  Category:dropped
                  Size (bytes):4528
                  Entropy (8bit):7.767750485404882
                  Encrypted:false
                  SSDEEP:96:CuzEyhAEZcKRuh3VfxBGou1pVB2m+WBLhyS8BjmjNCnUXN:1i7Jh3VfxBzm2AhjQgNKUXN
                  MD5:0B0FE6BD90383E79274BBD2E10D99EE9
                  SHA1:9F042189B76E9EBFCEBC2982E1F7D5BD7EF68E83
                  SHA-256:8EEC223EA0E7037B84BDBE1D4E9EBC31A2FF15406AECA80155BAB52876CB3834
                  SHA-512:204AA23C8878D0B9C3141A8BF3B2DEBD9A090E3BFDC576F2CF3B8FADE99250C117BA87C1BE7E0824BE6F54782FB5F2F45B50B34E4A226DC65B936E0389DBC54B
                  Malicious:false
                  Preview:......JFIF.....`.`......LEAD Technologies Inc. V1.01........................................ $.' "+"..(6(+/1343.&8<82<.231...........1!.!11111111111111111111111111111111111111111111111111..............................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.........................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................................................................^......................?....(......(......(......(........Y..n....4...s<`.# ............s...3..T...w............P.....?.k.?.c7...@..'~0....\......U.}..[V.....hj.w{..s...........=N...(......e.;..-b.f..y.5-..I....@.W.#....}...K.....z?.W6:.w}(...d._.....:.P.......8....Z........P.7.....|....6O...."I..7q..~S@...t....=..Z.z....r......h...t.:..|G.........4..|........C[.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\ImageList_1\trafficlight2.jpg

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:JPEG image data, JFIF standard 1.00, resolution (DPI), density 96x96, segment length 16, comment: "LEAD Technologies Inc. V1.01", baseline, precision 8, 96x153, components 3
                  Category:dropped
                  Size (bytes):4281
                  Entropy (8bit):7.712987286059384
                  Encrypted:false
                  SSDEEP:96:CuzEYhchCjpTUd8MgJk4Io24ntYIg9o16Nv/WkuQjO:1VKsagO4hRt5gb9eko
                  MD5:2E62DDA91EC4E783A5FBE21F3FBE2663
                  SHA1:7076122A61ED3AB18FF036C13C5C573ACCA0C944
                  SHA-256:6C95BBA1B34BF3FB7FA6E7F975D27AC147D328B8FB5F3BDDD78AE8CFE0A80364
                  SHA-512:449EDDF174CF1827FB8E9C3E32CF2A86CD169A2AE094B5CC1FB1A54DE7D73D6DE586B2DDA250DEF89B570B703FBFB8F8DBC052F172FAE65A50CA39881927DFCE
                  Malicious:false
                  Preview:......JFIF.....`.`......LEAD Technologies Inc. V1.01........................................ $.' "+"..(6(+/1343.&8<82<.231...........1!.!11111111111111111111111111111111111111111111111111..............................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.........................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................................................................`......................?....(....g...[..c..P..H.U...I..9..a...w......?......P........k....c....@..'~.....C....?.U....?.......0...T..iwmy....+..ih.0..#.@.P.@....P.@......'.%...U...j......(........q.._m...%.v..P.@..|..U...C..........8...x..gG....G..|.F.a..zP.Ai..G<=....}......,.m..s.......<9.<.m.{L..).>.i.....f...>`.3..P././.G. .<.._o..I...Y..1...<.:..x?...:K....d.=.N......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\ImageList_1\truck.jpg

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:JPEG image data, JFIF standard 1.00, resolution (DPI), density 96x96, segment length 16, comment: "LEAD Technologies Inc. V1.01", baseline, precision 8, 621x486, components 3
                  Category:dropped
                  Size (bytes):67660
                  Entropy (8bit):7.583176152727895
                  Encrypted:false
                  SSDEEP:1536:1DoQe3nQuoPnZJNj3zUcSYr1dSjpAn7aeVzp:2QYnQuGZJFLJ+Ep
                  MD5:64B779D5B717A6196C2A1451B3579CE4
                  SHA1:2D593215C4A45344907581D4FBBF4D877280B564
                  SHA-256:3C1763C2F3A7B575F9A4245E444F70A2FF1CC33774DB0D9C527C31A175518809
                  SHA-512:91FE58177B33FE04A302A0543151367E276E27BA1DE9D11C8D1B10B40E73118F08DE6B05C084A154B18D689FB2823B01A64B69F207F0B7F8C5730679AF62EA61
                  Malicious:false
                  Preview:......JFIF.....`.`......LEAD Technologies Inc. V1.01........................................ $.' "+"..(6(+/1343.&8<82<.231...........1!.!11111111111111111111111111111111111111111111111111..............................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.........................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................................................................m......................?....(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......c.7.M...?..I#]B.c.1..W\..9.z..2...j.|...........MN........%k..K..I$..'.3....2....+..UeN..k.:iT...>.3.....<....I...]..c....`..Gw..Hr.U.\.....a...-..e~..{.D(.....c.k.= .....(....2.Y.M.xWW.-V7...k.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\ImageList_1\truck2.jpg

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:JPEG image data, JFIF standard 1.00, resolution (DPI), density 96x96, segment length 16, comment: "LEAD Technologies Inc. V1.01", baseline, precision 8, 326x124, components 3
                  Category:dropped
                  Size (bytes):8631
                  Entropy (8bit):7.739983800752068
                  Encrypted:false
                  SSDEEP:192:1Yr6r6r6jXEt2k2k2k5QvCa699ablxhFpa5YobF56Tk3lax5V:1uYYWU1dF6faeiF5akVc
                  MD5:DCECA2E0F34D249E2C4764AB1C91A09F
                  SHA1:E66FB1F16A1926134D5374261B9921CB54E1D93C
                  SHA-256:65B5A657C66EF7FD85D611E4BC467BFD44C39C3D740289D57B2AFB90DFD65FD5
                  SHA-512:97B39AA0D510CC6C194808FEE100890EFF520AE8A9EC4065BA40E08EF077C4E022A61BF5445439B84447C2030EE6261B5AE3077B211CCC23FEF199566A56D0B2
                  Malicious:true
                  Preview:......JFIF.....`.`......LEAD Technologies Inc. V1.01........................................ $.' "+"..(6(+/1343.&8<82<.231...........1!.!11111111111111111111111111111111111111111111111111..............................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.........................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................|.F......................?....(......(......(......(......(......(......(......(......(......(......(......m|Mi.....4D.pH.....n..................m#.*....@.F..+J.Y... b..A)<.=...Q............/.P....kI....?.._.......?...<..@..-.'.. ...y....[ZO..A......................?.mi?.....................(............./.P....kI....?.._.......?...<..@..-.'.. ...y....[ZO..A...............

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\ImageList_1\vu.gif

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:GIF image data, version 89a, 28 x 34
                  Category:dropped
                  Size (bytes):4986
                  Entropy (8bit):7.777968855762023
                  Encrypted:false
                  SSDEEP:96:vqv4m8II/CUO8SZqnmKkKmRic3lTX7HCjdwIIT64Mk09IDwsvcbkGy:ajzIZt+yaRpBHudwIcMknDwBbZy
                  MD5:9C2DEEE78B019F080D470609ECECEF3A
                  SHA1:50DC1A7C3071A4099D515D8C2448EACBEA19E7CC
                  SHA-256:47983CD657B699C560530B7FC521C9FB1080E23EE3BD4F08C48AEFC0BA581946
                  SHA-512:D58F6ACF83889B7D20D000D27A37F32CAC1B0599BA2BB38649DE9C630440E3F822C6C1428C8CEA61DD41A13CED362654A894395E888D767A204660374B23ACAB
                  Malicious:false
                  Preview:GIF89a.."....<*.?8J.X..j..`..w..z..i..f..u..y..u+'Y.-Q0(s.(n**YC2nM8lqQ*GQ5o~?^OY.SV3Jm.Qg0hO.iW4gf5LHEVXLWZWUXnBbUFvGJxTUiMR{[TjqkVQiUohgKigRfyWrh^qsDegfgdwhufhtxsefwewvxfxyy1..WY.U[.Sh.Xb.lS.jV.ee.mf.wg.ti.yy.zw.ro...........................'...........................$..*.+$.....;.h<.F..........................*..........................%"..%..#..*.*%..8.-'.H'.DP.;R.NW.pM.NZ.im.Ug.fj.we.df.vu.fx.xv.ex.wl.[p.tD..Q.Gl.n^..t..u..t..z...S>.{..SW.Xz.tU.vu.^..l..x..z..g..y..t..w..p..t..x..u...Y..s..[..x..]..v..w..w.w..o.h..............................................................................................................................................................................................................................................!..NETSCAPE2.0.....!..Built with GIF Movie Gear 4.0.!.......,......!.....9..C..*^\xQ......(.....G.6p..L....0.0..B....$(......H....U.d.0qB..".L.!b.@..D..1..G.EAV..B...H.p)b`RD"F..r.i.u...5.K.3c..2f./o..B..9j.d.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\ImageList_1\vul5.jpg

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:JPEG image data, JFIF standard 1.00, resolution (DPI), density 96x96, segment length 16, comment: "LEAD Technologies Inc. V1.01", baseline, precision 8, 28x33, components 3
                  Category:dropped
                  Size (bytes):1456
                  Entropy (8bit):7.625464635812748
                  Encrypted:false
                  SSDEEP:24:13+oFWXeI0XxDuLHeOWXG4H7DAJuLHenX3wSdirLlmjsORqFbg2sULQtldysJMH6:1LFWuIuESAHdiHkRyg/tzMHze
                  MD5:2CD8B3663C1076339FF4A3B333E6E771
                  SHA1:2476AA0E77D63CDA7CB19AE4E304141074C49F8F
                  SHA-256:F35453859B65012FFC7B3DE610F77B08BE7D9BB2C6AEC1728B4AE6006E21DC6A
                  SHA-512:A9813ABC5FE2D3B113019FD22DEB21081EB6F50E702D8ABF1C1EE01980FAB076395267159432DCD4EA5E60866350913062BC20AB77B99097257F8EE5BA46E345
                  Malicious:false
                  Preview:......JFIF.....`.`......LEAD Technologies Inc. V1.01........................................ $.' "+"..(6(+/1343.&8<82<.231...........1!.!11111111111111111111111111111111111111111111111111..............................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.........................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................!........................?....u4P.FP...>....^f#.*Rt.v...._.....8.Q..h.[|.....F.Bk.%/.r^).N.9(@+.....w...)....O...J......H.).e.]n..}_O2...g.[..$l..vx.`...b...]?....l.......+.e.......,..+dkq.G(....s..J.!58....V...t..i...r}:..mt.w\.L8.@..R.r8..z..1...j...........2.).Pii..+...o.....:T.W.$.>\..^@.<...*....*N....?2.V+...S\.Z.M.>.8&.c.....c....70..?^.rB.:sJm-.....z..U.Qn.[mo..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drawing\quayside crane way.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 211 x 40 x 24, image size 25440, resolution 3780 x 3780 px/m, cbSize 25494, bits offset 54
                  Category:dropped
                  Size (bytes):25494
                  Entropy (8bit):1.8496541110238813
                  Encrypted:false
                  SSDEEP:12:+qfrnHHPnHxAnsvoMoHwDPIponIpavQM4HQbHQjgMaAMCozwMqIboM4weITvMh9/:1LH+T5qqqMUoBFt
                  MD5:4932981BF97FB0DAF8893831579C67F6
                  SHA1:F58E179FC4783B64CB888D7B62C4C91511B492A8
                  SHA-256:E9640795DBBA62C108041172CCCB70164D89448B611B0D7C5E0959F24B13867B
                  SHA-512:03D32D2F986D9EE89263EF80D0EE738409636AA8836AD3DB713F5DD08B935F239DE612EBF0EFB7999AE62861CE7B5DCC3565C8594A184C4609482F1EF10A4F12
                  Malicious:false
                  Preview:BM.c......6...(.......(...........`c....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drawing\rtg wheel 0.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 212 x 151 x 24, image size 96036, resolution 3780 x 3780 px/m, cbSize 96090, bits offset 54
                  Category:dropped
                  Size (bytes):96090
                  Entropy (8bit):1.0753063343120786
                  Encrypted:false
                  SSDEEP:24:MKqqq5qqqEqqqqqqqqq6iqqqsqqiqqqaqBqqCqhqqqCqpqqUZqqSqZqqqEJqqqqR:b
                  MD5:21238CB3B1E91695A49B83DB10ECFE78
                  SHA1:A22A6059B039AC9C25785A7157B2573AAE56B836
                  SHA-256:83E54340F85A240E142BE30B3F43167B33680024600929430ED728CBDC1E94FF
                  SHA-512:5D3429B02681286B6ED0856030893423EEEF01C6A8BE974A08083FE48126B0150D62A9E09239B816F01BFCF69B222A2DC3FF7ADDF80C76A2533E05055DF5A38E
                  Malicious:false
                  Preview:BMZw......6...(...................$w....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drawing\rtg wheel 45.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 219 x 146 x 24, image size 96360, resolution 3780 x 3780 px/m, cbSize 96414, bits offset 54
                  Category:dropped
                  Size (bytes):96414
                  Entropy (8bit):1.1380140676174386
                  Encrypted:false
                  SSDEEP:24:Qf9qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqiqqqqqqqqqqqqqqqqqqqqqqqqqZ:QfZp
                  MD5:0B9E65150A7A227C9FC59D271EFFE585
                  SHA1:0E33F462AEDF8D11CF8E1CD1560F33E968E3BA64
                  SHA-256:85AD3CE70E9FCDBC25E36174FFF1B3D035AC979956067231BD967B62A26B2EC5
                  SHA-512:A99090009255BFBF8770A1CDD10E5273008A46105193B391554F2942B931458EA81A9335E52EA37A372267800E76B0EEB4DBB8177B1495E71688F09E7A5625A2
                  Malicious:false
                  Preview:BM.x......6...(...................hx....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drawing\rtg wheel 90.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 210 x 138 x 24, image size 87216, resolution 3780 x 3780 px/m, cbSize 87270, bits offset 54
                  Category:dropped
                  Size (bytes):87270
                  Entropy (8bit):1.0553936883707684
                  Encrypted:false
                  SSDEEP:24:TCqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqnqqqqqqqqqqqqqqqqqqC:TB
                  MD5:D7FD77FF449F8233C0E8D0E57F353F21
                  SHA1:319D1B1CCB2CE85435A55D8F1547A71950B5FF50
                  SHA-256:79A27E4661A9EF2A3CCFC4941411DEBEF6D8E13E3A810D5FA9C9C4C9306E994E
                  SHA-512:CA049F9B645E0260C53D361BC36DC84813657D94308B7C9DEA834A0F852401A9777BAE2055F7C22609CC5EF116FBC3E65ABA67A6C5CC24849C2D098BDCB6721B
                  Malicious:false
                  Preview:BM.T......6...(....................T....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drawing\rtg wheel turning fault.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 212 x 165 x 24, image size 104940, resolution 3780 x 3780 px/m, cbSize 104994, bits offset 54
                  Category:dropped
                  Size (bytes):104994
                  Entropy (8bit):1.0673941360893195
                  Encrypted:false
                  SSDEEP:24:nMqqq5qqqEqqqqqqqqq6iqqqsqqiqqqaqBqqCqhqqqCqpqqUZqqSqZqqqEJqqqqa:5
                  MD5:40FE19ECC33922F3225288022ADFFF9E
                  SHA1:A982AD48CB968D48E0FCC8FE76F4AC21F56D96D0
                  SHA-256:C223AA0FE0D1D6B88BE5896CE0C9C60A87D6D4F75071AFAE0EBA82189CA7F801
                  SHA-512:B6FCC38005F7F180106D4F79026CD4E6ED2BAA1DB1338320ACB6EFB37181FBD3534C848D1EFAF01222B5F09B0281DAAECCEF43547DF7273C79370A9B0C681163
                  Malicious:false
                  Preview:BM".......6...(........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drawing\rtg.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 26 x 20 x 24, image size 1600, resolution 3780 x 3780 px/m, cbSize 1654, bits offset 54
                  Category:dropped
                  Size (bytes):1654
                  Entropy (8bit):1.744540176076973
                  Encrypted:false
                  SSDEEP:24:0HnHH/n21q6RKiqqqqqqqqqqRKiqqqqqqwqqqqqqqqnqHwiqCwiqKiwiqgfqqQ4D:s
                  MD5:5C142734E2CEDA443826D3200CB5D838
                  SHA1:11B687D2A136BF534F3634291A274A884C29FE7F
                  SHA-256:5A11B316128939C81E64DCCBC920839D324DC8AB2C1C5C78B2CB29DB5DBA3234
                  SHA-512:A1245A865A465DBB088BBD8956307A0291ACC7F7E929C8822D8AF679ECC1A7BADFC549FB0B3367EB116C801D4D7FCA9CD6BD0736D669E7493D6232FC6F4E6B99
                  Malicious:false
                  Preview:BMv.......6...(...................@.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drawing\rtg1_1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 26 x 20 x 24, image size 1600, resolution 3780 x 3780 px/m, cbSize 1654, bits offset 54
                  Category:dropped
                  Size (bytes):1654
                  Entropy (8bit):1.744540176076973
                  Encrypted:false
                  SSDEEP:24:0HnHH/n21q6RKiqqqqqqqqqqRKiqqqqqqwqqqqqqqqnqHwiqCwiqKiwiqgfqqQ4D:s
                  MD5:5C142734E2CEDA443826D3200CB5D838
                  SHA1:11B687D2A136BF534F3634291A274A884C29FE7F
                  SHA-256:5A11B316128939C81E64DCCBC920839D324DC8AB2C1C5C78B2CB29DB5DBA3234
                  SHA-512:A1245A865A465DBB088BBD8956307A0291ACC7F7E929C8822D8AF679ECC1A7BADFC549FB0B3367EB116C801D4D7FCA9CD6BD0736D669E7493D6232FC6F4E6B99
                  Malicious:false
                  Preview:BMv.......6...(...................@.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drawing\tyre 0.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 90 x 100 x 24, image size 27200, resolution 3780 x 3780 px/m, cbSize 27254, bits offset 54
                  Category:dropped
                  Size (bytes):27254
                  Entropy (8bit):1.1966723677624431
                  Encrypted:false
                  SSDEEP:24:Qqqqqqqqqqqqqqqqqqsqqq5qqqSqqiqqq8qhqqqyZqqkJqqqqqqqqqqqqqqqqqqs:WTSw2d
                  MD5:D73F46F67A713D2F9A5D5FD37CDA2FCD
                  SHA1:D06478E93237C50F318A34B80802671B994532BB
                  SHA-256:3055368219AB339D27B7DC20500E716BAB0944914FA89352FF578189A13F61F0
                  SHA-512:97B291B4CEA5B9BDCC1072D2D1AABADEEA01A3E0C007E3F7ACA6AC866D0A9E9ED301D62F630DDF50988F97DB61E1A703CB67C6091FA32DC737BD0D3F3F8205DC
                  Malicious:false
                  Preview:BMvj......6...(...Z...d...........@j............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`..@..@..`..`..@..@..@..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drawing\tyre 45.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 90 x 100 x 24, image size 27200, resolution 3780 x 3780 px/m, cbSize 27254, bits offset 54
                  Category:dropped
                  Size (bytes):27254
                  Entropy (8bit):1.2723415422604636
                  Encrypted:false
                  SSDEEP:24:mqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqt3Cwqqqqqqqqqqqqqqqqqqqqqqqqqk:lX
                  MD5:FF42208B3628655BC8EF6CC071447F67
                  SHA1:7C5AFEF4BF8C9AEC0DFDE6DF10CB0B9E8004AED5
                  SHA-256:9D3B1CC5E7511EF38827E4AE9981E15D6D51A162121789CF2525C8D62177DC75
                  SHA-512:5837682201B71B6122E1634FEF230909A496750FCACBAB1D26A75CB817AC89BCD2DF8FF8B4E1BB378FE9E1B0C923CAECA03862E03E18192C0F60B6E8FD490D8D
                  Malicious:false
                  Preview:BMvj......6...(...Z...d...........@j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................@..@..@..@..@..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drawing\tyre 90.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 90 x 100 x 24, image size 27200, resolution 3780 x 3780 px/m, cbSize 27254, bits offset 54
                  Category:dropped
                  Size (bytes):27254
                  Entropy (8bit):1.1640505479451926
                  Encrypted:false
                  SSDEEP:24:0qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqFqqqqqqqqqqqqqqqqqqqqA:O
                  MD5:3ECF28042D833E262B6D54B065396C41
                  SHA1:D7C7B0B3A7F11D586E34A88F1161740D318D2E5A
                  SHA-256:9DA9B4A963CC3EE1BFEDEEEA92E038E476AF0CAEC323B6F50A4500A6E46DCB4D
                  SHA-512:8659CD7D43125B36A71CB2C55297ED43B2EEC5E9AC5B52E65AECB14C23BA05E86B828DFC34ADF18BFA2B6B71983B8CB0457776F7D3C2BA14B01ACFA6E8B72090
                  Malicious:false
                  Preview:BMvj......6...(...Z...d...........@j......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................@..@..@..@..@..@..@..@..@..@..@..@..@..@..@..@..@..@..@..@..@..@..@..@..@.......................................................................................................................................................................................................@..@..........................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drection\arrowrot1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 20 x 24, image size 1200, resolution 3780 x 3780 px/m, cbSize 1254, bits offset 54
                  Category:dropped
                  Size (bytes):1254
                  Entropy (8bit):1.1156992558741603
                  Encrypted:false
                  SSDEEP:12:qQcfnHvHPnHnvHnHnHnHnHnHvnHnvn/HvnPI:qc
                  MD5:15A75C2FA38926205D991A0FD8F43B03
                  SHA1:F00E5C0AC20ADE34682FF3B82D6E749130C174D0
                  SHA-256:097B79AA3F236288E58859947BFA78FCEEF189CC41CEB4E1EE7A5B8A9C736268
                  SHA-512:E3D88EC462BD62FBE73636897C40B19EB004ACD7107636C5C4920F707265163394577AB2B1C7BFD949272CABB268B7E06B978BDF19BF5F16E996DAF1F54EAE23
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drection\arrowrot2.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 20 x 24, image size 1200, resolution 3780 x 3780 px/m, cbSize 1254, bits offset 54
                  Category:dropped
                  Size (bytes):1254
                  Entropy (8bit):1.114336312853214
                  Encrypted:false
                  SSDEEP:6:qQc4igSASvHPnHnvHnHnHnHPPHP4AngAASvAio:qQcfnHvHPnHnvHnHnHnHPPHPPnnHvHo
                  MD5:55A159901E62058F69FFE0EC720AF49A
                  SHA1:99CC78DCF33509D69D16E46AB8B46DD422D79D41
                  SHA-256:20E521C46CDDAF078894865399EA82D15C8FFAF57A6D682AF11308358F0AF91C
                  SHA-512:A0A8729ABB87B48BAC13CE025D2F66BE761D421D99482DC9990A154AD7DD9ADB9A5322670B731CFE97DDDF720357DE432ABEA6890DB694B2E8A55B4BF745B998
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drection\arrowrot3.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 20 x 24, image size 1200, resolution 3780 x 3780 px/m, cbSize 1254, bits offset 54
                  Category:dropped
                  Size (bytes):1254
                  Entropy (8bit):1.1156992558741603
                  Encrypted:false
                  SSDEEP:6:qQc4igSASnnPnnH4AvA4nnHnHvnHnPHYSASgio:qQcfnHnnPnnHPvHnnHnHvnHnPH/Hno
                  MD5:E56F56A229F9FDE460F6B745BC640906
                  SHA1:CB8B83CA6CA5FACF293203C7000E72580741F27C
                  SHA-256:E2E93AC6FCE555DF66A9E12F513EB4D256C2D87B8E456318BA49FB0DE2EAF0C5
                  SHA-512:C82FD7E023AB8B1431555BD9B9326C1134C6B627D6718EFDCE2352D7EF82AB4C562E9A82F8AD711871924DEB9EB7855F6EAA54882A0CEC3D72609ECC9CEBDFAF
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drection\arrowrot4.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 20 x 24, image size 1200, resolution 3780 x 3780 px/m, cbSize 1254, bits offset 54
                  Category:dropped
                  Size (bytes):1254
                  Entropy (8bit):1.114336312853214
                  Encrypted:false
                  SSDEEP:12:qQc/nPHfPHPvHnHnHnHnHnHvnHnPH/Hno:q8
                  MD5:C70DCDCABD90E51C8160F5D7D53C0D81
                  SHA1:E142A24296B5F159325D2973AE29B50E7DC78252
                  SHA-256:74EE6B2EB9B68E12B46F890C0A5DF1136C68E788DCA584A911EF33335E6D68F2
                  SHA-512:1F6AFE484D76AF04BCD2772359313061EFE8AA1D5D7A094B5E327B94933D91360173A8DDCA1E65E49F6298780BD2CBC9586B80424BA98A74CBC642B950E29B33
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drection\arrowrot5.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 20 x 24, image size 1200, resolution 3780 x 3780 px/m, cbSize 1254, bits offset 54
                  Category:dropped
                  Size (bytes):1254
                  Entropy (8bit):1.1156992558741603
                  Encrypted:false
                  SSDEEP:12:qQcvfn/HvnvnHnvHnHnHnHnHnHvnHnPH/Hno:q8
                  MD5:742829509CE18EC8B757F661997C6A0F
                  SHA1:264DFEB9391D9D597E9AF4D7DC13EB760C7D4E83
                  SHA-256:F6578DE0755A25926ED4B4E226F6B49EF249DDED46922F2ADE47B054C58A70F7
                  SHA-512:B28E5E1C25C69E1CA349976C1D4E7FA7F8EFB784ED4A33A795A267091D98F45A29864F724119D8120C3ED75A1E76306D7FCD27FC037ED8B5F4C223FE30653F88
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drection\arrowrot6.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 20 x 24, image size 1200, resolution 3780 x 3780 px/m, cbSize 1254, bits offset 54
                  Category:dropped
                  Size (bytes):1254
                  Entropy (8bit):1.114336312853214
                  Encrypted:false
                  SSDEEP:6:qQc4iHYSAAngAPPHPPHnHnHnHvnHnPHYSASgio:qQcfH/HnnPPHPPHnHnHnHvnHnPH/Hno
                  MD5:A9BBF0352F751E05F4D146F4D2BF34F8
                  SHA1:7335F10AC602EF582E346D5346CFC214D718250A
                  SHA-256:93B89FF43ABA2D6B5274FFAA6A611C81CBEA8ED86277C002A57C4C0ADDD62B67
                  SHA-512:3A480D8B396B45DA8184A84F7B83ACE471175788A20A8FF72151084003E9E8F62BAF05747A01AD372D34771C0496E6EAD96E62CB60110090D406B525AB6B488E
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drection\arrowrot7.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 20 x 24, image size 1200, resolution 3780 x 3780 px/m, cbSize 1254, bits offset 54
                  Category:dropped
                  Size (bytes):1254
                  Entropy (8bit):1.1156992558741603
                  Encrypted:false
                  SSDEEP:6:qQc4igSASvHPnHnvHnHng4HYAPHnnPngSASgio:qQcfnHvHPnHnvHnHnnHvPHnnPnnHno
                  MD5:E6D310DD85C6A32F431CF86D15EFBE1E
                  SHA1:D17A7FF4D4518A292BD4BDFC32B9AD30F6B682D0
                  SHA-256:F086D4A7EF8FAE3770BE971886338C288113AA428D97FAD52116912E2A673416
                  SHA-512:5258E4555F24A1F2180B861AB0315A3F7C2CFDEF55673ECCA48068B3781AA5D5BD8BE8A8815B387BA7491DDFA58B9FD772C587CAD9EA7494B313E1CC8B94714C
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drection\arrowrot8.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 20 x 24, image size 1200, resolution 3780 x 3780 px/m, cbSize 1254, bits offset 54
                  Category:dropped
                  Size (bytes):1254
                  Entropy (8bit):1.114336312853214
                  Encrypted:false
                  SSDEEP:12:qQcfnHvHPnHnvHnHnHnHnHnHvfHfPHfnI:qc
                  MD5:2F3220AD1A5DB65CDF6997E945678E2D
                  SHA1:84A8D229EA7B6FC730A8DCE4FEFC3291690A30C4
                  SHA-256:A0979061692B2AD59288F6626DE6C557F367BDB3FE6ECAA41C70FD34F0614BAA
                  SHA-512:D672FB5D65A695E52FDDE33EB73727C1A9047C38D523708B853B9775BD6FFD8DE2DCDC2046C74BBBC87E3C0BCCF24A7B4B51183DF422A7CF14A9EE89DD61DF11
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drection\arrowrot9.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 20 x 24, image size 1200, resolution 3780 x 3780 px/m, cbSize 1254, bits offset 54
                  Category:dropped
                  Size (bytes):1254
                  Entropy (8bit):1.1205448126530333
                  Encrypted:false
                  SSDEEP:12:qQcfnHvHPnHnvHnHnHnHnHnH/HHPHfvPHPHnH/I:qs
                  MD5:AEA15D0DAD2054E4360FA15EE4B83DDE
                  SHA1:9B982F7BE1C64482C01E99CC5A759066A5FD9DA0
                  SHA-256:13C91F7A46B1B59C5F8E228C947026193F06656AB617679003D846C60B11377F
                  SHA-512:57A2E8AD4E316CCFB398E2730006289C80508216C482269B7577A58FB3B7D650391380F16754F6A02CC91D3E4D3D7D019543D91A41883CC73A21C54F598F744F
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drection\east.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 128 x 127 x 24, image size 48768, resolution 3780 x 3780 px/m, cbSize 48822, bits offset 54
                  Category:dropped
                  Size (bytes):48822
                  Entropy (8bit):1.2855808340779964
                  Encrypted:false
                  SSDEEP:12:clmA1lNl9fV9lNl3Xvvv1PPPPPVvvvNPXNfPflXXNFllX9lv/lllXX9P/tH9nv3l:ckVVs
                  MD5:DFA715EFD2964B0D517A26EB01F8B5F4
                  SHA1:EE44FE19F7AD80DE5F68F1D5FF2A4AAE8810A803
                  SHA-256:83D43410D6A9338387A348C2135FF7E62FDD7B12A14A04D58E8E40904DD5197F
                  SHA-512:1EDAC8E1E487D0BC8ACBE4E13F6E89EC45335FB88CB9C9C60006D72DA08ABEC072065D19AE227656C77CD258A87E6FF2A50A09297DFDF030B52D5B43648594C1
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drection\north-east.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 130 x 129 x 24, image size 50568, resolution 3780 x 3780 px/m, cbSize 50622, bits offset 54
                  Category:dropped
                  Size (bytes):50622
                  Entropy (8bit):1.2807046268107067
                  Encrypted:false
                  SSDEEP:12:3rVI1lNl9fV9lNl3Xvvv1PPPPPVvvvNPXNfPflXXNFllX9lv/lllXX9P/tH9nv3B:37pHvW
                  MD5:6953BDFA65A814C68CF3162A33DD2045
                  SHA1:19ACDE7223FACC0D16B4E6FF45BCB1F4A5C51689
                  SHA-256:1B893F64D6CF706D6EE8E332C0F51771ADF025999681966125CD56C9798ECC83
                  SHA-512:842C76C66BBF4018EC5A099B54770640984A76DD97731BE364DDA0D6729A9C3F6D95CF9A020613DB186A3C905F0B6025EE8947FD2FC12AED3D5F6FCDDE492AB5
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drection\north-west.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 126 x 125 x 24, image size 47500, resolution 3780 x 3780 px/m, cbSize 47554, bits offset 54
                  Category:dropped
                  Size (bytes):47554
                  Entropy (8bit):1.2949746318762645
                  Encrypted:false
                  SSDEEP:12:bFIFldlNPlNldlnHfffF/////lfffdPXNfPPlXXNFllXNlv/lllHX9P/9H9nvndX:NRw
                  MD5:D42294D7B9185D1D927437F5050EB954
                  SHA1:3C7D9678CCBF25E2659CDE92DB9AB932C1016669
                  SHA-256:BD797322B94FC06699FA71F99E78FBFB24919E0593BD2B09F1DF72E822A6EFAD
                  SHA-512:CD8A24F1E56420F84869E5B4A4DA041C8B35CC82826D91AD260574DF2F3011090311A58BBCD40A5CB3A543AF82D3C547BA1F5A912E98F3ED4284D7C5E1B048BB
                  Malicious:false
                  Preview:BM.......6...(...~...}.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drection\north.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 127 x 127 x 24, image size 48768, resolution 3780 x 3780 px/m, cbSize 48822, bits offset 54
                  Category:dropped
                  Size (bytes):48822
                  Entropy (8bit):1.2886281209139794
                  Encrypted:false
                  SSDEEP:12:cuoKmPPPICglqglqgQAgI6glqglqICPPPPo6o6o6o6AgAgAgAgAgAgICICICICAp:cu0DbNRpppp8
                  MD5:8FB821BB52FDAB59CCE10AE7FE78298F
                  SHA1:72FDB84C6D35CE7A190C9CE78E4F102A0B8397C0
                  SHA-256:C9BB4943BFB5E5F770DA8365BC17831E639B0C082E6A113A2E10D4FFA05E8D55
                  SHA-512:189B5B6F95304DB48146C70777CD2DE4430EF02AE45BAFC891B85FB75B71E45530A1B78E010D67A96EC59122F3585D0139927D624823F1737C248FE19DC18DE7
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drection\south-east.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 126 x 125 x 24, image size 47500, resolution 3780 x 3780 px/m, cbSize 47554, bits offset 54
                  Category:dropped
                  Size (bytes):47554
                  Entropy (8bit):1.295985856105831
                  Encrypted:false
                  SSDEEP:12:bFoFldlNPlNldlnHfffF/////lfffdPXNLlXXNPlvvX99tH9pd/VN1l1Vfl1V3Vp:Ftn1O
                  MD5:8B26D64FF1A53B39B3BF38100122029D
                  SHA1:B436C3D68CE7B059E44BD4B5544B8CEF65E80A46
                  SHA-256:BFE4619FB255F78922CF16AC4E5AB603E60F6FBD9A77AD35DF9325E05787521B
                  SHA-512:2777DDF494CE5F81531C3F14D2FFB716683E7C1843CBD6C769D4B14458F27CE159D56EEF41A0D55846A4DF67EDB5BDAD7F12DCAA70C9A7473FB96C61EF0918A5
                  Malicious:false
                  Preview:BM.......6...(...~...}.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drection\south-west.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 130 x 125 x 24, image size 49000, resolution 3780 x 3780 px/m, cbSize 49054, bits offset 54
                  Category:dropped
                  Size (bytes):49054
                  Entropy (8bit):1.2880976747593174
                  Encrypted:false
                  SSDEEP:12:1GwI1lNl9fV9lNl3Xvvv1PPPPPVvvv9fPPFllXdp/llld55P/F55nvHdVF5/lllb:IJKFU
                  MD5:A3DC9CE257B00C5CA96DE64B3DC00A08
                  SHA1:585AD66D67EC35ED1EF95BC788615FAF205EFC28
                  SHA-256:55D67B7D165BA5F1D6F69519D482EF84F1DFAE3A939369B10D92C793DF0F0254
                  SHA-512:51341FC9A4E17125B73404C01420B0913C1A35DAE8D004237B9B69CF451278811FD66129259838AB8586A27B93FB34CCFC4006F0CB7E633868A85D57D0382E90
                  Malicious:false
                  Preview:BM........6...(.......}...........h.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drection\south.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 128 x 127 x 24, image size 48768, resolution 3780 x 3780 px/m, cbSize 48822, bits offset 54
                  Category:dropped
                  Size (bytes):48822
                  Entropy (8bit):1.2859419390837779
                  Encrypted:false
                  SSDEEP:12:clmGDDDfPX71PflXX7HllX9leuxlllXXQuh/tHQuJv3d/4uDV1l14uxlllHl14u9:cYFN1lFpDzG
                  MD5:549A33DD40DB9ACED33BA3141EB2C7C4
                  SHA1:E5A9768711C83AEE1EC4EB700CEB9D8306E43BAA
                  SHA-256:B8280FF33D2F593C2F66344706F046973EEAF9B30EF6CE7709661F16E8BD35B7
                  SHA-512:7515F82D3CE55D653C5D23B9EA5E61640D4B6864CDC1EC8FCB477D9EF7052BEA87FA8BFC7862B2A6C475614965DC255CA92F581A63AA658F5DD674474B2BD35C
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\drection\west.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 133 x 127 x 24, image size 50800, resolution 3780 x 3780 px/m, cbSize 50854, bits offset 54
                  Category:dropped
                  Size (bytes):50854
                  Entropy (8bit):1.2770084102355654
                  Encrypted:false
                  SSDEEP:48:ovvXvvPHPvvXvvvvXXXXHHHHHHXXXX/XPvHPPH/XXXHHHPXvvPPXXHHXXXxf3PJm:5
                  MD5:AA59E4605790589E85586CB10FE1647D
                  SHA1:FF40082A9B63ADC35A2F579186AB0DFCEB05F736
                  SHA-256:E5B2D2965F363FC122CB49190ABC11CA6A244E8F99D0C9CD413768D53D2EC670
                  SHA-512:EBCC4A9BF5DA64A0FA194851E21890AB5AF767C4628DFC02629EF188E5BC630F3F555F990EDEECFD6FC8DECB62818DF5804599C3DF0E3AEFACF42D55B682550B
                  Malicious:false
                  Preview:BM........6...(...................p.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\clip.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 15 x 14 x 24, image size 672, resolution 3780 x 3780 px/m, cbSize 726, bits offset 54
                  Category:dropped
                  Size (bytes):726
                  Entropy (8bit):1.3235434433106807
                  Encrypted:false
                  SSDEEP:6:4ml+6Ad77sXwiwat7sX9YY17sXw6rsYpt7sV9psXFpFXpZ8nX+pqftRpqX94HY6A:pQ6mYwLvYww+oV+pW4H/A
                  MD5:CE8720519E2B00096AE519A15B0FC025
                  SHA1:E41C0566DA0CF997E95C206458A7467ABA156DE2
                  SHA-256:11CF589ED764F1A669EDA0284A633E106962A2AF645338546DBAF74C10963C61
                  SHA-512:57206DC99014762D2BA25524B2BC93E33A4AEC38FCE3D0BA7BC22E672A689FE85BFB4DF0DFF9C4C97C4092E020BFDA7452395E061834304A5D3FFA604D48E337
                  Malicious:false
                  Preview:BM........6...(......................................................................................................................................................................................................................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\close.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 19 x 17 x 24, image size 1020, resolution 3780 x 3780 px/m, cbSize 1074, bits offset 54
                  Category:dropped
                  Size (bytes):1074
                  Entropy (8bit):1.5828774717961018
                  Encrypted:false
                  SSDEEP:12:TtvfHHHH/HHnnyHinsSnnNSKwHNSMSnCn37HnYHJHfA:BvjOrjv
                  MD5:589907DAE378B0CD4CE218809B97043E
                  SHA1:8D61805316F84D343B245501C70C92A6E731A432
                  SHA-256:BB6D966993158941132C1B7EB6CFB5E3461197EED91FDE2581AA0A4A8F4883F5
                  SHA-512:9956071BE1F698B485B79777FF3E09BB1845D23D4BB6811EE6AA3B6195201200A7EC6DB55183FE7DDE4805F65A4C1DE01E416A52796FB15CA0EEE215E7440D48
                  Malicious:false
                  Preview:BM2.......6...(....................................................................................................................................................................................@`.......................................................@`.......................................................@`................................................................@`....................................................@`..........................................................@`................................................................@`....................................................@`..........................................................@`....@`.............................................................................................................@`....@`..........................................................@`.......................................................@`.........................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\crane.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 36 x 34 x 24, image size 3672, resolution 3780 x 3780 px/m, cbSize 3726, bits offset 54
                  Category:dropped
                  Size (bytes):3726
                  Entropy (8bit):1.483270028740379
                  Encrypted:false
                  SSDEEP:48:qXvXvXvDrDrDnXXPXPXPXP7X8rSrSrSryrjr7r7r7nvnG/gPnHa:o
                  MD5:1F0DD460CBF9624710C1F2D4A10C3261
                  SHA1:268439445444D4E1BA76A95988668C09991CD82A
                  SHA-256:9E0C4818EFFB66AD54C3B48200DCD736210F6553022A372D4C2667A2B0E4E091
                  SHA-512:A01F2A6F15FF1BB453AD077F3E27DF2DB044F540A44C877B19ED237C23DE63DAA2FEE5446A1FBEA55FEE9F3AF43D3FB166AB65C98F11E47E7A079E8F91442850
                  Malicious:false
                  Preview:BM........6...(...$..."...........X.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\cross.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 17 x 17 x 24, image size 884, resolution 3780 x 3780 px/m, cbSize 938, bits offset 54
                  Category:dropped
                  Size (bytes):938
                  Entropy (8bit):2.320804737548337
                  Encrypted:false
                  SSDEEP:24:oAtJtt5qgtpSgtZSg/gIgtP1Igtrpvtfl2bpvtf13trZAgtPFg/g/gtZSgtpFt5P:oW5xpMP7rXfobXf7r3Pc5BJr
                  MD5:900AD3B92C7FE719AC93165B60BA6D1C
                  SHA1:CC1DEDB0E05C096091F5A589AD447AAB35CA150B
                  SHA-256:186F87CD89891DE30E1FACECBD89EA29B38AFF5E27D9AC3D7D7BD58F7D998891
                  SHA-512:E712689DDA27A548C98215568109BE77833B1083F4625C3E4C07BA2545455C5A907E99849F5B35D0C647A6AE5BBFB9C61B936FF98B0D36D6B97E556CBB397593
                  Malicious:false
                  Preview:BM........6...(...................t....................... .. .. `............................ `. .. ...... ..... .. .. `...................... `. .. ..... ... .. ..... .. .. `................ `. .. ..... .. ... `. .. ..... .. .. `.......... `. .. ..... .. .. `..... `. .. ..... .. .. `.... `. .. ..... .. .. `........... `. .. ..... .. .. `. .. ..... .. .. `................. `. .. ..... .. .. ..... .. .. `....................... `. .. ..... ..... .. .. `............................. `. .. ..... ..... `............................. `. .. ..... ..... .. .. `....................... `. .. ..... ..... ..... .. .. `................. `. .. ..... .. .. `. .. ..... .. .. `........... `. .. ..... .. .. `.... `. .. ..... .. .. `..... `. .. ..... .. .. `.......... `. .. ..... .. .. `.. .. ..... .. .. `................ `. .. ..... .. ... ..... .. .. `...................... `. .. ..... ...... .. .. `............................ `. .. .....

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\curs.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 15 x 21 x 24, image size 1008, resolution 3780 x 3780 px/m, cbSize 1062, bits offset 54
                  Category:dropped
                  Size (bytes):1062
                  Entropy (8bit):1.1541247475622534
                  Encrypted:false
                  SSDEEP:12:bhbPPPPPPPPPPPPPPPPPPPPPPPPnHHnHHHHHHHHnHHnPPPPPPP4:b6
                  MD5:1247472106FC6F74EE3EB60144670829
                  SHA1:F5E40B4F0633ACEB3CD7F917F688A412B07A208E
                  SHA-256:2EF0A707F38556D8F92DB8C08A2498CFBB365001AEB9C3A0845815978B627D75
                  SHA-512:8FCB7929DB6A06B1A145853C59F17C103B6F1727B9703D93BD6179CC1F82D5E6E6AEDE61541BCE669A5A6BBA4429E3F713134B6670E9958B729B994376FDCB31
                  Malicious:false
                  Preview:BM&.......6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\dguide.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 31 x 33 x 24, image size 3168, resolution 3780 x 3780 px/m, cbSize 3222, bits offset 54
                  Category:dropped
                  Size (bytes):3222
                  Entropy (8bit):1.9442052995179462
                  Encrypted:false
                  SSDEEP:24:DYCeB3wtCe839UCele1tCeRAuw+PCe0XqqqqqqqqqqYPffcqwWcqwWfff3qqqqq3:APffHHfffxC
                  MD5:BA9CC55B2858D5B2AB01310B709B8B89
                  SHA1:0DC05F53068F185EA8AC710541A4ADAB3132826C
                  SHA-256:32BA7D1224244A82D16337595A98308099EFF0BD628019AA85A16E31B03F7A03
                  SHA-512:668E363B890DC64C96DD576961D66724A041870C1539AB64C8E52DD83CFD23522D976A1AF113B592C102C6CFE05001DEC6F0D164984B24DE7C45FA3532168E09
                  Malicious:false
                  Preview:BM........6...(.......!...........`.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\disc1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 14 x 14 x 24, image size 616, resolution 3780 x 3780 px/m, cbSize 670, bits offset 54
                  Category:dropped
                  Size (bytes):670
                  Entropy (8bit):1.6594118054768807
                  Encrypted:false
                  SSDEEP:3:wfl/jl8lnvFXv/f/lXXllllll//9/lXXllllll//9/lXXllllll//9/lXf//9/l+:wYdqz
                  MD5:8A8B15F376D72E4F06C5218DCE6C0350
                  SHA1:B54D9379BD48413FB9A79613C07633E78A27156D
                  SHA-256:F80A4110374031CD2283D69D909202ACF728537C9F9E77AF18136C26BF4D5144
                  SHA-512:484BB9CA8B7C1A5872FDBB9D4E4B5F0DAB6D9940E221A085BAEE859CBD763CDFD7DAEFBBB2CA1A29D98FDD94F8520F4CBB2C1135B29BC79562EB2DB5E9743F1A
                  Malicious:false
                  Preview:BM........6...(...................h...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\disc2.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 18 x 16 x 24, image size 896, resolution 3780 x 3780 px/m, cbSize 950, bits offset 54
                  Category:dropped
                  Size (bytes):950
                  Entropy (8bit):2.1316080231206467
                  Encrypted:false
                  SSDEEP:12:qfywfowA2gzoA2gzoA2gzoA26A26A26A9yA2poA2ba6Q/qqqqKgRW2ba6W2pWcQf:qDEVVKI/qqqqKsif
                  MD5:840862BB244B555016491DA5DD6CAA11
                  SHA1:3C337E685321AF2A2C9C5E3B17956AE8BEC4A90C
                  SHA-256:28EFFAC34DE7640AF9636B6B8896307B0C22A651B5A16B55934F65582E7F6044
                  SHA-512:293D917DC35D1FB2F079E5E2EE5696F3261F1BA12A301EC26AE65BD6A187DEF0EC75243C111E78C820058CBB7437A9708AC0048843BBFDFFF19CAD1BE506C3C5
                  Malicious:false
                  Preview:BM........6...(..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... .................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\dnar.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 9 x 6 x 24, image size 168, resolution 3780 x 3780 px/m, cbSize 222, bits offset 54
                  Category:dropped
                  Size (bytes):222
                  Entropy (8bit):1.223305727510799
                  Encrypted:false
                  SSDEEP:3:2IllQlNFXotDeuRtDP3e/AtPC/4tu//n/:xlmAnN+A1S4tuX/
                  MD5:5B010482A90750BAFE177E71E23054AB
                  SHA1:12C64A3CEA6EF940F11519FED80CB13A55E17BFC
                  SHA-256:7A35762B18434E7987B899509F0FB6CD414E2E46F5086C0F37E2334EAAAA96A0
                  SHA-512:F6718FF599C3D83275CB287B5E43038A1AC338861791B96F5BD3A0BB1756C71613F2314BF156D144D40CF108229E8C96B6353019F49A53E0DBAC259A8C083D91
                  Malicious:false
                  Preview:BM........6...(...............................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\dnar1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 9 x 13 x 24, image size 364, resolution 3780 x 3780 px/m, cbSize 418, bits offset 54
                  Category:dropped
                  Size (bytes):418
                  Entropy (8bit):1.1371045476016872
                  Encrypted:false
                  SSDEEP:3:vllCllC+lFloFXotDeuRtDP3e/AtPC/4tu//n/AtDDDDDDP3DeuRtDP3e/AtPC/1:vKlhtdnN+A1S4tuX/AVVN+A1S4tuX/
                  MD5:9C3363DF4AF4A3362B57E9472462FF6E
                  SHA1:3CB968A944EE6896044F63C56890884E902A2A81
                  SHA-256:E9638657162E7022210AC436E1897444E9AF37B848278642AD5597884C3A6431
                  SHA-512:AA2E214B6D53FB1F6A544A07222D0A1FECF4BD05B26657277D511EFFB4F5616DDD0D410B22117F54D20879EDE916F31DB0EF957F7EA11CC130CC5BD081573D2E
                  Malicious:false
                  Preview:BM........6...(...................l...............................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\dnar2.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 9 x 9 x 24, image size 252, resolution 3780 x 3780 px/m, cbSize 306, bits offset 54
                  Category:dropped
                  Size (bytes):306
                  Entropy (8bit):1.1328183347781209
                  Encrypted:false
                  SSDEEP:3:tXIll3/lxFXItDDDDDDP3DeuRtDP3e/AtPC/4tu//n/:9IlHcVVN+A1S4tuX/
                  MD5:7D7AF943C73A95A0FD49716B3198182C
                  SHA1:B05C32D8786516A5466C8012585C315AAE0C5DF0
                  SHA-256:2643D5B1B2457EB8FD3567E19EAAEC65BF44E903045915F894A4139841A03FB2
                  SHA-512:451BBFC8B0B843BDB123620AFEFA6620CE318E83140B98152D43B4CA2C819B87DDE3597472EFABDDBAEF83EC46F065176EC0BAAC5E4E627B0358B0D83C29D044
                  Malicious:false
                  Preview:BM2.......6...(...................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\ffwd.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 17 x 15 x 24, image size 780, resolution 3780 x 3780 px/m, cbSize 834, bits offset 54
                  Category:dropped
                  Size (bytes):834
                  Entropy (8bit):1.1714940829739389
                  Encrypted:false
                  SSDEEP:6:6yQl/pMGXjGXjGXjGXjqjqjqjqXjqXpDXpDXpDXc8EEc8EEjqXpDXpDXpDXjqjqa:wBJKKK3upppc8EEc8EEuppp3KKK
                  MD5:8D1D3276981483A7F0424B8DD1ECC1C7
                  SHA1:BE464865F1258FB5458416DAB79A0D03EFCA6C64
                  SHA-256:70F3265753B38DB7C605B61C075637E77198FBABB93EEE9A33A8A5254F526A21
                  SHA-512:25FA5D5E557B60F195E049C732C5AEAC20D3A6F9848131DA195BB8F40F2E3E67C120BCA2FA844DF9A58A68AE7F51275CF3587C08CD2662840B4732D442516581
                  Malicious:false
                  Preview:BMB.......6...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\form.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 13 x 13 x 24, image size 520, resolution 3780 x 3780 px/m, cbSize 574, bits offset 54
                  Category:dropped
                  Size (bytes):574
                  Entropy (8bit):2.0650927677625583
                  Encrypted:false
                  SSDEEP:6:QclgWtbSXjUUUzjqjDjDcjSXjUUUzjqjDjDcjSX/u2O/d:QU7egUUzlWgUUzlW/u2O/d
                  MD5:D435989158BA89E45EC9D40BBE2CBA20
                  SHA1:DC3B0F329E9768BEEF0622B3B2A59209FF4218D8
                  SHA-256:9D8BBAA3B0D8D9D19FAFA1D8AC16B54516D625ED464A38A8971F3DB9CD5066F7
                  SHA-512:74B87D36A554EEBFECA54C078F1DD38E055B8D8705D4AEF02A4B8ADD5A2A8EAE0500738B45AD8FBA733F410572A6B3D81173E971561BB92E6D35E0D29D2E9563
                  Malicious:false
                  Preview:BM>.......6...(...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\gantry.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 60 x 35 x 24, image size 6300, resolution 3780 x 3780 px/m, cbSize 6354, bits offset 54
                  Category:dropped
                  Size (bytes):6354
                  Entropy (8bit):1.4235889568323037
                  Encrypted:false
                  SSDEEP:48:BVPH77v7Xb7HTfDz7bPfDz7HTfDz7LHfDz7X7fDz7nL7Hzf/7zfbfbfbfTfbfTnq:y
                  MD5:AF58F9E0777C794FAE99F9A34949E01D
                  SHA1:29D3A4BD3BDBCBEB43F91C5941826B345F3924DA
                  SHA-256:705D021D290A55BC83783C2AA8588FC277E5B9DC15808C2E74CB9BFBA1E70AD0
                  SHA-512:0CDE40DFD62917C0CB33F8648324619113563C63A7F50CC78E1A19047ECB436D43DE0B674BADC0111D93455C2DDC3CC68A9FF4C1CE843F51A17C69736ECECC5F
                  Malicious:false
                  Preview:BM........6...(...<...#.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\hand.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 20 x 24, image size 1200, resolution 3780 x 3780 px/m, cbSize 1254, bits offset 54
                  Category:dropped
                  Size (bytes):1254
                  Entropy (8bit):1.0931951602770642
                  Encrypted:false
                  SSDEEP:6:qQcgi09YMnYsBY0BYMAYMAYUDjeYbpeYbCHfffrSY2SvI:qQcnTp3fkkobbbCHfffrSzSvI
                  MD5:44E1680520C6F84473E473B40CCE7485
                  SHA1:55D91B1ABB75F518DBCF627C639BD7BCE21B78BE
                  SHA-256:548F0AF88C18F7DD6F1A8E113B24077A5500469BC4094F021FDFC31CDFC767C2
                  SHA-512:C3F52A0D957008E1F1CAF2B13A69F15B64B5DEFF8F2CCA737DDDF2CE4E0EC390B0F16252ECB6AE9CAF281673D7A75A38C779E7E7BC00C150858767284BEABED1
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\help2.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 18 x 24, image size 1080, resolution 3780 x 3780 px/m, cbSize 1134, bits offset 54
                  Category:dropped
                  Size (bytes):1134
                  Entropy (8bit):1.8796631857723896
                  Encrypted:false
                  SSDEEP:3:SXlPl/+lR7j9Xv/1/l/lXpe//llllllllllllllllllllllllllllllllllllllV:Sqb98EEEEEEEEEEEEE7XA/
                  MD5:C00FDCBF8D3A9758CEA3762DB53B3575
                  SHA1:00CDC3E35930563D549B25F762A52712D7493796
                  SHA-256:16C5AAD746925085DEA46BEF2B9ECF1A02F386952373364D1838D3617CA557C1
                  SHA-512:AF4562632A4225525DDA69304C928E11175CDD40A8770E33D7B706E053C7A90CB04F160EEB234464184BBFF30F65498ED56FE8E0225A790C0123901BBC14BF07
                  Malicious:false
                  Preview:BMn.......6...(...................8.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\help3.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 18 x 24, image size 1080, resolution 3780 x 3780 px/m, cbSize 1134, bits offset 54
                  Category:dropped
                  Size (bytes):1134
                  Entropy (8bit):2.042925725453544
                  Encrypted:false
                  SSDEEP:12:Z0o+4oW04gXXeEEc4zsefyg4z0XenKg4z8zze8KgE4zXKzEecyg4owo:K8PXufuf+ME2vfXo
                  MD5:553106AE838A14383ACBF8789A8F4E95
                  SHA1:25FA7AC864F187C9C0A7A00BC328A2AD859E2217
                  SHA-256:BABEFA6BBF7C557FBA4376FC7EF5D95D68DD7E7D7EBACE233D11E6579F98F4D2
                  SHA-512:1F0F333E6F6886652DA2943B8E5C4B93A6E2B992882D85447DE76C626D86340F098BF27135434A4C07D5C52DC6139F5446720B4730EEC843075184FEE843A07F
                  Malicious:false
                  Preview:BMn.......6...(...................8.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\info.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 768, resolution 3780 x 3780 px/m, cbSize 822, bits offset 54
                  Category:dropped
                  Size (bytes):822
                  Entropy (8bit):1.546260746212469
                  Encrypted:false
                  SSDEEP:6:bAlfrYigyYa416A1VGuu44tI4AI44O6YygiI:Efr/n/e6mIuu44G4V4d6/nI
                  MD5:EF8EFE642EA0F199F18957F386C19F2D
                  SHA1:3313A5D4F8806AD01D706292CAB4F7206EF74972
                  SHA-256:EC3F20FB3FA604F483C7DF38EA2CC020746CF1F998EC19B87ABB897351DA6B67
                  SHA-512:487F5AE99005E19A39FD4EE4DFF94AB6CB4DBCEC1E20AD2EE4F3DA6F8006863A0811CF5A38EDCE3A3D424C0E390B6A476DF77EBF732A1DC8F4A7541FE0187CD0
                  Malicious:false
                  Preview:BM6.......6...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\key.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 19 x 14 x 24, image size 840, resolution 3780 x 3780 px/m, cbSize 894, bits offset 54
                  Category:dropped
                  Size (bytes):894
                  Entropy (8bit):1.1731828737546406
                  Encrypted:false
                  SSDEEP:6:TSlZcDPPP49SPgSY9SP46g9SPASAgHASAgH46ngSvPPP4:mbcDPPPnPnHPf/PHHHHHHfnnvPPP4
                  MD5:C0929C691BBC03F8EBBD545F292F913E
                  SHA1:4C598AA8ECF7D450292F3A81352986CD8F1F2D8E
                  SHA-256:E80186FBDDB250888C4410E041007EDD34F97AE562DF06BCDC8E06D268FE7408
                  SHA-512:41E9152477C7E98F1126A7C2981465406163F4952F6E83BA985039556EB14915FA20177A61E70237DDCB72296B1E3BA230809EBB77AC6F1F508CEB081EC7B6D8
                  Malicious:false
                  Preview:BM~.......6...(...................H...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\last.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 23 x 16 x 24, image size 1152, resolution 3780 x 3780 px/m, cbSize 1206, bits offset 54
                  Category:dropped
                  Size (bytes):1206
                  Entropy (8bit):2.119575812054884
                  Encrypted:false
                  SSDEEP:12:a+tMfsfH///n/nnHfnOdXOsaR31GdWOS7MdbHDWksaR3LbbnmLSHk/USn//nHfA:a+C0HiIR3s9bRR3LkTw
                  MD5:6E1F85B813A763C9A1B22B0C5DC45BA7
                  SHA1:50BF67DB9D9DD7037C3498B6C19DEDFA6BF57B85
                  SHA-256:91ED14BFC2A84E0C7A35C7DF6E1B76BE9F168E525548C4E6DDAAEEDDD83C91B9
                  SHA-512:A1D6996281F0046F35A2C86C7A6E81CEC5BF80799F1E86DCB7169B8B87CADF93F0684E51FE7B68AC8903F9C8664D554A40BB90BEC6645D74C12D39D206DA4B18
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\last1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 23 x 23 x 24, image size 1656, resolution 3780 x 3780 px/m, cbSize 1710, bits offset 54
                  Category:dropped
                  Size (bytes):1710
                  Entropy (8bit):1.9284747768504653
                  Encrypted:false
                  SSDEEP:12:sGtm0GPHPHvHnPPHHHnHnPHHHHnHHvfHvPPHfH///n/nnHfnOdXOsaR31GdWOS74:sGyHiIR3s9bRR3LkTw
                  MD5:8DB076EF8BCFCB4BD1C86B08B9A761E9
                  SHA1:642EA6E3F8837BB54CF771DF7FBC69F87B82BC9C
                  SHA-256:8D188F57D5B34B8C3D43DFE20EE666292CD85E46B3BDC0F8357ABECE23687252
                  SHA-512:37E93B6F3190D7F89B080C48CF5542E4026D87070BCCDFBB042CEFB2F63856BCE6CE6D225E77535097EE2854B7C91C4DEF2C3BDC860EE8EC6203E5FBFCF4E545
                  Malicious:false
                  Preview:BM........6...(...................x.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\last2.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 13 x 13 x 24, image size 520, resolution 3780 x 3780 px/m, cbSize 574, bits offset 54
                  Category:dropped
                  Size (bytes):574
                  Entropy (8bit):1.1630581571723657
                  Encrypted:false
                  SSDEEP:3:QtelglslFlHvFXStDeAaAuDDDDDo/tDeAaAuDDDoa/t3AuDDDXpQDDXpAuX3AuD4:QclgWtg9ktli/F///FbiLtjLjgv4
                  MD5:776F04E243A6CA9BBFE4F1F82D82A9A8
                  SHA1:50541A887A457ABC6382C82CEE5FE9CA37BF2873
                  SHA-256:5F1C64DBA198E016ADBE9B301204DC650D19F6DCDC980A3B1F9FF9D23575CA27
                  SHA-512:7C842E67773EEEC8ADFD9DF84496971640EDDC5D6F76B616CF8F3C878915C7758C88119162E20C0107B724C2C194AF5645A3ABD249AE8FC5E55AF6B68BF6D735
                  Malicious:false
                  Preview:BM>.......6...(...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\left1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 10 x 11 x 24, image size 352, resolution 3780 x 3780 px/m, cbSize 406, bits offset 54
                  Category:dropped
                  Size (bytes):406
                  Entropy (8bit):1.0883792511386838
                  Encrypted:false
                  SSDEEP:3:Zjlml/c/lsFXgtDDDe/gtDDe/atDe/Yte/CA/H/CA/Yte/atDe/gtDDe/ytDDDe/:ml/05AgYagY4CAfCAY4aggYyA
                  MD5:4AC8D45FD76EF058D00AA54A33CEC521
                  SHA1:847F0065FBB3AA91099B999A489E15DD3E2DAEB0
                  SHA-256:C9921692267134AD6109E021A2A403542E786DFE8F9E41CDEFB797698CDE35CA
                  SHA-512:B096EDF3181A4AB10D3C9D8CDCC87BBE88257C83EA64C751DB512F6684B1B6687695912030F6F3450B9B9DCDA62F2BB6F659FCBEB4526870B3DC187F8933BAC1
                  Malicious:false
                  Preview:BM........6...(...................`...................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\left2.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 8 x 11 x 24, image size 264, resolution 3780 x 3780 px/m, cbSize 318, bits offset 54
                  Category:dropped
                  Size (bytes):318
                  Entropy (8bit):1.2563631790067724
                  Encrypted:false
                  SSDEEP:3:JXJl/6c/la7pXotDDe/StDDe/AtDe/6te/4A/l/wA/ite/4tDe/6tDDe/AtDDDeX:ZG0a7GYSYAg644AtwAi44g6YAA/
                  MD5:CBC2E278369C3CB4FDEE676CBFC05F37
                  SHA1:9B1FB38BE89B662DFBAEAE199FB2A77DF9DB84C0
                  SHA-256:F89ED61746D180D7F6F7D7483ACAF014D4FA06650C6C36327FA5A13F7ECAA6C6
                  SHA-512:5EE0426AC439B6C7F19D66270F50D9C1E6F6F68FAD0B6BC0D58BD365C9AF3213FE7E1BA5A63FE3E8E61FF199BC8C2E5D0A55BAEA5360977B8F88338407CBCE55
                  Malicious:false
                  Preview:BM>.......6...(...............................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\left3.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 13 x 9 x 24, image size 360, resolution 3780 x 3780 px/m, cbSize 414, bits offset 54
                  Category:dropped
                  Size (bytes):414
                  Entropy (8bit):1.143626910701697
                  Encrypted:false
                  SSDEEP:6:5MlkK67GgSYY4AgCA64f4Atn4AqA64Q4AgCgSY:5kH6ynvPnHXXHHPPnn
                  MD5:0193DFBA0B2111641159E4648BB856F3
                  SHA1:FB21533F89630BF2E4786FB5C5CE2A8DEAEAA41E
                  SHA-256:721004898E8F34AEE1706B0BD85B5AF8AB442C25B478C2B60B5AF950313C9C3A
                  SHA-512:205E86E396C8A2C2C0E08CF191BAE530CF1C907655EDBA1B9590BEBE006D9B6AD61C84A52A7AFC6825EC7E3AFBDDD5D5AEA9A168670EAA7B1B0F26ECAE8A1715
                  Malicious:false
                  Preview:BM........6...(...................h...........................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\left4.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 26 x 19 x 24, image size 1520, resolution 3780 x 3780 px/m, cbSize 1574, bits offset 54
                  Category:dropped
                  Size (bytes):1574
                  Entropy (8bit):1.0242364554221621
                  Encrypted:false
                  SSDEEP:12:0jN//nnffHH//nnffHfv//HHffnn//HHffnn/:0
                  MD5:224C0CFCE4A76AF33BAFE7B0440826CA
                  SHA1:16327ED158B1A3BF24637DBC3A9D3455CE73B6DD
                  SHA-256:51EC965162A2A2E8A0974F79BEA7451E80C031DB0F1CC5A4E29B84A390EC7BDC
                  SHA-512:047B2FE33B10A296A33AA940C161A3863CF17964E17E9DCB3D637A21158187DB722038D68AA68751F22900AE469D3772236C145D65B2E0A68C5EB638F8B3C353
                  Malicious:false
                  Preview:BM&.......6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\menu.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 31 x 28 x 24, image size 2688, resolution 3780 x 3780 px/m, cbSize 2742, bits offset 54
                  Category:dropped
                  Size (bytes):2742
                  Entropy (8bit):1.9289866592655027
                  Encrypted:false
                  SSDEEP:12:BOflQgYiqqq4gIzQKO/KUFFr/n6RWV8KuXSwauDQbf:Bbfiqqq4fb+Km6R0lwaXT
                  MD5:3B2B0B3D63CAD31316869B80B563AF72
                  SHA1:4BFFA624FF1B1FD9E8A04636DF83841AD2CE88D9
                  SHA-256:24A1D9BAC311336C0ADD3107112857BA0472A331E8EF97CB5B97098C0A39B5A4
                  SHA-512:33B567A18085BC37B66D57F46E1902175668338477E60F797BE7A498C5EBCA5E65B0F60B96C9EF5532C84E2FF9A61F4078EA146BB7A5C0D1EEC5C27184F76CC4
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\mgtr.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 17 x 15 x 24, image size 780, resolution 3780 x 3780 px/m, cbSize 834, bits offset 54
                  Category:dropped
                  Size (bytes):834
                  Entropy (8bit):1.3942556554463703
                  Encrypted:false
                  SSDEEP:24:wJ/3Fq+CVxfrGqq8U4YGJ8WNxq8oGdvQ+H:wJPl49rvtBUGm+H
                  MD5:B29DF01B251726CA7972614B85F7ED49
                  SHA1:2F5573823C7F14C6EA3E9278603309D3D3DBE488
                  SHA-256:6E57BABA31D508DC647AF74AD65016F08A2521566666B08CC0C85C87A625376E
                  SHA-512:3497B3C3EB54ECA74314741029A7D75457E137A0AAF9B6A4D97E9FF83E78DDC491D6349CFC32A9006BC117F3811208F7A853BC5E2E3BED63E8EE0015CE05FF42
                  Malicious:false
                  Preview:BMB.......6...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\minmax.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 19 x 18 x 24, image size 1080, resolution 3780 x 3780 px/m, cbSize 1134, bits offset 54
                  Category:dropped
                  Size (bytes):1134
                  Entropy (8bit):1.213144632120905
                  Encrypted:false
                  SSDEEP:12:PfcEIPnOJ6HIPIPIPXbP/qqKySqqqqqqqqqqqqqQ/fqKSPqFP6P6PgH1OJ6:Xt9j/qqKHqqqqqqqqqqqqqofqKxL
                  MD5:07BCC1CB160F8301E4A2C0A12ECB3F35
                  SHA1:F396936DD1E719FADFC7AE9F8A48ABE6C3C44ACB
                  SHA-256:F9E46F46B3BBF01E62D140FA0C0EE9017F71DFA17656CECA0897622F85F80A0E
                  SHA-512:7A91A64D437FE1D809EEA7F0394F04A2E2548F585B71ECE4A3B5CA7BA0BDBFA38B98F8EB00773DE092025547DE82EAE9FD77755EF780832EA61C116BA824F44F
                  Malicious:false
                  Preview:BMn.......6...(...................8.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\msge1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 25 x 25 x 24, image size 1900, resolution 3780 x 3780 px/m, cbSize 1954, bits offset 54
                  Category:dropped
                  Size (bytes):1954
                  Entropy (8bit):1.8343201997159895
                  Encrypted:false
                  SSDEEP:24:85rfPb7v/LL/v7bPfrrfPt/f1FNpVVtZ1lNJV1t51FN2:wrfPb7v/LL/v7bPfrrfPnXHXHXHXHX2
                  MD5:DD164EFD3E53737873F067701C4C1820
                  SHA1:CF09CD759BC31FB8CE295F501C27ABD6898A7389
                  SHA-256:D6813FBDC062477DCD1B3A9682D9029B58D9498B954E09A0C4D9893DBF7F08F0
                  SHA-512:26AE74E837E3970C15BF24C5DA2D971DBD312AC2ABBB126807679254699C272E2DC33B3E9004F0DACF0D3CA11893EEEF8D45D65EAAF97951DBF615CD8EF66BC6
                  Malicious:false
                  Preview:BM........6...(...................l.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\msge2.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1140, resolution 3780 x 3780 px/m, cbSize 1194, bits offset 54
                  Category:dropped
                  Size (bytes):1194
                  Entropy (8bit):1.1357279535595182
                  Encrypted:false
                  SSDEEP:12:G6EKAPvvBnRP2SHQavhnzPmSAKmSH46PuynQav2SHRPBnvv4:GJ0
                  MD5:75C7B1782FA6A611830562D8E8A439A7
                  SHA1:62E46B0ED24342B5E18B5E622A261B7B3F5DD799
                  SHA-256:1DA37FFB919E4F4901BD8DA59F893EB726B662B8B58E29A8F0C747332BD57DC9
                  SHA-512:7B5432A4B75437EFC36B59C3EA635398C55938FF4236EC230302F4D6C2E50DF003AF6A994418FAE9EA3E271DCDC4E83476597DDF32645572889013E2B6B867AD
                  Malicious:false
                  Preview:BM........6...(...................t.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\msge3.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 19 x 19 x 24, image size 1140, resolution 3780 x 3780 px/m, cbSize 1194, bits offset 54
                  Category:dropped
                  Size (bytes):1194
                  Entropy (8bit):1.1101842762429661
                  Encrypted:false
                  SSDEEP:24:GJnqxqqqZ3hq3qJqqqqqqqqqRqqqqfqqqq5qqqq3qqqqBqqqqq3qqqqqRqqqq3qL:Y
                  MD5:E9F2388AB2DA986A6C4BD42CD7A7BB9D
                  SHA1:67B9AD4F308B3AEE7C81104E7E84F338301E3268
                  SHA-256:260EE553EE9F01AA1E5EE15CB7AD94A5C147191CBCAC52C8BAE0F78EA90E610F
                  SHA-512:15E3FB7D2608D8575324CC5F0C8CDDD8DE84FCBA629B10AD7B1DC608082CA105308D8B9EA9280EF63FB698CE28CDC0E8A79CE6BFDA8C36FD133956286B3640B3
                  Malicious:false
                  Preview:BM........6...(...................t.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\music.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 11 x 15 x 24, image size 540, resolution 3780 x 3780 px/m, cbSize 594, bits offset 54
                  Category:dropped
                  Size (bytes):594
                  Entropy (8bit):1.22200774431608
                  Encrypted:false
                  SSDEEP:6:qlal/pB4YKgKYqnHPH4SH4SH4SH4SHAAAqAAHASPASPHg:Uatpu/nHnHPHfHfHfHfHHPHHHPHPHg
                  MD5:DB82FBF9534C82EF8C1B6A923B5EC801
                  SHA1:9C18ADAC555E1865AE8B15CF6EEDDC6B491B390F
                  SHA-256:66FABF094FD1B6DED403D858E25A1803AD5BFBA6CF73FB0CC8D8F92B16C86A7A
                  SHA-512:EE9BF872D533B3BCCE7B55FE4A2B08DFFE4AC80C05D0F5BC5F3C1A414EA32635BEB3E0AA03133362371550450BEF3561511BDD8E9C254C285FB10F73E4E65536
                  Malicious:false
                  Preview:BMR.......6...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\next.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 22 x 21 x 24, image size 1428, resolution 3780 x 3780 px/m, cbSize 1482, bits offset 54
                  Category:dropped
                  Size (bytes):1482
                  Entropy (8bit):1.8654223347529606
                  Encrypted:false
                  SSDEEP:12:ZxhHH/n/H/n/H/n/H/n/Hmak67o/bo/bo/bo/bo/bo/bo///o:5/f/f/f/ftYssssssw
                  MD5:C3FAE19ADEBA0B1EB7537D89EA6F0AB5
                  SHA1:D58F6636CD42435F8713EF5C689B2FE84B425A23
                  SHA-256:7E276B007435C352ED270725E077BC88B4A3603D50806088DA16800AC8045F69
                  SHA-512:746F8E4C27782BA55513F4880A19E8263D8EAF7F0D8E86696E46D6A080C8D3F2FEC67D213DEF5F65575A61376F39FF7E251EE162493B0EE25DFF47264C76B472
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\next1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 22 x 28 x 24, image size 1904, resolution 3780 x 3780 px/m, cbSize 1958, bits offset 54
                  Category:dropped
                  Size (bytes):1958
                  Entropy (8bit):1.7717230770293209
                  Encrypted:false
                  SSDEEP:12:OfGwHH/n/H/n/H/n/H/n/Hmak67o/bo/bo/bo/bo/bo/bo///vPHHPPPPPPPnnf4:5Q/f/f/f/ftYssssssw
                  MD5:2B7022D66E32AFEDFCF8614A0DA95A74
                  SHA1:C587B84B6380BB80C561460A00122DCFA1154DD3
                  SHA-256:AB67C8A7A20D205B32481C3FC043F4FF0DB368109DD34FF001391002F0828564
                  SHA-512:30052FBDF0DFACD6CE56F8F1F286F367E552CB852C75B1A6708BA8CA4E667C22C6624C235CBAFF8DCBB6BCB39362BFBF1524F8EB1E602A81EAF4E7B552B1538E
                  Malicious:false
                  Preview:BM........6...(...................p.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\note.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 768, resolution 3780 x 3780 px/m, cbSize 822, bits offset 54
                  Category:dropped
                  Size (bytes):822
                  Entropy (8bit):1.3205953730797932
                  Encrypted:false
                  SSDEEP:6:bAlfrArUX7eX87DXBeX7eXBDX7DX7BX7nXpsX7UX7DX2pDXpDX7UX7njnX7nXgXx:EfrnK8P0KxPNzqAP2ppA/zgLAPXm
                  MD5:E0F1D141ED31EAED6FE901D3218ABA83
                  SHA1:A2FF8BDC5D36AC19B6E0B0546E0E694715A5266A
                  SHA-256:CCE8CE6B2DF7557FC1D027C0CBCEDA19F6D281F1B66486D91D6787D24552AF8A
                  SHA-512:BEBB4858E7336E525FCAE1271EDF9C936FD7030800BB7A6AC7702314265FA3C92C98AB0B04BE69BE56CA0648559832679A0CDD8520206EC617BC0DDBEE99E6C2
                  Malicious:false
                  Preview:BM6.......6...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\open.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 15 x 14 x 24, image size 672, resolution 3780 x 3780 px/m, cbSize 726, bits offset 54
                  Category:dropped
                  Size (bytes):726
                  Entropy (8bit):1.5362068880656239
                  Encrypted:false
                  SSDEEP:12:pQQnTgZXrXUqXrqqqY5qqqcGXwvnvn3vP4:pS7Eq7qqqMqqqx1
                  MD5:B9E10D40513EEFAD534F9D458BED3475
                  SHA1:C3FC73F98FE5527355DD2A3A348D928AC81CAC3C
                  SHA-256:AACC46AFD6818EA3AAC0B180AC883D8754B247C027A4794F45EF9DF271593754
                  SHA-512:9987FBC65C5EAB6E35852FAA774BC7F19B6D3B0CF32EC095273B326872AE6FAE866A6EE61981F4D7527C36EBAC4BF6CA2A69F6EDA7F4E862DCA5B6ABEBE99FC6
                  Malicious:false
                  Preview:BM........6...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\pen.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 10 x 19 x 24, image size 608, resolution 3780 x 3780 px/m, cbSize 662, bits offset 54
                  Category:dropped
                  Size (bytes):662
                  Entropy (8bit):1.1943688618143287
                  Encrypted:false
                  SSDEEP:6:/lst6iwiFawAAKCw4o4yAgYagQ4sAqAq/vvv/QOwitRtwAfqqK/4JtS//gSg:/lc67tfH/fJvvHvv4Z2RKaqqK6AHg
                  MD5:3D2A7740D1B99EB681BFEB409C4ECA8D
                  SHA1:537A72978539BF36A801AA3D5DC78B8BF91D0460
                  SHA-256:D911CD6360FA0D710C3DFCF08BAACA6F4C02FAB008A241297ED57BE4BA5B7697
                  SHA-512:033930C19B9254CF82B487B5A16B69EADB77D0F0240F6A3F90B51779F6FEB29CCD41FE558A025DD4A279AD70338BFBA49B41E54E1334269DD24F4CF7487CACC7
                  Malicious:false
                  Preview:BM........6...(...................`...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\prev.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 22 x 28 x 24, image size 1904, resolution 3780 x 3780 px/m, cbSize 1958, bits offset 54
                  Category:dropped
                  Size (bytes):1958
                  Entropy (8bit):1.8404396044382145
                  Encrypted:false
                  SSDEEP:12:OfGwfn/f/f/f/f/f/f/f/qIkDQcjYcDgcjocDwcj4cDAc9fnvvnHvnP3Hnf3PXfw:5KnnnnnnnNkUHPXfnvB
                  MD5:687CC86B50139E5B4BC9A1C903DCFB37
                  SHA1:146FB3E178F3815B43C1B76A527857657C3CE80C
                  SHA-256:81634D3A3459A3FF97AC15AF469B175F9A42B4313EAEF724ADF6BF4709A489CD
                  SHA-512:7146D5113426017E718B799B00B6CAF04AD2966F5B515E608309BFBF6D72847E1917732BADAEB1CB27CF69E3310392DDA542BEF788CB76EC4566E490E0C4E3C8
                  Malicious:false
                  Preview:BM........6...(...................p.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\print.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 16 x 14 x 24, image size 672, resolution 3780 x 3780 px/m, cbSize 726, bits offset 54
                  Category:dropped
                  Size (bytes):726
                  Entropy (8bit):1.171565583100651
                  Encrypted:false
                  SSDEEP:6:4q6Ag0YARrBX/XRX3RtY0BRRYD86UBYDrsBY4oA:T6Hz851YLD86/Dr3PA
                  MD5:C795F9496B59639D31A44A9AA5D2EB6F
                  SHA1:89798284A2C6C339FB9E7E9A499D02D878D39B3E
                  SHA-256:DC2A59088C25163922EA6797C283C1E1E6A8E13C09CC2074DA18D74A80731DF2
                  SHA-512:7D243F726ED60FA8634BA849D46CC85D00BFBE0ACD6968FCA61C5F91F34A0C645BC0B863E09BEF56B72A5181BD21BD808E2A8E9560457438F0795B14E87AA129
                  Malicious:false
                  Preview:BM........6...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\samples.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 24 x 25 x 24, image size 1800, resolution 3780 x 3780 px/m, cbSize 1854, bits offset 54
                  Category:dropped
                  Size (bytes):1854
                  Entropy (8bit):1.369961315707911
                  Encrypted:false
                  SSDEEP:12:zsGHHHvHvnnnnvHvnnPnHHnnHHnErrrpBr62fcs1sP+R9:Q
                  MD5:FED075F36A54972183C68CB57A34B8FC
                  SHA1:5D998231E6965B65B1C250A36E0F516504D0E42D
                  SHA-256:E430785D6A66983ED22BFB280C7353174E43367FFE2618DE3974F70AFE0730D8
                  SHA-512:CCF83090C4DFEF233DFFE6D34EB02C8F2C52EE52EB6C9D9B4E236EEE055767D595119F57B0601E10A4C026F8E38962FC5CCDB2DE4677B3ECD4DE8C1755A7E906
                  Malicious:false
                  Preview:BM>.......6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\scr1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 26 x 31 x 24, image size 2480, resolution 3780 x 3780 px/m, cbSize 2534, bits offset 54
                  Category:dropped
                  Size (bytes):2534
                  Entropy (8bit):1.1438359474402144
                  Encrypted:false
                  SSDEEP:12:zdqY8I8TL8OnvkshtlVOECahtkshtkshtkshKLjiBjj2KhK2KPpo/Lpo/Hpo/T2a:AhOeae1pJ
                  MD5:64DDA02248227830A18418C013BE2A6B
                  SHA1:A766C70119A5AA3087A4B58F02BA975E635536FA
                  SHA-256:5A108EF8E502F5625AF43E7318D6B2CA5064BA2525D5C46CC104FF1BEFF053AE
                  SHA-512:9A49F8F28FF4AD54F4DDC4FA6EA5A56E7C49951D0B021D1AC1F049CC982A450056E486333B2EF0203217A8C12005A80C6AD21E423BF4454BB956FADAABA36C73
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\scr2.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 26 x 31 x 24, image size 2480, resolution 3780 x 3780 px/m, cbSize 2534, bits offset 54
                  Category:dropped
                  Size (bytes):2534
                  Entropy (8bit):1.125703465342315
                  Encrypted:false
                  SSDEEP:12:zdqY8I8I8nvkshtlVOECahtkshtkshtkshKLjiBjj2KhK2KPpo/Lpo/Hpo/T2o/n:AVOeae1pJ
                  MD5:217FF1759E8D04A6DC30B4C86978F112
                  SHA1:60394591EC872735794F089BE5A52DCE96CDCF98
                  SHA-256:2F690DAEA7303D3B82A3E95BCD43CB83033C7D60316F741FE1935BFCCBBE45BB
                  SHA-512:16AFE0804279E4E7FCAD7E18ADDCCFF1669C1D0CA72055DA6F426051D3E19F9021D415D408555687960B5F29EC500076FEB9B7C37E8A884E4510BEF4A41804DC
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\scr3.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 26 x 31 x 24, image size 2480, resolution 3780 x 3780 px/m, cbSize 2534, bits offset 54
                  Category:dropped
                  Size (bytes):2534
                  Entropy (8bit):1.1007804487900275
                  Encrypted:false
                  SSDEEP:12:zdqY8I8I8g8g8g8thtCAdhCAhttTAvo2KT2KPpo/Lpo/Hpo/T2o/P2o/rSfo:AxBeae1pJ
                  MD5:BA6730862B8DFC8E6A6FF76E75FEF1FA
                  SHA1:B1E04CA7F14EFE852085B63C87F526C767365441
                  SHA-256:E32C06BC046A1B7E402E86B2AD1A3DC246CA49A2A10C93D417EE4DF1BA54F98A
                  SHA-512:4FD19A8E5443CD0177FBFBB6579C810E5029F9844D42911A3989222C241018BA255C1452D949532993C574EB008967593749469473CD43816EDE24850CCF6076
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\scr4.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 26 x 31 x 24, image size 2480, resolution 3780 x 3780 px/m, cbSize 2534, bits offset 54
                  Category:dropped
                  Size (bytes):2534
                  Entropy (8bit):1.1007804487900275
                  Encrypted:false
                  SSDEEP:12:zdqY8I8I8g8g8g8phtQSdhQShtpTAvo2KT2KPpo/Lpo/Hpo/T2o/P2o/rSfo:AhBeae1pJ
                  MD5:704CC9F96E0C9BE7CF0E8085DE972E5A
                  SHA1:5BC4BD26A1A3CA102A8EBFD3EEF261C68DDC90D6
                  SHA-256:E0455D6D789073D91733516EC4B2F4F29CAE206B7E85A50FB98685130FC6CD60
                  SHA-512:EC6B2541FEB12BBD55247CF14F0E7869A5A1752B05C404F15FD46F869518D48439DDA30DF6E5C1A20A02B6774C5375A04F25C5106BD15AF1EC79664C75E90016
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\scr5.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 26 x 31 x 24, image size 2480, resolution 3780 x 3780 px/m, cbSize 2534, bits offset 54
                  Category:dropped
                  Size (bytes):2534
                  Entropy (8bit):1.1438359474402144
                  Encrypted:false
                  SSDEEP:12:zdqY8I8I8kshtkshtkshtkshtkshtksn/lVOLLjiBH2KY2KLcpo/URpo/Hpo/T2a:ANGdFe1pJ
                  MD5:EDBBD46856DD7EC51DAF392AB580919A
                  SHA1:AD617E182D6B37E508F02D43ECACF6A843008BC1
                  SHA-256:2B225CBEBDB001953371D268EF8B848BD6D229D0B9D1091BF5EA10E634D7AB8A
                  SHA-512:879A994091F2E0BED0D27C9AE0F1877609791AD9B425A352A55620FCA63560D8D64C23689C314CCA7ABB37EBC3495045CF1EDB88E210C9914A9DE8C613D4935B
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\scr6.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 26 x 31 x 24, image size 2480, resolution 3780 x 3780 px/m, cbSize 2534, bits offset 54
                  Category:dropped
                  Size (bytes):2534
                  Entropy (8bit):1.125703465342315
                  Encrypted:false
                  SSDEEP:12:zdqY8I8I8kshtkshtkshtkshtkshtksn/lVOLLjiBH2KY2KPpo/Lpo/Hpo/T2o/n:ANGeae1pJ
                  MD5:E06F9127C3AF7E0533636BEDE3B9D448
                  SHA1:B2B358762605635EA21A63DD1A2ECAD3CACF63BD
                  SHA-256:23909552897CB535FE4DDFA2DCD5C559F75AF9AA1EA3F0A5762B04019F37DC9A
                  SHA-512:74347C51B9A43619E9EC8A66D1FF7F2FE2B1D5ACF63D5B89B7547827BA272118F35DF0AF4AD558845E6DF5333D566A296C94D5EC7CCD4273D5D801D4E27A55CA
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\select.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 12 x 14 x 24, image size 504, resolution 3780 x 3780 px/m, cbSize 558, bits offset 54
                  Category:dropped
                  Size (bytes):558
                  Entropy (8bit):1.203656466468881
                  Encrypted:false
                  SSDEEP:6:g2K7mP4AqSqtPRt3Rt3Rt3RtvRSqSApSPg:fKSP4AJOzrrr8JhP
                  MD5:B33F97252A39C41E4563A6D7DAC83121
                  SHA1:146507CE991FC2E8B1569AC60F3ABC1F07A7C71F
                  SHA-256:4F95686A694C4FB8436F1C69D3CC479BEDB3981F9A0C72068AEF935ACA0BC2E1
                  SHA-512:5D483DC36376EA8A555200BCC90553A8F6305221B6FDD230C46DB0B630F8C41A4C5A7187340C3A77A36F43E48FCCF50909672BB510DFF846DFE127F14B392EFE
                  Malicious:false
                  Preview:BM........6...(...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\shutdown.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 110 x 47 x 24, image size 15604, resolution 3780 x 3780 px/m, cbSize 15658, bits offset 54
                  Category:dropped
                  Size (bytes):15658
                  Entropy (8bit):1.9860645162915107
                  Encrypted:false
                  SSDEEP:24:VInBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB5BBBBBBBBBBBBBBBBBBBBBBBBBBBBK:bN31Z1X1lX1Hr1tldhZ
                  MD5:AAE5383E2E37AA67793C6EB0CC7BE21E
                  SHA1:CD4C1A847919C32757C0BC0CE9D6B8BA9CE6F6FA
                  SHA-256:A415B7E9A63BE4BAD41F6A98E7F7FFC9343A063848FD727584C6D4F5405B482B
                  SHA-512:EC2B415EFC4A5109324481582EF450DBF2B3A95D2636A1A9469D1941A9DD19AFE75223C998A78957F51C41EB2FEA69FC2E37256DD462C7FF5F441F5E2C884362
                  Malicious:false
                  Preview:BM*=......6...(...n.../............<....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\skew.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 46 x 39 x 24, image size 5460, resolution 3780 x 3780 px/m, cbSize 5514, bits offset 54
                  Category:dropped
                  Size (bytes):5514
                  Entropy (8bit):1.9079491036716874
                  Encrypted:false
                  SSDEEP:24:2dAwnVQuGXy17+6ePeeKM2lY2wAw4faRyuItFt0Rtd94:onVQuG47+D7Kyyuer03f4
                  MD5:52874239D571518BB4BC9686FEF894EE
                  SHA1:BE78F8A6416D735B8CE8574184A270D31D1007BA
                  SHA-256:C9EB603DD216DDB315C6DEC426FAEFEBEA4AA1271534959A74372A640B839FB0
                  SHA-512:1AEA64BAF2AEA84890F7DDE6A211C7E27B34993AC50CD6F4B8A6B972FE72A0DA5ED4B0685A764D9A16B1ABAE2DB0A1213E2DB380C413E008E26BA252E12E6EC7
                  Malicious:false
                  Preview:BM........6...(.......'...........T.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\stop.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 768, resolution 3780 x 3780 px/m, cbSize 822, bits offset 54
                  Category:dropped
                  Size (bytes):822
                  Entropy (8bit):1.1629421623847787
                  Encrypted:false
                  SSDEEP:24:ELqqqqFqqqqqqVqqqqqqqqlqqqqqqqqqq7f8O59qqqqqqqqqqlqqqqqqqqVqqqqO:x
                  MD5:7D0A22CA520CF9E462F36E3C2A41F949
                  SHA1:CFACFBF0504777A84C265EFD4ED642A79293C398
                  SHA-256:3E80EE7D463640694F2729F8BFD075358ADE75C79B78821F2C26663C7E63E2F4
                  SHA-512:8172EDCD975759D328A202577BDC3CFE14FF265161AE320F5CA11443121A57545D2BF8350FFD90ADD4ACEE1990A8A2C3283B94C40569C32BAB8639B2EE64C6CB
                  Malicious:false
                  Preview:BM6.......6...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\stop1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 9 x 9 x 24, image size 252, resolution 3780 x 3780 px/m, cbSize 306, bits offset 54
                  Category:dropped
                  Size (bytes):306
                  Entropy (8bit):0.44758808848902243
                  Encrypted:false
                  SSDEEP:3:tXIll3/lxFX:9IlH
                  MD5:29964BE6AAD440758AF3A9399A79AC38
                  SHA1:BA6D450543AA32803371B6757F2B92DFDCFDC714
                  SHA-256:BFA3CBA1734A46D8F61C9E57A7B773E366B503E9EF0DC81E4A6C0E9F7BB1A09E
                  SHA-512:F3E0EBC048BC4F0EE3A29B2F2062712A89FFEB99461D639C9B595B53775F81E762CBFBC61B73B9B9487E930E2371CD04D15C1097088025DDCC97391E5BE7F418
                  Malicious:false
                  Preview:BM2.......6...(...................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\tag.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 41 x 28 x 24, image size 3472, resolution 3780 x 3780 px/m, cbSize 3526, bits offset 54
                  Category:dropped
                  Size (bytes):3526
                  Entropy (8bit):1.2487400739321932
                  Encrypted:false
                  SSDEEP:48:NPLrLrPfPfPfbbbbbb/vrLrLrLr3Xrzrm//b4/a/wpdBK/C:J
                  MD5:8542FB5520048BC344565FDEF82A9C52
                  SHA1:43787BD304C9E3630D9EF9ECCC42E1258169DDC2
                  SHA-256:3F4625EE33FC9C9143A4B64AD253F039EB453C3B01855BB23410F9FF2FB56059
                  SHA-512:A8112A33C006FF281BD9800BD14C352B7A40CEDEE1636D26BF5BBEF0CF1564DAC19103AF07CFEA911E2C0E05C2B31792249A1DB91FC8A981D657F6C0A36A5231
                  Malicious:false
                  Preview:BM........6...(...).....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\tagview.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 41 x 31 x 24, image size 3844, resolution 3780 x 3780 px/m, cbSize 3898, bits offset 54
                  Category:dropped
                  Size (bytes):3898
                  Entropy (8bit):1.8247174191939823
                  Encrypted:false
                  SSDEEP:48:rsfXfXf7jf7jf7jf7jf7jffXffnPf3/HNLz1vP/bbpbDDf/3f/vP/XP/JP/lPD27:ro4
                  MD5:4C98E95594732CEE4F7A058603726E12
                  SHA1:871D6B6A2EA298CAABD24D0DDDB1E90D6EB4B298
                  SHA-256:1B72F589A8D0FAEABAD6A53B11FE5AE4A6467CBE324610C2E416078844DEDFED
                  SHA-512:1AF663BFBA5DC219B474462EB681105368FE5295B023B03F9C47CAB9792385A3461ED62C3E1A1A008033FD1EC5A0CA8E4DA05A1EFA0A000E7C32042A6FC35E2E
                  Malicious:false
                  Preview:BM:.......6...(...)..............................................................................................................@@@......@@@................................................................................................................@@@......@@@................................................................................................................@@@......@@@................................................................................................................@@@......@@@................................................................................................................@@@......@@@................................................................................................................@@@......@@@................................................................................................................@@@......@@@................................................................................................................@@@

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\tick.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 15 x 12 x 24, image size 576, resolution 3780 x 3780 px/m, cbSize 630, bits offset 54
                  Category:dropped
                  Size (bytes):630
                  Entropy (8bit):1.3885136403900908
                  Encrypted:false
                  SSDEEP:12:JWaV4Rl5NA/qWRlF1A/qq4PtA/qfWRlA/qWRlPA/WRlAqWRlfqWRlv4RlZt4Rlls:JZ4DTA/qWDTA/qq4A/qfWDA/qWDPA/Wf
                  MD5:16ADE7801D6579B445B906CD8BBEEC86
                  SHA1:C3F8F6FCA9FE7996E45EC577BD2AB38BE90CA0EC
                  SHA-256:9CEA2DECFAC73391CD9855CF539688A7576B153EB2CC08767911027D06B4379A
                  SHA-512:32F33280AD5EAAAE0C23F44965B67FB3CDBFD65458B38AA42B4711326EDDDB4E6A625D39EBFA5F479C23AFCD4FEB2468846E75505BA25C75746D50CCDEF26DD1
                  Malicious:false
                  Preview:BMv.......6...(...................@.........................................................................................................................................`.....................................................................................................................................................`...................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\tmbs.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 24 x 24 x 24, image size 1728, resolution 3780 x 3780 px/m, cbSize 1782, bits offset 54
                  Category:dropped
                  Size (bytes):1782
                  Entropy (8bit):1.211464259549414
                  Encrypted:false
                  SSDEEP:12:kYePnHnH/nffvnHnHnL/q9o/6goNgmXgVRg37gAVgSfqNR9:kjBxocBJ
                  MD5:9B639F915ABD71492C0CA13064BF17FE
                  SHA1:A38663C407008559367D330FC537141939F9DBB1
                  SHA-256:51717B1A1D28972168DA038364D9264B9398B44B59FB1D82A4F5ED8F75FCFC6B
                  SHA-512:38FA6653876B17965AF713A4A5B7EFB1C7380A681AEB09ECA46F7F34F6E2478EAF4603F626EE36CA98A165ABBB360B61E676DB906D1BB4B43EADF8C870C5BF05
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\to front.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 19 x 18 x 24, image size 1080, resolution 3780 x 3780 px/m, cbSize 1134, bits offset 54
                  Category:dropped
                  Size (bytes):1134
                  Entropy (8bit):1.4539895549172845
                  Encrypted:false
                  SSDEEP:12:PfcUPPHH//H//Hn/HB4/HB4/HB6HGv/Ov/Ov/OvHv//HHHP4:X3nP22388eo
                  MD5:2A921759C3D472D95E1E7A1BC1141A36
                  SHA1:1CDDC60B28E3F27F0BE30903A7BE7B79BA1EBCA0
                  SHA-256:734AB11C63DFC7346A3056032577383549FA41B7B153255A12B5534EECEA3791
                  SHA-512:6E2203BBC5F2545FE15870BD27DFCEA80864892601276CBC6605152295EA18653943A2E5F221365AE2E3FC14A6AB5BB0B553170285B9BD6DD7441AF567801613
                  Malicious:false
                  Preview:BMn.......6...(...................8.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\trend1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 768, resolution 3780 x 3780 px/m, cbSize 822, bits offset 54
                  Category:dropped
                  Size (bytes):822
                  Entropy (8bit):1.1715753470773365
                  Encrypted:false
                  SSDEEP:6:bAlfwUXsFX5/pBjDXpDA/pnTpDXy9KuuXw1QXmA/t7DXXt5sA/XtMXGqecnNRA//:Efrk5vAptu5Qr9TMhN5hAPN/11
                  MD5:F675BE194E39514D716B9D26D9512FA3
                  SHA1:1FDB146C0ECD4782A44C9912B022249D7AAE3D8D
                  SHA-256:ED5F68417328909C00D274B4DB8A4D47D44E0DC8E21F433B357C734ECCDBF8AF
                  SHA-512:96CF81D2A03E74B5766DC4FD2A33C50A377294C8CEE6FE14C3EECF130A4A51459D62163D685FED41C5F22D022208E0633829181B42EA29BAC57C4E6AD50B84EE
                  Malicious:false
                  Preview:BM6.......6...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\trend2.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 20 x 24, image size 1200, resolution 3780 x 3780 px/m, cbSize 1254, bits offset 54
                  Category:dropped
                  Size (bytes):1254
                  Entropy (8bit):1.1299965338630025
                  Encrypted:false
                  SSDEEP:12:qQcH1OnuIutndAuZ3GXmnn5ScHdJtFjUzmsnA:qV
                  MD5:B26898BB6E2B93DC115EA98B3735C5CC
                  SHA1:57426993154C130F697B04BB468CB15A36349B5D
                  SHA-256:96BF0100C4542734AC0EDA63DA91EA136E5FF7A71A6CDD1AC108A15FEB186977
                  SHA-512:F1702C9027EE4F149BED293C24B01F4E29235D358F0523DFA567886E156883B3C9AA1BF0BE420DAE4CEF22B3FFE1445B211E803640C0F342F53AC3B2BD36B450
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\trend3.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 20 x 24, image size 1200, resolution 3780 x 3780 px/m, cbSize 1254, bits offset 54
                  Category:dropped
                  Size (bytes):1254
                  Entropy (8bit):1.1303534350938074
                  Encrypted:false
                  SSDEEP:12:qQcHH/JYYnup+utndKH3wHEnHnH/VScuSmJZ8kjKqzwQnHA:qp
                  MD5:76028DA0B9B3FF2F42C2CCF4167A2424
                  SHA1:EFA87D4407E858616B4893B44B7DDBE144A528EF
                  SHA-256:775131F702FA3698379D155502ED729F855E5E01543802F12A0C28AC627651D7
                  SHA-512:F9A4F0DCBC09CFB4BA5EFDF9159B46A26FD61098188009F23FFD3C9946F2D74B9E40644E86584A9A8FADF13052F5CD6DED59BDE41B1AE8C7D31D9B293154F220
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\trend4_1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 32 x 32 x 24, image size 3072, resolution 3780 x 3780 px/m, cbSize 3126, bits offset 54
                  Category:dropped
                  Size (bytes):3126
                  Entropy (8bit):1.6212602774458815
                  Encrypted:false
                  SSDEEP:3:Shl/3c/l7XFFttttttttttttttttttttttttttttFtttttttttttttttttttttt6:/gsI8yIwtsu4NIyIwtsuUNIAAAAXsX
                  MD5:53C0B00BBFB5C638576968A6F76A9790
                  SHA1:B55C7CE7EEAC767089A01BBD8C8313296A401E57
                  SHA-256:E5A79ADB978FE734F55D6D78F3840674A27DA76219ADDEA426148518BE6B97CA
                  SHA-512:B9E87FBC63624562015B84F4726D7424FD45D0D86CE05D796C6FF3717447D6015FE681D6DC5A498292EB19E71E691A3076B4CA07A1BAD71DBCB2915E8E0B93B9
                  Malicious:false
                  Preview:BM6.......6...(... ... .................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\trsp.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 24 x 24 x 24, image size 1728, resolution 3780 x 3780 px/m, cbSize 1782, bits offset 54
                  Category:dropped
                  Size (bytes):1782
                  Entropy (8bit):1.3112627758554602
                  Encrypted:false
                  SSDEEP:12:kYEHnfH/HnHHW6czQsTwhKyJ0vWebOKgzSMp999:kzMBg
                  MD5:22A9997EA3C6C06E741F73365914628E
                  SHA1:DCB6F37CBD8F061BB21D9E4CF5005C4EFD8C5BF6
                  SHA-256:D54BBAFD0E570F86A1DCA3836C26E7C594569F2489412E11761CDC8D532AFE6A
                  SHA-512:1AB93C4286CC9FEC4254074D7515ED7DAA320FD894B44AF31E028140743409E08CF344280ED8EEA0B3AB5F68FAA2A72E1325A8DFF19F4184F3157CAD487D8FCE
                  Malicious:false
                  Preview:BM........6...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...............................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\unchecked.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 13 x 13 x 24, image size 520, resolution 3780 x 3780 px/m, cbSize 574, bits offset 54
                  Category:dropped
                  Size (bytes):574
                  Entropy (8bit):1.8842772181177299
                  Encrypted:false
                  SSDEEP:6:QclgWtpUK5Q8AUQ8AUQ8AUQ8AUQ8AUQ8AUQ8AUQ8AUQ8AUKO:QU7pO333333334
                  MD5:4A91E108F2486D7C8326BEBBB5BE5426
                  SHA1:C83F97072FB4BAFEBA45C8C988F1B58C91F19681
                  SHA-256:AA8B46012C7D7FB25EE59A1A0D540C2D10CF1EBDAD34573ACA54887E3AF24C3C
                  SHA-512:FF16529F380DB86E9DC759A47AC1910BC144D8AA1BB3E6A9A74B33565F9276B0B37344DE95E92DF1D8E13786958452E96D9D13CD524E1955F336695FB5F767F9
                  Malicious:false
                  Preview:BM>.......6...(...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\up.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 9 x 6 x 24, image size 168, resolution 3780 x 3780 px/m, cbSize 222, bits offset 54
                  Category:dropped
                  Size (bytes):222
                  Entropy (8bit):1.223305727510799
                  Encrypted:false
                  SSDEEP:3:2IllQlNFXP/GC/4t3e/AtP3DeuRtDu:xlmPGS4t+A1Vg
                  MD5:4F52C551D16F78F334748EE2EE0E6AFB
                  SHA1:410DF8E13689ABB7244984344D7A59DE76E25F58
                  SHA-256:77DD1FFAAB8B1D67577CE668E5D89B2E088412650121A084595407AA47B5AD23
                  SHA-512:97335E6C9A77B2E0257303E6AD31E7A31C17765B8CE9A6DAFE609261B5585819934A9442C12C189A3C8D78F1D7261B40554CDF92AD7E074DD95D2C8131324186
                  Malicious:false
                  Preview:BM........6...(...............................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\up1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 9 x 13 x 24, image size 364, resolution 3780 x 3780 px/m, cbSize 418, bits offset 54
                  Category:dropped
                  Size (bytes):418
                  Entropy (8bit):1.1371045476016872
                  Encrypted:false
                  SSDEEP:3:vllCllC+lFloFXP/GC/4t3e/AtP3DeuRtDP3DDDDDDe/X/GC/4t3e/AtP3DeuRty:vKlhtCGS4t+A1VNOvGS4t+A1Vg
                  MD5:7B7E1AC2A454F76C22242961C5975EFB
                  SHA1:69297134F50A31632424CFB34135726F80B485BC
                  SHA-256:86651B56B93A3ADE6FB0ACB7A318D9A0C1A7D08F79A7091A9D2967EB50D1AA47
                  SHA-512:FA3C6C3834142CE9E1A7F92D744071F347A4DD7359C962947EF019A9C057E7AFB25FF5D8FD6E04BC75124D879B7D83EC46C9EBBCDD9BA091CBBD247EEBF3FDED
                  Malicious:false
                  Preview:BM........6...(...................l...............................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\waste empty.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 29 x 28 x 24, image size 2464, resolution 3780 x 3780 px/m, cbSize 2518, bits offset 54
                  Category:dropped
                  Size (bytes):2518
                  Entropy (8bit):2.434312274551005
                  Encrypted:false
                  SSDEEP:24:ZbbXDr/fjr3CWC+PbPxsr7zB1hbOoB3PLr/LbvLLfL7SrbC:ZbbXDr/fjr3CWC+PbP6rjbTLD7SrbC
                  MD5:45773F3F8C4B8EFD775F6AB39596CCD1
                  SHA1:FC91E732672BC63B4C8BB56B7DE8D27896F07F5F
                  SHA-256:5EAD386D0B54006B7173DFB2249BEB7617556379CAD3FCAE7089217091B59AAA
                  SHA-512:30B6B7CE25EA1F6613590B892804283B935685536A4DE9A12BCAB1F76FEA2F938CDCA5BCE7E81ADEA8BD957530DA08D9195A7801AF427F0138FD75859D4B4AC7
                  Malicious:false
                  Preview:BM........6...(.......................................................................................@``@@@@``.........................................................................@``@@@.........@@@@``.............................................................@``@@@.....................@@@@``.................................................@``@@@.................................@@@@``.....................................@``@@@.............................................@@@............................@``@@@...................................................@``......................@``@@@.........................................................@``................@``@@@...............................................................@@@........................................................................................@``.....................................................................................@``.........................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\waste full.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 29 x 28 x 24, image size 2464, resolution 3780 x 3780 px/m, cbSize 2518, bits offset 54
                  Category:dropped
                  Size (bytes):2518
                  Entropy (8bit):2.4287464796538747
                  Encrypted:false
                  SSDEEP:24:ZbbXDr/fjr3CWC+PbPxsrul601kKOoRH+BHLr8LbvLLfL7SrbC:ZbbXDr/fjr3CWC+PbPWrgbTLD7SrbC
                  MD5:542338EEA2EB59CF458F372147356AD4
                  SHA1:5F7E6C37A4D4C9DDE7C1C721B115860CDEBDD869
                  SHA-256:2F98D53B98929711C6E0C93D5FC59E2E22D22A7550007BC2C5D3032ED5984898
                  SHA-512:7F83F88102C8FDB7E792805333233967168F8AFB7498FE4D8BC2DC9676C71DB2DA5752E4AA50900AF99750423FA5767377D5E0CAF8087AA2F0D04DFB582A1354
                  Malicious:false
                  Preview:BM........6...(.......................................................................................@``@@@@``.........................................................................@``@@@.........@@@@``.............................................................@``@@@.....................@@@@``.................................................@``@@@.................................@@@@``.....................................@``@@@.............................................@@@............................@``@@@...................................................@``......................@``@@@.........................................................@``................@``@@@...............................................................@@@........................................................................................@``.....................................................................................@``.........................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\weight.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 48 x 32 x 24, image size 4608, resolution 3780 x 3780 px/m, cbSize 4662, bits offset 54
                  Category:dropped
                  Size (bytes):4662
                  Entropy (8bit):1.7923859872571333
                  Encrypted:false
                  SSDEEP:48:Wb3fHrjrjrnHnHnHzfHfHfL/f/f/rf//77AdAmAG:d
                  MD5:F207C4AFA5F8F5623709974A2D3AD2F8
                  SHA1:B89C59E147AFD00FB3ABF3A140344E6C62F8198E
                  SHA-256:FFFCCB067254E56B45C7055DE7D51417558270CD44BA9EA4DA90ABACA90EAA46
                  SHA-512:C316B9DD1242967BC01FEC4F09F6B846FD95CBFE69F7B8D050468542D50CB09B3AFD816FB7D72C62C1AA724C2EA3945EAAA53021E3C1A04DC1E35952D2463C68
                  Malicious:false
                  Preview:BM6.......6...(...0... ..............................................................................................................................................................................................................``.``.``.``.``.``.``.``.``.``.``.``.``.``.``.``.``.``.``.``.``.``.``.``.``.``.``.``....................................................................................................``..............................................................................................................................................``..............................................................................................................................................``..............................................................................................................................................``..............................................................................................................................................``..........

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\wheel.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 58 x 35 x 24, image size 6160, resolution 3780 x 3780 px/m, cbSize 6214, bits offset 54
                  Category:dropped
                  Size (bytes):6214
                  Entropy (8bit):1.2283831825055325
                  Encrypted:false
                  SSDEEP:48:7MRwBDz7PWDz7wNDz7TZDz7eDz7THzfvzfvfbfvfTfvfTnfvL3ffTHfWTDPf5y//:Y
                  MD5:1A3CA81A47FF910CE275AC63F4EC1460
                  SHA1:6128E234715F594B972FB97B2EBCE0659A65CC66
                  SHA-256:DBED1902A45161EF7B96294447035C1C87D3550F2C873EABC09965E065FDEDA8
                  SHA-512:CC275F23B587EAA6A37536E0163F529B82086F22AEBADB5028F866E918250AEB018612F627007B1A8DDFA4618F6A7122389A0A4260BFCF5B4FC9AEB318FC9A88
                  Malicious:false
                  Preview:BMF.......6...(...:...#.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\wordpod.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 22 x 30 x 24, image size 2040, resolution 3780 x 3780 px/m, cbSize 2094, bits offset 54
                  Category:dropped
                  Size (bytes):2094
                  Entropy (8bit):2.5281321453255843
                  Encrypted:false
                  SSDEEP:24:A6BBBBBBBBBBBBBBBxBBBBBBBBBBBBBBBlBBBBBBBBBBBBBB8BBBBBBBBBlG0kBK:K
                  MD5:A959DB8206EA544B99AE06126317912A
                  SHA1:83E5233CC43BF8F49E617C18D9543CB303D0D25E
                  SHA-256:3A33163B66EF77189827DF5F0D35B9E35718445EBDDBA469B3071E3261287BD6
                  SHA-512:FC93075D39D0F40A17FF46F436F152799206901D3BA4E0C76F96F692E0C1096DA2CAEAC7F430B29D5E5CBC31006EA2D3D27C0518ED0FCFCCA881DC2D387156B2
                  Malicious:false
                  Preview:BM........6...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................@@@.................................................................@@@..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\zmin.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 15 x 15 x 24, image size 720, resolution 3780 x 3780 px/m, cbSize 774, bits offset 54
                  Category:dropped
                  Size (bytes):774
                  Entropy (8bit):1.4072221816449666
                  Encrypted:false
                  SSDEEP:12:yTqvnXooHQQd/funMWmCKwiwi7ziXQrIo/nQYvoQ+:yk3gb+E7ot+
                  MD5:AE73E7F5F7FC02CE42044592EB83E96B
                  SHA1:9CEF36C72B2B9BB853B4991C2A0F21CC2A2BD7C8
                  SHA-256:0850B740D96C4FE721B6E2A1C12FF03EBA2515E38AF74FC20032E547B11657EB
                  SHA-512:975FC3D4C3EF14FC3D02477354560732BF53B3E5B22B2FADE962FE6E1EE908AB7C06CD7A57A32355F47FADA84B55DF6D72D4498AE5F68AE1496E7118CA15BD56
                  Malicious:false
                  Preview:BM........6...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons2\zmout.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 15 x 15 x 24, image size 720, resolution 3780 x 3780 px/m, cbSize 774, bits offset 54
                  Category:dropped
                  Size (bytes):774
                  Entropy (8bit):1.4150334115517484
                  Encrypted:false
                  SSDEEP:12:yTqvnXooHQQd/fuEWTKwiwi7mXWIo/nQYvoQ+:yk3oT+8zot+
                  MD5:DEC0B50CB1B9250680DA96D43FBA338E
                  SHA1:1B57308274489F8D82AB0F5F2BACB3C1DCC9ED4B
                  SHA-256:2F20C675C14122966A3F5720422207EA6A90E26D49B907639F2957D2BA679CC7
                  SHA-512:03BCACB2C8D2EF44FB174CCE8AC372AC20012154153EAF00F7C8043748F2E627583CF6E964F41C24E9504A6D9B51795C2D4B027FF62A4DB1117AE18E5FE84732
                  Malicious:false
                  Preview:BM........6...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\alarm1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 29 x 32 x 24, image size 2816, resolution 3780 x 3780 px/m, cbSize 2870, bits offset 54
                  Category:dropped
                  Size (bytes):2870
                  Entropy (8bit):1.45967257322045
                  Encrypted:false
                  SSDEEP:48:1LL+vsbyfrvrYAvPXS/2LWAvEAAb6AAfIAAr+AAPWXAnAeLhr9qAnnW:D
                  MD5:9F752615B987C8C58B0A7965DD041CE0
                  SHA1:895031A1E277634A3DFC0FF6EDB51DA7EAA45B50
                  SHA-256:1D95596A78DB1890B4B08E180A1348F58AA9836C40CDA7304DEBF6EE13E40AA2
                  SHA-512:01F65C9AE9A86223E3E7E5B54744EBD06DB4E89E036874A7C0E8242AB420CEEA592B88DB7F53A2142528E5BB19B1C490804D0E98C768B9DC0D9F48CEF9187436
                  Malicious:false
                  Preview:BM6.......6...(....... .................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\alarm2.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 25 x 25 x 24, image size 1900, resolution 3780 x 3780 px/m, cbSize 1954, bits offset 54
                  Category:dropped
                  Size (bytes):1954
                  Entropy (8bit):1.635797292507641
                  Encrypted:false
                  SSDEEP:12:8XrP1p/N1/V3AtEtWVwNC1C1ctctctB3tjtxtXtGt4WsWsttPP1RHHg:8RpV1tYUsQwwMMMrhL9U4WsXH2
                  MD5:46ED26DBA97D300E37A3F0C6344D7027
                  SHA1:C433538F536EBBDDFE87FC88A3FFA072371145A0
                  SHA-256:8892EE1641BA30320B96F84509925A17584EC48DC28401349E3A1445DB7A0C4E
                  SHA-512:269BA367DA80BFE3B9B05349B476F240A0526E73904D90958A74BDC8A4E5EC39323DF877EB22BB0F3A8A1E44F472CA83F42332EC3466A05C2688FEC1DFFF51F0
                  Malicious:false
                  Preview:BM........6...(...................l.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\alarm2_s.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 19 x 17 x 24, image size 1020, resolution 3780 x 3780 px/m, cbSize 1074, bits offset 54
                  Category:dropped
                  Size (bytes):1074
                  Entropy (8bit):1.7145461941823914
                  Encrypted:false
                  SSDEEP:12:TtvPIaAoXSvsnsnaPaPnrPdUnEYmnHf/P4:9EE
                  MD5:75A877503D183E8F94639D46AE771275
                  SHA1:93585E27F44680D8992983214A8B8A8947D62FD0
                  SHA-256:CC81CAC2DA04D3AC00EBE354E95172C050546F70BA800F2DE2E2BE4F12F6FB1A
                  SHA-512:A0725917FE54F3C253E0B66BA892118315365107C9650239D2138BBFBF6AACA1765BD14454A3227E2C46F8007D96714BAC2743FCC3E492FE8A4527D1AA35F775
                  Malicious:false
                  Preview:BM2.......6...(.............................................................................................................``.``............................``.``.........................``.``......................``.``.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\alarm3.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 36 x 34 x 24, image size 3672, resolution 3780 x 3780 px/m, cbSize 3726, bits offset 54
                  Category:dropped
                  Size (bytes):3726
                  Entropy (8bit):1.4833382763878702
                  Encrypted:false
                  SSDEEP:24:rqJqqq5qqqqqqCqqqqqxfqqqqqB/qqqqqpfqqqqq8cqqqqq8kqqqqq8kqqqqq8SL:r
                  MD5:4078C99B7275CBF457FB430E016C631D
                  SHA1:E1E3895040C08094D434C379C9706E7F36A10184
                  SHA-256:888BE425AD2B063CB63F49904C2D28BB29429237AE727275F657BCDE8FBEE421
                  SHA-512:8C2B43A03A8046F838CB7CCF11F9DB8A001FB252BC74208200EC3D49A6C920BD85FD05E5E0D1E3635F97EDC76231D5A1FC8D55C16A4262876EC40F532BB1C5FA
                  Malicious:false
                  Preview:BM........6...(...$..."...........X.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\alarm3_m.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 23 x 23 x 24, image size 1656, resolution 3780 x 3780 px/m, cbSize 1710, bits offset 54
                  Category:dropped
                  Size (bytes):1710
                  Entropy (8bit):1.4971453165598652
                  Encrypted:false
                  SSDEEP:24:sGv/qsqqqy/qqqx3qqqhHqqqqVqqq8zqqq8Oqq83qq8yqq84qqqHqq8Xqq8QqqqY:FvfX
                  MD5:C700ECCA6C7F6B1150CED03EDA4035EF
                  SHA1:6BE1461526ACF2ABA0A2C2497E7E00716BF3B16B
                  SHA-256:AE9019DBE11D4440DA3889B9E5E41642D2A837CE480A94EC5B7325321784B0EF
                  SHA-512:B08A962E91E53EBD8E4A13F21257E4C6279B76519C85CA39CD88E22001CDE10026BBEE20EFD8D88334A0A38848DC0078CE9A80A2C3C28A1CC5806D40ECA60AB9
                  Malicious:false
                  Preview:BM........6...(...................x.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\alarm3_s.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 19 x 17 x 24, image size 1020, resolution 3780 x 3780 px/m, cbSize 1074, bits offset 54
                  Category:dropped
                  Size (bytes):1074
                  Entropy (8bit):1.5987586174077608
                  Encrypted:false
                  SSDEEP:24:oql/qqVqqqQqq8Nqq8Pq8Oq87q8Jqqqq8Uq8/qfqzqqoiqgqqoqql:NX
                  MD5:3909CBD7EFD07405A76210F5C24CF415
                  SHA1:F7FB118C0C3B3BAB9511E86DE6CF961D67066B11
                  SHA-256:7E21754BABFDC7DD4080FBBE5A50BB68A024B2F3FC1F5C0FF97580DFC4F58647
                  SHA-512:E9DD902C5C03BC0D9180C1F80241095CAAF526532B48EF7EF1D397DF2A2DE2A88360DF84A4D6B15FDD851DFBD1B5281C92C5475CFE432362818A8059BD0B7A48
                  Malicious:false
                  Preview:BM2.......6...(..............................................................................................................................................``.``....................................................``.``.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\alarm4.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 30 x 32 x 24, image size 2944, resolution 3780 x 3780 px/m, cbSize 2998, bits offset 54
                  Category:dropped
                  Size (bytes):2998
                  Entropy (8bit):1.3131239652855435
                  Encrypted:false
                  SSDEEP:12:mjH8g8gRIxfr3iIR/rAkc6bHhcsxxu2KT2KPpo/Lpo/Hpo/T2o/P2o/rSfI:lT+Beae1pp
                  MD5:E4E5835AB753BA8A175351D51DACA7EC
                  SHA1:AFB2748C19F68D70A0326A9195DFD11C95992154
                  SHA-256:11DADA0D41AFE8FE8E56F0B4FD03B28B1AB4FF18404AFBAF3F722F50C78E89B8
                  SHA-512:05C0C122101625274982359ACF41513928EE7DA922D5B609A6837E124DC518D75FCAD386E919E0392DB329A312E00C7C43E187962E93681F5DCDFF57D9920525
                  Malicious:false
                  Preview:BM........6...(....... .................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\alarm4_n.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 14 x 16 x 24, image size 704, resolution 3780 x 3780 px/m, cbSize 758, bits offset 54
                  Category:dropped
                  Size (bytes):758
                  Entropy (8bit):1.3196838678108866
                  Encrypted:false
                  SSDEEP:6:Y/2lfw4LAY4IsL4LAY4IsL4LAY4IsL4LAY4IsL4LAY4IscSALALvIsAdALAsAoA:YKfwE4E4E4E4E3Sfc2co
                  MD5:C605C2399E6A21D7F6A4F41B9097D125
                  SHA1:8F32156C2D74AF7C1F383C75FE7633BCAD679DB0
                  SHA-256:09709FD4DA4DD6281C26193F8AB3CBB5759D7D7D7DF39172D5CC4A1EE5CBD520
                  SHA-512:5E34D0B6551C090C56D2071271E51280191C126725FFE041D71E8A21607A54A5C7D007118A0F9373A0DDA6AE7057EEEAAF57AAC0898AC563A137E82924A317FF
                  Malicious:false
                  Preview:BM........6...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\alarm5.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 19 x 17 x 24, image size 1020, resolution 3780 x 3780 px/m, cbSize 1074, bits offset 54
                  Category:dropped
                  Size (bytes):1074
                  Entropy (8bit):1.2477871579924045
                  Encrypted:false
                  SSDEEP:6:OCl8t0vP1GwNGSYpsXSvUAYnUAYnsSYPsSYPssXrPs9jnYw7qjeXie7A7psXEOiw:TtvP3nXSvsnsnaPaPnrPdU+qEOiHf/P4
                  MD5:CE07A552E742A69BA93A7D6173DA3777
                  SHA1:C424310FB689C76CE8B16682225D1B1D60AD7D46
                  SHA-256:ECEE9B06200416982A3A06EBB9CE40099EABA46C1CA66577CCDF9CEDCDAD59E1
                  SHA-512:C57D995B3B8C1CD6CC2D1B4F094CB5C2F8C0689CED2D98FC97117A91627874F4F825B0DD172897C263DD3E948F0B4F72FAF3558C3296305E08675663C3389569
                  Malicious:false
                  Preview:BM2.......6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\alarm6.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 28 x 25 x 24, image size 2100, resolution 3780 x 3780 px/m, cbSize 2154, bits offset 54
                  Category:dropped
                  Size (bytes):2154
                  Entropy (8bit):1.809036415650508
                  Encrypted:false
                  SSDEEP:24:hSm//7t9FDptyNIiw2Cw2Cw2Zw2/wmD9D5KD:hSStbDP4IsMM5n15KD
                  MD5:0E14568D1F604944A0ACF20362080919
                  SHA1:2AF57979D3B5231A73B88F0F15D3B3FCD68FF649
                  SHA-256:7E353AA56267ED7162545B77974E224CA6FAC2DCD0F3FEA1EA6EF1F6DC134650
                  SHA-512:53C5BDD033848D67D2A4D51FF260B706C307B71B983A744141C7C3CF92A5449BCF699D6E943D56B26A954C9C7BB6E0E653B3D8B5851B94BE70EBBF485CB779E1
                  Malicious:false
                  Preview:BMj.......6...(...................4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................``.``.``.........................................................................``..........``..............................@``.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\alarm6_n.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 28 x 25 x 24, image size 2100, resolution 3780 x 3780 px/m, cbSize 2154, bits offset 54
                  Category:dropped
                  Size (bytes):2154
                  Entropy (8bit):1.7123453224059604
                  Encrypted:false
                  SSDEEP:24:hSmfdXqlqd7XqqlqqqBaqq5qqqIqqUqq4qqsqqqqqq0MQqqqqq4zqqq82qqqqqq3:hSsI8w1BlFIjlKD
                  MD5:05B67098D1788AF16FA102AAC08FFE03
                  SHA1:6E2A105C35379A7792C78AF540210A5AE942436F
                  SHA-256:279AC0CF3312108D442A4158622B84D9DC95946B3D6C98CC8590206DAF5694ED
                  SHA-512:481776CE4F23F2E074636E1839E316A959870903BF8A0156DA49BE71318F25E6436F407235F0111233C1379D3F99778EC1155A65DA7000C389B24DB8CB0A6C16
                  Malicious:false
                  Preview:BMj.......6...(...................4.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................``.`@.........................................................................``.........................................@``.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\alarm7.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 28 x 25 x 24, image size 2100, resolution 3780 x 3780 px/m, cbSize 2154, bits offset 54
                  Category:dropped
                  Size (bytes):2154
                  Entropy (8bit):1.9578504743514809
                  Encrypted:false
                  SSDEEP:24:ztf/7r/uEv/+7rNUrh+tbh4tPhkLXrOCHBs:5f/7r/uEv/+7rurabAP6LXrOB
                  MD5:F993A3FC29A0472FB6FC146A6C599E3B
                  SHA1:062BB669FD30C1D4FD5C38887A24DA2781483B70
                  SHA-256:ADA340C28BDC6D15371DA46817E09F17600D72EA23787A7E1A435AE0119B1498
                  SHA-512:73C106AA15082B8C27D5FE5057A322C5902512D9FF5878BB56A50F54448F811754EE0682F5D3560D4743D5C1AB84B0C923351A147FD45EA231A0257C38E1BFC8
                  Malicious:false
                  Preview:BMj.......6...(...................4..................................@@@@@@@@@@@@.....................................................................@@@.................................................................................@@@.................................................................................@@@..............................................................................@@@.................................................................................@@@.......................................@@@@@@@@@....................................@@@.....................................``@@@@@@.......................................@@@.....................................``@@@..........................................@@@.........................................................................................................................................................................................................................................................@``.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\antena.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 11 x 28 x 24, image size 1008, resolution 3780 x 3780 px/m, cbSize 1062, bits offset 54
                  Category:dropped
                  Size (bytes):1062
                  Entropy (8bit):1.8299728653364145
                  Encrypted:false
                  SSDEEP:12:ftYfbFJvffNJ9lvvvvvvnlZnnlZnnlZnnlZnnlZvvvvvvvvHHvvPHvPllXvlS:VqnDDnnnnzHS
                  MD5:C0ADA85BBB3114211EB9EAB26B1F5DAE
                  SHA1:D25979336569D419302BE4995318F92977CDF8DA
                  SHA-256:31FC57879853F43B6D9324A69F20EDB97D0E8C565B887A7FBA26177A57F3A46E
                  SHA-512:8F79A2CC2B81EFF8FB7215CFDF57B1D642E8DD9BB5DE32AF40B8C5B4EF76D1ABC9F753B58EE6AF5FA0545F5AECD4CBF9CC71E8F9B0D2B69A7104DD1047BBFD9B
                  Malicious:false
                  Preview:BM&.......6...(.......................................................................................................................................................................................................................................................................................................................................................................................@@@...@@@...............................................................@@@...@@@...............................................................@@@...@@@...............................................................@@@...@@@...............................................................@@@...@@@...............................................................................................................................................................@@@...........................@@@..................................................................................................................@@@....

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\computer1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 59 x 42 x 24, image size 7560, resolution 3780 x 3780 px/m, cbSize 7614, bits offset 54
                  Category:dropped
                  Size (bytes):7614
                  Entropy (8bit):2.132645077510749
                  Encrypted:false
                  SSDEEP:24:voAtxtxtxtxtxtxtxtxtBtBtftBtRXtxtxtxtxtxtxtxtxtxtxtxtxtxtXu:vpXXXXXXXXnnlnXXXXXXXXXXXXXXXu
                  MD5:BF16052D358E88A9FA8CB222F5A1D301
                  SHA1:0CBCDD9AFCB2B16ED7ED2B9FBCAF64FAEE876DBE
                  SHA-256:ED435FEA2423EADA88D57EDFC94F1C728FB094E1B2FC19E8D8F5AAE5BDD1306F
                  SHA-512:435299E4E6B8862F66CBD5FDAE6FF9F97C2E3F9CD38997AB068BE69335C0903DD6EB5989E4D1FFE9865E2F5BCF1706BC5C001FFADB73ECF0D95D6216FFDB7C95
                  Malicious:false
                  Preview:BM........6...(...;...*.........................................................................................................................@@@@@@@@@.....................................................................................................................................................................@@@@@@.........@@@@@@.........................................................................................................................................................@@@@@@.....................@@@@@@.............................................................................................................................................@@@@@@.................................@@@@@@.................................................................................................................................@@@@@@.............................................@@@@@@.......................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\computer2.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 41 x 64 x 24, image size 7936, resolution 3780 x 3780 px/m, cbSize 7990, bits offset 54
                  Category:dropped
                  Size (bytes):7990
                  Entropy (8bit):1.9347591627284852
                  Encrypted:false
                  SSDEEP:48:J/fvvf/PP/fvv3X3X3PPPf/vv/fPPf/vv+:U
                  MD5:3BA00D98FBCA33A87163664BAF2A61B0
                  SHA1:0C41F44476E6B9F63320140C75601BB491D08CD8
                  SHA-256:F73A5EBA526F022AD81532CA7B6EE27D596638601E33642EC6DED0BA3FFA2841
                  SHA-512:C80187944F74EFF42D2277881BE5E0F823C2123EFD1B81979D92EC4669883761B12CC0FF7316F575F04FC56EBA9F8067613C4FA9B2EA6AE2A1FFF875D27D4B7D
                  Malicious:false
                  Preview:BM6.......6...(...)...@.........................................................................@@@@@@@@@.............................................................................................................@@@@@@.........@@@@@@.................................................................................................@@@@@@.....................@@@@@@.....................................................................................@@@@@@.................................@@@@@@.........................................................................@@@@@@.............................................@@@@@@.............................................................@@@@@@.........................................................@@@@@@.................................................@@@@@@.....................................................................@@@@@@.....................................@@@@@@........................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\computer3.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 119 x 48 x 24, image size 17280, resolution 3780 x 3780 px/m, cbSize 17334, bits offset 54
                  Category:dropped
                  Size (bytes):17334
                  Entropy (8bit):2.5451931547146778
                  Encrypted:false
                  SSDEEP:192:N111111111111111111111111111111111111111H111zL51N11H11LrP1f1111H:9
                  MD5:1D314AD78D3988E4BCBE4E047C5E692A
                  SHA1:52A97FEEA77409FED529D9CC67B0D71E004441B1
                  SHA-256:3347D868A4DDD41D98D826BD1B723614DE80D3CC63B78FF943C3193F6AAA7CF7
                  SHA-512:4837F23F4D476F154B0ECF6A749C96C59A1FCEDF3551F6B15621EF33C3BCD13F9A494A3B782C1B90853C299C9215CD760A0E85F28FFFEAA6E7B229EA39EAE053
                  Malicious:false
                  Preview:BM.C......6...(...w...0............C...................``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``.``@``................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\connect1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 28 x 59 x 24, image size 4956, resolution 3780 x 3780 px/m, cbSize 5010, bits offset 54
                  Category:dropped
                  Size (bytes):5010
                  Entropy (8bit):1.6352454953519366
                  Encrypted:false
                  SSDEEP:24:yUnn3T2kMkknHeOTO7O7nfeD7D7D7DSeyeCsUnA3bO7O7uGXXkkFOTuD1f3HnI:xyZ
                  MD5:90FAF56CE9B859D72900A7A0C6704DE7
                  SHA1:09AD2343114DCDB1D5DA2F102891392C68D3C23F
                  SHA-256:8655C29D1E24081D03C9E129E0A4B0881DF4261286184C6A6F258D874CB6119A
                  SHA-512:B7496C0D615CBA8BB068B8DAAA722D937D156005237A4EF1269527B46124DC678B9BA5733E0BFFA9010C81B6AC5A95F76EA9A32177B56335365B1D39AA7CA468
                  Malicious:false
                  Preview:BM........6...(.......;...........\.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\connect2.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 28 x 59 x 24, image size 4956, resolution 3780 x 3780 px/m, cbSize 5010, bits offset 54
                  Category:dropped
                  Size (bytes):5010
                  Entropy (8bit):1.6207295454890187
                  Encrypted:false
                  SSDEEP:24:yUnnnnnnnkkWT2kMkkkkkkkHeOTO7OLA3bO7O7uGXXkkFOTuD1f3HnI:jyZ
                  MD5:09895BAAE698FF343B4620C004E91240
                  SHA1:18D6FDDD97165BDA6842E16ABA9F0F24258F46C9
                  SHA-256:BAA59EEF744ED98EA912E94D3300C007F13CE205F3EF1C412199DF3EFC80EF8E
                  SHA-512:920E70F6790DB0F0A67B852654FAEEC22D1D9E1D4C8FCD6A366FD26092FEBC08C04BA90DF1A48B3AFE53B72C524023B906780DBDE43F0DD306394B0497631205
                  Malicious:false
                  Preview:BM........6...(.......;...........\.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\controller1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 56 x 58 x 24, image size 9744, resolution 3780 x 3780 px/m, cbSize 9798, bits offset 54
                  Category:dropped
                  Size (bytes):9798
                  Entropy (8bit):2.1082815518017926
                  Encrypted:false
                  SSDEEP:24:03tptptRt1StRt9itN6tJtFKtRtRQtnt4hS/IoqYSIS2wCKict/tRtVtxtxtVtJI:GPP3O3m+vG3sn2JF37XX7vvD33bPPa
                  MD5:00C1E5B74F15A49B297B8840DDB8AD74
                  SHA1:3646692E062A99BA423C3FA16E6630E749261C70
                  SHA-256:9EDAA40B11DA7D704DFE9E0D5CA88D029CC474B34286062DAB237357E239D65D
                  SHA-512:2455BEA5AD69CA686C4C7D658B440ECB26A9E973012B71A395C10439BC2EDAAB8A88E37E4C22884269BA9F8A8DD85FEB30C9822A13C12148631A9BA65376630D
                  Malicious:false
                  Preview:BMF&......6...(...8...:............&.....................................................................................................................@@@@@@@@@.........................................................................................................................................................@@@@@@.........@@@@@@.............................................................................................................................................@@@@@@.....................@@@@@@..............................................................................................................................@@@@@@@@@.................................@@@@@@..................................................................................................................@@@@@@................................................@@@@@@......................................................................................................@@@@@@..................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\controller10.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 42 x 50 x 24, image size 6400, resolution 3780 x 3780 px/m, cbSize 6454, bits offset 54
                  Category:dropped
                  Size (bytes):6454
                  Entropy (8bit):2.2628819040837467
                  Encrypted:false
                  SSDEEP:24:utJtJtJtJtJt9W8GPu6snhv4xi6+GVlFK9ceCRtxtRtxtRtxtRtJtxtxtxtxtxtK:kvvvvvPeiQX3X3X3vXXXXXXa
                  MD5:10E51BD9ECB030C1386D5081C0562BC0
                  SHA1:90137463A920E4BA54570DE925D66862EDF666CB
                  SHA-256:2D69413F27FA6E5218891A5B6263BE0866BBCB0161DE6A43314D2A17A3810D80
                  SHA-512:110FA77F71841583330608AB7A9CA040AF7582A24E25559AB542E3445DE4606E57B84D551568B4E78AE78B2F2445166519DE6E08C087806BE6203C4A26BF7027
                  Malicious:false
                  Preview:BM6.......6...(...*...2................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................@@@@@@@@@.................................................................................................................@@@@@@.........@@@@@@..................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\controller11.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 37 x 27 x 24, image size 3024, resolution 3780 x 3780 px/m, cbSize 3078, bits offset 54
                  Category:dropped
                  Size (bytes):3078
                  Entropy (8bit):2.8259874286285482
                  Encrypted:false
                  SSDEEP:48:yibLrn7nLnb7rLzvTa7DDqr++bOeLe27uOr+uC:yd
                  MD5:82C968B9085B8C5AAE8FE1140F5E2CF9
                  SHA1:A3A404CAE3F525C11EEB5B3F8B1682A1B7BEAF63
                  SHA-256:A36A07E529BE5C4630EEA01A0DDC6C30C55AA411238D6C32E65BA8BB03C63C01
                  SHA-512:9EFBABD74F685B9A3DCDF98A658B862261CA8346360238CC88BB63FA5F74617715F0AD6D0435CBA37EE644E299B7D1F86661471215A8A98A1C8FB95203C29929
                  Malicious:false
                  Preview:BM........6...(...%..........................................................................@@@@@@@@@.................................................................................................@@@@@@.``@``.``@@@@@@.....................................................................................@@@@@@.``@``....``@``.``@``@@@@@@.........................................................................@@@@@@.``@``.........@``.``@``.``@``.``@@@@@@.............................................................@@@@@@.``@``................``@``.``@``.``@``.``@``@@@@@@.................................................@@@@@@.``@``.........@``@``.``...@``.``@``.``@``.``@``.``@``.``@@@@@@.....................................@@@@@@.``@``............@``.``.``.......``@``.``@``.``@``.``@``.``@``@@@@@@@@@@@@............................@@@.``@``.................................@``.``@``.``@``.``@``.``.``@``@@@@@@@``.``@@@@@@......................@``.......................................@``.``@`

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\controller12.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 27 x 26 x 24, image size 2184, resolution 3780 x 3780 px/m, cbSize 2238, bits offset 54
                  Category:dropped
                  Size (bytes):2238
                  Entropy (8bit):2.875983408599353
                  Encrypted:false
                  SSDEEP:6:blaI3lRlF4SlRlVXlRllrlJEa7/v/Fa1aatWal6adWa0ay5a6VaCw:bMI3/lF3/lVX/llrHz7/v/jbXw
                  MD5:EFF1ADB55AAAA8641F8A60D727358C56
                  SHA1:B9CDC38E1C775AA67B722B8E07AF8F9234DCD9B6
                  SHA-256:8B1F1585797B312B1709C416B441DA5F6691976B77F7D4941421E84F259282DD
                  SHA-512:3589EAC345B4CD7FB924797048461FF01F5328B0387F44F2F241D064282EC2D233EA531342C65318C67756131165F903F4C3F894DA7A5DA9384461C80D4D63F5
                  Malicious:false
                  Preview:BM........6...(..........................................................................................@@@@@@@@@...........................................................................@``@``@``@@@@@@...............................................................@@@@@@@``@``@``@``@``@@@@@@...................................................@@@@@@@``@``...@``@``@``@``@``@``@@@@@@.......................................@@@@@@@``@``.........@``@``@``@``@``@``@``@``@@@..............................@@@@@@@``@``...............@``@``@``@``@``@``@``@``@``........................@@@@@@@``@``..........``.``.``...@``@``@``@``@``@``@``@``@``..................@@@@@@@``@``..........``. ..``.``.``...@``@``@``@``@``@``@``@``@``...@@@@@@@@@@@@@@@@``@``..........``.``.``.``.``.........@``@``@``@``@``@``@``@``@``...@@@@``@``@``@``..........``.``.``.``.``...............@``@``@``@``@``@``@``@``@``...@@@@``@``................``.``.``.....................@``@``@``@``@``@``@``@``@``...@@@...................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\controller13.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 26 x 41 x 24, image size 3280, resolution 3780 x 3780 px/m, cbSize 3334, bits offset 54
                  Category:dropped
                  Size (bytes):3334
                  Entropy (8bit):2.1548145687760445
                  Encrypted:false
                  SSDEEP:12:rU/HHfnnf/Xfffff/nlFlFlZ/lllt/lp/lp/lR/lR/lR/l1la:qfffffff/lffZt/ttptptRtRtRtva
                  MD5:DF1274A924B3D9FCD4E4C9D7ACBA4BED
                  SHA1:6D42D2067580AE12E578372B2BD1694928620DB9
                  SHA-256:D40A959F7BD26AFB94755DB84F4A6B4433B250AC4A9EA2FA4D5AAC118382C3A9
                  SHA-512:B073AEF04C730DBF836348721EADC7B7F3FD8C4CB5CFAF6F1D5837477622058E544C6989AFA9B84D7F26723ED293A70ACE68F5181D175BD06212E213D807D7E7
                  Malicious:false
                  Preview:BM........6...(.......)............................................................................................................................................................................................................................................@@@@@@....................................................................@@@@@@@@@@@@.``.``........................................................@@@@@@@@@@@@...@@@.``.``.``...............................................@@@@@@@@@@@@......@@@@@@.``.``@@@@@@......................................@@@@@@@@@@@@......@@@@@@...@@@@@@@@@@@@.``@@@@@@..........................@@@@@@@@@@@@@@@...@@@@@@......@@@@@@@@@@@@@@@.``.``.``@@@@@@..............@@@@@@@@@@@@@@@@@@@@@@@@......@@@@@@@@@@@@@@@@@@@@@.``.``.``.``.``@@@...........@@@@@@...@@@@@@@@@@@@...@@@@@@@@@@@@@@@@@@@@@@@@@@@.``.``.``.``.``@@@...........@@@@@@...@@@@@@@@@@@@@@@@@@@@@@@@......@@@@@@@@@@@@.``.``.``.``.``@@@...........@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@......@@@@@@@@@@@@@@@.``.``

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\controller14.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 67 x 63 x 24, image size 12852, resolution 3780 x 3780 px/m, cbSize 12906, bits offset 54
                  Category:dropped
                  Size (bytes):12906
                  Entropy (8bit):2.4153388415150387
                  Encrypted:false
                  SSDEEP:24:WihAiq9ihX/RhAiIiLihX/CihAi//ughAi/CihAiIi2yiIi7ihAiIi+e:U
                  MD5:183E901A0C31A029B5B15564AF13A2F0
                  SHA1:609125B9D0D2CE6853F88D49D915DEB88AD7024F
                  SHA-256:EE25E266F536D6C6C76DAC96F2E24443D4992F8F89766B5DEF5A6313D7D2AD4C
                  SHA-512:B96BD917E83078038FC957ABF77A7262C99D5B2B3B478537750135DADF8654BA0CBA626E635E7DF2ED9B85E7F41D52E0E668B648A82EDC1A473DF9A35556E978
                  Malicious:false
                  Preview:BMj2......6...(...C...?...........42...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@.....................@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\controller2.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 28 x 46 x 24, image size 3864, resolution 3780 x 3780 px/m, cbSize 3918, bits offset 54
                  Category:dropped
                  Size (bytes):3918
                  Entropy (8bit):1.9826899665295563
                  Encrypted:false
                  SSDEEP:24:ktRtd/tRtxtRtxtRtxtRtZ/f/f/fZtJtJtv6:6333X3X3X3Z/f/f/f/vvv6
                  MD5:3F69E5594CD3A79FC4FEABDAEB281FD9
                  SHA1:51EDACA022CA5E3C6E7BE359EF0C02C9986AC73B
                  SHA-256:E522E805BA31EDD3EE92C4E7D42686718A797682127B6050EFBD97983C5AF8C4
                  SHA-512:29119BD0290D4AFB7C99719ECAFFC82F5DDE165FEB74EA8365C037BB59D01CA3D9C674491AC74945D46767D3D354100524B6122636FACA694FC313FF291E961D
                  Malicious:false
                  Preview:BMN.......6...(......................................................@@@@@@@@@........................................................................@@@.........@@@@@@.........................................................@@@@@@.....................@@@@@@................................................@@@....``@``........................@@@@@@................................................@``.``..............................@@@@@@..........................................@``.``....................................@@@@@@.....................................``@``..........................................@@@@@@...............................``...................................................@@@@@@....................................................................................@@@@@@....................................................................................@@@@@@..................@@@...............................................................@@@@@@......................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\controller3.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 28 x 46 x 24, image size 3864, resolution 3780 x 3780 px/m, cbSize 3918, bits offset 54
                  Category:dropped
                  Size (bytes):3918
                  Entropy (8bit):1.9485006773482463
                  Encrypted:false
                  SSDEEP:24:ktJtJtRtxtRtxtRtxtRt9/f/f/fZtJtJtv6:6vv3X3X3X39/f/f/f/vvv6
                  MD5:1D2CBB8D396434FF3A371603242C5129
                  SHA1:ACCF9F4DF918538CDD1CC29747493EB7D4289A78
                  SHA-256:A71E4531D8D118FAAA3A5BFBB7EF075BC1A0FBF813E48DE0B63F551A45C8B628
                  SHA-512:3E26AF77038C7A8D340539C846765B4C2274202F0FE17648BB849C9BED22BF8D2D02A813D253B83A8D089061F7A40835450734FB1E1174415AEA2881E6A3DA68
                  Malicious:false
                  Preview:BMN.......6...(......................................................@@@@@@@@@.....................................................................@@@@@@.........@@@@@@.........................................................@@@@@@.....................@@@@@@................................................@@@.................................@@@@@@......................................................@@@...........................@@@@@@....................................................................................@@@@@@..........................................@@@.......................................@@@@@@....................................................................................@@@@@@..............................@@@...................................................@@@@@@....................................................................................@@@@@@..................@@@...............................................................@@@@@@......................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\controller4.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 28 x 46 x 24, image size 3864, resolution 3780 x 3780 px/m, cbSize 3918, bits offset 54
                  Category:dropped
                  Size (bytes):3918
                  Entropy (8bit):2.1236481106180305
                  Encrypted:false
                  SSDEEP:24:WtRtptVtxtRtxtRtxtRt9/f/f/fZtJtJtv6:M3P7X3X3X39/f/f/f/vvv6
                  MD5:67B4BFF8A0894889335B39B00B9DC0F7
                  SHA1:AFCA91A0D41DC6103EDABB153C7DEA14729F9FCB
                  SHA-256:4C46988E2E04E7257F92C1CBEEF71FA1EFD2B28BDE61FA4630DA31DDE7E5E467
                  SHA-512:4E3F6E435D53EC7ED2B8F7A08338F50221352A8CA65C0E24AF13BB10E7288740ABCA6E08E59A57D2ABBF9C77E5B77E6CF054FFB4C55EE2CD869AB4805D144A03
                  Malicious:false
                  Preview:BMN.......6...(....................................................................................................................................@@@@@@........................................................................@@@@@@.``@``@@@@@@...............................................................@@@......@``.``@``.``@@@@@@......@@@@@@@@@...................................................@``.``.``@``.``@``@@@@@@.........@@@@@@..............................................``@``@``.``@``.``@``@@@...............@@@@@@........................................``@``.``@``.``@``.``@@@.....................@@@@@@.................................@``.``.``@``.``@``.``@@@...........................@@@@@@...........................@``.``@``@``.``@``.``@@@.................................@@@@@@......................``@``...@@@.``@``.``@@@.......................................@@@@@@...........................@@@@@@.``@@@.............................................@@@@@@......................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\controller5.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 28 x 46 x 24, image size 3864, resolution 3780 x 3780 px/m, cbSize 3918, bits offset 54
                  Category:dropped
                  Size (bytes):3918
                  Entropy (8bit):1.9082517931123544
                  Encrypted:false
                  SSDEEP:24:ktJtJtRtxtRtxtRtxtRtBGGGGGGC/f/f/fZtJtJtv6:6vv3X3X3X34/f/f/f/vvv6
                  MD5:2CC242961500A45ED513D4CD8ECD64DB
                  SHA1:B844A468B9EE66117D030585FC2031EE182A14BE
                  SHA-256:E2E1FA961B8D5A864CD6F8EC21704B77D6599F7494F6DDAE9C0DC954D8B101BD
                  SHA-512:F32702ADE3DCACAC462227CF3937C4A8B8CF82930A2A9B7BFCB895C4CB988E335984BD85F3FD3DD7DBEFE285B9C62B176527C97F1AB86047B72CEBB2DE58026E
                  Malicious:false
                  Preview:BMN.......6...(......................................................@@@@@@@@@.....................................................................@@@@@@.........@@@@@@.........................................................@@@@@@.....................@@@@@@................................................@@@.................................@@@@@@....................................................................................@@@@@@....................................................................................@@@@@@....................................................................................@@@@@@....................................................................................@@@@@@....................................................................................@@@@@@....................................................................................@@@@@@....................................................................................@@@@@@......................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\controller6.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 56 x 39 x 24, image size 6552, resolution 3780 x 3780 px/m, cbSize 6606, bits offset 54
                  Category:dropped
                  Size (bytes):6606
                  Entropy (8bit):2.14082525515753
                  Encrypted:false
                  SSDEEP:24:R84tptptptptptptptptptptntJItxQtxtptptptptptptptptptptptptP6:GOPPPPPPPPPPtUkXPPPPPPPPPPPPP6
                  MD5:1ECE06FC890D11C22DA061AE4851FA13
                  SHA1:D51392A0AAACC7FFCAE1D011E62A0245510E5A5A
                  SHA-256:C58E35F1F19E7C34E37F16EBEC765FBE00D19541245D5DF829A1101BA36BE35B
                  SHA-512:92F1FD8177DCF0DD0458191958C56F4059DB8295691775049AE80CA9A59D05BB1ECD63967827DE6D83DD018C85ADA926DE5D24BF6D8F93F82A9D119302FAF671
                  Malicious:false
                  Preview:BM........6...(...8...'......................................................................................................................@@@@@@@@@.........................................................................................................................................................@@@@@@.........@@@@@@.............................................................................................................................................@@@@@@.....................@@@@@@.................................................................................................................................@@@@@@.................................@@@@@@.....................................................................................................................@@@@@@.............................................@@@@@@.........................................................................................................@@@@@@...........................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\controller7.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 56 x 39 x 24, image size 6552, resolution 3780 x 3780 px/m, cbSize 6606, bits offset 54
                  Category:dropped
                  Size (bytes):6606
                  Entropy (8bit):2.199424890147169
                  Encrypted:false
                  SSDEEP:24:R86UwItjtptptptptptptptptptptptptq:GRpPPPPPPPPPPPPq
                  MD5:C6EF3A58762F9F2989BD71E60EBFF6C7
                  SHA1:0607D701A4B635B319700DFD771474EEDB5EF897
                  SHA-256:9733FAEE85F297A900F1EAB974654AC88C09B21A5520CBB0369B0199F2D36391
                  SHA-512:49729537CC0DA990D40120FA6EE0C3973F8EB75C3533388525B624A257A3BC149E1EF346269D4AA542A0F65E97CF97991A47E080219766DEFEE1501A33EBDA16
                  Malicious:false
                  Preview:BM........6...(...8...'........................................................................................................................................................................................................................................................................................@@@@@@...@``@``...................................................................................................................................................@@@@@@...............@``@``.......................................................................................................................................@@@@@@...........................@``@``...........................................................................................................................@@@@@@.......................................@``@``...............................................................................................................@@@@@@...........................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\controller8.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 44 x 30 x 24, image size 3960, resolution 3780 x 3780 px/m, cbSize 4014, bits offset 54
                  Category:dropped
                  Size (bytes):4014
                  Entropy (8bit):2.2411208663261557
                  Encrypted:false
                  SSDEEP:24:UtJtJtJtJtJtJtJt3t1ftxtRtFim/fZtJtJtJtJtJtJtJtJtxta:qvvvvvvv9vX3V/f/vvvvvvvvXa
                  MD5:A2C645D7463A7612F28C89769F552F25
                  SHA1:A4519BE2BDFA6A450ADA58EED8DB02774E8FDF1D
                  SHA-256:041E7AF9AEF03DEE151FAAEFB276B3513176ACB27AF2C1E43DB43EA8945BEF74
                  SHA-512:B143387DD7F8858F70EFBD8F0F44C159E2DC1C02000B46E76FF55AC8F1E146E1DFE38FECC2C69BD871C62C96606358846D7B0CBED1B51BBB5D5492D539CBEE9D
                  Malicious:false
                  Preview:BM........6...(...,...............x......................................................................@@@@@@@@@.....................................................................................................................@@@@@@.........@@@@@@.........................................................................................................@@@@@@.....................@@@@@@.............................................................................................@@@@@@.................................@@@@@@.................................................................................@@@@@@.............................................@@@@@@.....................................................................@@@@@@.........................................................@@@@@@.........................................................@@@@@@...................................................@@@...............@@@@@@.............................................@@@@@@.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\controller9.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 44 x 30 x 24, image size 3960, resolution 3780 x 3780 px/m, cbSize 4014, bits offset 54
                  Category:dropped
                  Size (bytes):4014
                  Entropy (8bit):2.2411208663261557
                  Encrypted:false
                  SSDEEP:24:UtJtJtJtJtJtJtJt3t1ftxtRtFim/fZtJtJtJtJtJtJtJtJtxta:qvvvvvvv9vX3V/f/vvvvvvvvXa
                  MD5:A2C645D7463A7612F28C89769F552F25
                  SHA1:A4519BE2BDFA6A450ADA58EED8DB02774E8FDF1D
                  SHA-256:041E7AF9AEF03DEE151FAAEFB276B3513176ACB27AF2C1E43DB43EA8945BEF74
                  SHA-512:B143387DD7F8858F70EFBD8F0F44C159E2DC1C02000B46E76FF55AC8F1E146E1DFE38FECC2C69BD871C62C96606358846D7B0CBED1B51BBB5D5492D539CBEE9D
                  Malicious:false
                  Preview:BM........6...(...,...............x......................................................................@@@@@@@@@.....................................................................................................................@@@@@@.........@@@@@@.........................................................................................................@@@@@@.....................@@@@@@.............................................................................................@@@@@@.................................@@@@@@.................................................................................@@@@@@.............................................@@@@@@.....................................................................@@@@@@.........................................................@@@@@@.........................................................@@@@@@...................................................@@@...............@@@@@@.............................................@@@@@@.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\drive1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 31 x 20 x 24, image size 1920, resolution 3780 x 3780 px/m, cbSize 1974, bits offset 54
                  Category:dropped
                  Size (bytes):1974
                  Entropy (8bit):1.9542074231593665
                  Encrypted:false
                  SSDEEP:6:N1el7cw70dDX5DX5DX5DX5DXoLkX5DXALiXxnXxDX5DX5DX5DXKLuXTDX5DX5DXe:ee0kZZZZoAZA+FBZZZKKXZZZ
                  MD5:A64F2BC7C5A3A1E24F68E960A0AE6BE4
                  SHA1:65AA691E07A9918C7C2D0168BE80B7DF06CC64CD
                  SHA-256:46725CA1CA009245D976ADBA0DB00DBE937337BE2278E3F5784AA9EF98F84F19
                  SHA-512:CCD447CC8ACF611E0425EF46545F01FD041227AE0829C3B74E6E2963D0C8A6B45D8D4C0CE4A3EF70C4CF29F6181F1CE87A1B4818770C34689A8214905A2C2B14
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\drive2.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 29 x 14 x 24, image size 1232, resolution 3780 x 3780 px/m, cbSize 1286, bits offset 54
                  Category:dropped
                  Size (bytes):1286
                  Entropy (8bit):2.07714922953082
                  Encrypted:false
                  SSDEEP:3:+gGl/Z8l7Hl9Xv/KtDel/l6/tel0X/llllllllllllllllllllllllllllllllld:+jl/mzKf/TC/agXy7ngX200UuqAwoN
                  MD5:8BEE5D9766AF5548B1E15432401CE032
                  SHA1:0D75F9810AA7D3A89ED8F0755A30C48CC6C2095D
                  SHA-256:9B4F878747C784B2C06CD8780568EA5D84A390B05F75D4938265763F93034685
                  SHA-512:6B11D9C0A1643321C8F125CC6A98D97B3CAF3FD0BD5D622B7D5A7DF3FECC0A67839857E4011AE456A1C71F5600EE4EBF50B7D05513BF69C159DDD1BD4FAB90A3
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\fax1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 37 x 32 x 24, image size 3584, resolution 3780 x 3780 px/m, cbSize 3638, bits offset 54
                  Category:dropped
                  Size (bytes):3638
                  Entropy (8bit):2.252291728484894
                  Encrypted:false
                  SSDEEP:48:lPL/vFbkrfPD7+/JYLsvhf1rnGPdr9bQLb/+LNvjvBLF7drJbpLDi:V
                  MD5:ACF2A23F1628389D3F8428801735202C
                  SHA1:6FB65DCE1FDAC323693947494C8D060E58F3187D
                  SHA-256:3322F6EDADE50C4A127480312E2884E72F939A0B7C59B912C67F7ADF3E3D2810
                  SHA-512:0BB3FB744EB01221D07F688F7A9D8A026FC81FA66C4B6C801619A62C81C4B89C436163575A197304638F5600A48E6862C94E3E72F63A1CB91F9609002A667CC0
                  Malicious:false
                  Preview:BM6.......6...(...%... ..................................................................................@@@@@@@@@@@@@@@..............................................................................................@@@...............@@@........................................................................................@@@...@@@@@@............@@@.....................................................................................@@@......@@@@@@@@@...@@@@@@...@@@..................................................................................@@@@@@.........@@@............@@@.........................................................................@@@@@@.................................@@@................................................................@@@@@@..........................................@@@.......................................................@@@@@@...................................................@@@..............................................@@@@@@....................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\fax2.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 15 x 13 x 24, image size 624, resolution 3780 x 3780 px/m, cbSize 678, bits offset 54
                  Category:dropped
                  Size (bytes):678
                  Entropy (8bit):2.3796276262793943
                  Encrypted:false
                  SSDEEP:12:5ZK//lpf/lZ/E/l9KRm4Oc2q7EKO6/A2moE/YI1IOC:58tRtFEt98vO6GVC
                  MD5:79F6BBE9414725E7BAFB50135CBC076E
                  SHA1:B7C3E2DB4A2A06AD3237B15EF4EE42090C0A09B8
                  SHA-256:4D88021AF923F5D3BA9D815CBB80522F07091EA17C52E7E7CD0CBEFFE115198C
                  SHA-512:F5F1D8BD11BA04E9B31AD8874DFBED5D06E93CD5832FB39E2DF2BBA01FC1C57352E9EC339FC49DD875F9AF0343140F4F5F308CB8A8B0A1B67F9BCE12EFD5A389
                  Malicious:false
                  Preview:BM........6...(...................p.....................................@@@@@@@@@.................................@@@@@@.........@@@@@@.....................@@@@@@.....................@@@@@@............@@@.................................@@@@@@...@@@.................................................................................................................................................................................@@@.............................................@@@................................................@@@................................................@@@...................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\keyboard1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 53 x 25 x 24, image size 4000, resolution 3780 x 3780 px/m, cbSize 4054, bits offset 54
                  Category:dropped
                  Size (bytes):4054
                  Entropy (8bit):1.9094506649399006
                  Encrypted:false
                  SSDEEP:24:tSU9UlUUUzUj8UUUUUbuUUUcUUUUUUMUUUjWUUUUUUUUUUUUUUtUUUUUUlUUUUU2:tc
                  MD5:883EC468C9BA04F6509ADAC54533F232
                  SHA1:B53FC0F619F3D0B64CF9991436D800730AB1BBFB
                  SHA-256:00B594E9E44BEFD935261E7D1F09B103708F17650889D1D3C178BF2DC1E8E5A3
                  SHA-512:F6AA419BEBFC9A391D1C58DED4FF17E62EB1E69CDE7E5FFC1C6C960FBAC3B007BB2A5E259B3B51E14AC307FA17EC9AB738B00EB447665D73AB171EE0DD024EC2
                  Malicious:false
                  Preview:BM........6...(...5.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\keyboard2.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 45 x 28 x 24, image size 3808, resolution 3780 x 3780 px/m, cbSize 3862, bits offset 54
                  Category:dropped
                  Size (bytes):3862
                  Entropy (8bit):2.1193950529106775
                  Encrypted:false
                  SSDEEP:48:OrfPD7I/OLBffPTfVb/Lns0OL573r/bNLV7zr7bzL7i:g
                  MD5:1D7160A6F3CAC4A5A261A4AD254D6F3A
                  SHA1:2372DDA0AFE3BA03F725B64024DDB809B477E9AF
                  SHA-256:A2793F6DCC3DB4042FBCDF21980470DE761C7D23BE058A0E3450DD301544BBC6
                  SHA-512:AF4A15F28FD790AF5EF19CB166B44A2A9AC3B1A37BC463A6C854A53C11A26BB94FBC83A97580F8E59C464F7925AEC7DACDE4F33019CE0FA76A2CC80F73CF7471
                  Malicious:false
                  Preview:BM........6...(...-.............................................................................................................................@@@@@@@@@@@@......................................................................................................................@@@@@@...@@@......@@@.............................................................................................................@@@@@@............@@@......@@@....................................................................................................@@@@@@.....................@@@......@@@...........................................................................................@@@@@@..............................@@@......@@@..................................................................................@@@@@@..............................@@@......@@@......@@@...@@@...................................................................@@@@@@..............................@@@...............@@@......@@@@@@...@@@@

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\icons\moden1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 30 x 18 x 24, image size 1656, resolution 3780 x 3780 px/m, cbSize 1710, bits offset 54
                  Category:dropped
                  Size (bytes):1710
                  Entropy (8bit):2.3168679405141708
                  Encrypted:false
                  SSDEEP:6:ssTtJtJtJtJtJtJtNYlhAqlR//Ia//4o/H/gw/f/AYn/4Y/n/ASA:ssTffffffg///Hn/H/n//fA
                  MD5:F261A8ED7C62AB1E778B15BA154C7A74
                  SHA1:D9CA54FD6968FDC2C060C297B93E9599708B65A6
                  SHA-256:23ADFEC92E661184927BBF1F8EE6EF110FB9445629DC8FD6FD4E817C28724152
                  SHA-512:65DD77435492C5B60F2DD220B9F4BD49F230552BA3ADA0B36C230A654281F055BA17BE91CBF7FF41F87AEA0E5F4B4733C1B7FBD5521623DFD5AEDF176D2C2302
                  Malicious:false
                  Preview:BM........6...(...................x.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light1-black.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 17 x 17 x 24, image size 884, resolution 3780 x 3780 px/m, cbSize 938, bits offset 54
                  Category:dropped
                  Size (bytes):938
                  Entropy (8bit):2.4811537602298523
                  Encrypted:false
                  SSDEEP:24:oC6rTGitII4iXPbZBAiXfnlxXIx7FI2itkiTg:oz/e1
                  MD5:CC438B39004F40ADF8F6A8E00E64E30B
                  SHA1:67EDF3DDE365B86567F02B3A702BFC59BA8210D6
                  SHA-256:BED07F9A7837D4761262F3D247E6A89E765A080BC0617C164CED8A294562684F
                  SHA-512:A507CB2B166640719BE4BAC1E7505D80C96D1F61149DE7F2061F2597699B96CB92D2DBB9A910539A2C2F3E34D39E823286D5F91662D1B654F4824AD56FE0634A
                  Malicious:false
                  Preview:BM........6...(...................t.......................................................................................................................................... .... .... .... ................................@ .......@ ....@ ....@ ...................................... . .... .... ....................... .............@ .......@ ....@ .............. . .... . ............. .... .................... .... . .... .......@ .......@ .............. ................ ............. .... .............. .55..77....77 .... ..........@ ....................55............. . ............................. .55..........55. . ....... .@ ..................77 .55....55. .... .................................77 ..77...... . ....... ...................................... . . ...................................... . . ...........................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light1-blue.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 17 x 17 x 24, image size 884, resolution 3780 x 3780 px/m, cbSize 938, bits offset 54
                  Category:dropped
                  Size (bytes):938
                  Entropy (8bit):2.252021411435947
                  Encrypted:false
                  SSDEEP:24:oC6rTFtFiI4iXfKKiPKXnKK3HRW3Hi4CK4CAgiXCiqqRKCiXYq4nI2trTg:oU
                  MD5:41E25BB11EF209C18B99F2EAB2075866
                  SHA1:ACF56EDB4C8684A88C509B0FEA88A6D7A0E88CFC
                  SHA-256:E4353598E6BF9CA3076B39722777EB95D234B9FD00D9F7D9817CF20DEF684592
                  SHA-512:55919CAF7B4402CDA6B4A8A6476E14D2917BCE9A4F8B32A0F9D53E544B05FCE62A1FD8824B0C24B67DB8C159F8C7D1E1D98ED7A626117C79486D309036552CD4
                  Malicious:false
                  Preview:BM........6...(...................t.........................................................................................@..@..@..@..@.................................@..@..@.....@.....@..@..@........................@...........@.....@.....@.....@..................@.......................@.....@.....@...............@....................@.....@.....@..@............@................................@.....@..@.........@...................................@.....@.........@......................................@..@.........@...................................@.....@.........@......................................@..@............@...................................@...............@...................................@..................@.............................@........................@..@.................@..@.................................@..@..@..@..@.........................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light1-brown.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 17 x 17 x 24, image size 884, resolution 3780 x 3780 px/m, cbSize 938, bits offset 54
                  Category:dropped
                  Size (bytes):938
                  Entropy (8bit):3.52323846106138
                  Encrypted:false
                  SSDEEP:12:o/eJ6kiTrtznfXfA/tvn57tj3XtIiLFq0wvv07XKb/HFIrCitkiTg:oC6kiTrtzfXf63BLFpLX0IWitkiTg
                  MD5:ABF5388B51D08B678F78266724D191BC
                  SHA1:4D9D3B485CA73473CD9B5505DBE135838EC9654D
                  SHA-256:94AFAC8A91A039B01E8F29B8C09B8DA6B7A197986AFBCCF432486346D256709E
                  SHA-512:8362CDFDDFB0D5CEEE3741655553F3C44FF190C56500B10830FA4AD033F7B24EA75BB8C7F71F1EEDCD471C7A802141AA189D5DB1DF6FD29C380F87F09D4C101B
                  Malicious:false
                  Preview:BM........6...(...................t.........................................................................................@.....@..@....................................@.....<Z.<Z.<Z.<Z.<Z.@..@........................@..<Z.<Z.<Z.<Z.<Z.<Z.<Z..@`<Z.@. ................@..<Z.<Z..i.<Z.<Z.<Z.<Z.<Z.<Z.<Z.<Z.@...................i..i..i..i.<Z..i.<Z.<Z.<Z.<Z.<Z.@ ...............i..i..i..i..i..i.<Z..i.<Z.<Z.<Z.<Z..@`@............@...i.@...i.@...i..i..i..i.<Z.<Z.<Z.<Z.@. ..........@..@..@..@..@..@...i..i.<Z..i.<Z.<Z.<Z.@............@..@..v..v....v..@...i..i.<Z..i..@`<Z.@............@..@..v..........@...i..i..i.<Z.<Z.<Z.@............@..@..v..v......v...i.@...i..i.<Z.@. .............@..v..v..v..v..v..@..@...i..i..i.<Z.@.....................v..@..v..@..@...i.@...i..i.@........................@..@..@..@..@..@...i.@.......................................@.....@............................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light1-dgrey.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 17 x 17 x 24, image size 884, resolution 3780 x 3780 px/m, cbSize 938, bits offset 54
                  Category:dropped
                  Size (bytes):938
                  Entropy (8bit):3.4127257654800855
                  Encrypted:false
                  SSDEEP:12:o/eJ6kiTNAtfdrC4X06ACPt2qWLtKt4ridMwFfqXbzISitkiTg:oC6kiTCttvX06MydMKyXbzISitkiTg
                  MD5:9316060020550781BA6912DA6969B406
                  SHA1:7A221C4F78AD8A5D93A02579ECADB8AC43B28C0D
                  SHA-256:E282470A3195338C3D8820C248058D167D18204C35190D8204197069DBA57222
                  SHA-512:8CF07376EEE93F96A791FD726CB8EEBE500AE3536B537D68D1CDABA999CC1AB4CAB58344D8772542B21D53FBD13DEC0647A1D4707E20642F0A1EF85C40376A14
                  Malicious:false
                  Preview:BM........6...(...................t.........................................................................................@.....@..@....................................@.....IIIIIIIIIIIIIII@..@........................@..UUUIIIUUUIIIUUUIIIUUU888III@. ................@..UUUUUUfffUUUUUUIIIIIIIIIUUUIIIIII@..................fffpppffffffUUUfffUUUUUUIIIIIIIII@ ..............pppppppppppppppfffUUUfffUUUIIIIIIUUU888@............yyypppyyypppyyyfffpppffffffIIIUUUIIIIII@. ..........yyyyyyyyyyyyyyyyyyppppppUUUfffUUUUUUIII@............yyyyyy............yyyfffpppUUUfff888III@............yyyyyy............yyyppppppfffUUUUUUIII@............@..|||...............pppyyyffffffIII@. .............@.................yyyyyyppppppfffUUU@..............................yyyyyypppyyyffffff@........................@..@..yyyyyyyyyyyyppp@.......................................@.....@............................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light1-green.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 17 x 17 x 24, image size 884, resolution 3780 x 3780 px/m, cbSize 938, bits offset 54
                  Category:dropped
                  Size (bytes):938
                  Entropy (8bit):2.8707367816078024
                  Encrypted:false
                  SSDEEP:24:oC6E1otSIcXUpEKEvRIyFNQXRqqKzBxiIlHt/g:ocKpEKEvRIy73Hy
                  MD5:0C29DE993218762873960B4AF273C157
                  SHA1:EDEFC7BA90451DD6B6421F97936B255FBA8463CD
                  SHA-256:F0DB045831396314E7479F816732538555E92C558A523D7B8B91224E7501BC7C
                  SHA-512:FE3F1AD8157523FDA7004BF6695A8FDC193126A1B3A1F3204783ABF8D1BE13B88630F938D7CDE72B880EAA0753B1C1FF7826E06B613837B38B24C8F01CFC20AB
                  Malicious:false
                  Preview:BM........6...(...................t..........................................................................................X..@..[..@..X.................................X..@..X..y..[..y..X..X..@........................@..y..y..y..X..y..X..y..X..y..@..................`..y..y..y..y..y..y..y..X..y..X..y..@...............@..............y.....X..y..X..y..X..X............X.................y.....y..y.....X..y..X..X.........@.......................y.....y.....X..y..@.........X..........................y..y..y..y..X..X.........@.............................y.....X..y..@.........X..............................y..y..X..X............@...........................y..y..@...............X................................y..X..................@.............................@........................@..X.................@..@.................................X..X..@..X..X........................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light1-grey.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 17 x 17 x 24, image size 884, resolution 3780 x 3780 px/m, cbSize 938, bits offset 54
                  Category:dropped
                  Size (bytes):938
                  Entropy (8bit):3.220419808801129
                  Encrypted:false
                  SSDEEP:24:oC6kiTIbtMISXX1hf+QoTMbXSVIZKitkiTg:oX3+QoTUs
                  MD5:54B4B6611C13AB80325421E6D7707C73
                  SHA1:CD582DEB344F2CA57558645C2002B9111B900C9D
                  SHA-256:FF4656643AB6FD00815CA25DFE19C6A051B504BA5C138475128F9D9D87C65F03
                  SHA-512:461FD7CD3C6BFFD996EBE70FE2F49F9B028880F0E01B4B937891B2CB44ED6660BE5096188B4F3ED19FB6DA31E5675F39653DC610CB7AF0FA261710A30D682030
                  Malicious:false
                  Preview:BM........6...(...................t.........................................................................................@.....@..@....................................@.....bbbkkkbbbbbbbbb@..@........................@..kkkkkkkkkbbbkkkbbbkkkbbbkkk...................@...........kkk...kkkkkkbbbkkkbbbkkk@....................................kkkkkkbbbkkkbbb@..........................................kkkbbbkkkbbb........................................kkkkkkbbbkkk@..........................................kkkkkkbbb..............................................bbbkkk@..............................................bbb@............@..............................bbb@...............@................................kkk@. ..............................................@........................@..@.................@.......................................@.....@............................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light1-lblue.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 17 x 17 x 24, image size 884, resolution 3780 x 3780 px/m, cbSize 938, bits offset 54
                  Category:dropped
                  Size (bytes):938
                  Entropy (8bit):3.01422450215529
                  Encrypted:false
                  SSDEEP:24:oC6kiTFt7gImOXtVOmZ4OGWGJXrXXYIZhtrTg:ojVjSnPG
                  MD5:734D448941CCE0F8652A834F63373EEB
                  SHA1:6715891E99D1C80F4C631396D6276654FB7CDE69
                  SHA-256:78EB226E877F914643662F0E08E5F2AA59C86FE203984CBBEEEB1988AD7E6AAF
                  SHA-512:3E045DCDE3F5C09DEA90AFFEB0BD207700C23B8E2F2519AA659C5117BF92EABD785630F13CE0965B3A504B76DF8A52111A2FA3692F006B145462E3B8C6765F25
                  Malicious:false
                  Preview:BM........6...(...................t.........................................................................................@.....@..@....................................@.....HH.ff.HH.ff.HH.@..@........................@..qq.qq.qq.HH.qq.HH.ff.HH.ff....................@..qq.qq.qq.qq.qq.qq.qq.HH.ff.HH.ff.@...............@........qq....qq....HH.qq.HH.ff.HH...................................qq.qq.qq.qq.HH.ff.HH.@.................................qq....qq.qq.HH.ff.@....................................qq.qq.qq.qq.HH.@.......................................qq....HH.ff............................................qq.qq.HH.@............@.............................qq.qq.@...............@................................qq............................................qq.............................@....................@..@.................................@..@ .@..@ .@.........................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light1-mag.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 17 x 17 x 24, image size 884, resolution 3780 x 3780 px/m, cbSize 938, bits offset 54
                  Category:dropped
                  Size (bytes):938
                  Entropy (8bit):3.275992349622471
                  Encrypted:false
                  SSDEEP:24:oC6tvJqEVHfH0DbzYj1b+JO1Y3E1bbbQZxqmtvJg:oVvRNH0DbzYj1b+k1Y01bbbQ+OvO
                  MD5:780544585CD1FC7E7298040CE9A8C032
                  SHA1:D67817F462BA24DB2D6B0BF1C2876930EDC32D64
                  SHA-256:ADDE001C4D312E05D9ADCE61FE01E4964BDD214C10484FD535A572DB6D8FCC7E
                  SHA-512:F3484343A85E7EAE693F1D1440AFFE0A4C79B68D5315BEBADE33478DDC186D021C3BBB168A64B08175E9740C6B2E04506F3FB99A8A1294679334A1B0392FB175
                  Malicious:false
                  Preview:BM........6...(...................t..........................................................................................BB..+.BB..+.BB................................BB..+-.Bf.f-.Bf.f-.B.BB..+........................+f.ff.ff.f-.Bf.f-.Bf.f-.Bf.f.BB.................BBf.ff.ff.ff.ff.ff.ff.f-.Bf.f-.Bf.f..+...............+............f.f...-.Bf.f-.Bf.f-.B.BB...........BB...............f.f...f.ff.ff.f-.Bf.f-.B..+.........+.....................f.f...f.ff.f-.Bf.f.BB........BB........................f.ff.ff.ff.f-.B..+.........+.........................f.f...-.Bf.f.BB........BB..............................f.ff.f-.B..+............+..........................f.ff.f.BB..............BB.............................f.f..+................. @............................+.......................BB..+...............BB..+................................BB..+.BB..+.BB.......................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light1-orange.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 17 x 17 x 24, image size 884, resolution 3780 x 3780 px/m, cbSize 938, bits offset 54
                  Category:dropped
                  Size (bytes):938
                  Entropy (8bit):3.230391220402337
                  Encrypted:false
                  SSDEEP:12:o/eJ6kiTVtZPXTA//t2vtleItxp1iMKkmHSH11YXXBhAI1YitkiTg:oC6kiTVtZPXTN4MwHSYXXBmI1YitkiTg
                  MD5:11E643B75151308FE91DE9E87B542D56
                  SHA1:A779C8714157EF493E108596CC5E4BBEA5BA2A3A
                  SHA-256:FBC5C2CE4A95922580B49B129A98358AF1B85F5C0BED19AC5522A29F8249D4FB
                  SHA-512:F599ED66E9F51C485BFB0B9426DCAF648364FF809F7881703E5763CB0EAB6423CC55BF38E312B76DDBD9A612B5F477F6609DF8AA44DBC924D88FD5D1AB254380
                  Malicious:false
                  Preview:BM........6...(...................t.........................................................................................@.....@..@....................................@......C..C..C..C..C.@..@........................@...C..C..C..C..C..C..C...l.C.@. ................@...C..C..V..C..C..C..C..C..C..C..C.@...................V..V..V..V..C..V..C..C..C..C..C.@ ...............V..V..V..V..V..V..C..V..C..C..C..C...l@................V.....V.....V..V..V..V..C..C..C..C.@. .............................V..V..C..V..C..C..C.@..................<..<..u..<......V..V..C..V...l.C.@..................<........u......V..V..V..C..C..C.@............@.....<..<.....u..<...V.....V..V..C.@. .............@..<..<..<..<..<.........V..V..V..C.@.....................<.....<.........`.....V..V.@........................@..@...............`.@.......................................@.....@............................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light1-purple.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 17 x 17 x 24, image size 884, resolution 3780 x 3780 px/m, cbSize 938, bits offset 54
                  Category:dropped
                  Size (bytes):938
                  Entropy (8bit):2.814164698517714
                  Encrypted:false
                  SSDEEP:24:oC6kiTltliIvXYiaCH9m6XOiX2iIxtrTg:oyCHH
                  MD5:1C07DACC6BC522FD8BDAAB5D2E3E8E1F
                  SHA1:A3DCFA8791933E36B2CE899F096A35682973967D
                  SHA-256:63BD77699EAB9593DEAEC341A97F4C7DC4806B041CA9310547AF873125990067
                  SHA-512:7EBD4B6C83B26B9BB6C5721A08F6E23693411B931FEB812F8C56BECA3A308845280A672942F7220A5CBD39A9C7927FF56AD91CE8820CF1F26E08520DA23EA1EB
                  Malicious:false
                  Preview:BM........6...(...................t.........................................................................................@.....@..@....................................@.....@.`...@.`...@.`@..@........................@...........@.`...@.`...@.`......................@.......................@.`...@.`...@...............@....................@.`...@.`...@.`..............................................@.`...@.`@.............................................@.`...@................................................@.`@. ...........................................@.`...@................................................@.`@. ..........@...................................@...............@............................................................................................................@....................@..@.................................@..@. @..@. @.........................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light1-red.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 17 x 17 x 24, image size 884, resolution 3780 x 3780 px/m, cbSize 938, bits offset 54
                  Category:dropped
                  Size (bytes):938
                  Entropy (8bit):2.6740329783701338
                  Encrypted:false
                  SSDEEP:24:oC6kiTFtFiIYw4iDfS04bGR36wffRiXNTiXe41JtEiTg:ojJ8j
                  MD5:BA5A77B917224BFEC61AE669E3CF061B
                  SHA1:97A40A525C4DDD940EB93137E8B8DA794962B8E1
                  SHA-256:C31C0D9C67BD6D270164807F1B06955D5DA78F192ADC28FEDC3272D2BCEBB441
                  SHA-512:1551C275575669D41531C0744D695448BDA71D77009AC3E0B4B8ABF5128994E6BE87531ABBB2D431A09AEEBBD37F8434A39894620D1FF0A30CD28B0D52C596A7
                  Malicious:false
                  Preview:BM........6...(...................t.........................................................................................@.....@..@....................................@...... `.... `.... `@..@........................@............ `.... `.... `...@..................@..................... `.... `.... `@. .............@... .. .. .. ..... ........ `.... `@................ ..... .. .. ................. `.... `@. .............. ..... .. .. .. .. ........... `...@............. ................. .. .............. `@. ................................ .. .. ..... `...@................................ .. .. ........ `@. ..........@...................... .. .......@...............@........................ .. .. ....@..................@.................. ..... ....@. ......................@.................. .@..@.................................@..@. @..@............................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light1-white.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 17 x 17 x 24, image size 884, resolution 3780 x 3780 px/m, cbSize 938, bits offset 54
                  Category:dropped
                  Size (bytes):938
                  Entropy (8bit):3.4349787946230173
                  Encrypted:false
                  SSDEEP:24:oC6kiTCtaIcFXpitsMGf4atXaXLI9itkiTg:o3DosMGQk
                  MD5:4F491FBB378E2E714D669BF02ED10BFC
                  SHA1:1202AFA4618E90444786D23ED85899CF098C08B5
                  SHA-256:F1E0580177754DFC1C0BA28E8346D803E80A5F9B44CBD40376E65BFDBE0FF506
                  SHA-512:88CC1F69F368D46470771B64085571017CFF900892371DA3E177C26870B8B135BA6B2C45355C56369E9438BBDA2839D88608AC41B3D84B2CF6770A295BDD5FE8
                  Malicious:false
                  Preview:BM........6...(...................t.........................................................................................@.....@..@....................................@....................@..@........................@................................................@...................................@................................................@.......................................................................................................@.....................................................................................................@..................................................@............@.................................@...............@...................................................................................@........................@..@.................@....................................@.....@..@............................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light1-yellow.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 17 x 17 x 24, image size 884, resolution 3780 x 3780 px/m, cbSize 938, bits offset 54
                  Category:dropped
                  Size (bytes):938
                  Entropy (8bit):2.7073486394133677
                  Encrypted:false
                  SSDEEP:12:o/eJ6rTG+fPPA1t1tVtztPiMGjfXgG1m+Ecg:oC6rTG+fPPrvfXx1m+Ecg
                  MD5:138DB1AC08A370CB62D7D4BCC6239A2A
                  SHA1:874C5EEB08D166DB5206B25F2A4D50BE0ABCA863
                  SHA-256:EABE0F11E5EDE67238B98EAF2C13A8846E9FDC3E50F11FACA7941335384AF51F
                  SHA-512:F28CC649487047C0576DC3299B7E29A8B25FA8279AED12E4D9C6DF7A3210D0F3E9C03118014838C4DECBCEF15C53E9E9520A848CA03F075F2A19D824CF12740A
                  Malicious:false
                  Preview:BM........6...(...................t..........................................................................................``. @.``. @.``................................``. @.``....``....``.``. @....................... @..........``....``....``.... @.................``......................``....``.... @.............. @...................``....``....``.``...........``...............................``....``.``........ @..................................``.... @........``.....................................``.``........ @..................................``.... @........``.....................................``.``........... @.................................. @..............``..................................``................. @............................ @....................... @.``................``. @................................``.``.``.``. @.......................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light2-black.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 11 x 11 x 24, image size 396, resolution 3780 x 3780 px/m, cbSize 450, bits offset 54
                  Category:dropped
                  Size (bytes):450
                  Entropy (8bit):1.5669165206630171
                  Encrypted:false
                  SSDEEP:6:tKl/6027UAuAAAAAAAA//Ju//eAu//Jl/WAl/vffff5l/WAl/Ju//eAu//JuAAAM:tKt6023QY4nXnfY4m
                  MD5:78CAB0CDDBA9F602BAEA3E4F2430EF52
                  SHA1:91092A3725363E4F48683849ED62CAA35F70B089
                  SHA-256:205CD404990ABC3F014DFDABE1A46F58EA1CF5D68B2F2186136059E85973544F
                  SHA-512:BCDC0197575ABC10837BC478C243901BD6B4AB55C32EBD0D4A108A31F51B700F2AF00545DACE7BE3B91AC330D240B6EDBC8EFA06254BFEC3387C462E0C52759A
                  Malicious:false
                  Preview:BM........6...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light2-blue.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 11 x 11 x 24, image size 396, resolution 3780 x 3780 px/m, cbSize 450, bits offset 54
                  Category:dropped
                  Size (bytes):450
                  Entropy (8bit):2.0436869602168195
                  Encrypted:false
                  SSDEEP:6:tKl/6027UAuAAAAAAAA//Ju/xu//Jl5l/1t5ANy4INyqtNX9ghlQy43l/Ju/xu/8:tKt6023QY4nXtKN0NptNXeh+LfY4m
                  MD5:4CC275A4817D0E8E6CB46700DF7555EE
                  SHA1:CD65528A259B219C0B692F01960E202CBC59645B
                  SHA-256:86041A84F083B3B6DBEBE4C416FFAB90827D0F37B7A257F9761189378E10D8BA
                  SHA-512:0B242F8F15818B73684DF1D1E340C3272CDC2B882B0BB191D26475A10DD0CC4EBCE90FE0375447E94D5D98B2BE2C074E28FB2B0C7371B582E99220B9525D2DB8
                  Malicious:false
                  Preview:BM........6...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light2-brown.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 11 x 11 x 24, image size 396, resolution 3780 x 3780 px/m, cbSize 450, bits offset 54
                  Category:dropped
                  Size (bytes):450
                  Entropy (8bit):2.792627165270167
                  Encrypted:false
                  SSDEEP:6:tKl/6027UAuAAAAAAAA//Ju/0//Jlb/uuuoAuSVIouSV3e4NAuSV3YNAJl6VvNDM:tKt6023Q3VGRmYoiv3m
                  MD5:DDF58526042DD15A06603AF5F731BCB5
                  SHA1:9A2EAE48ECD9F13709F234AC8354EEE38B9BF140
                  SHA-256:4602B209F1F5D994F09BA8788E6D6660A24133AE8B7B2C716B654CC990509FF2
                  SHA-512:301F5F02E79A69AB7CC58D6247CB701E69FFE43FD7C4F3496F0922552FABA26B20C1AB3424186BAEA843E52F4F00EEC796718F42BF479A3C8021DD201FBAA0BB
                  Malicious:false
                  Preview:BM........6...(....................................................................................@`.@`.@`.@`.@`...................@`.@`.@`.@`.@`.@`.@`.............@`.@`.@`.@`.@`.@`.@`.@`.@`..........@`.@`.7p.@`.@`.@`.@`.@`.@`..........@`.7p.7p.@`.@`.@`.@`.@`.@`..........@`.7p.@..7p.7p.@`.@`.@`.@`..........@`.7p.@..@..7p.@`.@`.@`.@`.............@`.7p.7p.7p.@`.@`.@`...................@`.@`.@`.@`.@`.................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light2-dgrey.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 11 x 11 x 24, image size 396, resolution 3780 x 3780 px/m, cbSize 450, bits offset 54
                  Category:dropped
                  Size (bytes):450
                  Entropy (8bit):2.7183198399656536
                  Encrypted:false
                  SSDEEP:6:tKl/6027UAuAAAAAAAA//Ju/iWA//Jl2YW//OOC6wh6wsD3YQQwzQnlygW//Ju/X:tKt6023QVtdT6u6B3QqQnZgVtm
                  MD5:A25086CFB8242FFA458B6DAB5C02451B
                  SHA1:65D5E89C45AC749B75056B25E688801D34D4D0AB
                  SHA-256:D15B55074C898D98BBF1C01B2B4281580DDEF6C5D237EDC139B3298B5E16BC60
                  SHA-512:B95A10754CE7CD296B4E81C2D6F34FF68EAAAC0C7914392BEF816E3B5FBBC6542EF2DBBCE081686F21077E1E8B21F4CCF975818CC23C2399267826E3CA8133BD
                  Malicious:false
                  Preview:BM........6...(....................................................................................@@@@@@@@@@@@@@@..................@@@@@@YYY@@@@@@@@@@@@............@@@@@@YYYYYYYYYYYY@@@@@@@@@.........@@@YYYdddYYYYYYYYY@@@@@@@@@.........@@@ddddddYYYYYYYYYYYYYYY@@@.........@@@ddd...ddddddYYYYYY@@@@@@.........@@@ddd......dddYYYYYY@@@@@@............@@@dddddddddYYY@@@@@@..................@@@@@@@@@@@@@@@................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light2-green.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 11 x 11 x 24, image size 396, resolution 3780 x 3780 px/m, cbSize 450, bits offset 54
                  Category:dropped
                  Size (bytes):450
                  Entropy (8bit):2.040093704258043
                  Encrypted:false
                  SSDEEP:6:tKl/6027UAuAAAAAAAA//Ju//qlAlu//Jl/SlAll/9lFlBCl5l/SlAll/Ju//qle:tKt6023QVi4Qi/v/CnQifVi4m
                  MD5:9CB4DE5896BFA51BD8139A1638F8260F
                  SHA1:B0A5FC8B91A8CA5D5A300A9BB2656B6A604B08E4
                  SHA-256:7CD7B6D7C73A0EE73B2929AA569EF37F333EBEBCF949B3983549E715D3C30534
                  SHA-512:0004822E666EF717443115F5BA43E1F42C6E5DA76AD48D1723B2A395E45DAF89FFAEF2368DFC0EE7FC518A3A62AD0C28DE01CFF7D611D8D109CA9C5431017E4E
                  Malicious:false
                  Preview:BM........6...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light2-grey.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 11 x 11 x 24, image size 396, resolution 3780 x 3780 px/m, cbSize 450, bits offset 54
                  Category:dropped
                  Size (bytes):450
                  Entropy (8bit):2.993073802923537
                  Encrypted:false
                  SSDEEP:6:tKl/6027UAuAAAAAAAA//Ju/C5ytA//Js/BD8/l/lFbX1fZX7ynLOwKunLL75EL/:tKt6023QfsSl4LC0LPc8sTAFfm
                  MD5:F0518B1A7957D158E5472CF51AF18C59
                  SHA1:4C055A10E7F964EB1629182DDF9F326EEAABB9DD
                  SHA-256:30FF012F0F46A61CCCD71596A31D3EBB8790E71D56AE665F6BAEA55F88FCF05F
                  SHA-512:E51F75F070820BCF8846B109E5D04A1BB27E90C4B94D408515935081F7CE53C194FFC32DA4C74E63533780B503E54BEDA1B29984ACFB6B3FE0CB32BA447D4FC6
                  Malicious:false
                  Preview:BM........6...(.......................................................................................ooo...ooo.....................ooo...............ooo...............ooo..............................ooo.........................................................ooo.........ooo......................................................oooooo............ooo.......................................ooo...ooo...................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light2-lblue.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 11 x 11 x 24, image size 396, resolution 3780 x 3780 px/m, cbSize 450, bits offset 54
                  Category:dropped
                  Size (bytes):450
                  Entropy (8bit):2.2659226277385285
                  Encrypted:false
                  SSDEEP:12:tKt6023QVi4mcQijP1Nx1116St9P6Stv13q26SthO6SifVi4m:tu6D3QVi4PQiSS2S0SnzSifVi4m
                  MD5:6751562ED5A1136038CF16D7C7C99322
                  SHA1:F070451B837FA4CE6442845AB6D60B890833F5CA
                  SHA-256:B5749955ABB8B0190F74C68AFF9B97600465ACEB5AFE3B93C4CF4BBAEFFF4F76
                  SHA-512:F5FEB5A5051B2B4CC7BDE0AB10B1EC565AD1FAE8EB4E8CFBBE01DE244D84FE0A611E289751C122C0877FD36A37C5F3BCDD7546495F7FC93CD044043F61C0D83B
                  Malicious:false
                  Preview:BM........6...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light2-mag.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 11 x 11 x 24, image size 396, resolution 3780 x 3780 px/m, cbSize 450, bits offset 54
                  Category:dropped
                  Size (bytes):450
                  Entropy (8bit):2.62458983279989
                  Encrypted:false
                  SSDEEP:12:tKt6023QXnGKlclPKlllguLl3lltz5u0Xm:tu6D3QXXlclilllgKl3llZ5FXm
                  MD5:AF82806F89C43EAFF287D56748F699E1
                  SHA1:0B8831819CFAEFE2527ECABE984060D2CD0ACC26
                  SHA-256:FAE0571D77D0D32AD85728D2CA2DD28EDAFD9F1D1708475DA895A1A20280789B
                  SHA-512:11238B600A56D6367581BA92DCA5AD92FA0CC47F17EC8C2612C55F8666B4EA1E51303911E9FB18ECAD3D39E7BECB983717B9E5A03F710964D5AEF2D59FF65C0E
                  Malicious:false
                  Preview:BM........6...(...............................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light2-orange.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 11 x 11 x 24, image size 396, resolution 3780 x 3780 px/m, cbSize 450, bits offset 54
                  Category:dropped
                  Size (bytes):450
                  Entropy (8bit):2.7264278884249684
                  Encrypted:false
                  SSDEEP:6:tKl/6027UAuAAAAAAAA//Ju//qWA//Jl/SW//1BrzIYenl/gW//Ju//qWA//JuAK:tKt6023QVtQKBr8YenCgVtm
                  MD5:90D10E294B1822324B5D631634C8CD8C
                  SHA1:5D2B0CEE5A65173ABB6D2B7583F6A3C7D35D5F3D
                  SHA-256:52FCCEA986CDBC44F94C988617E382ED05BAE5F98AFD25F12FBC6966FEDCCAE7
                  SHA-512:4623A13CD5EA89DFACB1724626D3AF2C444205BA35AACD4210F57D845F57D0BE45291F0519BCE468A1F6FA9B5D464C16C2EFC6DCC660B9AAD5F35A47F694F11C
                  Malicious:false
                  Preview:BM........6...(.....................................................................................`..`..`..`..`....................`..`..`..`..`..`..`..............`..`..`..`..`..`..`..`..`...........`..`..l..`..`..`..`..`..`...........`..l..l..`..`..`..`..`..`...........`..l.@...l..l..`..`..`..`...........`..l.@..@...l..`..`..`..`..............`..l..l..l..`..`..`....................`..`..`..`..`.................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light2-red.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 11 x 11 x 24, image size 396, resolution 3780 x 3780 px/m, cbSize 450, bits offset 54
                  Category:dropped
                  Size (bytes):450
                  Entropy (8bit):2.399686704946286
                  Encrypted:false
                  SSDEEP:6:tKl/6027UAuAAAAAAAA//Ju//s//Jl/z/H/H/j/nfw/eFs/Jl/7/Ju//s//JuAA5:tKt6023QX9fLvfw9hXXm
                  MD5:1B997A7876D490EC383A1FAA2D146B91
                  SHA1:8F86FE00F4E132EF00599127A0EBDBD077504F30
                  SHA-256:725E7B3FD1001FB64570BD7809BA3FD1C28EC9607953FE7093B2B1BA727F7683
                  SHA-512:E93000BAFD813E50AD93BA8119AA2E6EFCF9E8CCA1C34889FCA9A71D93B737A5811D98069342E31129BC3902C7C90CC3D47C7FAE0B0545C70CC56D71EA1EF753
                  Malicious:false
                  Preview:BM........6...(............................................................................................................................ .. ............................. .. .. .. ..... ................. .. .. .. .. .. ............................. .. .. ............................. .. .. .. ................................ ................................ ........................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light2-white.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 11 x 11 x 24, image size 396, resolution 3780 x 3780 px/m, cbSize 450, bits offset 54
                  Category:dropped
                  Size (bytes):450
                  Entropy (8bit):2.990665921092451
                  Encrypted:false
                  SSDEEP:6:tKl/6027UAuAAAAAAAA//Ju/iWA//JloA//OWe+eoleqqeg5l0A//Ju/iWA//JuP:tKt6023QVtZapVtm
                  MD5:5781B76C741E394C5408E864D3F9CB12
                  SHA1:475991DF3F786A31E2CA9434EA90E1718C8AFE65
                  SHA-256:901FA1BC6F7503AEDAA58C8F793B8BF1376CD924DB9F43D445D21EF0A067E8A6
                  SHA-512:AD2FA0CFFD9FAC913F955E76B625C485B6B868EC12D375A39A9F425E7669439BC162215ED7D0FE91F1F6F1E852D24EE168BD8068029666EDF7ABEBDA0380AB4D
                  Malicious:false
                  Preview:BM........6...(....................................................................................@@@@@@@@@@@@@@@..................@@@..............@@@............@@@....................@@@.........@@@....................@@@.........@@@.....................@@@.........@@@....................@@@.........@@@....................@@@............@@@..............@@@..................@@@@@@@@@@@@@@@................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light2-yellow.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 11 x 11 x 24, image size 396, resolution 3780 x 3780 px/m, cbSize 450, bits offset 54
                  Category:dropped
                  Size (bytes):450
                  Entropy (8bit):2.2659226277385285
                  Encrypted:false
                  SSDEEP:6:tKl/6027UAuAAAAAAAA//Ju//jA//Jl/7//1t/H/H/Vu/Yt/Vu6/Jl/7//Ju//jr:tKt6023QXXtffdu/Ytdu6hfXm
                  MD5:50678F441075D2BCAB5FD71BCBAFE354
                  SHA1:2FFC04A7EA2D2B2AB9E35485F8E0C528AFFAE8B6
                  SHA-256:E68CCBFA5730404563661F9EFA9C739C2DF750C28DE55492DAF34C81404D0433
                  SHA-512:BBE459C7C171935E454DBFE687B7B1979EB9888B6BD5D831643A3BCAB6FE23CE3885F71E6B263367A67DA88CE83DCA178FD7BBBB2F9FFAB9838E7DB88E6A8023
                  Malicious:false
                  Preview:BM........6...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light3-black.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 14 x 14 x 24, image size 616, resolution 3780 x 3780 px/m, cbSize 670, bits offset 54
                  Category:dropped
                  Size (bytes):670
                  Entropy (8bit):1.2847679189328869
                  Encrypted:false
                  SSDEEP:3:wfl/jl8lnvFXmtWtVllllllllllllllllllllllllllllXHllV/tHllV/tHllV/p:wYgw4wt
                  MD5:6FFEC7802154EF504C6053BA4FD5D1D7
                  SHA1:75A848F7E09BC94F3147D80A76E662E441D0879D
                  SHA-256:154EA7C7C89B31AE23CF15F92E046E25847F1F7643FCBF543C57A8E94953BBF8
                  SHA-512:5ACDE2EFD7C6C9946CF4D33D823E9D10BA8524CCCD102E93EAAF51313E179C45F174DA549358418834F533B49417B1E316353CC3077274BD4F00B18FEFDBAD10
                  Malicious:false
                  Preview:BM........6...(...................h.....................................................................@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@.........................................@@@.........................................@@@.........................................@@@.........................................@@@.........................................@@@.........................................@@@.........................................@@@.........................................@@@.........................................@@@.........................................@@@.............................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light3-blue.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 14 x 14 x 24, image size 616, resolution 3780 x 3780 px/m, cbSize 670, bits offset 54
                  Category:dropped
                  Size (bytes):670
                  Entropy (8bit):1.3607477354106046
                  Encrypted:false
                  SSDEEP:3:wfl/jl8lnvFXmtWt41ltt1l1l1lllettttttttt1llettttttttt1llettttttt7:wYgwXGGGGGGGGGRqqqqqqqqqOwt
                  MD5:726ABF29D34C72892AE634A1BD9E847F
                  SHA1:6E09721B19CF74E082C59B99BDE7E35DC7CA06F5
                  SHA-256:F8FAC37A76FFC773AC3040BC4B4EB44189AAB2969146E782A2F990AA82D251B7
                  SHA-512:A56D17A4ED3FEA55A5413B656C7D82E9C70EA269B1AFDF1E324BAB3A844104C67874B1562E9DC2F523DB3BF7CBDAC56B4F4AAA645C64ECEBFAC419530DA78CD5
                  Malicious:false
                  Preview:BM........6...(...................h.....................................................................@.....@..@..@.....@.....@.....@...........................................@...........................................@.......................................................................................@...........................................@...........................................@...........................................@...........................................@...........................................@...........................................@...........................................@...................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light3-brown.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 14 x 14 x 24, image size 616, resolution 3780 x 3780 px/m, cbSize 670, bits offset 54
                  Category:dropped
                  Size (bytes):670
                  Entropy (8bit):2.5766175129059325
                  Encrypted:false
                  SSDEEP:3:wfl/jl8lnvFXmtWtFNNNNNNNNNNtllvttlttttttttVllvttlttttttttVllvttx:wYgwYwt
                  MD5:40D304DFEA558ABA981C3DD9B5090EC4
                  SHA1:AC6DCC8118A9EC748BB6FB091D2EE548623542C0
                  SHA-256:3FE529419C4DD8F41C88FB3F1A2E3679573213CD51458D97788FF688A6D7B559
                  SHA-512:0779D1EE55AFAF3016064C9D96E9C5AC09A3BA144F2341C3A9C564546A33E5A679786122D8A25FD1E50ADE91FF60C152963F99E17E1D0B0CCA711E4B2D3A6132
                  Malicious:false
                  Preview:BM........6...(...................h...................................................................@`.@`.@`.@`.@`.@`.@`.@`.@`.@`.@`.@`...........@..@..@..@..@..@..@..@..@..@...@`...........@..@..@..@..@..@..@..@..@..@...@`...........@..@..@..@..@..@..@..@..@..@...@`...........@..@..@..@..@..@..@..@..@..@...@`...........@..@..@..@..@..@..@..@..@..@...@`...........@..@..@..@..@..@..@..@..@..@...@`...........@..@..@..@..@..@..@..@..@..@...@`...........@..@..@..@..@..@..@..@..@..@...@`...........@..@..@..@..@..@..@..@..@..@...@`...........@..@..@..@..@..@..@..@..@..@...@`..........................................@`.................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light3-dgrey.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 14 x 14 x 24, image size 616, resolution 3780 x 3780 px/m, cbSize 670, bits offset 54
                  Category:dropped
                  Size (bytes):670
                  Entropy (8bit):2.184123353124834
                  Encrypted:false
                  SSDEEP:3:wfl/jl8lnvFXmtWtv/t/llllllllllllllllllllllllllllX1fFfVF3XFt3XlXJ:wYgwolwt
                  MD5:F398CFA5D26C8E8D32E9E68F17C665D7
                  SHA1:15F7BED72FEE12B1C44DE7D5288E869BEB656EF0
                  SHA-256:49B3E1363414AD2D56D67081F1DB5C46CF1738607F513AF16E0759565F53928F
                  SHA-512:DAFE9B2F93AB578863AB6FE0764377C344338B6A9BCB8977DFC495771DDD0F2E3199A188B7785C4D6520200970EF19B1FF85ED8BA25AC2D506D71A3F52B4EB77
                  Malicious:false
                  Preview:BM........6...(...................h.....................................................................@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@............``.``@``.``.``@``@``.``.``@``@@@...........@``@``.``@``@``.``.``@``@``.``@@@............``.``@``.``.``@``@``.``.``@``@@@............``.``@``.``.``@``@``.``.``@``@@@...........@``@``.``@``@``.``.``@``@``.``@@@............``.``@``.``.``@``@``.``.``@``@@@...........@``@``.``@``@``.``.``@``@``.``@@@...........@``@``.``@``@``.``.``@``@``.``@@@............``.``@``.``.``@``@``.``.``@``@@@...........@``@``.``@``@``.``.``@``@``.``@@@.........................................@@@.................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light3-green.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 14 x 14 x 24, image size 616, resolution 3780 x 3780 px/m, cbSize 670, bits offset 54
                  Category:dropped
                  Size (bytes):670
                  Entropy (8bit):1.3613236559611037
                  Encrypted:false
                  SSDEEP:3:wfl/jl8lnvFXmtWt+tFNF1F1Fi/NNNNNNNNo/NNNNNNNNtq/NNNNNNNNo/NNNNNO:wYgwIhqqqqqqqqqN+wt
                  MD5:76FC1144FC4DAAE24B6240B97A6FF11B
                  SHA1:41709EDED64E6C06AFF71346403F8DD5BE332385
                  SHA-256:1AC59C1067A2736D2D3A449B834A8E3CAD72941E6F196A4C0F399A758E550551
                  SHA-512:1B9311BB25383172280159C7C69F01215CAC882DC192082FF5F2872FBD5144AA6CB04F69D6A43428A2BDF9B1545EB7CB1D3294A572C69E303B7DA77159E608DC
                  Malicious:false
                  Preview:BM........6...(...................h......................................................................`.....`..`..`.....`.....`.....`...........................................`.......................................................................................`...........................................`.......................................................................................`.......................................................................................`...........................................`...........................................`...........................................`..................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light3-grey.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 14 x 14 x 24, image size 616, resolution 3780 x 3780 px/m, cbSize 670, bits offset 54
                  Category:dropped
                  Size (bytes):670
                  Entropy (8bit):2.385662096424981
                  Encrypted:false
                  SSDEEP:3:wfl/jl8lnvFXmtWt3d5FzFXlll5FzFXlll5FzFXlll5FzFXlll5FzFXlll5FzFXx:wYgwIwt
                  MD5:34A513351AE3E18BCC3C08D1F62442BE
                  SHA1:FEAC388CA67C863DA7FC966B202C8E61EFC470B7
                  SHA-256:5BBC3A0744F48905514D4D86C9794325A5F05A65F00742E164603991C26B361A
                  SHA-512:71507BAB36D1952035526C1F0A7D9BCCD96ED826CDA626CC71A6E3A63A125A79133B1637423BB822006BCD4F39B6FB8852059F32D525E4E63825C6B4AB662058
                  Malicious:false
                  Preview:BM........6...(...................h...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light3-lblue.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 14 x 14 x 24, image size 616, resolution 3780 x 3780 px/m, cbSize 670, bits offset 54
                  Category:dropped
                  Size (bytes):670
                  Entropy (8bit):2.15233955131027
                  Encrypted:false
                  SSDEEP:3:wfl/jl8lnvFXmtWtHNNNNNNNNNNtllRl/ll/l/l/l/l/l/l/l/l3llRl/ll/l/lz:wYgwkwt
                  MD5:AA042299C002CB7DE02F9D74D8C4277A
                  SHA1:CD8D05513A462C53C33388F6FC34E49C9935569D
                  SHA-256:BB5C97C32298191DA68F301602A171E2F79F18339E9B46DD63A2560FBA02B569
                  SHA-512:9D7C95D80DDA7DD31EAB67261B2156788DF301568683BE2C8FE9AD6DF000F6CFBAD23FAFEC3C5220FD7B010D2ECE495F26E7C4F1EAB91DF4340EB79323B0F4B5
                  Malicious:false
                  Preview:BM........6...(...................h..................................................................@`.@`.@`.@`.@`.@`.@`.@`.@`.@`.@`.@`.........................................@`.........................................@`.........................................@`.........................................@`.........................................@`.........................................@`.........................................@`.........................................@`.........................................@`.........................................@`...............................@`..................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light3-mag.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 14 x 14 x 24, image size 616, resolution 3780 x 3780 px/m, cbSize 670, bits offset 54
                  Category:dropped
                  Size (bytes):670
                  Entropy (8bit):2.092941926165488
                  Encrypted:false
                  SSDEEP:3:wfl/jl8lnvFXmtWtvl1tttttttttXFNF/F/F/F/F/F/F/F/F/1FNF/F/F/F/F/F/:wYgw4wt
                  MD5:105466328A379D4A392170E409E8A52C
                  SHA1:189D0355BFE8D84461B6A893F8668EA13FA585F2
                  SHA-256:D21D4D8FBEDDC9304847C52222EE5A997C5B8FD8E373CEB1E3E5F9FFD8B5107D
                  SHA-512:17FC3DC8FEE74C9465B3170C4E13FBB869ECAC40DFA13CABCED557820EA96B64B535A052270A79BF0064914695D48C2376A09DAC6981E56DC8356B691AF8644F
                  Malicious:false
                  Preview:BM........6...(...................h...............................................................................................................`...........................................`...........................................`...........................................`...........................................`...........................................`...........................................`...........................................`...........................................`...........................................`...........................................`..`..`..`..`..`..`..`..`..`..`.....................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light3-orange.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 14 x 14 x 24, image size 616, resolution 3780 x 3780 px/m, cbSize 670, bits offset 54
                  Category:dropped
                  Size (bytes):670
                  Entropy (8bit):2.0725732282634075
                  Encrypted:false
                  SSDEEP:3:wfl/jl8lnvFXmtWtNl/l/l/l/l/l/l/l/l/l/l/9lvNNNNNNNN///9lvNNNNNNNf:wYgw4wt
                  MD5:063A8A09340AD8D0E8FAC09E52789410
                  SHA1:D29B54187076FAE76FE3E6A508C4CCA4F26FAB52
                  SHA-256:E58CA697A8D0BE9ACD1A1D09FF8077C5A7EBA6DC2911288A18E934B56ACB1CAC
                  SHA-512:7761CEE9909079BF41DE215F3705FA83B50A22A7A0C8470FBF8987C0F1113505D2B81CC650A5C7A1E418E29F70E2537224DB1721E3BA167A14B947E5597150E2
                  Malicious:false
                  Preview:BM........6...(...................h...................................................................@..@..@..@..@..@..@..@..@..@..@..@.........@.................................@.........@.................................@.........@.................................@.........@.................................@.........@.................................@.........@.................................@.........@.................................@.........@.................................@.........@.................................@.........@.................................@.........@..@..@..@..@..@..@..@..@..@..@...@..................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light3-red.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 14 x 14 x 24, image size 616, resolution 3780 x 3780 px/m, cbSize 670, bits offset 54
                  Category:dropped
                  Size (bytes):670
                  Entropy (8bit):2.13742267459875
                  Encrypted:false
                  SSDEEP:3:wfl/jl8lnvFXmtWt9Fv3tttttttt333tttttttt333tttttttt333tttttttt33J:wYgw4wt
                  MD5:6B24C21A0211C47FF77AF340C87F4556
                  SHA1:5CC0D3440B21F72ADD78627CF78725486D18A9C1
                  SHA-256:96C2B73BBAAAC0393127C461372B1DDB4E5C30509502B2481CC232B85A2794C8
                  SHA-512:C440AFF3A2973AC9E74AD70357EC9F4035EC15EB447CA2B084BAF9E2D337ACBD263105A3681092968479CFD86A55650CD4F2E91DAB6BCEF4CBA364C1C47412EA
                  Malicious:false
                  Preview:BM........6...(...................h................................................................... `. `. `. `. `. `. `. `. `. `. `. `........@`.. .. .. .. .. .. .. .. .. .. .. `........@`.. .. .. .. .. .. .. .. .. .. .. `........@`.. .. .. .. .. .. .. .. .. .. .. `........@`.. .. .. .. .. .. .. .. .. .. .. `........@`.. .. .. .. .. .. .. .. .. .. .. `........@`.. .. .. .. .. .. .. .. .. .. .. `........@`.. .. .. .. .. .. .. .. .. .. .. `........@`.. .. .. .. .. .. .. .. .. .. .. `........@`.. .. .. .. .. .. .. .. .. .. .. `........@`.. .. .. .. .. .. .. .. .. .. .. `........@`.@`.@`.@`.@`.@`.@`.@`.@`.@`.@`.. `.................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light3-white.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 14 x 14 x 24, image size 616, resolution 3780 x 3780 px/m, cbSize 670, bits offset 54
                  Category:dropped
                  Size (bytes):670
                  Entropy (8bit):2.775146701102326
                  Encrypted:false
                  SSDEEP:12:wYxvQX75Wv8vQX75Wvu7vvw75Y7vvQX75G:Ke10q+U
                  MD5:98991D4A133FA43AD9C7D13C9D88CF94
                  SHA1:C02F7C5427045ACAFD03FC7BFE007F829C16DF4D
                  SHA-256:B5545DF7ECA7312768A666A7065CC6D78FB1735EDFF3E5E612849A9868A0418C
                  SHA-512:11BE3E0597E702474768837877D137F50E3967DDD396CBA8FBCE3C6B47106A06259D4A82EC26A77035F450F3E8E5C96B84E3C1DC839BDE33714CCCDA9FAC1EFC
                  Malicious:false
                  Preview:BM........6...(...................h...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light3-yellow.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 14 x 14 x 24, image size 616, resolution 3780 x 3780 px/m, cbSize 670, bits offset 54
                  Category:dropped
                  Size (bytes):670
                  Entropy (8bit):1.7437438547593076
                  Encrypted:false
                  SSDEEP:3:wfl/jl8lnvFXmtWt/fttttttttttXfttttttttttXfttttttttttXfttttttttt/:wYgw4wt
                  MD5:FDA05DE22D3EA77EE1CB3BACB9876230
                  SHA1:E6DA4F353AC61E7907F8CEDA23AC175FD1B45492
                  SHA-256:7948DC5105EDD221108B964354E1C6D65A327F98673A5F5E8640DDEA8F4C6AA9
                  SHA-512:CB82CA86A9CB352430186FEBB7D51CE41FC9E1011B0C507B001A9216EA3EA53A78277C41B8C9A11A8DE62F2A0CAD79EB61312CF11B33C0AB1463104487E90651
                  Malicious:false
                  Preview:BM........6...(...................h...................................................................``.``.``.``.``.``.``.``.``.``.``.``..........................................``..........................................``..........................................``..........................................``..........................................``..........................................``..........................................``..........................................``..........................................``..........................................``..........................................``.................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light4-blue.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 20 x 24, image size 1200, resolution 3780 x 3780 px/m, cbSize 1254, bits offset 54
                  Category:dropped
                  Size (bytes):1254
                  Entropy (8bit):1.4114132718865602
                  Encrypted:false
                  SSDEEP:6:qQ6oYOXqqqqtBqqqqtOXqqqtO5qqqqqteJqqtO5qqqtO4Gol:qQZqqqqHqqqqCqqqSqqqqqCqqSqqq/
                  MD5:EDE8E93EC55403B30C0FC8618925EC2D
                  SHA1:5E5B930CCAE216C299C7BBA64DDE17B1CE8EC841
                  SHA-256:52C5B152638AF6356AA4D9A2917F2F2C4E53D309150EB15D0ECA1346A1E5384B
                  SHA-512:934BF951009343B739A8CC7376FC3A84B41FC105FBB142DC2829AFA81652EC5A3FF4C3CFE96CAF14E2EEF1C2CA4C3A9E37AAB4D238742744DEEC808D196D7DB2
                  Malicious:false
                  Preview:BM........6...(............................................................................................................@...........@................................@........@...............................................@..@...........................................................@...........@...............................................@...........................................................@...........................................................@.......................................................................................................................@...........................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light4-brown.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 20 x 24, image size 1200, resolution 3780 x 3780 px/m, cbSize 1254, bits offset 54
                  Category:dropped
                  Size (bytes):1254
                  Entropy (8bit):2.5008492995201594
                  Encrypted:false
                  SSDEEP:3:+tlllPl/bc/lZ7r/9Xmt+t9NN333NNtll9vNvvvvvvPllHXlFXlFXlF//XlF3lNx:qQ6oAOl
                  MD5:DEC394C133E52E5E78A227B09C36E336
                  SHA1:4AFD1A5A1AD5491365198FFCD6D184D2BA91049C
                  SHA-256:E41C243E3142ABA80628EAE727ED8D2319899C8C120943F774FEBD9B595009A1
                  SHA-512:71227684A86F88882BFB62134D7DFA1C9BD1AB85A39C0FEBB5D3527ECC39DA1B82B779F46C5B4D8010C5EAB1C8A55E4C96A99537947307D90545F428E183CE98
                  Malicious:false
                  Preview:BM........6...(.......................................................................................................@`.@`.@`.@`@`..@`.@`.@`@`..@`.@`.@`@`..@`.@`.@`.@`.@`.......@`.@`@`.@`..@`@`.@`.@`..@`@`.@`.@`..@`@`.@`.@`..@`.@`.......@`@`..@`@`.@`.@`.@`.@`.@`.@`.@`.@`.@`.@`.@`.@`..@`@`........@`@`.@`.@`.@`.@`.@`.@`.@`.@`.@`.@`.@`.@`.@`.@`.@`..@`......@`..@`@`.@`.@`.@`.@`.@`.@`.@`.@`.@`.@`.@`.@`.@`..@`@`.......@`.@`.@`.@`.@`.@`.@`.@`.@`.@`.@..@`.@`.@`.@`.@`.@`.@`.......@`.@`.@`.@`.@`.@`.@`.@`.@..@..@..@`.@..@`.@`.@`.@`.@`........@`@`.@`.@`.@`.@..@..@..@..@`.@..@`.@`.@`.@`.@`.@`.@`.......@`.@`.@`.@`.@`.@..@`.@..@..@`.@..@..@`.@..@`.@`.@`.@`.......@`.@`.@`.@`.@`.@..@`.@..@..@..@..@`.@`.@`.@`.@`.@`.@`.......@`.@`.@`.@`.@`.@..@..@..@..@..@..@..@`.@..@`.@`.@`..@`......@`.@`.@`.@`.@..@`.@`.@..@..@`.@..@`.@..@`.@`.@`.@`.@`........@`@`.@`.@`.@`.@..@..@`.@..@..@..@`.@`.@`.@`.@`.@`.@`........@`@`.@`.@`.@`.@`.@`.@`.@..@`.@`.@`.@`.@`.@`.@`.@`.@`........@`@`.@`.@`.@`.@`.@`.@`.@`.@`.@`.@`.@`.@`.@

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light4-dgrey.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 20 x 24, image size 1200, resolution 3780 x 3780 px/m, cbSize 1254, bits offset 54
                  Category:dropped
                  Size (bytes):1254
                  Entropy (8bit):2.731089400092669
                  Encrypted:false
                  SSDEEP:24:qo+UGV5Pabq7Dmngija9EWuL28a5/I5LqU7:YD1U
                  MD5:4D9C4D7605C105E0A8B2BCFA5EAC9ACA
                  SHA1:0D26575A2DDE5BBF9A13E157988B6F8176F43BCA
                  SHA-256:BAD87AB444B2C928FD75D66B83945ECB9D0CA306B971FC7C6FC78C645393C0A0
                  SHA-512:E01F44C264F2959218D452444E81C31378F515B3A13F7570E316BBE2AF5638D03C1F403D49570013E57C3E19D5E095A1AF8E1CDEFA7C9C96984EF7323CD757F3
                  Malicious:false
                  Preview:BM........6...(......................................................................................................KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK......KKKKKKKKK```KKK```KKK```KKK```KKK```KKK```KKK```KKKKKK......KKKKKKKKK````````````uuu```uuu```uuu````````````KKKKKK......KKK```KKK``````uuuuuu```uuu```...```...```uuu```KKKKKK......KKK`````````uuuuuuuuuuuuuuu...uuuuuuuuuuuuuuu``````KKK......`````````uuuuuuuuuuuuuuu............uuuuuuuuu`````````......KKK``````...uuu........................uuuuuu`````````......``````uuuuuu...........................uuuuuuuuu``````......``````uuuuuu..............................uuuuuu```KKK......KKK``````uuu........................uuu...uuu`````````......``````uuuuuu..............................uuuuuu```KKK......KKK```uuuuuu...........................uuuuuu`````````......```KKK``````uuu...........................uuu...``````......KKKKKK```...uuuuuu...............uuuuuuuuuuuuuuu```KKK......KKK``````uuuuuuuuuuuuuuuuuuuuuuuuuuu```...u

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light4-green.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 20 x 24, image size 1200, resolution 3780 x 3780 px/m, cbSize 1254, bits offset 54
                  Category:dropped
                  Size (bytes):1254
                  Entropy (8bit):1.4804484175283688
                  Encrypted:false
                  SSDEEP:6:qQ6oiqIxqqIFiIiIXiqqBqqqqqIEIwxIiq+l:qQ6qCqqH/XqqBqqqqqJh/qa
                  MD5:6536D0CEEBD83631FFCA3B869B948ECA
                  SHA1:94FE399BF0EDB03607836F0CE21269A50E746DAF
                  SHA-256:8A408E9A5329FCAD3449C662E22B40AB5A535B670521E108AAC8AB43BBCB9A01
                  SHA-512:3958228AEBA6CBE3425C908ABCDCD7404C0353E801A24723841381A76D1326D40561B36EF18CA3508959356290467B101EAF225CFDD7611D51E7A6815D083197
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light4-grey.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 20 x 24, image size 1200, resolution 3780 x 3780 px/m, cbSize 1254, bits offset 54
                  Category:dropped
                  Size (bytes):1254
                  Entropy (8bit):3.0535730581508886
                  Encrypted:false
                  SSDEEP:12:qQAR609+o0Wlj9l20Yljo9ljxl2MM4ljZ4ljQlrMu9lu0ilu0HjlL408aPK:qbT0yHcodo0bHUZZvK
                  MD5:CA3EA8A4C0288A37AE9BFD84F7C419F0
                  SHA1:9EC5EAC92741A56D40AC3A40854D416B3B566DA5
                  SHA-256:46C02DF11BA0C6613E3EBD6DF91083B664E023645D39984D532F60BF897DC5D5
                  SHA-512:C0262268950EF4407B9CC8D875B3583C8515E74CFF1AE75D34A69E6DF4F7973C6FCFCBBEAFB53F5ADEE1FD111400F8B039316F9D07125577BCB2D0A61A4D9D5D
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light4-lblue.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 20 x 24, image size 1200, resolution 3780 x 3780 px/m, cbSize 1254, bits offset 54
                  Category:dropped
                  Size (bytes):1254
                  Entropy (8bit):2.0328942433297335
                  Encrypted:false
                  SSDEEP:3:+tlllPl/bc/lZ7r/9Xmt+tHttNl/l/tNl/l/tNl/l/tttHXNF/tF/F/NtF/F/Ntf:qQ6oCO4saOCkwKCcbSMFYOrl
                  MD5:876E4E6EFE7E8394B0C46BE657D30260
                  SHA1:1C4E96162FFA0FA5A0DA96D1F6A876D542C720C5
                  SHA-256:D03F22F50862F2A4A44CC66A9524723E354BB4848E360C947416B1F57D7C16B1
                  SHA-512:DE7D516A0282F687F2EBD051E2510BB798C09E6548059A1AAFB6B11707D1784BE181AF6D490C21C929674CC5C0AC34D7688802C3FF89DCF988AF8C29DB9BB3A0
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light4-mag.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 20 x 24, image size 1200, resolution 3780 x 3780 px/m, cbSize 1254, bits offset 54
                  Category:dropped
                  Size (bytes):1254
                  Entropy (8bit):2.296910547606339
                  Encrypted:false
                  SSDEEP:6:qQ6omaYaVAaV+aFFwaFOaV4taVKoFuaClol:qQqP3K
                  MD5:FCE7A016F95B937DDE213CAD57265B5E
                  SHA1:DFEAFDA0A2B5D6EC77032E46F26E504520494916
                  SHA-256:D98668DDBFA82E48C2C0133F78AFD5CE66EDDB1F46C1946D1FE64644DD305607
                  SHA-512:55BDBCA71A6DA7DA592825D8042287932D1D34E3FC768A7997B8F4B3D5D5FDFA6D6FCA10FE45C1F2D15241B82F87D4949DC29C24927BD3934677D25B668A5643
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light4-orange.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 20 x 24, image size 1200, resolution 3780 x 3780 px/m, cbSize 1254, bits offset 54
                  Category:dropped
                  Size (bytes):1254
                  Entropy (8bit):2.2852604911388443
                  Encrypted:false
                  SSDEEP:3:+tlllPl/bc/lZ7r/9Xmt+tFl/lfFt1lfFt1lfFt1l/l/l/l/lFtll9lFfl9lFflf:qQ6oNl
                  MD5:27E3CB73715EFF16617626C7E0839C52
                  SHA1:E78B85A981D7C5C72A60DA629CCF883ACE82FC12
                  SHA-256:1F0F264FA7D08CD84F348383D0DCC6935BE051B6E7A25446CD8E0AAEBC54F37A
                  SHA-512:8F494C8077BBD26489CBD185775A02036ADC6CB66BDFD364DBC54C7747D4056BC29CE52B6A3EFB1CB42AD1BDC624920FEC40EA0F58108D0B64BEE31CDFB01B71
                  Malicious:false
                  Preview:BM........6...(.......................................................................................................@..@..@..@..`..@..@..@..`..@..@..@..`..@..@..@..@..@........@..@..`..`..@..`..`..`..@..`..`..`..@..`..`..`..@..@........@..`..@..`..`..`..`..`..`..`..`..`..`..`..`..`..@..`........@..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..@........`..@..`..`..`..`..`..`..`..`..`..`..`..`..`..`..@..`........`..`..`..`..`..`..`..`..`..`.....`..`..`..`..`..`..`........`..`..`..`..`..`..`..`...........`.....`..`..`..`..`........@..`..`..`..`..............`.....`..`..`..`..`..`..`........`..`..`..`..`.....`........`........`.....`..`..`..`........`..`..`..`..`.....`..............`..`..`..`..`..`..`........`..`..`..`..`.......................`.....`..`..`..@........`..`..`..`.....`..`........`.....`.....`..`..`..`..`........@..`..`..`..`........`...........`..`..`..`..`..`..`........@..`..`..`..`..`..`..`.....`..`..`..`..`..`..`..`..`........@..`..`..`..`..`..`..`..`..`..`..`..`..`..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light4-red.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 20 x 24, image size 1200, resolution 3780 x 3780 px/m, cbSize 1254, bits offset 54
                  Category:dropped
                  Size (bytes):1254
                  Entropy (8bit):2.0732888564779453
                  Encrypted:false
                  SSDEEP:6:qQ6ou+AKYwAqKYY+gYgYW+AqKWAqqqqKYYlogY+QlgYAKYQol:qQAKiqKHfXqKhqqqqKnJSC/KK
                  MD5:B68C2BCB64E2E271B03F6BB6BC31C1D0
                  SHA1:FAE83CDFA25C16535B2625F05998D422B6DA87A6
                  SHA-256:F224AD56EFDB057ADD346D33239808E78CA0E07E989D54A6046E72EA41E44F41
                  SHA-512:8DDE522EAD3A17542CF1603C28CE34C97BFAE4C1A6ECBDA1417785B9B3F5A97A00FBF50CB61FD468CE537C7BAF474857F852FD158E3FC33BA77382FAB5714428
                  Malicious:false
                  Preview:BM........6...(................................................................................................................... ........... ........... ............................. .. ..... .. .. ..... .. .. ..... .. .. ................. ..... .. .. .. .. .. .. .. .. .. .. .. .. ..... ........... .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ........... ..... .. .. .. .. .. .. .. .. .. .. .. .. .. ..... ........ .. .. .. .. .. .. .. .. .. ..... .. .. .. .. .. .. ........ .. .. .. .. .. .. .. ........... ..... .. .. .. .. ........... .. .. .. .............. ..... .. .. .. .. .. .. ........ .. .. .. .. ..... ........ ........ ..... .. .. .. ........ .. .. .. .. ..... .............. .. .. .. .. .. .. ........ .. .. .. .. ....................... ..... .. .. ........... .. .. .. ..... .. ........ ..... ..... .. .. .. .. ........... .. .. .. ........ ........... .. .. .. .. .. .. ........... .. .. .. .. .. .. ..... .. .. .. .. .. .. .. .. ........... .. .. .. .. .. .. .. .. .. .. .. .. ..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light4-white.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 20 x 24, image size 1200, resolution 3780 x 3780 px/m, cbSize 1254, bits offset 54
                  Category:dropped
                  Size (bytes):1254
                  Entropy (8bit):2.7797183231530216
                  Encrypted:false
                  SSDEEP:6:qQ6oE+sUsfaa7m8smjBSf7+l5DfMqC500Drqq5Du5DjwLu8HMqO8MDpG5vZV2LKx:qQDsUsGqj7g00HwwrjvZ309bpK
                  MD5:04BC8BE5FAA956B704A9312F98D80FDD
                  SHA1:00E93419865176B729D233DDD028B0BA51563013
                  SHA-256:E274E5144FA3F54AE7029E0F14A1BB85E9A16DC2088F859E9785E16E450F1F28
                  SHA-512:21D35199337C9D7DD06DA5E13F78C0EE23096E3ED23CF8C959C1BE119F381B59B3F31FF2ADBDC7099193A8D698BF5D6E72A7DFF45C8DBE663B0F3CD48B6DE72B
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\light\light4-yellow.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 20 x 24, image size 1200, resolution 3780 x 3780 px/m, cbSize 1254, bits offset 54
                  Category:dropped
                  Size (bytes):1254
                  Entropy (8bit):2.1106876760433475
                  Encrypted:false
                  SSDEEP:12:qQgu/AuV/Sux/6u/tBB/Yu/tuu1/z/KuB/t/LBYu//:qFeAMSe6etYeI8rKW1ie/
                  MD5:132B33CC3C0088A04CD1BEF732E70464
                  SHA1:9D62446E6C6BA933A7E52BA50F44E9CAD97DF664
                  SHA-256:D548BAD27BC3F8AF610A0A1014827B5112FC4724B652E9306E8D599AB1638244
                  SHA-512:24AF25FEACD77AE810123F8001FB13C33EB644B299D05899CC363DC9DE6BD6863B4409F0FD4E621442F31DE069699B4EDC8749987F1BAE61D50EE694E8A3FB9B
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\panel\1-current.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 131 x 67 x 24, image size 26532, resolution 3780 x 3780 px/m, cbSize 26586, bits offset 54
                  Category:dropped
                  Size (bytes):26586
                  Entropy (8bit):0.5774727892640725
                  Encrypted:false
                  SSDEEP:24:i2w8aqq8F8K8n8t8K8K8GqqmaJ0F4T3chUM4wYnADKpYrTno:im
                  MD5:5E131F95F7C6386F18EF3320C93B197A
                  SHA1:544A7BDD2C02E0A55C6029365C621BBE094B6567
                  SHA-256:577BF65A25CC12510CAFA293E6ED6248BF0CCBC8667A3DA208A5013BF1AB370B
                  SHA-512:27767B7E9778CD1926E783641F5DD4B0C39A7B7BCCE9AF95579A51D6AC626BCC44F867BA22DA35E77FE301DFBACD28488A5E1C61AAD7440A113387215201711C
                  Malicious:false
                  Preview:BM.g......6...(.......C............g....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\panel\1-reference.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 129 x 66 x 24, image size 25608, resolution 3780 x 3780 px/m, cbSize 25662, bits offset 54
                  Category:dropped
                  Size (bytes):25662
                  Entropy (8bit):0.5345207758447095
                  Encrypted:false
                  SSDEEP:24:y4g8V8K8uA8z8K8zPx4ehc54RYFKBj2yhE:39
                  MD5:8F206F7BA4782BD712B43A2B4A448E90
                  SHA1:5BF1223ACAB5F4CF12016502141792BBC4DD2A09
                  SHA-256:55747B10D0F42B532BB56C98737A580ECCF828E4558193EB3B04907F12C66739
                  SHA-512:4AB4C80B20BB6EF4D0F72E38CEEBD15F2D839C99BDFB56CB62F425BF0A955F86D4D12CE8FEB6CCB056C2D9A8EF28146444E8D2DE094C21ED82057EE7B98B2B10
                  Malicious:false
                  Preview:BM>d......6...(.......B............d....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\panel\1-speed.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 139 x 67 x 24, image size 28140, resolution 3780 x 3780 px/m, cbSize 28194, bits offset 54
                  Category:dropped
                  Size (bytes):28194
                  Entropy (8bit):0.5304414094960695
                  Encrypted:false
                  SSDEEP:24:m38K828K8L8RL8K8ep8K8gJhXJAYX4a7UHYX4ZhQUYD:e
                  MD5:622A283B63C4C9D175AC49267F6E3381
                  SHA1:D6AC2458E73DAA77BB39DC1BE8CE92A2EAAA488A
                  SHA-256:597957EE407B305A3EAEC347ADDA44CB3E1288F83BA40214E3E4C4AFC4FAA54F
                  SHA-512:52A007549D67B293420559B3BF93CEC9C4FABB337094C6CD322CC5E175AFD7C723A66CFA6375BD93F0432CB9DA9978A826E58598D7CB337D4EE2A4490F221E8F
                  Malicious:false
                  Preview:BM"n......6...(.......C............m....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\panel\1-voltage.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 133 x 66 x 24, image size 26400, resolution 3780 x 3780 px/m, cbSize 26454, bits offset 54
                  Category:dropped
                  Size (bytes):26454
                  Entropy (8bit):0.5899063400507047
                  Encrypted:false
                  SSDEEP:24:6C8S8K8hqqqq8J8mF8K8cSqqqqySYBxBAtRYD447YR1Px0NElNkYr:K
                  MD5:C27A854E7933281EB7CC26FC6148CDE1
                  SHA1:EDE8A167789605A20225FFFA0106C1A8928A0AE3
                  SHA-256:8903689EB2F087DD9B96BC28E9DBEA98265BB263EFC4BBFD620D144208AFAFD4
                  SHA-512:ADCF2A765A88AB46F0D97082FF3E0B44A3BBA2E00B89C3D017CFF0C71BC5DD97E2C32B1BE75BE86ADC798B0A0CA0F136DDC3AAEE8B9B9750751D617C01BF6D77
                  Malicious:false
                  Preview:BMVg......6...(.......B........... g....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\panel\current.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 312 x 162 x 24, image size 151632, resolution 3780 x 3780 px/m, cbSize 151686, bits offset 54
                  Category:dropped
                  Size (bytes):151686
                  Entropy (8bit):0.2699967977450171
                  Encrypted:false
                  SSDEEP:192:YebbbbbbjY45YuWc08sn85PwDT2HAtAQFR:K
                  MD5:FD7CA5E95C0387C075ABA594B100581C
                  SHA1:CC11DBF866805189C24D05A2D4D720F243D6A7B0
                  SHA-256:4AF1AA8FB6EF36229FDB68BB43FE606440968C14EB64DC8A7B17C087A59E8F3E
                  SHA-512:9DDCEF9137A1929813146CD0A653A8183C9A2F96611A68F30CB8699C6AF176FCF6ECBD3D95A6AF6EAC720884346700729132DF0349289029CC1F143BFA5C249E
                  Malicious:false
                  Preview:BM.P......6...(...8...............PP....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\panel\reference.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 312 x 162 x 24, image size 151632, resolution 3780 x 3780 px/m, cbSize 151686, bits offset 54
                  Category:dropped
                  Size (bytes):151686
                  Entropy (8bit):0.2573606430423719
                  Encrypted:false
                  SSDEEP:192:2MbbbbbbjYIJ6uWc08sTY5PwDT2HAHQBKn:+
                  MD5:FEBF25B3756F089B19E79C7EEE9FD99A
                  SHA1:6403E4DA09302F36CC5ACD66C228FA863B305FAD
                  SHA-256:C737F5F350747E36FA9C49AAF9C68C2796A71B5ECC8BFFADFC829981331DC855
                  SHA-512:254924ACB13FE3A0C902983ABF68F2551D1725D27E563F1DFC230B16ABD5738DB088531F51DE0081E0762787FC64B8385E9ECEDEDDC5DA0C4D2BB2DAB7B3A39A
                  Malicious:false
                  Preview:BM.P......6...(...8...............PP....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\panel\speed.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 331 x 161 x 24, image size 160356, resolution 3780 x 3780 px/m, cbSize 160410, bits offset 54
                  Category:dropped
                  Size (bytes):160410
                  Entropy (8bit):0.2737701593874456
                  Encrypted:false
                  SSDEEP:192:geIIIIII+1SD6LD1YY1wJ6aHAqjXTD/fJ4:K
                  MD5:846A46ABDC25394DF528635DCDFDB388
                  SHA1:6F6291E3CEA445FE03692D4F64FC4DA595DD11A5
                  SHA-256:420BD996B4B9D35349BEEF2AE4122661A18F10FBD01EEA705AAB95047DFB5A28
                  SHA-512:CB921EA6C2A6EE195D8FBA96EDD139ACD259E9B5167514598FB72927E3E2E48816CCE49BAA8FC7AF7279F1E12DEB9176AEEA9BB73212F67115EAFDBE4412FE24
                  Malicious:false
                  Preview:BM.r......6...(...K...............dr....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\panel\voltage.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 318 x 163 x 24, image size 155828, resolution 3780 x 3780 px/m, cbSize 155882, bits offset 54
                  Category:dropped
                  Size (bytes):155882
                  Entropy (8bit):0.29749844356399
                  Encrypted:false
                  SSDEEP:192:r4llllllxmkfrig7MwC9sQB25hAreUtv3m:C
                  MD5:66535AC04AFAD8780CFC6B1DA4E26995
                  SHA1:F752E079E601AC91D31894063EC475FB07046914
                  SHA-256:9CF38E572D37573884CC0CEC906D287BD6E5933BBA5534E0E0F769526C33E20A
                  SHA-512:41677266CCCE8F81DECAC8E87C9D9D1A7CCF7D48BB643218E506E37E8534AFB047CE8D2EE566DE297FA9A22916644CB3410E7293FC90E6AB1F43FBB00E3276AB
                  Malicious:false
                  Preview:BM.`......6...(...>................`....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\Thumbs.db

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:Composite Document File V2 Document, Cannot read section info
                  Category:dropped
                  Size (bytes):179200
                  Entropy (8bit):7.043050123323021
                  Encrypted:false
                  SSDEEP:3072:Ege1pG3k1QG8HcP895V9i15b397UQrOAYYoLUNeWjX:EX1pG3k1QG8Hc0n9ib397xO7Ye
                  MD5:4BB4B5F001C05922802659AE3707FDE5
                  SHA1:FBDA712BB44467453DA8E7697D2D2A482B54CF38
                  SHA-256:1F374D93A3CE4B6FD427950D78D6F588ACB730C02ECD417E75C9950B292A0337
                  SHA-512:5932232C81CDFA1DB51FD90C613C7F5664801F1E0AFDD65D03AD8E612245686AC5F29DC8FFD10A7F6DAB66BDF9D8FF13DEF272BCE5737D64FEAD3B94707A7933
                  Malicious:false
                  Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................'....................................... .../...!..."...#...$...%...&...(...7...)...*...+...,...-.......0...?...1...2...3...4...5...6...8...J...9...:...;...<...=...>...@...O...A...B...C...D...E...F...G...H...I...K...^...L...M...N...P...]...Q...R...S...T...U...V...W...X...Y...Z...[...\..._...l...m...`...a...b...c...d...e...f...g...h...i...j...k...n...........o...p...q...r...s...t...u...v...w...x...y...z...

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\mashimaro2.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 32 x 32 x 24, image size 3072, resolution 3780 x 3780 px/m, cbSize 3126, bits offset 54
                  Category:dropped
                  Size (bytes):3126
                  Entropy (8bit):2.224401730335668
                  Encrypted:false
                  SSDEEP:24:gPVoVVLVPxulrqC45DqLfqRwqAqqqoUMY:guxeGEa
                  MD5:1FF4E3EBF77B434A0C553F6EFB1BD7BF
                  SHA1:B56CFC6C5E12159D8621AF2DEE3D5D831299DFB8
                  SHA-256:8308C077EE4FD53B084DE4E4FC04F0883110C1936DAEFA7461F16D87C8C791E9
                  SHA-512:AD0B72C3C343FD1BA0073E4BE013F5CDBA3AF53FF3D15A0747DDFB13F4E291382C177C62B2BD6E4DE45ECE4028D3C2A01BB786C73D403FBE5C017ED9E5BC120F
                  Malicious:false
                  Preview:BM6.......6...(... ... .......................................................................................................................................................UU.UU.UU.......UU.UU.UU.UU.UU.UU.UU.......UU.UU.UU.UU...........................................UU.UU....UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU....UU.UU.UU.UU........................................UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.....................................UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.....................................UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU..................................UU....UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.....................................UU.UU....UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.....................................UU.UU.UU.UU....UU.UU................UU.UU.UU.UU.UU.UU.UU....UU..................................UU.UU.UU....UU.......UU.UU.UU.UU.UU....UU.UU.UU.UU.UU.UU.UU.UU.U

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\mashimaro3.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 21 x 23 x 24, image size 1472, resolution 3780 x 3780 px/m, cbSize 1526, bits offset 54
                  Category:dropped
                  Size (bytes):1526
                  Entropy (8bit):1.6519928461637114
                  Encrypted:false
                  SSDEEP:12:Pi+0dzqcBqIPnq4fqPSJD4KRyyl6QVlOeVVV3H4p:PKzq2qonqCqamyXVVE
                  MD5:CFAD9533F54881EE365F06993E1BEE92
                  SHA1:D6AB255A1DD05CA9BDDF7A2E5222EA408AB616C8
                  SHA-256:74B19D10AD59D435EE009EF1905DEB6363434E6B482BAA3C87B02A1CCE7B7845
                  SHA-512:468149B1C3A34F7D4839A1EC6D54F605460CB05B0AA7AC4DE7E9EFA3105CB574AFDE1DF59F0D4B4903BA6F0E3149C44FBDF0E3D41E70499B760C16673712B70A
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\mashimaro4.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 23 x 24, image size 1380, resolution 3780 x 3780 px/m, cbSize 1434, bits offset 54
                  Category:dropped
                  Size (bytes):1434
                  Entropy (8bit):2.3789091535607922
                  Encrypted:false
                  SSDEEP:6:Jm0HAA4XwXmA9HwwwwwemADwwwwwwwwwwwwwmXDwwwwwwwwwwwwm9DwwwwwwwwwV:Jm0Sy1bCVu44DWUWDWg9KKw
                  MD5:93C35AA579E40D86264DD21CC36DF0B0
                  SHA1:A4FD6A6BB5B5D1A9C5D9D2BF100CD981C3FB2398
                  SHA-256:878E2286AE5C9FC26C4D272712B43E608C782F90AFF43C2AD3F5A67DFFECD520
                  SHA-512:E65ED01EC460236577CA99E15C921531CDB9A6EF54D88B9D2EB06C2E038FA9685C0E2902E524074437FD58937D21AD0B6D739960A3FFB566E370CF9D7F801077
                  Malicious:false
                  Preview:BM........6...(...................d....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Ni............................................................Ni.........................................................Ni..........................................................Ni.............................................................Ni..........................................................Ni.......................................................Ni.......................................................Ni.Ni....................................................Ni..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\mashimaro5.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 23 x 24, image size 1380, resolution 3780 x 3780 px/m, cbSize 1434, bits offset 54
                  Category:dropped
                  Size (bytes):1434
                  Entropy (8bit):2.375694979475633
                  Encrypted:false
                  SSDEEP:6:Jm0HAA4XwXmA91flmA1LX1691492PKX1MEH1zfC271/t0X1eHVd7X2md7XAAl9bL:Jm0fzXBDLDq5lq3eq94qM5qJ9
                  MD5:BDAB3DA57BC95ED9C031B90C66E3ED13
                  SHA1:B6052D79CDF2E0C0D6FDB5DE2CDA4DE6C4C1E12D
                  SHA-256:C8AB1EE170EAB90758993E855689AD29FD84DCBBA78E6D8BE0399148DB958827
                  SHA-512:F6D755A50DC1F83708D1931F825C5385601B29C7DFB0D9CBD66CF47E1B0CBB3233BCDF3F38DA27F74F05D486D123F8C18A4E1B0F11A50713886644FCC4DD9595
                  Malicious:false
                  Preview:BM........6...(...................d........................................................................................UU.UU....UU.UU.UU.UU.UU.UU.UU.UU....UU.UU.UU................UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.............UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU...................UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU...................UU....UU.UU................UU.UU.UU.UU....UU.............UU.UU....UU....UU.UU.UU.UU.UU.......UU.UU.UU.UU.UU..........UU.UU.UU.UU.UU.UU....UU.UU.UU.UU.UU....(B.UU.UU.UU..........UU....UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.......(B.UU..........UU.UU....UU.............UU.UU................(B.............UU.UU.UU................UU.UU..........UU.UU.(B.............UU.......UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.(B......................UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.(B.........................UU.UU.UU.UU.UU.UU.UU.UU.UU.UU.(B...............................UU.UU.UU.UU.UU.UU.UU.UU.(B.(B..................................UU.UU.UU.UU.UU.UU.(B..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\motor fan 1-1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 26 x 33 x 24, image size 2640, resolution 3780 x 3780 px/m, cbSize 2694, bits offset 54
                  Category:dropped
                  Size (bytes):2694
                  Entropy (8bit):1.9472710713586205
                  Encrypted:false
                  SSDEEP:24:VVZa8a858ERquK0KLrmIRfaLBQB8f1jfrfLfmfRe6+tJyRiJ7qPziqqIFqvdVY:+
                  MD5:2A5FA33943A2154E1F88FABE5C3924D6
                  SHA1:803968B31142DE91D58AE54F2EF801F283C0D491
                  SHA-256:42C72AA0890D47ED77DBCF65A768AB17E54D028A11E91E74A3A4D72B8EBFD60B
                  SHA-512:1C0E9DE5D3A6610727E55CB8A5FB3D8EE7E342A94FD86B2042F18B5DBE72B681D3379F1EABA3B1292C8C32B6B660707EADD9F7987CDCD2FC6FD238DE31095099
                  Malicious:false
                  Preview:BM........6...(.......!...........P...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`..........................................................................................................`.....`..................................................................................`.....`.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\motor fan 1-2.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 26 x 33 x 24, image size 2640, resolution 3780 x 3780 px/m, cbSize 2694, bits offset 54
                  Category:dropped
                  Size (bytes):2694
                  Entropy (8bit):2.2801647412279036
                  Encrypted:false
                  SSDEEP:24:VVJjaijaija8uYRp9RCKLG5GiFxihUaiTjwiPfi1W/rDD/U/9/U631Wa83Qj1idg:5
                  MD5:483EB5051009674B0F511C0DB32F287D
                  SHA1:5CC91BD3F3C47EAB2304973889B1623B9FCFACCF
                  SHA-256:450782D73E001105D4F0D64F6F907C27080CD199736A548A7C6C0177D551D169
                  SHA-512:C8EBA9BA4DCD8F1D35ECE9A5C05605383299A8942AFB854A8806AC7C524218EA685CD498B0C2B56F48559500690FCBDF5A74E6EC9F27409979BB9CB20652E13E
                  Malicious:false
                  Preview:BM........6...(.......!...........P............................................................................................................................................................................................. .. ..... ..... .. ..... .. ..... ..... .. ..... .. ..... ...................... .. .. .. .. .. ..... .. .. .. .. .. .. ..... .. .. .. .. ...................... .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ...................... .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ......................... ..... .. .. ..... .. .. ..... .. .. ..... .. .. ............................... .. ..... ..... ..... ..... .. ........ .. ........ ............................ @. .. .. ..... .. .. ..... ..... .. ..... .. .. .. `.............................. `.... .. .. .. ................. .. ..... ........................................... .................... `.... `.... ................................................. ..... .. .. ..... ........ `.... `. @...

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\motor fan 1-3.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 768, resolution 3780 x 3780 px/m, cbSize 822, bits offset 54
                  Category:dropped
                  Size (bytes):822
                  Entropy (8bit):2.452120569679049
                  Encrypted:false
                  SSDEEP:6:bAlfxAeIAiAlm7l7PB7lpKuprlWOQ2vLuX9d7Vf7leal5EIAa:Efhm73hEuprlpQ2vKT7Z7kON
                  MD5:BC8B5F4E762C8A4D5C5E5A3481BE7609
                  SHA1:CCB2EAB8D688AE6D6E83ED7D1C9D8BF891B10F17
                  SHA-256:6168054CCC40B91698F70B68F204908037DC88F4A8CD3E52C0B64C7D1DB0AAE5
                  SHA-512:240D38E561E28E6686EA2DDF1257D2AB701E62FE2F8FDF1C253FF0351899DE52CE558C617950DD3AE95090A2E1D86BA357EDFC744B0532B1F0698B404F59BCA7
                  Malicious:false
                  Preview:BM6.......6...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\motor fan 1-4.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 768, resolution 3780 x 3780 px/m, cbSize 822, bits offset 54
                  Category:dropped
                  Size (bytes):822
                  Entropy (8bit):3.0741923780039118
                  Encrypted:false
                  SSDEEP:6:bAlfxARNFVlOSfFl77RNWm8GBj/TxDceGaaRB9ZVf7les7Wlt0vQAlJ:EfENZpV7RU2j/Tx4eGRRB9T7Us7iIJ
                  MD5:0072339C2D0BEC097D202C7597F2FF10
                  SHA1:9C9D4113A23C8B948C35382C920AE2861FD0A73A
                  SHA-256:4A09AFDA472CB8F9B606BF22C291E303C365C2B5F502460D4FF82662FF896F3C
                  SHA-512:6B0401EBAED6AA3186740E506CE848081D3643038CC703D7DF9A4CC07D5AC3EE1F8CD6C32D6B2FE796C5840F78F22365BD33AF33C7F37AEC307C1490EE078C5A
                  Malicious:false
                  Preview:BM6.......6...(.......................................................``....................................................................................@ ...........................@ @ ...............@ ..........................................@``...................................................@@@@ ...@@@.....................@@@..................@@@......@@@............@ ...............................``@ ...@@@.............``...@``...@@@.................................@ ............@@@......@``..................@ ............@ ......@@@....``..................................................................@@@......@@@.....................@ ..................................``.........................................................@@@..................................``...@ ...............

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\motor fan 1-5.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 16 x 16 x 24, image size 768, resolution 3780 x 3780 px/m, cbSize 822, bits offset 54
                  Category:dropped
                  Size (bytes):822
                  Entropy (8bit):3.0943354346341247
                  Encrypted:false
                  SSDEEP:6:bAlfxA9xxbblfFl5KvFUseJ/lKJDItRZblO8Jkmuix1ml9PbJ:Efs5DgUseJ/QmY8JkhiTmj1
                  MD5:4A93706D73C45F673BC0968CE308EA7A
                  SHA1:B27C590BE9B23815F80BB4A257895B987F882C0C
                  SHA-256:9F181DCF7CC9E025DDDF7F2C77C8779A35E6B2EEAA5F01D25870E619A1291B0B
                  SHA-512:842B3063C1A3D579857EA295E59526AD21547E3C999074C6186A3FCD229162E664EF8B9EB96F9EB4066CF86C33A84E2600868F4C59CC99C5D9A608E322827606
                  Malicious:false
                  Preview:BM6.......6...(......................................................................``.....................................................................@ @ ...........................@ ..............................@@@........................@ ..........................................@``............@@@......@@@...@@@@``.........@``..................@``......@@@...............@ @``@@@...@ @``@ ............................................................@``.................................@@@......@@@....@ .... @@@@. @...............@@@...@@@......@@@............@ ...............@ .......................................@ ..............................@@@............................................................@@@...................................................@ ..............................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\pump1-1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 151 x 44 x 24, image size 20064, resolution 3780 x 3780 px/m, cbSize 20118, bits offset 54
                  Category:dropped
                  Size (bytes):20118
                  Entropy (8bit):2.606325483549981
                  Encrypted:false
                  SSDEEP:192:2111111111111111111111111111111111111111112C1111111111111111111i:Rtn
                  MD5:D4058DB385D45FC2EED40D94575451A6
                  SHA1:01A2B92682F20C74EB6C0D4F04AAC528CA3601BD
                  SHA-256:34894D985EB11143E640CB65374BA928C35BF0B82F77FEC1A331EF554DC803C9
                  SHA-512:48428BC1E3527B03F680F21B850EB99BB8B3021A92A90C557F586E69B1BF05D100D0077613E8CFE8142B3E6089DD02E8BD2021331DBE3C990353FF497D39B54F
                  Malicious:false
                  Preview:BM.N......6...(.......,...........`N....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\pump1-2.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 151 x 44 x 24, image size 20064, resolution 3780 x 3780 px/m, cbSize 20118, bits offset 54
                  Category:dropped
                  Size (bytes):20118
                  Entropy (8bit):2.6129245453614103
                  Encrypted:false
                  SSDEEP:192:2111111111111111111111111111111111111111112D1111111111111111111i:RMn
                  MD5:440B64D56F0E707F82EE913EADF2CD47
                  SHA1:86C4F7CEE013D9DBAEF0B726907170A075C8CA3D
                  SHA-256:285F981E52B16D3F51B122AA6C9E9CCF1057C94AA59BDB561422A7232CE4B59B
                  SHA-512:4FA24E8D7C30735C0B679DFA5DABDB05A53A2FE7E3636E05DBBFF347968992469E9427D8D5E0C53CA6E37B8A2660528E4C792463C4D6D3FB01E53A8C22E3997E
                  Malicious:false
                  Preview:BM.N......6...(.......,...........`N....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\pump1-3.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 151 x 44 x 24, image size 20064, resolution 3780 x 3780 px/m, cbSize 20118, bits offset 54
                  Category:dropped
                  Size (bytes):20118
                  Entropy (8bit):2.6130063035247857
                  Encrypted:false
                  SSDEEP:192:211111111111111111111111111111111111111111271111111111111111111i:REn
                  MD5:C2CA1B27C3793C8911B25B9B15115A41
                  SHA1:1411EB438C219C5B5BC736AAB5185276DC5E7F02
                  SHA-256:9D828018785F6599F4ADB0DB0133C27A03D3FDF927A5980F7333328CD700B93B
                  SHA-512:B2C54628DF15B8EB770738EE368911572CA2393664DCF5AB0CCDB0A4DAC6CC80FCC9768EB3D1F3B79C6F7F90324E3431261A27F6739A306A3AC276358ED77976
                  Malicious:false
                  Preview:BM.N......6...(.......,...........`N....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\pump1-4.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 151 x 44 x 24, image size 20064, resolution 3780 x 3780 px/m, cbSize 20118, bits offset 54
                  Category:dropped
                  Size (bytes):20118
                  Entropy (8bit):2.6132303235899195
                  Encrypted:false
                  SSDEEP:192:211111111111111111111111111111111111111111231111111111111111111i:RQn
                  MD5:715B0C45BA4A5F74181AAFA0AB0DE220
                  SHA1:9CCDB4461BC0295A303A2492122C13A9DEE745D1
                  SHA-256:ECBF1DA7A8F81FE71F0B2F228F3D80F0F9A005BB242F72CC4485760B5510E2D3
                  SHA-512:45116261508D9E5DD39C4261B9C385225206EE08F36CC0977D1157CCE005999DAD638C0333336E570924BEAB00366AA6E6290E16BA9D65EE2A83228D6554520C
                  Malicious:false
                  Preview:BM.N......6...(.......,...........`N....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\pump1-5.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 151 x 44 x 24, image size 20064, resolution 3780 x 3780 px/m, cbSize 20118, bits offset 54
                  Category:dropped
                  Size (bytes):20118
                  Entropy (8bit):2.6014344280723813
                  Encrypted:false
                  SSDEEP:192:j11111111111111111111111111111111111111111ke11111111111111111110:6/L
                  MD5:9D6A216D575FC696D8CFC619BCD17472
                  SHA1:8FD6FB3F57987C5805FEAD74F339106958A12278
                  SHA-256:39ED311E366A53E99D677E0C4184947705A5BE6EE1F6CFFB9A66886342AB502F
                  SHA-512:940D3E4BBC077D37F2BE54CB81F150D42D024BF3A5B376A0F446C1146AEC1089C77DFC344EE17ED053C0D793DBDD11103201283B73912737B83274D5F7021D65
                  Malicious:false
                  Preview:BM.N......6...(.......,...........`N....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\ring1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 17 x 18 x 24, image size 936, resolution 3780 x 3780 px/m, cbSize 990, bits offset 54
                  Category:dropped
                  Size (bytes):990
                  Entropy (8bit):2.277771826066388
                  Encrypted:false
                  SSDEEP:12:MC7zaRzPaXvRKwyKGf46Cgf5IpKHyXgK1CFn:MO2RTaXvRKwyKsXCa5iKSwKIFn
                  MD5:04638D74A517D4CE8A73F01D1160515C
                  SHA1:3F70D3DCA596D95807726638DAA6FB09A283F1D7
                  SHA-256:A4D64A0E22749D66386E959D75735D43A61297EEAA77166FD1BE3B5EDD541F14
                  SHA-512:E8CCF349F02D30357400662E28721BAE3A17A05A02DBB9F74462A84047222B121F13A01E2B6FA66882D5C0B1F206B9DF0E5996452A5356B0224EADFECC1E428C
                  Malicious:false
                  Preview:BM........6...(................................................................................................................................................................................................................... `. `.... `. `................................ `....... .. ........ `. `....................... `....... ..... .. .. ........................... `.......... .. ..... ..... ........ `.............. `....... .. ..... .. ..... ........ `........... `.......... ..... .. ..... .. .. ........ `........ `. ........ .. ........... ..... ........................... ..... ........... .. ..... ..... `........ `. ........ .. .............. .. .................. `.......... ..... .. ..... .. ........... `........... `....... ..... ..... .. ..... ..... `.............. `.......... .. .. ..... .. ........................... `. ..... ..... .. ........... `....................... `....... ..... ..... `................................... `. `. `.... `......................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\ring2.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 19 x 18 x 24, image size 1080, resolution 3780 x 3780 px/m, cbSize 1134, bits offset 54
                  Category:dropped
                  Size (bytes):1134
                  Entropy (8bit):2.225381501006043
                  Encrypted:false
                  SSDEEP:6:SCltcyAXGAzzXC5taWzzXC5t4AezeeyW9zAQOO/WAzXBYt4WXOhKG+2OOBGo+OO9:PfcuzazzhoXJpxKoqKUvCU5QK4SKYD
                  MD5:DA3408A4E844C152FEA443A7F0120719
                  SHA1:8647903BC6A70C803DEF82687CF4B637586733D7
                  SHA-256:970FDFFDB98770BD71502FBB37AE76B645B2543216560590549F18BDBFCFDE9C
                  SHA-512:8C34E1A4D378A6D014FE496269D7A11CBDA80B1B04668919705FCB18870DE995DE9667AB1CC6F1B83B14104B225E9431719D414A982F933F604CE6804021F46D
                  Malicious:false
                  Preview:BMn.......6...(...................8....................................................................................................................................................................................................................... `. `.... `. `........................................ `....... .. ........ `. `............................... `....... ..... .. .. ................................... `.......... .. ..... ..... ........ `...................... `....... .. ..... .. ..... ........ `................... `.......... ..... .. ..... .. .. ........ `................ `. ........ .. ........... ..... ................................... ..... ........... .. ..... ..... `................ `. ........ .. .............. .. .......................... `.......... ..... .. ..... .. ........... `................... `....... ..... ..... .. ..... ..... `...................... `.......... .. .. ..... .. ................................... `. ..... ..... .. ........... `.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\ring3.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 19 x 18 x 24, image size 1080, resolution 3780 x 3780 px/m, cbSize 1134, bits offset 54
                  Category:dropped
                  Size (bytes):1134
                  Entropy (8bit):2.225381501006043
                  Encrypted:false
                  SSDEEP:6:SCltcyAXGAzzXC5taWzzXC5t4AezeeyW9zAQOO/WAzXBYt4WXOhKG+2OOBGo+OOL:PfcuzazzhoXJpxKoqKUvCC5aKKqKBOD
                  MD5:8D36E9928DA24ABF61F73FB9379128A1
                  SHA1:854FD5EB7C592AA7FB2FD4FA1ABF97979BAEA21B
                  SHA-256:36C0A5CD20309A3FD0C8722C39495F1151EFEB51629DDC711724FC1F98D34649
                  SHA-512:745401040756C6C3B57C3E7FF5BDF5EF7290AB8BF1AD5E7D099A451252B83516260EE714A0898330F87EC42A5BE0BBB62CB70DDCD7B7E6C487BCF1118A53A2A2
                  Malicious:false
                  Preview:BMn.......6...(...................8....................................................................................................................................................................................................................... `. `.... `. `........................................ `....... .. ........ `. `............................... `....... ..... .. .. ................................... `.......... .. ..... ..... ........ `...................... `....... .. ..... .. ..... ........ `................... `.......... ..... .. ..... .. .. ........ `................ `. ........ .. ........... ..... ................................... ..... ........... .. ..... ..... `................ `. ........ .. .............. .. .......................... `.......... ..... .. ..... .. ........... `................... `....... ..... ..... .. ..... ..... `...................... `.......... .. .. ..... .. ................................... `. ..... ..... .. ........... `.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\ring4.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 19 x 18 x 24, image size 1080, resolution 3780 x 3780 px/m, cbSize 1134, bits offset 54
                  Category:dropped
                  Size (bytes):1134
                  Entropy (8bit):2.3057179229395692
                  Encrypted:false
                  SSDEEP:12:PfcuzazzhoXJpxqYa3K22lsKWslTOByygQrk:XJ2zloXJpxqYa3KvSK/Dyfrk
                  MD5:DDECDAB511547E81DFAAA5543690CB08
                  SHA1:50AA2828C0BE76542D822218C5DA183074DA0B6B
                  SHA-256:D032DAF97853AACAC0283C2208E90FF9417E17E094BE889345435DCE6F70739E
                  SHA-512:DA05769CD57340D4C74942418EB6A20E650B99404E5C5077A7AA48822F501B2A22D130244DD0586A76FF4EB678D5BB8B199BAAEE704E80324AA0F68B7A154D0D
                  Malicious:false
                  Preview:BMn.......6...(...................8....................................................................................................................................................................................................................... `. `.... `. `........................................ `....... .. ........ `. `............................... `....... ..... .. .. ................................... `............. .. .. .. ........... `...................... `............. .. .. ..... .. ..... `................... `.......... .. .. ..... .. ..... ........ `................ `. .. .. ..... ........... .. .. ................................ .. .. ................. .. ........ `................ `. .. ..... .. ........... .. .. ........ `................ `............. ..... .. .. .. .. ........ `................... `.... .. .. .. ..... .. .. .. ............................. `....... .. .. .. .. .. ........... `......................... `. ..... ..... ..... ........ `.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\ring5.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 23 x 21 x 24, image size 1512, resolution 3780 x 3780 px/m, cbSize 1566, bits offset 54
                  Category:dropped
                  Size (bytes):1566
                  Entropy (8bit):1.6768710782644627
                  Encrypted:false
                  SSDEEP:24:VFVVVVVVVVVVVVkVVVVVVVVVV0VVVVVVVVRVVVVVVVV8VVVVVVxVVVVVVxVVVVVo:Vl
                  MD5:2A0BF9F03C1B15C4BC2333B95A00CE0E
                  SHA1:D3D8C4B0E21024751B970E79D2D726A12A98685F
                  SHA-256:E7F37FFD8FBEBCE7B3DF94EC3386F2627474D971944FA70826DBD0D46282861C
                  SHA-512:E9FA5DD70F782FCFB9D9F28CB3DB19E75F0BE1CA167FFBAFBF5E236A36B1EE799C6F09D47A106FD8E8DA0E417449C305D1112CC77852EB11550EB340A835E6DB
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\ring6.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 23 x 21 x 24, image size 1512, resolution 3780 x 3780 px/m, cbSize 1566, bits offset 54
                  Category:dropped
                  Size (bytes):1566
                  Entropy (8bit):1.5962340568955975
                  Encrypted:false
                  SSDEEP:24:VVO5qqqOqqqqqq8qqqqqqqqqfqqqqqqqqqqqAqqqqqqqqqqjqqqqqqquqqqqqqbT:VM
                  MD5:761869FACF33CFB5F857070BD5ED0F64
                  SHA1:7C599BE0C37D9202FB749697867659A0EDADFA15
                  SHA-256:E42FDA78E3795726A25F1BCDCB6E47BD8285B45EBB66E2FF32A2E7E351B21413
                  SHA-512:A2B91A5F94CCEB22272C18BC5EF6D72924DC9500A8932D05592A7CA379F9B5786972A6D8B2833E3FC1D8D7AD13E1E2C072191AAEEADA525A7E5E432CD283FEAF
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\ring7.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 23 x 21 x 24, image size 1512, resolution 3780 x 3780 px/m, cbSize 1566, bits offset 54
                  Category:dropped
                  Size (bytes):1566
                  Entropy (8bit):1.5962340568955975
                  Encrypted:false
                  SSDEEP:24:V86yqqq9qqqqqq0qqqqqqqqq8qqqqqqqqqqqvqqqqqqqqqqvqqqqqqqUqqqqqqUb:V0
                  MD5:CB5799531C76181D7ECF743C85E0173D
                  SHA1:C47FCD046121B5596712BACC49E1B9B2D6DB535D
                  SHA-256:586F70FD065F8E3530469ECC93D4B04ECA5B605735761881EBD2EBDB2C9C6034
                  SHA-512:9E2F01E0EDFC25086D6F0211541B350F8121363EB11CC84D229B5108248D9D311A309897B9CC592A35DC5BBE8C5B2EDA627E55D491CB7DC8CC9753E3273A2FF3
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\roller1-1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 98 x 20 x 24, image size 5920, resolution 3780 x 3780 px/m, cbSize 5974, bits offset 54
                  Category:dropped
                  Size (bytes):5974
                  Entropy (8bit):1.7709863461789421
                  Encrypted:false
                  SSDEEP:12:6Z/v0BBBu0BBBSQVmddf5fo7RzAX5X7t/xF/S:U/MBBBVBBBSZdHt/xF/S
                  MD5:1BCED8FCDC2DB39D2367F6C4BDB8342B
                  SHA1:766FEBA5BC5FF89635471B4DB291B4840F15DA5C
                  SHA-256:33AD04D9C9F556486CA62348160CC71EDEABECA3219E062F9DD7440B949D1EFA
                  SHA-512:247E8B236C9A71FE832B5E29312CC537DEC1E2A03564A2CB18CBD26AE060F5304E889CB2E6A9F38525D1580302473CCA8A41F6969C4BFA53826606EB5D8B3DC1
                  Malicious:false
                  Preview:BMV.......6...(...b............... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\roller1-2.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 98 x 20 x 24, image size 5920, resolution 3780 x 3780 px/m, cbSize 5974, bits offset 54
                  Category:dropped
                  Size (bytes):5974
                  Entropy (8bit):1.7709863461789421
                  Encrypted:false
                  SSDEEP:24:U/MBBBVBBBS7HZd7d7hjhVMBBBVBBBS/S:x
                  MD5:47C0F86C2DCEA59FD0985DEF2FF9F2B6
                  SHA1:8CDBC6C75FD1760477AE104F557A85EA06C783F3
                  SHA-256:5496A97289AC9F80D01928231F3E6BA223B6C8B23997ABAE64FAB5C6BD1F4802
                  SHA-512:87319B1DABFE79160C4C240035852DCC68CC860EB2AAFB5AA238F55E50CB713E106BA071DB920563E282C526F67BD3DFD6DAA6889EBBE48ED7CF4DFE1871AEDF
                  Malicious:false
                  Preview:BMV.......6...(...b............... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\roller1-3.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 98 x 20 x 24, image size 5920, resolution 3780 x 3780 px/m, cbSize 5974, bits offset 54
                  Category:dropped
                  Size (bytes):5974
                  Entropy (8bit):1.7709863461789421
                  Encrypted:false
                  SSDEEP:12:6Z/F/xtdX5XYzp7V5Of5f7dQVmv0BBBu0BBBS/S:U/F/xtvdZMBBBVBBBS/S
                  MD5:2439DC996FE391521B4C9E96DBE211A2
                  SHA1:C8B39E0AD16740006790CCFF5CFC5567E2734694
                  SHA-256:B51D38DDB9FFFC14E741CD78E5904A339E83FA30D8AB698F0422B94F6671402F
                  SHA-512:B5CA0DBF880239C2038EFEABFDCF8F9B6654DA85EFA875E5E2303484B94078649DD4CC2189EFE433CE7ACFDE025CB203B5D77C673EBD8446918527BCAFA8F37A
                  Malicious:false
                  Preview:BMV.......6...(...b............... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\roller1-4.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 98 x 20 x 24, image size 5920, resolution 3780 x 3780 px/m, cbSize 5974, bits offset 54
                  Category:dropped
                  Size (bytes):5974
                  Entropy (8bit):1.7709863461789421
                  Encrypted:false
                  SSDEEP:24:U/MBBBVBBBS7hjhVdSYBPfb/vL20drDVMBBBVBBBS/S:h
                  MD5:2F6EB5D4F0C508CBA3E2B595F40CABEE
                  SHA1:8489D71DEFC0DB451BD1C364B1A5F6B17F0CEB64
                  SHA-256:31EA169B628E1F56FCBC845DB009CAACD119C83F563E2FC2DC27D5693B272A12
                  SHA-512:F2425995975FD9E4683A7F856BD72DEB753746291E0B5569C0BC43F04D81D7347ED0E66136A3147E90B665EC3F6A4D39ED5ABC9B0081B1C76E8899A3995C1E79
                  Malicious:false
                  Preview:BMV.......6...(...b............... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\roller2-1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 18 x 18 x 24, image size 1008, resolution 3780 x 3780 px/m, cbSize 1062, bits offset 54
                  Category:dropped
                  Size (bytes):1062
                  Entropy (8bit):2.051561849194073
                  Encrypted:false
                  SSDEEP:6:a4hAzIAkA9N0a0a0a0amAmAAvX1tAXV6A4XvVpFXjjZ+b7RTBVfldldPbXfQXjNq:XFK0BBB/drjffFG9efXFz68/S
                  MD5:C62352D43CDE1BFAF9BF33A335E97425
                  SHA1:FADB47647B37E797BE4A4118AB2735049551468E
                  SHA-256:9D869C674AF39DE6BB843987216FC98CADF5356D1FBBD8AFD51C8038B19A945C
                  SHA-512:BAF649F8800E49C34588618F38081BD7ED5F0001DCFDB6E9D005D4CAD4171B7E0FDE8E5978248CBEAF5C304E524373FC5F8A64E1CF75363AF2C2E20F3C1C0146
                  Malicious:false
                  Preview:BM&.......6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\roller2-2.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 18 x 18 x 24, image size 1008, resolution 3780 x 3780 px/m, cbSize 1062, bits offset 54
                  Category:dropped
                  Size (bytes):1062
                  Entropy (8bit):2.0583422033065455
                  Encrypted:false
                  SSDEEP:6:a4hAzIAkA9N0a0a0a0amAmAAvX1tAXV6A4XdpFXjZ+DRVVpDXVnRQXjZTXdpFAXp:XFK0BBB/drj3F23W3Fjd0h+K0BBB/S
                  MD5:270CE5DC53350CED220A4D3B9DAD5CD5
                  SHA1:1730A1B6D38E4279A5DA826559DAF320B06799D0
                  SHA-256:50E8F6E63E3D2FA442AB1EC109B1857C4F0B2BEFF5B54FF6EF9DDB8027A5A865
                  SHA-512:85F467D3B3110E221D432B35BDF6033DA050ED7E315FD4596263DE90AFBB2AF1C7F830E5AD4BBB837A11E2DAC5D5354EC272F3A44D4706224A6FB4023F887013
                  Malicious:false
                  Preview:BM&.......6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\roller2-3.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 18 x 18 x 24, image size 1008, resolution 3780 x 3780 px/m, cbSize 1062, bits offset 54
                  Category:dropped
                  Size (bytes):1062
                  Entropy (8bit):2.0716604754230747
                  Encrypted:false
                  SSDEEP:6:a4hAzIAkA9YAmAAAWtAXoA4XvXFXjN+HXfTPfldldBVbXRRQXjjZTXvVpFAXV6Av:XF/68zfXF499WffFjd0h+K0BBB/S
                  MD5:9B23E054E9C9392AD910DD7D3919965D
                  SHA1:B2ED83FCEC1124171C1D88D942C452BB325C2CB1
                  SHA-256:CCDB3711E754A4E59C787D20BAD27BE1CF5B3761BCD64935BDD3265B02C2280C
                  SHA-512:FEE42DD915D2BC06E1AA2EA8FDECCF1B0D3C25AE93426EE2B582CB7F179924103D086764B500D678270399D91684DD4D71459674647E40D98829D0A1F5063456
                  Malicious:false
                  Preview:BM&.......6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\roller2-4.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 18 x 18 x 24, image size 1008, resolution 3780 x 3780 px/m, cbSize 1062, bits offset 54
                  Category:dropped
                  Size (bytes):1062
                  Entropy (8bit):2.0716604754230747
                  Encrypted:false
                  SSDEEP:12:XFK0BBB/d0h+jfw+UdbH1p+fw+jd0h+K0BBB/S:1xBBB/Oh+jY+UJ+Y+jOh+xBBB/S
                  MD5:C3FAE8AB5FC7F7C1740178BA7AF30DEB
                  SHA1:8FF60A7B1115C0DB3B1EE7DB06C894315D591830
                  SHA-256:199BDFE98CFBFEDE5FC7C5FBEF55343D8BE1B0427D7C872C7CE7A0284485B9AB
                  SHA-512:210CC6DA3236C3EECA2FF5C71B27A48494401C975679617499EED6EE3B5C76F8A2775A01BEF2BC0C9CB0FFE8A1A71A814C87F10EDE16D2644B697A98254A291F
                  Malicious:false
                  Preview:BM&.......6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\smoke1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 70 x 24, image size 4200, resolution 3780 x 3780 px/m, cbSize 4254, bits offset 54
                  Category:dropped
                  Size (bytes):4254
                  Entropy (8bit):1.6219294409131026
                  Encrypted:false
                  SSDEEP:24:ydzOhXFGB6XXG1vap0GrqrM6QgmGKrgZFMxkaka:7
                  MD5:A36E2449BA9F78F03DA3548078AAFFE0
                  SHA1:3FC9974F82E8E0D323DEA4AFF559E857B97E0F64
                  SHA-256:A962A3F4CBE6D49D18034407F93389A3EB8F21B8CE99468176498322B2AFCD27
                  SHA-512:7A97D1607ECD22194779474F4B80184CBFAA1AB38EFACD0D8CE5551AB7562B11FD1027A370593F3AD28D334D852E8275489686D3C3A7E614E5A83A91A9E8724C
                  Malicious:false
                  Preview:BM........6...(.......F...........h.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\smoke2.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 70 x 24, image size 4200, resolution 3780 x 3780 px/m, cbSize 4254, bits offset 54
                  Category:dropped
                  Size (bytes):4254
                  Entropy (8bit):1.6098086647471894
                  Encrypted:false
                  SSDEEP:24:Wt6W9lArXGGlMGWWy9xd1sruQTKG12NhGpIcGF53gkMZOGiEecTu/HQiQ62r6Nsd:L
                  MD5:002776AE123EBAD5A53FE1083E2FEE79
                  SHA1:973DF3C6057F63DF582804CAB377AC0FE11D6083
                  SHA-256:99EB42E147E45541E4FD04135BA217746E4F1666C1144C1903F39223FECF8745
                  SHA-512:A32FDC7EE53C7F7AE64CF8B67A7CEFA60172C11178E996A586D2CF9AC54A9D0DCFEC2BF55EB0AFD6B86339C027C974AE860767757D9BEC54B148130FFCD5729B
                  Malicious:false
                  Preview:BM........6...(.......F...........h.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\smoke3.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 70 x 24, image size 4200, resolution 3780 x 3780 px/m, cbSize 4254, bits offset 54
                  Category:dropped
                  Size (bytes):4254
                  Entropy (8bit):1.6234203489787333
                  Encrypted:false
                  SSDEEP:24:WzjQMul9uQMUMKYQtMQru9QQQWtWrWtGIA9rXXGAXzVuWyEVAdMbr/XrGMtNPd:z
                  MD5:13149718C7455BD7A5F2680EA1C892F7
                  SHA1:181921354A0E4FDB42BF309F131716462DAD1706
                  SHA-256:350F07EC814F54F9879F342CBE0706FCD5A22427536586D837ABC656852E4C07
                  SHA-512:34B111AD217493C6644F6D0114FAF85FD712CB1910559A6DF5EB59EC338C1B39E47FAFDE1FDAA8189EBBD74D3673079C0F28BCA48EEBAA494B213E64134EBB6F
                  Malicious:false
                  Preview:BM........6...(.......F...........h.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\smoke4.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 20 x 70 x 24, image size 4200, resolution 3780 x 3780 px/m, cbSize 4254, bits offset 54
                  Category:dropped
                  Size (bytes):4254
                  Entropy (8bit):1.6280344911230946
                  Encrypted:false
                  SSDEEP:12:5caEanacayajCa2aIaGapaOalaVahaNapawaEauaEaIaCa8:WrKjp1F/V09gQMo0Hrdr/Br
                  MD5:0223E89FE6E544D367809B4E155F9926
                  SHA1:073E2E8291F1EEED1A8FCC4E2CAFE17F0D2A430B
                  SHA-256:A0D0DCC98F8E2A25F68656D37FC0E146FE299CD594A9849668D320FE4EA39C3A
                  SHA-512:4AA692F999AF1DE4AC3686AE56DED5F0669D290FAF749946619ECE326F9A918A938133397F4ACC17548D1A86E202BB8F105E51D3BD319A5FEDFC0CE4D406F937
                  Malicious:false
                  Preview:BM........6...(.......F...........h.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\trafic light1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 22 x 30 x 24, image size 2040, resolution 3780 x 3780 px/m, cbSize 2094, bits offset 54
                  Category:dropped
                  Size (bytes):2094
                  Entropy (8bit):1.476680658688713
                  Encrypted:false
                  SSDEEP:24:AILfRiqk1iqqq6aFqqqqxoFqqqqzBqqNRo1eaVoXCD7UlqLVLqqqPaLqqqeoLqqA:S
                  MD5:654E5547F930005380B7A324A5163D85
                  SHA1:E528C70BAB9E62FCDF76D2C94D40B88B5842A36B
                  SHA-256:3EC859D83148892128B485D97ED9934CB8F121F66A9E76AF5016E58640276061
                  SHA-512:CD4E80B04F1E019A3EE7F4ECE5384FBB5E2B5CC3B6F8B450794BD6017E3B8ACF3029194D8FC2734FF5B42F84D50EA8A44C93B601EDAECCB952FE90618A8EE38A
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\trafic light2.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 22 x 30 x 24, image size 2040, resolution 3780 x 3780 px/m, cbSize 2094, bits offset 54
                  Category:dropped
                  Size (bytes):2094
                  Entropy (8bit):1.712139960487021
                  Encrypted:false
                  SSDEEP:24:AILfffaNoPVR+FIaNoPIUlqLVLqqqPaLqqqeoLqqqg+q2/:a
                  MD5:8B6FFC3C645760F4C2ABFB6BC875E461
                  SHA1:CA699F38608FB657F95475C161616B32A0BBFCE9
                  SHA-256:3F31A37D4B6D954BC7EC827F0802A633C818E5F415AA7D85B25F8266BC4B6914
                  SHA-512:499724B0071436827B397E3337F68BA33372000E408CF212E64D3BA82FAEF8FE0343DD74B741A37AE386E4FD0B2A8DB44C382C585EA739C555C66F5414847E72
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\trafic light3.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 22 x 30 x 24, image size 2040, resolution 3780 x 3780 px/m, cbSize 2094, bits offset 54
                  Category:dropped
                  Size (bytes):2094
                  Entropy (8bit):1.7423740370093852
                  Encrypted:false
                  SSDEEP:12:OIcILfffazpozrVRo1eaVoXYUBaVzEazpozrsX/:AILfffaNoPVRo1eaVoXYUQVgaNoPk/
                  MD5:08B9CE5DB5A25FC182EA6FCA6B8DED0C
                  SHA1:F283AC99718D7AEC03025DE59A52BD42C70458EB
                  SHA-256:5C6F5E7B9944505C6158F74EA4915646547A2766A5621A19A58DF9502D2A4F29
                  SHA-512:93A4C38EE7E8C8072B657393C508A893020066332F9674DAB98134C15ED83285FF2F6131F4DF3AB483D5CC00CD98DABA95C2400BFEE1AA1B3C12DC9F805CCCC5
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\trafic light4.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 22 x 30 x 24, image size 2040, resolution 3780 x 3780 px/m, cbSize 2094, bits offset 54
                  Category:dropped
                  Size (bytes):2094
                  Entropy (8bit):1.7183743587232625
                  Encrypted:false
                  SSDEEP:24:AILfRiqk1iqqq6aFqqqqxoFqqqqzBqqNR+FIaNoPIUQVgaNoPk/:Q
                  MD5:4EAC0EC9455E6A7CCB7EF0DD868680CD
                  SHA1:61D080796C2AA4589CFADF254216D24445DFDB5C
                  SHA-256:3FB8DD470775CF83CF0D1BA5AA4B47D5FB25EB2CC3161F454066BB767F597435
                  SHA-512:974EAD175B8EF3902F7BD261FD99D030AFAD5A426D318955F9498202F559332D8537ED21AB1C47494AD2D555BFFB65B3EE645976435B7F1ED1685E88DCE4B6BF
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\trafic light5.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 22 x 30 x 24, image size 2040, resolution 3780 x 3780 px/m, cbSize 2094, bits offset 54
                  Category:dropped
                  Size (bytes):2094
                  Entropy (8bit):1.7801122093332102
                  Encrypted:false
                  SSDEEP:12:OIcILfffazpozrVR+FIazpozrs7UBaVzEazpozrsX/:AILfffaNoPVR+FIaNoPIUQVgaNoPk/
                  MD5:A62FDDB74ED43C44EAF99545F7BD1843
                  SHA1:EF28EB169A7E029F903F437468DD3F4C7ECDBBAD
                  SHA-256:A4A321BF030029D56C32CDE323D25D6121DB9597787CB910BCE58F93DF2075A8
                  SHA-512:CEB6E33E19D276459B6D0D65CE89288851B66FF1FCB162CE27CE98B2343FF2F70669536D305D89AEF8D8BBCDA8D81E43F54B2A13247D3FAEA16EC89266DC6E3A
                  Malicious:false
                  Preview:BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\vu1-1.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 28 x 34 x 24, image size 2856, resolution 3780 x 3780 px/m, cbSize 2910, bits offset 54
                  Category:dropped
                  Size (bytes):2910
                  Entropy (8bit):2.7750394691269933
                  Encrypted:false
                  SSDEEP:3:mql/ldlPlsl9/l8XBFzF5l9lLFlNJ/zFZl9lNLjlPtllllllllB/zFV/uDlltlf4:mK+lfglaw
                  MD5:7D391C0838F3B0F5AC7593026E2F492A
                  SHA1:34A63D7A8EE8C19410C8644B811DCFD87150E92C
                  SHA-256:3B7200EE3A722AB3F050F1A7A9A57C7B43C329EF4B81A537ADBD58CA19E1EC0D
                  SHA-512:E458F653E53A57893C47D2A09D69567D8304AFC607774C7EB5E2C7202592238ECE8E9015679D1E7722CA7D447F7D027DFE2A553E29C1B62F7DE4CA18EF82A2AA
                  Malicious:false
                  Preview:BM^.......6...(......."...........(................................................................................................................................................................................................................................................................@``..................................................................................``.``@``..................@``@``................................................@``...@``.``@``...............@``@``.``@``@``...........................................``.``@``@``@``..................@``@``@``....................................@``......@@@@``@``@``..................................................................................``.................................................................................................................................................................................................................................................................................@

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\vu1-2.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 28 x 34 x 24, image size 2856, resolution 3780 x 3780 px/m, cbSize 2910, bits offset 54
                  Category:dropped
                  Size (bytes):2910
                  Entropy (8bit):2.776709352545678
                  Encrypted:false
                  SSDEEP:3:mql/ldlPlsl9/l8XBFzF7vNTlNJ/zFZFlNlN/tlPtllllllllB/zFXFlNlNuDllf:mK+lfKlqltAAkIJT
                  MD5:21DD4DF32730C16A23E4A7ACF6688CB1
                  SHA1:309DDAAE8A0C58CECD359885EEF24D2818DB559E
                  SHA-256:3DF6941C4B82A4A63BD68880BF4DE796672D936AC898403997ACEB68CE55EC3E
                  SHA-512:EBBCA62DFB5EFED504B482FF43FC24B85D106D085CF2A804EE3C3831BDA2E0B7C5AB7E71B499F3F08DAB4CCB955992B44B78677EACA58B16D1774E3BA4D784A8
                  Malicious:false
                  Preview:BM^.......6...(......."...........(..............................................@``@``@``.................................................................................@``.....................................................................................................................@``..................................................................................``@``.``............................................................................``.``@``.``..............................................................................@``.``@``.............................................................@``.............``@``.........@``@``...................................................................``...............@``.``.``.................................................................................................................................@``.``@``............................................................................``.``@``@``........................@

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\vu1-3.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 28 x 34 x 24, image size 2856, resolution 3780 x 3780 px/m, cbSize 2910, bits offset 54
                  Category:dropped
                  Size (bytes):2910
                  Entropy (8bit):2.777695631835488
                  Encrypted:false
                  SSDEEP:3:mql/ldlPlsl9/l8XBFzFXFPtlpFlNJ/zFbnFNllPtllllllllB/zF1Nl1BzDllt+:mK+lfXlK5klqKk8Z
                  MD5:EB244D0358D3BB2D4FA67FCA0E9D6653
                  SHA1:72BA68ECE0C054A14E5DDF899115DF1AD177CA58
                  SHA-256:34489D0730DD69538829D1A2D69F991EF7A9735766B62F1BDDC5D1B256209667
                  SHA-512:72D2EBEAC64139C04835C27F786F447B876544CEEDC827FABE52759AF5DDDB93E3C350F85A8A6F93BB59CCAD05534BA8E907A7B524F192D3FF49F6FA25D3A968
                  Malicious:false
                  Preview:BM^.......6...(......."...........(...........................................@``@``..............................................................................@``.``@``@``..................................................................................``.................................@``..................................................................................``.``.``..............................................................................@``.``.``...............................................................................``.``.``.............................................................@``............@``@``.....................................................................@``..........``....................................................................``.``@``.``.............``.........................................................@@@.``@``.``............@``.``.``.``@``......................................................@``........................@

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\vu1-4.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 28 x 35 x 24, image size 2940, resolution 3780 x 3780 px/m, cbSize 2994, bits offset 54
                  Category:dropped
                  Size (bytes):2994
                  Entropy (8bit):2.769465990044013
                  Encrypted:false
                  SSDEEP:3:1XldlOl/c/lgXBFzF5lrFlNJ/zFNlF3lllnlBBlPtllllllllB/XFFft3labxDlH:11Ol/0LG/MfXI+iqx
                  MD5:FCFFC94907131DBF6D2DB254417BD72A
                  SHA1:21CC967F1C5F4CA510665D0CEEC024C9BD050CA7
                  SHA-256:E8CD53FE8A84E13C027FE89AEFAA6DA1866D27662FF2A446AB3B7E59362B664B
                  SHA-512:5A25A5092B8603CAF8DC297339C36A9338919222DE74E84069B5F29A9DD687513BC3D2E3F139EFB2764EA0071E29C57B97C9063BC00A5AB40EEEDDBF03C91028
                  Malicious:false
                  Preview:BM........6...(.......#...........|.........................................................................................................................@``.``..............................................................................@``@``@``.``.......................................@``.................................@``@``.``.``.....................................``.``.``....................................@``.``.................................@``@``.``.``......................................................................``....``@``@``.``.............................................................@``@``.``@``....``@``........................................................................@``.``....``............................................................................@@@.................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\ImageList\picture\vu1-5.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 28 x 34 x 24, image size 2856, resolution 3780 x 3780 px/m, cbSize 2910, bits offset 54
                  Category:dropped
                  Size (bytes):2910
                  Entropy (8bit):2.998487975214669
                  Encrypted:false
                  SSDEEP:3:mql/ldlPlsl9/l8XBFzF5lPNhFlNJ/zFZlPtNhjlPtllllllllB/zFP/eFNlltl6:mK+lfpCagXWGCmyKqqH
                  MD5:8E3634C9590E80E592F16D1C2A3F8A2D
                  SHA1:753A71C80376F2AE7998E8BCFADBCDF98C729D60
                  SHA-256:72B47D571C399DC62B04E7C9D333A5CF23F8EE1CFD3471805E82E46D1F69CEEE
                  SHA-512:41F4ED4433573148A86F7745073A6B20FD62932153CE2E3023E4B6060BAB82DBC026243DA2AFC96F76C95C58B71D191BDF1A9433083AF57D9D0E36B4EFA0CBFE
                  Malicious:false
                  Preview:BM^.......6...(......."...........(.................................................. .. ............................................................................. .. .. ............................................................................. .. .....................................@``........................................ .. .. .................................``.``@``..................@``@``.......... .. .. .............................@``...@``.``@``............. .@``@``.``@``@``. .. ................................... ..``.``@``@``@``.......... .. .. .@``@``.``. .. ...............................@``. ....@@@@``@``@``............. ........ .. .. .. ................................ .. .. .. .. .....``............. .. .. .. .. .. .. ................................ .. .. .. .. ....................... ........... .. ............................. ..... .. .. ........................ .. .. ..... .. ............................. .. .. .....................................@

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\Button\Back.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2608
                  Entropy (8bit):4.866988294053023
                  Encrypted:false
                  SSDEEP:24:JdfVXrKAaOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcA:3f9rZgqQ5Bo6z+pEm7T7Kcd0r9T
                  MD5:FFF144487300833596635EDE37192AA7
                  SHA1:25C198D9DA50973A03096D9D28E0CE3264D10796
                  SHA-256:6DFE306C63DB508D1B7E85CCFDF4FA2F33208BE207C8B1E97091F768F6A13216
                  SHA-512:D0E52AA05E02EBC99688BDD578D6B753854134E822423F929B0A7E82AE593649170E7A96DD9018B89402729A5ABFEA4DE50609332FA8848F1334EF8DF8CC0236
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Back" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>1001</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\Button\Close.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2610
                  Entropy (8bit):4.858586523348448
                  Encrypted:false
                  SSDEEP:24:JdfINXrKAaOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Km:3fIlrZgqQ5Bo6z+pEm7T7KcdHr9T
                  MD5:0948AE24CFEC29C24EE15A9580E96872
                  SHA1:823B2DD66F8D52820F4D1C348CCFF01DE502334C
                  SHA-256:4ADCE62DC5451FE5CEA4E9816B19793D923D58FA44116D18CAFD56C37C062E2A
                  SHA-512:794F86A36489F491D84D90D46A0226734BDE9C8F63D5874A854863294C62324160F6B7452BF3672149D0A71748D5804F70A20041E928473B76916077EA6107AC
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Close" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>1001</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\Button\Diagnose.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.8637696074837535
                  Encrypted:false
                  SSDEEP:24:JdfUzXrKAaOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc:3fUTrFgqQ5Bo6z+pEm7T7Kcd3jr9T
                  MD5:1381210FE854FDA47ED05CE99EA35AAE
                  SHA1:EDAA194DCDDB7A6C44C696146A78BBE04DBCC3E5
                  SHA-256:2C2ACEF8DECF228D54A349592AC89506608584513F098273C035122DB389444A
                  SHA-512:C44CE55BB8C72103B1E731320F823F37C9229D559C9F684EBBE0C6E8FA583C593CFFD0ADA330C527E26543FEB29A228467F024D954894527B89C7922DCB4A28C
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Diagnose" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>501</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\Button\E-Stop_Normal.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2625
                  Entropy (8bit):4.875490855506663
                  Encrypted:false
                  SSDEEP:24:JdfMdXrKAaOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7K2:3fMVrFgqQ5Bo6z+pEm7T7KcdXMHPYr9T
                  MD5:E145565AF0360380CDF0FAB3031421B2
                  SHA1:BFB9094E6A06E54E9A4992C6D614206CF57E71B8
                  SHA-256:FCD7A4E1DD1D4475205B709AFC807286C9FC933D59F1C629D9A9CB4EB71683D3
                  SHA-512:61B8368DDBE574517A3AF0091DFC56A0E45238D0ED78EA9DC9E468B89E2DA04649A9144F678B28B518902B08812B52D3F69EDFAA229DCD11D59D86C823AC3236
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="E-Stop_Normal" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>501</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\Button\E-Stop_Pushed.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2625
                  Entropy (8bit):4.879773195080085
                  Encrypted:false
                  SSDEEP:24:Jdf5qXrKAaOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KM:3forFgqQ5Bo6z+pEm7T7KcdXMHqr9T
                  MD5:1EB0FF5CABBABFB694D277432D6B3165
                  SHA1:105F60B63ED4C2CB2136B2D231B70DC11CD062F2
                  SHA-256:D8C79E7E1B99444A1E8E0FD2AC97465970EF245AA2FDD1393520C9F03148D41D
                  SHA-512:44F439AEFC11CC1D56847C5982DFE03F0EBDE3420DB8F685B04382041BFD8F6B06453465DADA4A2C10BD93619E64B3448FC77BA8181ECA431F6E246C0370908B
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="E-Stop_Pushed" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>501</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\Button\GPS.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2605
                  Entropy (8bit):4.8666320100425615
                  Encrypted:false
                  SSDEEP:24:JdfGXrKAaOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc4:3fqrFgqQ5Bo6z+pEm7T7KcdEr9T
                  MD5:CF97E43E3EA4EF8057574EBED876F8AA
                  SHA1:2A1633DCD8974A89CF6A30B3D53F5ECF161A39D4
                  SHA-256:D3E6FE16B4B7241EE717991E1E8FA9B8542285E9C50079A4DE02FC673A232771
                  SHA-512:F29738BED51C938D6381B8397A0398CE18CA8816533F85839B6EFE90FFA9915A0896CFC8853B6AFAF2BE0A8FAE377B4809C71EBCE5B75A44BC6527B41B0CA329
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="GPS" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>501</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\Button\Gantry.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2611
                  Entropy (8bit):4.865052808117823
                  Encrypted:false
                  SSDEEP:24:Jdf5XrKAaOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kck:3fBrFgqQ5Bo6z+pEm7T7KcdUr9T
                  MD5:581C6476D34420CEEBAB56FADD190D55
                  SHA1:8730B95C8FEABB9E2B17C647D9843E0C989EE527
                  SHA-256:E47329B2AA10ADEEBF2F254E7A71727369F52581BFE2D8F52D202A484F69BEC6
                  SHA-512:83B2BCB14F21AE8367C00735CD4101ABF5154242B4BA8F24125AE4412D795E873033BBD6C7B7BE872470933D56DA596C9301B70FCA9330BD71E66867F0345CBC
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Gantry" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>501</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\Button\Help.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2607
                  Entropy (8bit):4.860953026104003
                  Encrypted:false
                  SSDEEP:24:JdfBXrKAaOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcv:3f5rFgqQ5Bo6z+pEm7T7KcdKMxr9T
                  MD5:D967083FC1DAC443A2220D6DE1916A33
                  SHA1:907475443A513EE0376842B5841F3E157C18131D
                  SHA-256:112DE84411DBF07C1FB4D5BB8C6CC2DE607DBBF04B9E3B5DA72A7C34B86D93E8
                  SHA-512:A3FC588E9B5C13A1A8195632A9FCB5F4DE190C9938E2FDC99623983E9CA75ECB16ACA934B83D30F0D532CA23B627BCD3B2384786826FEF1C3852FDA73428BC25
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Help" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>501</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\Button\Hoist.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2609
                  Entropy (8bit):4.862528900595944
                  Encrypted:false
                  SSDEEP:24:Jdf5nLXrKAaOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb79:3ftrFgqQ5Bo6z+pEm7T7Kcdvr9T
                  MD5:D49D6B6CC9329C2B23DCF30E369BFB01
                  SHA1:14A1C78E7C6F391CA10AFED8C551CF158D68585C
                  SHA-256:0D6528FFC616A35FD6259304706AE4D51A17FC6E5CAAB82070BE95E0F8504F1E
                  SHA-512:25273B4FA8F3FABA7FF71B91B6AAA20CAE70E7A8DCC60D6A5DAB90B39AEA00646BDCA7510106254EE233C1D6B26AF6CF3D0981AC422F77EAEE69D8434F6AF30F
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Hoist" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>501</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\Button\Home.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2608
                  Entropy (8bit):4.8618710912037795
                  Encrypted:false
                  SSDEEP:24:JdfRXrKAaOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcc:3fprZgqQ5Bo6z+pEm7T7KcdQr9T
                  MD5:0296E3DCDA35661E84EFD512C9B78B83
                  SHA1:3D6FDCBA5532C821BC589D0222DB14F70BAE06D2
                  SHA-256:6E630F5592D5D3AF92C95800EB1F00E76B22C15F1AAADA3428B9ACCD60870249
                  SHA-512:9D437E3D4E2DEF23A860CC282D8E67B18FFB897277D797A41A380E397252466B978F81C694662D0900C9C4FE6E649F5D7EF42F4037082E2C5143A7544E1E3C33
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Home" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>1001</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\Button\Inverter.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.860885285646714
                  Encrypted:false
                  SSDEEP:24:JdfhXrKAaOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc4:3fZrFgqQ5Bo6z+pEm7T7Kcd8r9T
                  MD5:6F23C15B10850D898BAB98B76E0EE74B
                  SHA1:6EC5B8636F82C710ABBE8DD8222BE99F0DBDE92D
                  SHA-256:6EA0128DEF85D73276D745A3D6313E17BAD88059AA520A4BCE9CF14EA67697AE
                  SHA-512:C48CC82CB676238E011BB5BC5E82B1F48D1EB8FB1735C303F7AF156DA90F7947BB5252C0D699C474326F5B8EF8D573E1E4D68DB42A1CB533B93FA7C6ACD1E004
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Inverter" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>501</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\Button\Maint_Normal.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2623
                  Entropy (8bit):4.868757242972138
                  Encrypted:false
                  SSDEEP:24:JdfE8XrKAaOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KR:3f5rFgqQ5Bo6z+pEm7T7Kcdur9T
                  MD5:8FA2DC8F823C2CF790FE7D2448C966CD
                  SHA1:E779485D911B07FAC6F827322EB2A65E64905F63
                  SHA-256:95AA4EAFA16B025532AB3FCF5824153613CF6F918B188CDDA6659FA2EAE75C2D
                  SHA-512:7FCFABB5CF085ABACB518C3C35EC25DD72F4A2769D14A3BFF0D3061A651E75F895A097769F0268E1DB6D4C80161BDB28B77D0FAD0A225C06AEBF7FC5FB46EFE9
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Maint_Normal" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>501</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\Button\Maint_Red.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2617
                  Entropy (8bit):4.869346165267421
                  Encrypted:false
                  SSDEEP:24:JdftLXrKAaOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KX:3ftbrFgqQ5Bo6z+pEm7T7KcdCr9T
                  MD5:F9C95637803DB5194CD5053D3F8B315D
                  SHA1:BCD6E57C66BAE3EAAF402E882FD5C0A6BAEBEBDC
                  SHA-256:7105655A9BF6E094C3A201237A17254559CB5A29CBA3F39A9C3F3994BC68F093
                  SHA-512:988A36D592646A9F165AF6727A0DD71C27BD90FC66C4C930F103D9645C57B3EE14E2B53C52F7EFF2EB06326C4A6CDE92038C76C7AB40DE5AE136B2C65B1BD9E6
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Maint_Red" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>501</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\Button\Maint_Yellow.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2623
                  Entropy (8bit):4.87340344158223
                  Encrypted:false
                  SSDEEP:24:Jdf0HXrKAaOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KC:3f03rFgqQ5Bo6z+pEm7T7KcdGur9T
                  MD5:1B7E2E2D0913299B3BF61CEA85F6FF87
                  SHA1:45C647FA61FE100D0A97487066C0A6A6954DD881
                  SHA-256:41A308B313D5EAC6D3CDFFCE5CCFE7ADAA302423F1C2673DE90E1B1D12F7D676
                  SHA-512:70C1522D7C226C8450E9E92A15F77D848E9166F167564A04035F78D55D0B5FA078ED02FFD53943A954BC63299B14E42C934E3C3F3915C8FC568E32CCB9655E72
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Maint_Yellow" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>501</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\Button\Menu.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2607
                  Entropy (8bit):4.85777084109552
                  Encrypted:false
                  SSDEEP:24:JdfRXrKAaOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcU:3fprFgqQ5Bo6z+pEm7T7KcdrMFr9T
                  MD5:11AA03E5CF050CD0E2BCEE8B85D8BD21
                  SHA1:3673EC2314003C99F728C744FBA9477F72EB175B
                  SHA-256:E243F41C60EAF000E3061A4FA3E5CAF0A0CF814BBC2C799C16F38E919E379541
                  SHA-512:8800CB018171CB21965779FADD9E02F0850F077D183283E1D4F8D28AE000516D79742DF8ABF14A969EED271ED1A4A224F0F6907314AAC376778414B3529127D6
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Menu" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>501</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\Button\Minimize.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2616
                  Entropy (8bit):4.861442089130819
                  Encrypted:false
                  SSDEEP:24:JdfuXrKAaOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcz:3fCrZgqQ5Bo6z+pEm7T7Kcdj3r9T
                  MD5:D789695C6100DFBBDF1A4276264F65A9
                  SHA1:44B8DC69D5E031E9AFF419187C5A9782FB00E478
                  SHA-256:B5875E79B2AC814ACD4EE2BEF24C64E2C66314006D9626ADF088503A4924FB77
                  SHA-512:251D4E4E6EA147007B991881B7FAF09E492115336F73079C969DF5A69B51CD80B97696F70B2985BEFB99C65C898C8D70E57A3DAD2C05DC86F071F510DD462ECE
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Minimize" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>1001</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\Button\Spreader.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.8616961737119215
                  Encrypted:false
                  SSDEEP:24:JdfWXrKAaOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc3:3farFgqQ5Bo6z+pEm7T7KcdjMur9T
                  MD5:D13C9F39FC04660239A80CB538C7DB39
                  SHA1:AD414F626931D5CE98F031A7F769526CD3890465
                  SHA-256:63A30C21242BDE3733650A72D1BCFFC523BB7D20065CFF5169363178F76D4C51
                  SHA-512:42154D2831C50AB16CC829CB4DA1309DAB4318FE48DFADE5B48D38EC3ADD89FB69F35E9C2BB4A8C3B375D834CD19C7FDA3B0F52D53A9502BED1B8ADBA4C40CC8
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Spreader" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>501</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\Button\Trend.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2534
                  Entropy (8bit):4.864085552022256
                  Encrypted:false
                  SSDEEP:24:JdfpXrKQEaOgqQjKXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KA:3fRrOgqQuBo6z+pEm7T7Kcduk26T
                  MD5:ACB5FE66D35E0FDC87DF2CE9FBFBC7FB
                  SHA1:3B6724931A5BA9D8E8313C19CCB9C66E31E8B915
                  SHA-256:5C98109DBAE3327F04C1CEDD6872432306E4F30A8BF2519B0864CE01430E26D9
                  SHA-512:E08B98A39E93C268C1B3446E631745153CD04E81205CD9ED15A0F0D0A3A109C48345428312A3A68B8F02BA8A2A31DE91F61179F6A8D768FAB8835A604A586CA9
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Trend" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Symbol>.. <Version>1</Version>.. <ID>501</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\Button\Trolley.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2613
                  Entropy (8bit):4.862906266563149
                  Encrypted:false
                  SSDEEP:24:JdfzXrKAaOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcJ:3fTrFgqQ5Bo6z+pEm7T7KcdgMpr9T
                  MD5:8E005878B3FCC21C6A207A5620DEBE33
                  SHA1:383D905D281B27119034824507FCDF54D0D85629
                  SHA-256:4D22204B761537EB450DAB725C9C1ACF5D5BD7D1439EA5E2B8198345CF6E7ADC
                  SHA-512:A78BA5E7785C13D1E0D3FB4455564FD1C3C4FA2EB34F46745246D325D6513FFB4ABFD34DB03EEF7CB423C53324270ECE3ED8E670E9E6F7490343B0D4D5E8D4A3
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Trolley" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>501</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\Button\User.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2608
                  Entropy (8bit):4.86121216489429
                  Encrypted:false
                  SSDEEP:24:JdfjdXrKAaOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kk:3fJrZgqQ5Bo6z+pEm7T7Kcdbr9T
                  MD5:8F40AE94DBDA3FC3025CF2D3320D988F
                  SHA1:887B519EBEA17AF3EEE4514AFA2B83DA98D771EE
                  SHA-256:4B552DC1EBEC4A5E561574AD59484F687AF1A66516828EE2872B3C9A9F2F4A24
                  SHA-512:D8F210438718B93082FE6A5F6C5502829C42E3881D98C5CF09FF61396A60171CDF4C40B51656AFDC43913088D85D5BC7D49BA5B40CC4A2175D9431098BF8FFB0
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="User" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>1001</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\Button\Wheel.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2609
                  Entropy (8bit):4.862761962266884
                  Encrypted:false
                  SSDEEP:24:JdfVXrKAaOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcI:3f9rFgqQ5Bo6z+pEm7T7KcdnMesr9T
                  MD5:AC0CA37BB2B2F1899B17098992F31B0D
                  SHA1:E90CD830A5219B8B9CCE13845FCF93B11306BAF9
                  SHA-256:90727D354955FA54D655F69C9DB25971590DAC7FCC98852645721E8D79A06DB4
                  SHA-512:F42AA5E72B8832297CEB0629A1CE4C2F302E358225B04641DE6E6D903DCC17164A7A0F8C7F5CF39E916483A016AC8B7B5783D9700A3D1E8C291EC54BBB7F2C6B
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Wheel" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>501</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DIRECTION\arrow1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):8611
                  Entropy (8bit):4.657158828746267
                  Encrypted:false
                  SSDEEP:96:Gr5Y5v0gUcH5fUg0M3KLi5XDfUg0MeaLxgex2:6kJppKL6bUaLGeM
                  MD5:C6967F3893C1862471E2702E9340572F
                  SHA1:BDC919F08FC64CC1AE82B8B9F40CBF85689CA559
                  SHA-256:32CDD5E39DC39D325B9C8FC786237C9377D77F44516295881355A952F4F4505F
                  SHA-512:274E1FAE0ACBDA57C0ABF825800444DF98F44115C0FEC0AA87F1A0B63A1861A3CBB78C7132890F1B84773CC4BE3E006011DEB1966B8AE3D3655CF157F1C1F791
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="20" Height="20">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <ElementGroup>.. <Version>1</Version>.. <ID>4686</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DIRECTION\arrow2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):8613
                  Entropy (8bit):4.6572909787123
                  Encrypted:false
                  SSDEEP:96:Gr5Yhv0gUcHmfUg0M37LiWLoFfUg0MeaLxSm:64Jap7LuVUaLxSm
                  MD5:E9B6EB2676C1C0AEF217A3A33BADDF4F
                  SHA1:F925E8BF8C13B2754B3B6288B09792E2C02D26CC
                  SHA-256:4F55A03BBB54CCFA93E7DC4961F5A5D6DDEA8842A49BF749D949A756472A90D8
                  SHA-512:641F5A3A1FF95779CCD832F90A597760AF4A1C32A86B1FD5174ACE5E90377EB94A47656D40FDB84FE6AFD38B31A2D5F4F5694B59749742EF836CE3935D9DCAA4
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="20" Height="20">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <ElementGroup>.. <Version>1</Version>.. <ID>5685</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DIRECTION\arrow3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):5773
                  Entropy (8bit):4.8836559780092905
                  Encrypted:false
                  SSDEEP:48:3fPGr88CF990vgqQ5Bo6z+pEm7T7KcgaAPIg9Py4p3mvgqQ5Bo6z+pEm7T7Kcg/9:Gr5Y0v0gUcHAry41mv0gUcu6Lh7K
                  MD5:7267BCA61680A65D57E5732979967B4B
                  SHA1:AE37FEC522AE83C968FF103E0E7A174F38223387
                  SHA-256:221D601BBB206217F702516BCAEB50A61E3B0135F8478B2D49CE89CC0EBE0AED
                  SHA-512:C0280BBAB96D9354E8A795268BC3373EC4B31202742C79542B92B1B4D41ECDEB32940EBDA4C6407F667057148B878452E5D288BAB90D38909F9112F20B167B82
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="20" Height="20">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Arc>.. <Version>1</Version>.. <ID>5698</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayE

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DIRECTION\arrow4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):5768
                  Entropy (8bit):4.879255236666548
                  Encrypted:false
                  SSDEEP:48:3fPGr88CF99ZVUvgqQ5Bo6z+pEm7T7KcgaNPIg9Py4p32vgqQ5Bo6z+pEm7T7KcU:Gr5YZVUv0gUcHNry412v0gUcu6L6huM
                  MD5:EE1F4E4354E814ABB1DABDDAF7908CA0
                  SHA1:C9FA4113C9FD18A796B69D4C8AB38597E351B3FB
                  SHA-256:B2D5A6660F1ABDF3F44B9C4184302C3FB28850D387CC1E3641D9556D31C09002
                  SHA-512:8F5B4A77A281AA096F390D017A6C3B31F9226B9E88B3B5423F11BE019B509548C3AC52BA753EB128B55F5DF9E190315E88D1BF01DA0ADC3EA9C956A57F35BDEA
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="20" Height="20">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Arc>.. <Version>1</Version>.. <ID>5706</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayE

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DIRECTION\arrow5.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):5769
                  Entropy (8bit):4.880469851350311
                  Encrypted:false
                  SSDEEP:48:3fPGr88CF997vgqQ5Bo6z+pEm7T7KcgadPIg9PygTpvgqQ5Bo6z+pEm7T7Kcg/Pw:Gr5Y7v0gUcHdrygTpv0gUcu6LgK7
                  MD5:31D98AB229DAEE8F3DAC80EEC055556A
                  SHA1:7DA071705C95F8F4F36DE1BC4ADE6D8F815A4022
                  SHA-256:D2F811C0A4BE9CFBAAD8AA081F9421378819E9A8BDB1395C94381C0D5CC0311F
                  SHA-512:6FDF4BEE9322C1AAD95764127758C4866FA4F54A499DD2C1C10089FAD1E7C8307BE88E153658E2A5E22010CA8D27A57CFA0D40DC8095D05C35AE614A83C65AE4
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="20" Height="20">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Arc>.. <Version>1</Version>.. <ID>5712</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayE

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DIRECTION\arrowX.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):13996
                  Entropy (8bit):4.7119409505462535
                  Encrypted:false
                  SSDEEP:96:Gr5YCv0gUcHefUg0MeYH/efUg0MeYm2yv0gUcHsryg1v0gUcHsrygf:6XJSUYHKUYmfJsr9Jsrn
                  MD5:F4A05F654390B030C3CD636F1F52CE4C
                  SHA1:1BC5250F84154373BE2FC3A79B063C1D08EC2002
                  SHA-256:ED3CD167945486776E73D49679BF8F20E604BAA0A8AEBFCB8F57FFFF1FFB7642
                  SHA-512:AD7A44CD8ADC59ADF5A2E34AC6CC41AA49BD79B5CEF928BF50BCB084E64E22B83BCD73BE8922987E99BB82091F468B0EE0D5604F417735A2C6A5E8BB5E94FDB7
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="20" Height="20">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <ElementGroup>.. <Version>1</Version>.. <ID>6676</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\bracket for tyre.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):8035
                  Entropy (8bit):4.85580720751896
                  Encrypted:false
                  SSDEEP:96:1rO1vEgUcdbnUNvxgUcQ5YB7vxgUcQ5YVv:+bbnUF5YVF5Yt
                  MD5:62E26CE640D08FA5469B0496EDDCEE34
                  SHA1:2A955F01A07BB04DA4730B4B5B881B34D13302DE
                  SHA-256:FB6C0F8185DF03FA07EAAAA260480F6BEC626C42FA691242032BD0DD1FD02AF7
                  SHA-512:15D87748BF47B5A02E43E4830F1C3071FEF3DCCB4BF98F4E46B9079FA0BC8133C8A1C51D4EA4E636D173510BEC40B1F8E6469BD4C167036552633E5E2CB4FDD1
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="bracket for tyre" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Rectangle>.. <Version>1</Version>.. <ID>11</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="255" Green="255" Blue="255" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVer

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\container-blue.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):16626
                  Entropy (8bit):4.596480594594037
                  Encrypted:false
                  SSDEEP:96:0rgxgUcdTGNg0MtzHUZWfRg0MthHUZWfRg0MtmHUZWfRg0MttHUZWfRg0Mt7HU5:Xs6ozHRchHRcmHRctHRc7HS
                  MD5:5FE73E23D757ACF9FB08D7AC83C3BAB0
                  SHA1:3ACE758E34713AF0611365A90BDE5D7EF495A8E7
                  SHA-256:885BB4F4CEA0EA6F29845705C68F17F2FE465E8F1CF3F6AC0F770B412AE5DA1C
                  SHA-512:3FD2166E98AA97F05F18066D230C2EBA1DC65AC8AD95C7BF5F897F90023849B78E336D5C084904205CA04007B4B0A096855F3B4707520C65DC6E11A20A1117C0
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="container-blue" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <ElementGroup>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpre

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\container-green.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):16635
                  Entropy (8bit):4.5989857605234885
                  Encrypted:false
                  SSDEEP:96:3rlvjxgUcdGGZg0MtzHUZWfRg0MtUHJUZWfRg0MtNJUZWfRg0Mt0ZJUZWfRg0Mto:BvjshkzHRcUHJRcNJRc0ZJRc7JS
                  MD5:BA67F1D1382EF59568FD6CC13854DD8C
                  SHA1:E2444929EE118E47279B338B266571E8D34E2A58
                  SHA-256:99C5FA60E47E13F44C95033B5AE3E2354E1DC61B6AFC6CA31AAF4BAC97D6DE97
                  SHA-512:92849D528B85A63F89DFB79F38EDA95E59BBDECE754CDEF819B8EFC5B8A16FEBFE8E65E3F7221A1765F4B94AF24F615AEFE47A411972D528B1D576A8C09B60CC
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="container-green" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <ElementGroup>.. <Version>1</Version>.. <ID>8</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpr

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\container-l-blue.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):39283
                  Entropy (8bit):4.565340090915675
                  Encrypted:false
                  SSDEEP:192:bsCoBHRcqHRcxHRc2HRckHRcWHRcfHRcWHRcEHRc0HRckHRch8HRcOHS:b5KxRxMxDxJxvxSxPxJxzxPxK8xdy
                  MD5:6B40C262382B23F8789C761BF20A259B
                  SHA1:D8428A625CE76CC28249EA7F40862966855A9036
                  SHA-256:BFADD121EA2E5B4C072B14F8BA7126D1B47E688C16650A3C8757F258DF4EDCBE
                  SHA-512:8BCDA5BCB624D1931507848DB261F65C1672B67C06DC614928C7DC88343E5CD779945F119A8C293E4E461FA936712D95DA1A0098C7C29E01CE4C2C58996D2F3C
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="container-l-blue" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <ElementGroup>.. <Version>1</Version>.. <ID>13</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerEx

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\container-l-green.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):39308
                  Entropy (8bit):4.566873210634198
                  Encrypted:false
                  SSDEEP:192:ZsVkxHRceJRcdJRcjJRccJRcQJRcwJRcKJRcaJRcTJRcDJRchLJRcSJS:ZWWx9HUHiHFH5H1H3HnHkHgHKLHJM
                  MD5:971F6527A63C6875DBB00FE58E499F9C
                  SHA1:853ED21174EC6CBD4A7497A77381B5D38752875B
                  SHA-256:8718C0092D7CFCA8C138EB00B5D103F61DDC3B936D879751AF4830A6028CD8AA
                  SHA-512:3721BC65FDD6CB9CAC942F962EC70182035A232289658B0C9F5E7D2615399175616B493D2701B2E7251C1132BEF84A385E742FD8F4E777BEBB0CBF748BAB320D
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="container-l-green" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <ElementGroup>.. <Version>1</Version>.. <ID>14</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerE

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\container-l-red.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):39306
                  Entropy (8bit):4.572023146264162
                  Encrypted:false
                  SSDEEP:192:6sVpV4HRcRiRcxiRc2iRcbiRc/iRcfiRcWiRcEiRc0iRckiRcXiRc1iS:6KpGxqYMYDYiYGYSYPYJYzYPYIYWd
                  MD5:1AA8D8E4E4C0109D1BF315C93C0E1973
                  SHA1:216E8A26D14DEDAB36A23EF2637A096A7EB9B3DA
                  SHA-256:722C32E92EF54EEE412B608FDACD2E45CD1C6C829CEFF7A0CF04585BCC06B6CD
                  SHA-512:9CD2ED18513AC6DD5AAC710AC9D2647EB630D71A3B8326E4F4EB40B0B05E32B633FF275852F6F906FD81B063EDCE8C32E8D5C74E004E92C56F678699DBDBF821
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="container-l-red" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <ElementGroup>.. <Version>1</Version>.. <ID>15</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExp

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\container-l-yellow.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):39309
                  Entropy (8bit):4.566386340501593
                  Encrypted:false
                  SSDEEP:192:4sQLyHRca/Rcs/Rc0o/RcI/RcG/RcM/Rcr/Rco/Rcn/RcE/Rc0/Rc1/S:4vWxhZdZfoZJZbZ5ZWZJZQZfZbZGq
                  MD5:2419EC86C210EBFB4DD85E3EC9DAAD99
                  SHA1:BD75A133EFF53C5F4C1BBB3BA214940EA5806E9D
                  SHA-256:35B3ED09E66D6661E7D19062E8EF677A45CDF5F76A6FA782F2897935BC2F84C1
                  SHA-512:908DAE283346B1389F6AA03A73FC5E8409FC71DC9DD39E0C6FC5E8D0840289D45E84E1A8243CEE99F206E77DCBA24A713753E7E72C532EA4A1B6676261713BC0
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="container-l-yellow" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <ElementGroup>.. <Version>1</Version>.. <ID>16</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVer

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\container-red.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):16633
                  Entropy (8bit):4.6012034141160685
                  Encrypted:false
                  SSDEEP:96:zrexgUcdVLG2g0MtzHUZWfRg0MtUHiUZWfRg0MtmiUZWfRg0MttiUZWfRg0Mt8iS:2sVCVzHRcUHiRcmiRctiRc8iS
                  MD5:857F37B0F69259276ADFEB395AF3288C
                  SHA1:9A9EC3F3C140096FE7FAF5F412671DE050F1088E
                  SHA-256:27B459F12193025FF49DC914A58D293940270AD678C836DFCC7068FF358DE13E
                  SHA-512:5D482CF69295E27CB1BC9351CBDB8F68DF03AAD33AAD0202495B06E39E313381D72AFF7B6D80DF4C309B3E4FF19E3C75328E5446F17AEEA33A5AE9DD2C2EE404
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="container-red" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <ElementGroup>.. <Version>1</Version>.. <ID>9</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpres

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\container-yellow.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):16637
                  Entropy (8bit):4.59767241121196
                  Encrypted:false
                  SSDEEP:96:YruxgUcdtG0g0MtzHUZWfRg0Mth/UZWfRg0Mtq/UZWfRg0MtG/UZWfRg0Mt7/U5:PsoLzHRch/Rcq/RcG/Rc7/S
                  MD5:57270368028D7A132B83A428DEF3C47A
                  SHA1:54EF0E03B2E8BC59288E1E9166AE4AB3AFACCD01
                  SHA-256:64EA01349EE4BF5A68D5855372F4A056279936A7C5F13696D993402C07B7CA36
                  SHA-512:858C89884DCB1A091A4E535DDAF44556A7E88089BD625B12338B0BC087DEDC654B3362304FDE594E65973BB9960F628EBC724A9DF68EA058E4BED61EADCFFA3D
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="container-yellow" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <ElementGroup>.. <Version>1</Version>.. <ID>10</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerEx

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\container_l_green.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):155974
                  Entropy (8bit):4.329551070795914
                  Encrypted:false
                  SSDEEP:3072:G7EKySQFsp3XFspd1FspjSFspsGFsppIFsprzFspgxFspGwFspb8FspkeFsp+XFa:gEKfQK1XKT1KNSKWGKHIK9zKixKMwKN+
                  MD5:A65536872C7E0D303B59DD92E91FD68F
                  SHA1:82E4F06441C32910F8F4D167F3AA73B86243F19C
                  SHA-256:AD08D4A07678B0CB01A73D21072E09FE5D3F96DC2CCA5F9E7D32F3F678F24410
                  SHA-512:7E13FB70F7240614FACC7A9304C71DFDF9B07EB5E1FFF1AC6C8C7BE6BAE30D97247694DAEE90803DCCDD1EC5C93C4192D62F6D8CD80B0F7897E97F917622EE6F
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="345" Height="165">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <ElementGroup>.. <Version>1</Version>.. <ID>8435</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\container_l_red.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):122327
                  Entropy (8bit):4.599824510278775
                  Encrypted:false
                  SSDEEP:3072:G74OQVc5h4Vc5HcVc5KPVc5xYVc5TsVc5OkVc5YEVc5vgVc56IVc5YtVc5DIVc5u:0HQKH4KhcKQPK3YKtsKMkKiEKhgKgIKu
                  MD5:B1EA3BF4D8FF8D849459C305CD340BBC
                  SHA1:D4856B4AA317D276101FBFB32639F755EB95E869
                  SHA-256:6B136AAA58A16C4FE884E3E5B3F497BA006B970550374ED8524DAC9D63A3E964
                  SHA-512:BC1A5C9B001CC388472F4C0D09C45DBBEBCC63A14524B6A9964541A4CB715CEB96D5004909D189ACB283E2A7F6C383BBF3BBD1D74767A4869877D559F0B79599
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="345" Height="165">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Rectangle>.. <Version>1</Version>.. <ID>2193</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\lift.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):39696
                  Entropy (8bit):4.4948484767051
                  Encrypted:false
                  SSDEEP:192:uskcmHFcCHVcYM+nTl5HtMOnIMYnmc9XlYLnvOrQMrnGbhn2F5+ECF5AJ:uxnl11X3Tl7TIPmElYoGF2F4LFc
                  MD5:12BCBAD1DA00A07956438DE849E58B2D
                  SHA1:6CD08185B794DBEBF93DE7A2A7CF73A3DFEEAD3C
                  SHA-256:BD9338963DBCA33449759C6890FA0609FD0095E837D5518F72AB2CC816946E95
                  SHA-512:419B1911E7C35706FA534287129355D460AC3231525C26F632C5D43EE86F4E10CAE80E7342C2DB97C0E3B3419595B6EBC35194802A562F8054EDF5163C58F5B0
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="lift" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <ElementGroup>.. <Version>1</Version>.. <ID>9</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\quayside container crane(part).sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):176351
                  Entropy (8bit):4.0722389308968285
                  Encrypted:false
                  SSDEEP:3072:b2CLjWAzHYqepfM/e+C12W2s2Shm2n2iZukNl9CarTFNqz1n1y1z1P1CKIYpA1MX:b2CLjrLzW0GVzD3AYfcMl9dvfG1olZQ4
                  MD5:0E015E69587F2BB6300D26E98D784405
                  SHA1:48E8F7EBD861E2165278C1DB0FFF2267E4F36AB2
                  SHA-256:36A0525381A26E6C5A0ABDF1C19930C03DC69950ED8EABFE0A3B387E13DF537F
                  SHA-512:ABE38B754D829545D25F8BFFF4A0B4DE5C4A907588BC3231DCD286E390360F3E486FF40031628D4822484C1078F8FF696DE754FE0239E03C718190EC4CC8D91A
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="quayside container crane(part)" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <ElementGroup>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\quayside container crane.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):242894
                  Entropy (8bit):4.4281032783338015
                  Encrypted:false
                  SSDEEP:6144:7PFFcu9IRzDsPCX0SsnKIAvt9E8+qpIpyK3f04FpRUZN4FtAjvl81FLjKjm0VtXo:7PFFcu9IRzDsPCX0SsnKIAvt9E8+qpI7
                  MD5:A507109639A8A492AB4A892327549339
                  SHA1:3F954C767AAB6019AB408EB68F2CC770FA94A5E9
                  SHA-256:78EBF5BF02296BC5FC7AEABD589C7ADC627EE3EDE9C96BA8BC2731931DAFADB5
                  SHA-512:4AD7BD6FF0766C0422FA5FE9369C61D6ADE604B65D5327258CD254E27851AA37A0B954252FBF96E74692CFA5D9D0B7107D0817F628E0A2139B23DFC60C044840
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="quayside container crane" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <ElementGroup>.. <Version>1</Version>.. <ID>17</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\quayside container crane2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):190772
                  Entropy (8bit):4.139580673015332
                  Encrypted:false
                  SSDEEP:3072:ruFL2V2Z2+AAk2n212z2R2G3m2n2V4NE4QhYmBlCGTz8y3CCaxCYZeC/pI7qq81S:ruFLKu3A5aIgW7WgO4JQ+G44w0ebZe88
                  MD5:A620CD65AC06683A95498445B728F536
                  SHA1:7637C41FA71BBC7E2FE3925790C9DDA184F668A6
                  SHA-256:BE1F1D763061AE9AE7E683A2E74E808F995E59FE9A1A3B8B7D2188237E1A3708
                  SHA-512:7EAEB0EE9993C8E578030EDEC0E1616F2766F839834C5DFBCF37C09CDCBD4793B3A0BAFBC4E5A4E27E480E19DA3D01C087BF0B456E54BE3368D15207B9DABA23
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="quayside container crane2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <ElementGroup>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\quayside crane way.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):176964
                  Entropy (8bit):4.556476139021512
                  Encrypted:false
                  SSDEEP:3072:RLVge1NYV6VFV9VNVBVpVTVPVNVfVVVnVXV7VVV7VnVnVXVvVLLLYVeV+ViViVCv:RL2kNY0rLjnnpVztbdVR7J1dFN5LEYgW
                  MD5:4F992B6ADACEC878170422A72A08CAA1
                  SHA1:8EE84D2ED975906B1E5F69092B08E679C69A5791
                  SHA-256:0446D5552AC36CF0A8C30EB759E62D350EDD8EA4CC1F1948455639828D4BB731
                  SHA-512:ED41ED756C33BA07933C4232062A062066D65C397AC374F008A405024016A2FEB9102606ABFBC46D834F052479A3DC8172BFA85DF68F208B21BDAE7A70B92323
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="quayside crane way" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Rectangle>.. <Version>1</Version>.. <ID>8</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="255" Blue="255" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerEx

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\rtg way.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):191648
                  Entropy (8bit):4.444248330131771
                  Encrypted:false
                  SSDEEP:3072:k8fyVGVl0eV4VbV6VrVZVAVvV6VAVZVhVZVzVlVMVuV8VOV9VgVBVCVwV5VYVPV5:k8acXfG1kdP+xki7zTBDKQGM3iHQyTuB
                  MD5:8C8EAC7A2E21AA9856641C7C89609A3C
                  SHA1:ADE219082DD99BCE10166626334A050A4A884A2B
                  SHA-256:8032AD4BFF7A772EA29F8244CFDBA672E5A38D5154DA8F3AC790EA2968B25849
                  SHA-512:0562981F545C68B069724B2BA03D4C605ACD57B7C1C353D0D10B6030EC992F9F5F089563CE8D4CF5395609A57E516DB129C8EF18B3525731505DE29644C4A965
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="rtg way" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <ElementGroup>.. <Version>1</Version>.. <ID>53</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\rtg wheel 0.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2625
                  Entropy (8bit):4.874901272868954
                  Encrypted:false
                  SSDEEP:24:JdfMzXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7K1:3fKrTgqQ5Bo6z+pEm7T7KcdITr9T
                  MD5:6601D6F438915076B8C45655E87B28F8
                  SHA1:E0C80350401E8E06C8B34362FFDEC1C7CAAC62FF
                  SHA-256:A28F12F93F95015580DE5675A5DC28416CF161AADD23D4BFE7269ACD8ECC678A
                  SHA-512:1081973952070BAE4B7F31B93F2B7F5521934C865DFBB10057045B1FF43BEDF961A075D7FBC41FB45ADA5C04DD6C0C58968BD50D0A801227AEC1486867AC21D9
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="rtg wheel 0" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\rtg wheel 45.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2626
                  Entropy (8bit):4.879167704722264
                  Encrypted:false
                  SSDEEP:24:JdfmsXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7K3:3fmYrTgqQ5Bo6z+pEm7T7KcdUpr9T
                  MD5:91267C8B098CD9A238F860533DEC3BCA
                  SHA1:66A8DC48A1473D8B6BA282E047A0625E842DC78E
                  SHA-256:F6BBC1808AA16CDA4F1F16F7736AFBB6792DD562B00C7EA62DB8EBBBA936CEA0
                  SHA-512:75ED21DDC5B6FFA04B2B532B950A98A8501F23E9853BCE902DC4E0654273FD80B48FB8A4B0671EC4C9BDDA4B68A3F2731E57160125C83F13B3AC9830E9AEFE93
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="rtg wheel 45" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\rtg wheel 90.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2626
                  Entropy (8bit):4.877999934308828
                  Encrypted:false
                  SSDEEP:24:JdfdtXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KP:3ffrTgqQ5Bo6z+pEm7T7KcdxEK8r9T
                  MD5:0580052F70EACEFAE9BF8A5A526C24F9
                  SHA1:446509AFA77B7D36611F856A7E882F0800526A42
                  SHA-256:2767CBAA76D6F061D3F6E69CE7EFC99F6949BB891EFB7840C9874D65CA0B5DF4
                  SHA-512:159D8E7F6591FA642AB35DC2B9A8ACF6E70ED8F16828162447AF91B035DA2529BA6330EA0BB1E2DC9773309EB9FF95B3B0631ED198C8F612383BE9DCB5B8C1BC
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="rtg wheel 90" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\rtg wheel turning fault.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2648
                  Entropy (8bit):4.875492965942596
                  Encrypted:false
                  SSDEEP:24:JdfmKLXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7r:3fmUrTgqQ5Bo6z+pEm7T7KcdYO9r9T
                  MD5:22AA7DE6786A645F1746D3ED07A2F8FE
                  SHA1:92263A6A2075D01264157CE1F13CE53E019C7221
                  SHA-256:E7A75C19F90AF4588C4EC89851F93F9FC18BCAD26838EC93BE09A8946ECB49D5
                  SHA-512:FF920EDFBEFE94A531C439A4C3A6027E682A974B7F3E1E82ACAAB6B88E6B0A962511509416567468AE342D6C3C098F99B0D0A3BBCEAD34411F448CD36BA500EA
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="rtg wheel turning fault" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpress

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\rtg(part).sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):122543
                  Entropy (8bit):4.285285256792394
                  Encrypted:false
                  SSDEEP:3072:l09osdfqGqmqGqjqrquBL5Xih/sx/KLlBl8lKlQlDEBLk0l+lTm40mC7j5GluLLu:l0m0yNtNOm+L5XC0VqLCE6Fkw0Mtm4xX
                  MD5:40199B901F694AD130C1FC6C8515369D
                  SHA1:E3007A85437228B50C6679B1D337EB49E4EBCB2E
                  SHA-256:FDB891B2DAF8F8665462F8DA8ADA45593480E104E512719F0B7ECC82B838F186
                  SHA-512:D3FF55668C373AED2BAB55109B3BE22EC09539631560DFE4131F83D65B0C3472AB0D9518D2A6CF84B74106FF515CAE7187F47DA55848D5E52515D2F0D1014FB1
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="rtg(part)" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <ElementGroup>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\rtg.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):505888
                  Entropy (8bit):4.235502559819333
                  Encrypted:false
                  SSDEEP:12288:WWFNZm1hkTbAQjEbz85QTVOj86VyKO+yCSHAk2F/Kw8ee7Q8X26LIZbL14+LspSh:WWFNZm1hkTbAQjEbz85QTVOj86VyKO+P
                  MD5:C3BA674BBAED8420AF513D6EBA6D2648
                  SHA1:BBFC5A2D498BD3E0D35F8635ED450278183DDF75
                  SHA-256:3B86DE7CD68550EB6767BE4980B4730D7ABFADEFE2E3B2FADB3CC5EF2A2BF98C
                  SHA-512:CC0B183793A22329B46E2D93D4E9324FCDC15683649E512815E83F9B74FE8342CE4A1F4DFB3FB5A11EFBC571361CE98A19F1F2FD8EB66A0E6BFFA57F07634192
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="rtg" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <ElementGroup>.. <Version>1</Version>.. <ID>38</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\rtg1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):695290
                  Entropy (8bit):4.010296816164654
                  Encrypted:false
                  SSDEEP:12288:hWbk6KmsERJ9WNHNhRCpt9yZhBv9MJXvEqlTtvqNOhQHptaOt7/kyhuiY/iHYflP:hWbk6KmsERJ9WNHNhRCpt9yZhBv9MJX7
                  MD5:A48CBA65E8381D2710A1D904205D7A22
                  SHA1:F35B96F6A4FC9E4BD3CB9E74F6EED59951424E1D
                  SHA-256:6F049265415A3577FBFD836B202761583356A3C20D6568244898B244CF541C4C
                  SHA-512:759DF2901F81D20A152167D147126D7000895190E4F7DBBFF9738E2D9E73FACDB076FA9F9E9FF0D7064C81503E51E370E46CA00D9382C41F0D35DB56C0436871
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="rtg1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <ElementGroup>.. <Version>1</Version>.. <ID>210</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\spreader.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):64436
                  Entropy (8bit):4.60393011717929
                  Encrypted:false
                  SSDEEP:1536:nM5kCiBkCO3TAi89Zb8IFrAWjKzAVH5Aj8LZU8W2LDLGO:nM5kCiBkCO3TAi89Zb8IFrAWjKzAVH5z
                  MD5:D88F164BF40C5FCA9FB1350BB89D7D68
                  SHA1:4410BC0B3C0D5AD9D4E6FE3A0DF6F5D8CA5BE146
                  SHA-256:145769DF661297D9ADCBF5A1C1ECB219FA33453ACB69568999D9D8E64B1EE14F
                  SHA-512:54F81C2A88647120BD9455C4497DE0B1E7697128F9474CEEEAA4A23190B5375D2F93F8D733EB15CCEC27C37D0278F3638C5CD699358EA141B6A6ACB3A4ECA343
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="spreader" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <ElementGroup>.. <Version>1</Version>.. <ID>9</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\tyre 0.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2614
                  Entropy (8bit):4.869526654788411
                  Encrypted:false
                  SSDEEP:24:JdfcXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kck:3forTgqQ5Bo6z+pEm7T7KcdEr9T
                  MD5:2C44ACC474B44146553F5070A28308C6
                  SHA1:B50B8C308FC9F28B33A7BCA8D0068439DB3B0200
                  SHA-256:E075AA3DD357050DBC796511FF9E351458DDA0AA5D0E1388458382AA8D9DE338
                  SHA-512:9E8D289F8BCE60280D0BD8B2FBF953D36D9A7D1F71DEEA7FC10E7C0C70E8577B73E45B2E924502426F7C182538C4BFB5EA0B8024906005311E20E41351DB5DDA
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="tyre 0" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\tyre 45.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.875093856255559
                  Encrypted:false
                  SSDEEP:24:JdfXXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcb:3fnrTgqQ5Bo6z+pEm7T7KcdDr9T
                  MD5:ADB218E0AD32F537D3AA69C59A4BA364
                  SHA1:F3A495F6E05B616B76D1AFC6E0C454EC362814FC
                  SHA-256:34F79C2FAFC492F6B80D490530D9384950A9A3A6A624FDB6A6FBCD1865034B15
                  SHA-512:AB728EF33ADDF47209591EFAF502433C5EBC760547E4681CD6BEFCE175A8BBBDB9E0AFA02A33B9B21682286B9813636DBE04DAB8E958FE57EC00A01DF14A3B3A
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="tyre 45" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\tyre 90.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2614
                  Entropy (8bit):4.87272802809794
                  Encrypted:false
                  SSDEEP:24:JdfztXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7K8:3fZrTgqQ5Bo6z+pEm7T7Kcd/vr9T
                  MD5:CEB1DE19BB7129F3FD343CB1D614499A
                  SHA1:C324F34AC6F051827D996C8CA39DD6A4B621974A
                  SHA-256:9D34DF975ACF90D6D2B4EEB46689C4E47A0D6325A210D9A4180C44C161F4992B
                  SHA-512:178D9661D920442FE72669DF89BF4A721AA729815903A45031ABFEA0AEEBA50BFB23D035560CAC0BE10B67110A0A159366E6823D80D6E82F77FDE3DDEBAA1E15
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="tyre 90" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\wheel 0.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):130741
                  Entropy (8bit):4.280274410256907
                  Encrypted:false
                  SSDEEP:3072:AzdjWQj8ptHUjmUtznVicEVfVDfAllclKlq2XbVjCHk1CjzvqM1x48YjWQj8ptHV:AzdyicpUNhVijR1fCyYQ2LpCEQXSMfnn
                  MD5:AE6C97AB48034122B52743ED155A2C1B
                  SHA1:8205FCD4F6D56046F7AE6B9EC19307B1AC79E6C8
                  SHA-256:ED6CB889C51AEB7E437F48C9344A6F8665D9AD2F5F66C3B98F866FDB99985DDB
                  SHA-512:7163A5A419648E9B44ECDCBF0A3CF5F1B3862924E593070117E6E87D462A373D0243EF5F5BB986D2507B70C12E897F0FC0E3728561CEE4C28293A053F0818A9B
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="wheel 0" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <ElementGroup>.. <Version>1</Version>.. <ID>10</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\wheel 45.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):173725
                  Entropy (8bit):4.295244711582798
                  Encrypted:false
                  SSDEEP:3072:vsi0EVIVj7XbVjCHk1CjzvqM1w3zGGcPgGKfYlYEudkoku7yH++V6le1qZlYEudR:vsiL617LpCEQXSMODjcZuYGfqNcwVIEf
                  MD5:138AD26C9ACC228D396E2354F852CDA1
                  SHA1:B20C10C2C6F7D04B0EE7B3232758939B01CDAF45
                  SHA-256:D7BAFCA3D080217F9BD628CC18C7EE9EF602C4A127790F95B26B46ADA21BFB08
                  SHA-512:91131D9A6E92222F9BDB7152A18F13CF6358305CE786FF0FFFAEA2F6C01A3DDF7ECFCE6031543761F511836A498AA4E713A8D7F5DC00B66466623C1A43FE2A84
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="wheel 45" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <ElementGroup>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\wheel 90.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):162779
                  Entropy (8bit):4.150866430117464
                  Encrypted:false
                  SSDEEP:3072:SliVEV9V01XbVjCHk1CjzvqM1x4xS6f8S7+sRRxu3yZ2g7B+0MwMXF8spA1rp6fy:SliSX+1LpCEQXSMfOSK8ONjkCEsBpHcI
                  MD5:296FAB062BCFF92BEB93C0F4F2DDF89C
                  SHA1:2B083322CE2B4D33D3D7D24E590152F61E9E1AAC
                  SHA-256:93121AB4F825CF84E5C9D5B7F35794E5C188825EA9263B505320DF60161060D8
                  SHA-512:5B286F6E0CF07D80C3780A696E9710AC2B57556A4D37BC38676723906C2213A6CA9B21589417BA9175125321B8D0833E0D90DCDEAF2BE0627756E3B9FECFAF9B
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="wheel 90" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <ElementGroup>.. <Version>1</Version>.. <ID>11</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\DRAWING\wheel.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):253409
                  Entropy (8bit):4.144809547239534
                  Encrypted:false
                  SSDEEP:6144:hPPiqeKrLG+iIcScPWEe/U2PiPcsrTt5RJaitD0cJJQWnZxgMZGZxkAwu3pmbAwE:hPPiqeKrLG+iIcScPWEe/U2PiPcsrTt2
                  MD5:D4A304FDD7A1628EB0EE19547DBA7A9A
                  SHA1:0BBAECC6B317C83B1A7354CB3F730AB657414926
                  SHA-256:75A9D0D86C171536FC753258FF3C9B14909A7AFA0966BFAC17EC7D418C3207E7
                  SHA-512:8F46A6C46D132A62CCF1BCB08C5983C5E0B7336663F6564D6AC433ECBB90A4903E7F5ECA081EBB25B8CA5291B72DC9BF5DB53ADA543F2F3114F49F0537EB649D
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="wheel" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <ElementGroup>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\CB1 1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2611
                  Entropy (8bit):4.8733136605077165
                  Encrypted:false
                  SSDEEP:24:JdfA6XrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7K3:3fdrTgqQ5Bo6z+pEm7T7KcdqZ3r9T
                  MD5:6822614C1EA901AD76EAC733EB974084
                  SHA1:2410D8B6F769E39D8BAC50C60BEC4355F63ABFDA
                  SHA-256:F4E92B51B22D466418D5FD5ADEACFA9675EAB61605BEB5EDBCA10DD64FAFCBA1
                  SHA-512:2A3CE3E5E6D6995249F57D541C62D6CB2806E55D4CA557002C73A08445FFEA50C167ACABFE2EBF9DCB9CAF8172B0F6B4FE738A4327E0946A3B973DE5F5F76B71
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="CB1 1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\CB1 2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2611
                  Entropy (8bit):4.8734792555229225
                  Encrypted:false
                  SSDEEP:24:JdfIXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc/:3fUr8gqQ5Bo6z+pEm7T7Kcd+Er9T
                  MD5:B84C5A9CEB4A06F9CBC9332A43A763C0
                  SHA1:8ACADF73347826DB8FEA55D5BEFFA491D07417FF
                  SHA-256:4CF4B67CF692F6F381D7A0B957FDF5FFB83D1747E28918A17D6C0907BFBDFCC4
                  SHA-512:7175E23B8BBF9E6168F13DA81362150FF82A2BA5DD44D7F78903D58A6688BB0EEFD63813538775FEC05B74E7C9FC426DBEA02A030C86185914D748A4C01F6675
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="CB1 2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\CB1 3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2611
                  Entropy (8bit):4.876223267745637
                  Encrypted:false
                  SSDEEP:24:JdfbXrKADvKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7d:3fLrxvjgqQ5Bo6z+pEm7T7KcdvPr9T
                  MD5:F84D49B297B6B0B4D8AEB7D1999979BA
                  SHA1:E5300B34CA41605D84177F5AE94DA5E880C08FD3
                  SHA-256:C19D8E437E5C63C9598867397EAE5960F30789AF184D8A9B7008F1B501DD6BE9
                  SHA-512:D2A654D628A0C9C7B8FC5C6592A7E6FC801B16FDD89C643CC90142609AFA8543175E93D18DA33DCD5BB6A96C4F153EBA1926EA7AE10D5E3DBEF235008D78441F
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="CB1 3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>8</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\CB1 4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2611
                  Entropy (8bit):4.876618895304492
                  Encrypted:false
                  SSDEEP:24:JdfOXrKAxOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcM:3firCgqQ5Bo6z+pEm7T7Kcdpar9T
                  MD5:8BB43FD8FD9275D45633A7E4D0332E92
                  SHA1:0E7840D6A802227C8A62D626D9DD2195803DABC9
                  SHA-256:9E6FB95DB32ACCA4CEE7E0928633242BD45D0DEC497EB2A7F7CA2E6CED8F6FAC
                  SHA-512:4B55A691F71FC9109CDD820D921EC227BD7B077938087CEE5EA8058D399D83BA7198554F2756E972186A546876BB2D73F8DD97B5CE967B26710DD16BBCD16480
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="CB1 4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>9</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\Dingzi.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2982
                  Entropy (8bit):4.9185207967624205
                  Encrypted:false
                  SSDEEP:48:3firRG8CF99RvgqQ5Bo6z+pEm7T7Kcga0Er9T:qrVYRv0gUcHdrN
                  MD5:2AC1421CE619C4BAD76765F2B8C12AD6
                  SHA1:21A43DCE04C27DBB7CDC9BF64AD2207ACDC10C6E
                  SHA-256:4956EB6B313112A5DBDF879B77A29893DF027A332DE835B89CDB6A957358CD72
                  SHA-512:E5A047A05A472FF96B11EAD95559EB82A902AEC6A01A922EFB3D90EF286CCB22B4037BEF3C42A3B67B78BD54792491F5182A1A929E12380838B4B00AF590B575
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <TagNameList />.. <Image>.. <Version>1</Version>.. <ID>70</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorLis

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\ZPMC1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):51741
                  Entropy (8bit):4.221697613522095
                  Encrypted:false
                  SSDEEP:1536:4bGYtXWkoI1hIgUyUv8BIIfIufLI+fIC0f0q:4bGYtXWkoI1hIgUyUv8BIIfIufLI+fI5
                  MD5:C2CFC25A35AF8DB16D1D1BBACEDEEFAE
                  SHA1:C9681505E0009CF8C707D9521AD384C600784A5A
                  SHA-256:C32B7AE03A432E71EC3984E7C34A9C9F0A7E09B452C18E87F66B9EAFE1DDE5B4
                  SHA-512:20CA487379C41B82A5E858BEDEDBBDC25D69C224A453D2DB38D0268A6D51E2C96836C75EB627E67DB35D0B171D9943F3233F07F324F41542CEC1F70F6B9B123D
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="500" Height="500">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <ElementGroup>.. <Version>1</Version>.. <ID>5974</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\adjust.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2613
                  Entropy (8bit):4.871867739951231
                  Encrypted:false
                  SSDEEP:24:JdfxnLXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb70:3fxbrTgqQ5Bo6z+pEm7T7KcdDZdGr9T
                  MD5:717605255711ADAD1BF2A57B095C9A00
                  SHA1:1E69060AD3FDBD98A21C2B35A7D0CFE371CCF1D3
                  SHA-256:162744CAB94AC52EE4812D8A7DA0A063103665E89B7A78494DAF18373075C679
                  SHA-512:0754FFF3B3DA48A13AD0024C460DD1F9184AABE522D6116E34570F96E286B939C37EEEF94A13C5C8073080D6D1B76C14B57F62DC9CB8CFBA10EED4FC2D0F611C
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="adjust" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\adjust1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.875765718353656
                  Encrypted:false
                  SSDEEP:24:Jdf6zXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KU:3fsrTgqQ5Bo6z+pEm7T7Kcd5r9T
                  MD5:F40FC1A69C1834C1F6B367244F7F942C
                  SHA1:0F0F276EBB36E57A17199D985DDF2C84C3785BD5
                  SHA-256:646C6DB943D5F8B958ED267C47FC703BF64D282B8982D2D56979D4E7CE3FA450
                  SHA-512:AC4D6AFD91EED2D69B4CFB9529721EC3A560CD88B242DE7667CF2F383351211E88560000FA7090F03EB8BA429F5396B64F6A40ECD0849EB341C21D13A0D9D66D
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="adjust1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\adjust2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.877014154901338
                  Encrypted:false
                  SSDEEP:24:Jdf9XrKADvKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7M:3f1rxvjgqQ5Bo6z+pEm7T7Kcdir9T
                  MD5:85419BEA21D2C67A99438153F11A56C3
                  SHA1:9DF460BCB397C91218BC6F61ADF22B60D63F86F8
                  SHA-256:FEC2D431E022B7C336B2024A77973FB748815773206D64E9FEB0BF693A11DC69
                  SHA-512:417F4B987EA8E0F8866D52302F2E52FCC3705DBE1F4447C5D808190951CDAB4A6C53954F18D8A1C99E4FCB37AD35B4A282A3D8B2FFC9C5894255539FCC8625CA
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="adjust2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>8</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\alarm1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2966
                  Entropy (8bit):4.91914922597029
                  Encrypted:false
                  SSDEEP:48:3fErRG8CF99ivgqQ5Bo6z+pEm7T7KcgaQRr9T:8rVYiv0gUcH8rN
                  MD5:760902F513F05D641084AB04CC72FE8A
                  SHA1:5790D4885E460468E35898D140EFD7D6CCA5E473
                  SHA-256:781B2226F7CCCAFEB283F7865B4145EC70C2E11C8D3E16CA963C0F95A552BD9A
                  SHA-512:260CEB92A572B7E35DA3C4DB704E63D91F857044011467A94A9BE15322CDBBEF570FEA05E5CE6614DE368EB04567D8F766EBEBA6B831A5A922BF3ACA6E156208
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="19" Height="17">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Image>.. <Version>1</Version>.. <ID>9433</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayEx

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\alarm2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2967
                  Entropy (8bit):4.92077139630319
                  Encrypted:false
                  SSDEEP:48:3fErRG8CF99svgqQ5Bo6z+pEm7T7KcgaQLr9T:8rVYsv0gUcH0rN
                  MD5:6107157E67077AC14FE6AD9817311C80
                  SHA1:B61E1B9CC1A7DBDE3962959A310A7A9A32FC6FCD
                  SHA-256:73ACE6114B8858B954A0DD5CB64A47438843CEC97665F25E52A85A49CD682757
                  SHA-512:87CCFE9E3BE29019D213FBE5864E163B54F8056D4C85A92F38A09F3CE1E1E64BB99CA65072B0D57C7F5519C77F0C9F680D273233494FEBCA658492BB1C8FF3FC
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="19" Height="17">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Image>.. <Version>1</Version>.. <ID>9439</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayEx

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\alarm3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2967
                  Entropy (8bit):4.921865131556927
                  Encrypted:false
                  SSDEEP:48:3fErRG8CF99xvgqQ5Bo6z+pEm7T7KcgaQ0r9T:8rVYxv0gUcHLrN
                  MD5:01744FB00EA364E1B7475925BFB42439
                  SHA1:7A423E74E460F50355F55DB92B293508C35A917D
                  SHA-256:1DCB09CBCD02DCF9B07BF52A7227A7D9A0CDF7E7F299F22E7D56BDF943DFFB9A
                  SHA-512:BF9167F8C9A0F6C1893F8438252377FD64A84039ADF049CFF15BA1EEA346A66A21769DC3B1DA589415AFB4EE7D9586D7EA7830009F459B007295B38DC5499E18
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="19" Height="17">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Image>.. <Version>1</Version>.. <ID>9445</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayEx

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\alarm4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2970
                  Entropy (8bit):4.937470844249116
                  Encrypted:false
                  SSDEEP:48:3fEr88CF99SvgqQ5Bo6z+pEm7T7KcgaQdr9T:8r5YSv0gUcH2rN
                  MD5:60FB9AAF59EEB697DF3E64DAF6B6A5CA
                  SHA1:351DD7FA26627642248BAA1446F4899613275FE1
                  SHA-256:F954B8D626B1418A77C9ED5BEEBB68AE3BE31E510583175E2440C0EFF7764DBF
                  SHA-512:9D1B847259685EC63878E412B11A21F1D0AFA7CBDC1A9A3A5C00DE202B4938068738A981F79ADD3C1A09FC91B0C56CE1114C3FDBC6FB69182A17D0062A37F9C3
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="19" Height="17">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Image>.. <Version>1</Version>.. <ID>9451</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <Arra

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\bucket1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.876911996936088
                  Encrypted:false
                  SSDEEP:24:Jdf3XrKADvKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7B:3fHrxvjgqQ5Bo6z+pEm7T7KcdTr9T
                  MD5:974C7116CEC27CF560D4CD0B6BE8A5AF
                  SHA1:F4F9DB8DDDFB33D90DEDDF7F497DF01AB01281AB
                  SHA-256:6BB2D7370A2B7730E0197BC9D11339ADFD96B5C1BF46B471274419B65163CAC7
                  SHA-512:E24DD92931EAFB72C7E24518AD0CE1627E9BA2AEF92ECDED13259AA2B9B283AEBE33BF0261226A0AB97034C2F1484542418EAF16EF103EE6AA6F088AB682786B
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="bucket1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>8</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\bucket2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.876312651250437
                  Encrypted:false
                  SSDEEP:24:Jdf+XrKAxOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc8:3fyrCgqQ5Bo6z+pEm7T7Kcdzsr9T
                  MD5:011ED30257A9647F19C204D21ABDB4DC
                  SHA1:40CA6B6DBAF9862ED723F86610A69FDC660621B8
                  SHA-256:928947F2EF704A9A3ADEAECB30CA8A404D11003930BB5565E8220C4C8FEFB78F
                  SHA-512:9BE91692B3C77592E1190FE354D242A6DB538844E1AC6C58DD378981EFCADDE125C17442829EE764BB9FFA796F30705EAB3240B9B069120CF3288662E08938A8
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="bucket2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>9</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\contact1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2618
                  Entropy (8bit):4.869713269236456
                  Encrypted:false
                  SSDEEP:24:JdflXrKAJOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcw:3ftrmgqQ5Bo6z+pEm7T7KcdV2nr9T
                  MD5:F8C707D9A647BEBADD80C6BB83B05C74
                  SHA1:B5D0378E91544DF30B22535D50A133888FA0367F
                  SHA-256:38E593CF106FDF04E0DFB6880D369ABC0D442FFFC451ABEA07329C3F4AF6457C
                  SHA-512:F44443622E86375F6E7E76B6F42EB3224DA867D5C6B8D8D7DB20A40A5FF0F424C90D5E50A49D7D73E779E9F509C62425029486D19C1053490A72D60FD403EBA8
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="contact1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>14</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\contact2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2618
                  Entropy (8bit):4.871105529032002
                  Encrypted:false
                  SSDEEP:24:Jdf4XrKAGOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcw:3fkrlgqQ5Bo6z+pEm7T7KcdZdMr9T
                  MD5:E991D09B7D8720E365A099D90E3A9498
                  SHA1:5C4F86331E9DFEB34DC8DDF70B5CD243462B6171
                  SHA-256:130179A5F01CEAB092A28B9DDA1CC3627F81C7925AEFE6BF128D842E87558524
                  SHA-512:21EC078B2EFAA1BA2D22674DE887CD65CD13717B32D63FB961772F5F1BC6181E83B5D61BC617A244FFBC670A02FDEB46C7073A694F41C1BC0DAFEBBF70A5FF7C
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="contact2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>15</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\contact3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2618
                  Entropy (8bit):4.871906834972181
                  Encrypted:false
                  SSDEEP:24:JdfLXrKACKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kw:3fbrUjgqQ5Bo6z+pEm7T7KcdVDZr9T
                  MD5:C7BA9B9CEBA750FE7BAAC66F00D60E07
                  SHA1:D798427B154A45E3F00682E424238154C96A13E3
                  SHA-256:B56B55A1F96C5E42FAD13DD9B4EF0A4F5EEF20A814E7E3001442876122C12E4D
                  SHA-512:ACCF0ABF8A08BFB9E2853FFC12B11673E0DF409CF38B43AF1BBBAF88393C9D81888DF483BCC3CBDB2B79FEC48924DB2FA68E0166C8FFBEC71B9E9051A39865A2
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="contact3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>16</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\contact4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2618
                  Entropy (8bit):4.873714383361152
                  Encrypted:false
                  SSDEEP:24:Jdf+XrKAAOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc2:3fyrzgqQ5Bo6z+pEm7T7KcdZcBr9T
                  MD5:D27C224679C9E5B36A304E8843C6598C
                  SHA1:FFC4FE1E03F5CB53863369DD86B2D12705862018
                  SHA-256:D10992F079CBEC0A9D4700B1F14DBA3C3C2B43E6DF95D122FD27D47B502CA240
                  SHA-512:26A0D4EAD3C9FAD1528BCB58C222B580EF839BE60B52B643C7F60800EF143FF83270AC726B2703376E49DADECEC04F34B83F79D0EC31FD86064BA8696AD4DDD9
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="contact4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>17</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\disc1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.872231471515184
                  Encrypted:false
                  SSDEEP:24:JdfmXrKAwOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcu:3fKr/gqQ5Bo6z+pEm7T7Kcd36r9T
                  MD5:BDF89CF889EBE1E75275C9BAA7BD860F
                  SHA1:297EA20395510478FFA85F2F1A5F08876FA39594
                  SHA-256:1681C907FC768FE64954D8A5D77B7576F765B0416324A8527C876F3B6D896226
                  SHA-512:06753A18395156DD18DBAB1A9B5C1901DB192B3F17D01E12ACC0022D0CB0C94B664C6F8B2067F67DA7D28E7CA900899D4B638550526668DE31202B0AAB61500A
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="disc1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>22</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\disc2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.874776861778917
                  Encrypted:false
                  SSDEEP:24:JdffXrKAbOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kch:3f/r4gqQ5Bo6z+pEm7T7KcdF7r9T
                  MD5:EDA3640CAF2B2DF03D06DC3F70827919
                  SHA1:62A8A00B2DF93A25A8BF5E7748D52A27C81DA91E
                  SHA-256:FCC8013731BF2C04DC2D56D000957F68782EC9E1D6D13BFDFA9BBDFCFF5ED236
                  SHA-512:D51696552D8DE4F35093AEAC731B53668930CBA5CD0C9C91AF4880AFD0BE56ED22D3D124930E9A80441636F40891A0AA10EBB39FA7B341285D7477F3B5F3BC07
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="disc2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>23</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\disc23.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2614
                  Entropy (8bit):4.879204618703145
                  Encrypted:false
                  SSDEEP:24:JdfcXrKA6OgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcq:3fortgqQ5Bo6z+pEm7T7Kcdjer9T
                  MD5:4C5F3447995F6B03093ED6CDCD13CEBA
                  SHA1:95A02056CF95C0DB698EAFDE60A1F73193F5BF60
                  SHA-256:5EAF6CD75281D8CC321C497AACDC86D587E9B75FE282FEAF8F5D2619F491BD71
                  SHA-512:4AF0F685463A85A6D2AAF6D86FF88BC1E835F0E7D4D6C706C8165344D4CB09A19F35E9ADA27FAB4C52D0CA11FB3ED7E4A2DC28DAE44E065C2ADE26E670D45B1F
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="disc23" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>24</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\disc3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2611
                  Entropy (8bit):4.873937398548911
                  Encrypted:false
                  SSDEEP:24:JdfgRLXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7r:3fgFrTgqQ5Bo6z+pEm7T7Kcd4wr9T
                  MD5:7B8478BF692063170EB7A428650CE629
                  SHA1:61893C98588D3B8DCDEDC512C982CA4ED2FECE59
                  SHA-256:65434BE2D5A0378D17DA2CAE6D814DE73AADDD83C2DF8DF5C15493BFB7E686EE
                  SHA-512:EB0C60D37AC53C222F3863E70442F99438D8B6554F3CE07DE1D531200BEE5F3B1C3927FE1FB063D033A20A8EB535BA85B0A55BAC9743624FD664F70E18F23B02
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="disc3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\disc4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.876716244502407
                  Encrypted:false
                  SSDEEP:24:JdftXrKA9OgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc7:3fFrOgqQ5Bo6z+pEm7T7KcdRhr9T
                  MD5:2CB304044F4616807496135D982D54FA
                  SHA1:494BAB59D6208645D14DC643BA17538F2ABDD588
                  SHA-256:C39507E74842E872E606460E6FCA0D5BF04531931A14DE97B83D0E3810E2F8E7
                  SHA-512:B0EA1A4C9EFE88469508CD05098ABDC5EC4E67C981E0D8F0F15D3197B64151E0617B47E098F610D5CE311FE0A2B1285D05331A5B568C67AB0BED8D4162B341F6
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="disc4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>25</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\e-stop1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.873957595930434
                  Encrypted:false
                  SSDEEP:24:JdflNXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KG:3f7r8gqQ5Bo6z+pEm7T7KcdTr9T
                  MD5:1666A9E171E893D0CD73F91C138D6505
                  SHA1:E1F03257C996BBE0DEDDBCAFC2A97A0D5153016A
                  SHA-256:C50E59D1A4AEF75F4D86A99376E457B8C964FF98724C06C3CC997CDDD43014F7
                  SHA-512:B16D181DC07C02661BFDF8963396B106196207950CF758DBB821B9758CE987B5B43D85185AFBCB4DA26D68124739C29A8D57021E647053C35F3BA720451B20DF
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="e-stop1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\e-stop2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.873995785402751
                  Encrypted:false
                  SSDEEP:24:JdfyXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc4:3fWrTgqQ5Bo6z+pEm7T7Kcd4r9T
                  MD5:77F51F1CAF20E9C9A3354795428B395A
                  SHA1:02327FA20B1AF2F910A1E406408052C2D0C2374B
                  SHA-256:546E2D21F95F4318897F00FFFCAC2FFE8F9EB0ED7B8EA3E8898E35125CD723A2
                  SHA-512:2E7F682DEBF5F07CE4E5D0754FDE2CB36E807C472904C9A88A69B1C53E809964272B58B1D5EA2435FA84A26790B41D9777398AEB9D68060713E8919C6C22148B
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="e-stop2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\e-stop3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2526
                  Entropy (8bit):4.888299694123392
                  Encrypted:false
                  SSDEEP:24:JdfFXrKQ8jDvKOgqQjKXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXO:3fNrW/vjgqQuBo6z+pEm7T7KcdIT
                  MD5:A6355B63E205093E75A4936C50009250
                  SHA1:2865F6236EEB614DB8781DB55F85A3338859813D
                  SHA-256:E2965BA3661CE431E24225141B89CD89DFDC132A0C0391EC137B07589EAC3B42
                  SHA-512:5BC977B7D92543B1893450D53DA46F2BF3245265D8BB45032C64F9CF7FC0A1A1556BD257375D854FA8F105C4BBC583F88E3A27E97022ED1B0579D5D35D81CF5D
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="e-stop3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <SymbolSet>.. <Version>1</Version>.. <ID>8</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\inverter1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2619
                  Entropy (8bit):4.8670402203775724
                  Encrypted:false
                  SSDEEP:24:JdfV6XrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KW:3fVurTgqQ5Bo6z+pEm7T7KcdPr9T
                  MD5:959D1514A7EED1186D8976E9A327DC36
                  SHA1:0FC887146A8C91606D2AC239ACDFF7C5A5A96AF3
                  SHA-256:C964BB1D29468AC1B76A29997EAD296D2D98C6D70A0C3E2A586470F08900499B
                  SHA-512:9575EBE4CBFE73A8BF4408A329D346F83D1208AAA8FDA4DDBE8C99A9A8CA044DE4C05644BFFD0015102FF79B820A34D8B0282539E72109974BD9296F7392FFF8
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="inverter1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\inverter2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.870317521966032
                  Encrypted:false
                  SSDEEP:24:JdfZXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcP:3fhrTgqQ5Bo6z+pEm7T7Kcd9xr9T
                  MD5:316C907461089EA7092EDDDCD728346F
                  SHA1:4D13B439E3DD7439BC08F5E38B66C6BC5737C3A3
                  SHA-256:2CA573E0DDEA155B158158D2CA496C426D0E3E1CF58CE880D9BF7091A19D2A14
                  SHA-512:CBE58783E8830B8F68538E51E68D69514651CD1E1F25F659BC682EBAA97396DE0AE7482B00DED766A4C0F78D66720C3E247AE44A35E30CAEC0FA92A21951A380
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="inverter2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\keylock.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2616
                  Entropy (8bit):4.87635190218545
                  Encrypted:false
                  SSDEEP:24:JdfcLXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KE:3fcbrTgqQ5Bo6z+pEm7T7KcdDv7r9T
                  MD5:05B998C98AB3D7B738E6803F3189CE0C
                  SHA1:39E1441CC25BEA84EFB41AEEDFC993287A2C0BFA
                  SHA-256:985473E472360C3611889FD84263A83361E5EAE569B9D1FD5738D12DE3A45C37
                  SHA-512:E5F4C26C98555C305CC2A9885B31D39A15D90736A5B086BB179278B1DCE3AC420E7A80B793FCBFF5063BC211CA9EBAB1259A3F90BBDA9F2AB14BC1F4832430A7
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="keylock" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\limit1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2613
                  Entropy (8bit):4.871764201588346
                  Encrypted:false
                  SSDEEP:24:JdfJ2XrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KR:3fEr8gqQ5Bo6z+pEm7T7KcdCBr9T
                  MD5:0EAEE765DB2B2F13570510FD1A7A4CEA
                  SHA1:21A61B7D25175042F1C260ED6810B651A7B09085
                  SHA-256:D8C7EF3C4C6F5451FE23C9708C7B1F791BB7772E1EFD2D00BFFC929570B3E2C1
                  SHA-512:7010D00505694FDEEBA315BFE927F6C92579BB82A6E942917F749A5C1D03AAA3129ABB371EEBE162C170630FC7BB3968E1BD51B1C8BD17D1200054C736ADD722
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="limit1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\limit2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2613
                  Entropy (8bit):4.8722096678804965
                  Encrypted:false
                  SSDEEP:24:JdfJvXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Ke:3fNrTgqQ5Bo6z+pEm7T7Kcd3xr9T
                  MD5:C158299614076C037D87B607F3ADA862
                  SHA1:A0E15D11C507E00BF596DF55A1B2669690794F54
                  SHA-256:CF57D0860EA4905CFC9F625C5E43AAF5ACB355CA5C6854C8BDAA107D12A44217
                  SHA-512:B2DF7550A8F2836EA260DDE2BC297F036CD248683426FC59C8C345433CD154C70B7CAF0499C62BF6AE9DF5E70F4B2DAA1291C6064877A3A48BE96F2DF4AB8DC8
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="limit2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\monitor.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2972
                  Entropy (8bit):4.93187712462617
                  Encrypted:false
                  SSDEEP:48:3fKr88CF99YvgqQ5Bo6z+pEm7T7KcgaSV2wr9T:yr5YYv0gUcHgrN
                  MD5:DE25BE706FA9C9259DEEBEFAD6948BA1
                  SHA1:1FC8F63E6BC75714CF5B9B5A38BAC32F42AFB41D
                  SHA-256:9ADB469C9B61BD4203193649BE1A1180F57C3AEDB6D0880DDC83161C3CDFE630
                  SHA-512:8418C84B720CCBE697B5AA6584AE850FD9D1342CD2C2C83631886FA9E00A4A4B7C9CE8D05DDA302A21C4FACC8A68F3BEA0071E73876E633ACDF1EF9FD5378975
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="111" Height="100">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Image>.. <Version>1</Version>.. <ID>9457</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <Ar

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\motor1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2967
                  Entropy (8bit):4.939994131163938
                  Encrypted:false
                  SSDEEP:48:3flr88CF99OfvgqQ5Bo6z+pEm7T7KcganXr9T:dr5YOfv0gUcHXrN
                  MD5:52EC3E65D8CD7C1E79D41C0BC7FF7DC1
                  SHA1:91FE3F12A7A1F76D7F637F210B5AF6C8BA8E1BA8
                  SHA-256:3A40D352B2EF2866AD3C727BC8DA032F84B6D21E434E95B7C47F7F040B2E878F
                  SHA-512:9354B58D84AE7F7EB5ABB00477664E3B6BD6EDD603A7B1F1966F7E85678D5DDE0A8938AD962C8D00CF583942DD70B2202141D3AE19A87A21BF0034F13161388E
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="69" Height="37">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Image>.. <Version>1</Version>.. <ID>8854</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <Arra

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\motor2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2967
                  Entropy (8bit):4.938428834197688
                  Encrypted:false
                  SSDEEP:48:3flr88CF99svgqQ5Bo6z+pEm7T7Kcganmr9T:dr5Ysv0gUcHmrN
                  MD5:CED36576C6943622031F8781C84A1128
                  SHA1:8999D624B339D078C61D6EE9B1BD6D6EE9DFEC3F
                  SHA-256:98169FD529F235196763D740B3D7CB90ED6FA1681BEEC136DE8442A91B70FE5B
                  SHA-512:CBE94D2D371E6A824778E59C4B56BA86D5878C42E4178F264EA01497FD90E442EAA258E5ED06AF2969CBE0E8A4BB738F9B7B38B7E07061EFE31740989D31EF58
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="69" Height="37">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Image>.. <Version>1</Version>.. <ID>9400</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <Arra

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\spanner1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2617
                  Entropy (8bit):4.867150779199521
                  Encrypted:false
                  SSDEEP:24:JdfyXrKAxOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcs:3fWrCgqQ5Bo6z+pEm7T7Kcd8r9T
                  MD5:8E75F5D4C2707517699EA7AC6040D5BA
                  SHA1:C5364AD9AA57A045E42B5E54D845C4B2868B30F7
                  SHA-256:76ACCCAD7D1D4AA4387596CF7ABC100146E6335EC2D4B14AF61D083194FB41F3
                  SHA-512:AAC6F07A009C87B5214A033ADC5B8376F20222A25C9A3EDA335D31D7B9AA8D1F8C03D5D0BB14B2478700666EFA501EF5642CC8F396BF1498E910B64336512E14
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="spanner1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>9</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\spanner2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2618
                  Entropy (8bit):4.866045855609096
                  Encrypted:false
                  SSDEEP:24:JdfrXrKANOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcF:3f7r6gqQ5Bo6z+pEm7T7KcdNr9T
                  MD5:C5DAF0DE9A371E1222A14AEF58410DD1
                  SHA1:57A38378A5BB9CA2BAE9BD26CA3D78EDD95D65C4
                  SHA-256:7073DFC904C4430A2478F02648897331A71E73FB201B9EDC611B4E5A433F06A7
                  SHA-512:CF579D04D38ECBA2FE952AAD22D2D233C18532D30FE84D1093ABD95ED4F0558E00D9FD04D9C786EE9E50FCD54D8675A6867B0B5E92F3D6E65C4878D6108D6083
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="spanner2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>10</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\switch1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.876599926744276
                  Encrypted:false
                  SSDEEP:24:JdfdXrKADvKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7s:3fVrxvjgqQ5Bo6z+pEm7T7KcdDPW3r9T
                  MD5:7FE440B6687534D66DE21771873BD344
                  SHA1:41C1DDF80410C509E3ABF9869CD86908B069F668
                  SHA-256:0D85C1D69380EA63FD3FF1A4EB83F1E5E21DE09D677ACA8C92B2FE79949238DD
                  SHA-512:B4145346696370B4BC9071AAF3BFD97C2150BAB40E8A5BA962150EB0B0FE7B7D4DDAEEE8F21DCB0A1E43F55171C3EDA4BF4327495EBC44E5236AC738548EA35B
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="switch1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>8</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\switch2-1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.884989143154231
                  Encrypted:false
                  SSDEEP:24:Jdf2XrKALOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcR:3f6r8gqQ5Bo6z+pEm7T7KcdaKr9T
                  MD5:A3FBB442B3B02A942B2720EE1CF66449
                  SHA1:E232287C5C9C72D6E3010FCF1BB4AD59AFB47085
                  SHA-256:BEE774199F7EA9651370535C959691CF21408C012F67F906AA022455283B490F
                  SHA-512:3DFB9E61C21F4E4F316B243A598A78A58C65E8F7064FEEA062244448C9C018652AD14CC95363C5965CA44025DAF569DAC6DF13AE9B5831DEC64F31F3F75C27B2
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="switch2-1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>30</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\switch2-2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.883789368699233
                  Encrypted:false
                  SSDEEP:24:JdfvXrKAgOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcn:3fvrTgqQ5Bo6z+pEm7T7KcdnLr9T
                  MD5:21CF5DA02DF189692FA260908EB4AECD
                  SHA1:BDFC871CD4B8D256AA94E587038879492D5F23CB
                  SHA-256:572FFE0586CAD3E7F1BADC68430E40ED2C60A6350D6C5BD0323B7BB23ADF348B
                  SHA-512:A4C690B4017AD6CC9BAC369FB045C8226407CC057EBE92BD7C8A4D263664737FB6EF72F6934F41749F72C0CAD49F761F66418E647226592A0E926040B6BE8AAF
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="switch2-2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>31</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\switch2-3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.8878837267135715
                  Encrypted:false
                  SSDEEP:24:JdfWzXrKApOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KA:3f4rGgqQ5Bo6z+pEm7T7KcdVqAr9T
                  MD5:F4D450D0D4C28E789EDB36F7A188B43E
                  SHA1:8DF09B80099B346A507EBED038060F7B38348188
                  SHA-256:0891B7B449888547B7B77B174DD4416D61A0BA7BDE33AA9C36B961E4CBD8F594
                  SHA-512:7538A93EDBDC70A1F7ACF7C7702EA8784D866A2706813892F4A9A254AA2E729DA3FE8640FBDEB3176BBD6E888A204761BA8C52B6540D6C3C1285ADBF0266948F
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="switch2-3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>32</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\switch2-4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.889261685861111
                  Encrypted:false
                  SSDEEP:24:Jdf3NXrKAmOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KC:3f1rFgqQ5Bo6z+pEm7T7KcdFxr9T
                  MD5:782D7E06E3ACD3B8DC6A1D4C4FDEF368
                  SHA1:0A12B85B44E5C228E579E6245C08F52A962E5D0F
                  SHA-256:0E42F5757F7492426A5CE77ABDE8791A2A09DF22A85ECC1882056E10032DF559
                  SHA-512:EDBE8EE4EDD8394987E5BA54C57CD82FF819C87BD2FEB8AB3B90B02BB02E6E9009B4F6EBBB207DDBC461E767CF6C0C52A3D19A928C80DD59032A60EAAAA64637
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="switch2-4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>33</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\switch2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.876536976016495
                  Encrypted:false
                  SSDEEP:24:JdfwXrKAxOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcv:3fMrCgqQ5Bo6z+pEm7T7KcdTvr9T
                  MD5:27B75972DD4542C83A45B543679E5B7C
                  SHA1:039EB2492873E412DBCB4925AA2DD2F80F496A52
                  SHA-256:AE755255B4F87768B8CF68C2DF4A0375DBE39E68FF9A6FC43703D78297262FCC
                  SHA-512:535BE2A24BB3600BAD49E37AFA5E11C9B057931675704CDD7D8CB653F7D4F122511A42F7DE54BBE60D6580523BA1536307FB50E929714EDBCD26FB2360797D53
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="switch2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>9</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\switch3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2616
                  Entropy (8bit):4.879818037854667
                  Encrypted:false
                  SSDEEP:24:JdftNXrKANOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KC:3ftlr6gqQ5Bo6z+pEm7T7KcdZCkr9T
                  MD5:9795D286533EC70540DF52339A29C8B1
                  SHA1:70FBB801E15EE28B6959DE615050E9398A98A2A5
                  SHA-256:CF12C198D4115E22944F8679704F6DF2FF5D8FC2ED3E81A6B53A64BDEC5AC4C6
                  SHA-512:652053FD47F8F9D5599ED65F6FCB2C8134BC71C410488182A252B1AFC37835E478F80CE3FDBBF237131C38D2184A302F144DBB25F476371956E5427C8C113C4E
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="switch3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>10</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\switch4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2616
                  Entropy (8bit):4.880407708128989
                  Encrypted:false
                  SSDEEP:24:JdfWXrKAKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcX:3farZgqQ5Bo6z+pEm7T7Kcdxdr9T
                  MD5:C883B86FA0D467516B613203D5C1D86F
                  SHA1:2A8A3912FAC890DCAD4BD2473C4868C5C2675035
                  SHA-256:D328D9C7A43DFDDA4F78CE317BB8A6321802D09FEAA0F6B3AB609BCD4D323631
                  SHA-512:8474E40B7403297C0865B39D29F8B036FEA087774B77715552777E0C850FD151FF04E5644D7E4D64F61AD7F53C510468CFA13DD1B330187755F404DF7C4BA784
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="switch4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>11</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\switch5.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2616
                  Entropy (8bit):4.878311165335609
                  Encrypted:false
                  SSDEEP:24:JdfZXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcr:3fhrQgqQ5Bo6z+pEm7T7KcddMSBr9T
                  MD5:03C319C8B7B084240D580F8D6093DB26
                  SHA1:0D12AB76692DFD4159608A833F3A982F3C9B8C68
                  SHA-256:46DABBDC9D613858CE71B102BFDF20B031E526FEFEF566991B4A71A461EF379B
                  SHA-512:1D6F3B26D02C8EB989DF10CB5C1D2EF397D3EF656E3855E636C10F477487C1ED41AF4A5B042D611C2AACA5E6B0A0D4029541F6333A8284EB008B8918E7A15920
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="switch5" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>12</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\switch6.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2616
                  Entropy (8bit):4.879028142750358
                  Encrypted:false
                  SSDEEP:24:JdfsXrKATAOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7K6:3fYr3gqQ5Bo6z+pEm7T7KcdMM7r9T
                  MD5:ED0B4044F49CCC4B72C7B5B11F9F6816
                  SHA1:8E2C99807D47B8AC2F1BFB78673F473F8B0E45EF
                  SHA-256:D5149379B305943EDD5C6DE64B48BA19311A9694B433A1E9A6DD7D6B5AE392CE
                  SHA-512:C73E4A871FA765650E786A0C9EB506374E5C064BE1B862453A304F7559A795B2594A78B6AA976F0F7B798A8BFA4097BAFAEBD8A3F1A936BE4D9D1B58F169C855
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="switch6" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>13</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\sysclose.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2973
                  Entropy (8bit):4.931812150813394
                  Encrypted:false
                  SSDEEP:48:3firRG8CF99avgqQ5Bo6z+pEm7T7Kcga7x2r9T:qrVYav0gUcH92rN
                  MD5:C1D832604045663EDF80BEBE0FC75B6F
                  SHA1:74BBE12A0B25B5E1878C20EFB8C6E1AE23F7C58C
                  SHA-256:FBC97B61C19FA442B6E98E60C29BE7517F2CC4E62F59E0C85C3CA8F051C23786
                  SHA-512:70B8FC82DC2EA141C60DA76D5244984A88263625D26D9336A106F73325BE91A3C9899488BE0E2F005AFFB10CA737056EADDCC84B752BC06871985350EE21ABC0
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Image>.. <Version>1</Version>.. <ID>9459</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <Arra

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\trafficlight1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2970
                  Entropy (8bit):4.919948345610378
                  Encrypted:false
                  SSDEEP:48:3fCrRG8CF99yvgqQ5Bo6z+pEm7T7KcgaSH4r9T:arVYyv0gUcHW4rN
                  MD5:88C00D0CD4C5C78228605DE458E1041D
                  SHA1:1C7CDD1CB062B4A6155D07161DF41DD6F3EE1BAF
                  SHA-256:77D779E049C01A319014D014C3D04FC7E296638E542ECA7380B1C2E4DA3E9642
                  SHA-512:8F15E50B8EA69F3FB8995842B9E892C97889D33C6B32B43B696CF54B1C9526B2C16273AC06DE72843547FA7D8303EAC7D46F5183FFB56EAD0004A32D0A72BAA7
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="22" Height="39">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Image>.. <Version>1</Version>.. <ID>9420</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayEx

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\trafficlight2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2974
                  Entropy (8bit):4.927146797043381
                  Encrypted:false
                  SSDEEP:48:3firRG8CF99N+vgqQ5Bo6z+pEm7T7KcgaMa4r9T:qrVY4v0gUcHM1rN
                  MD5:F358816083BFF73EE60ED75B03535000
                  SHA1:AC4E2849CEA5C75BC2D8478696B05C17D9BDA8F3
                  SHA-256:D5F8AF88A34AD35CCD50BA4FB0FD8E15E06AE6C8A00CD787BEA2328DE2650B24
                  SHA-512:CCAABA739C6F965DAE686A59ED4CDB385E95BA56D4726DDCF98CE96EEDC68ECE8B5280E83A5CFB3C68F59BA1C231C307785F97E9DCBB18BA18E9F720C051EE6F
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Image>.. <Version>1</Version>.. <ID>9426</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <Arra

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\truck1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2967
                  Entropy (8bit):4.92951066599839
                  Encrypted:false
                  SSDEEP:48:3fCrRG8CF99OvgqQ5Bo6z+pEm7T7KcgaqEr9T:KrVYOv0gUcHVrN
                  MD5:83CAAB919ECAF02E38930C328DBD1CA1
                  SHA1:7F69C721086364C4578E5DE4D8795DBBCA79A301
                  SHA-256:F7DD0B997CF85C23A01E49A504A50E0ADD4CE7DA0191EAA058F2791255810C42
                  SHA-512:72576240DCBBD3A1BFB8A649FD2C1AE85D1E10BD50E02EDE29E8ED09301C33A4B829D70E4979821061C92F61A041C89EE1EC7893CA109180E6A9D5B5FE9016F6
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="577" Height="463">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Image>.. <Version>1</Version>.. <ID>9406</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <Array

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\truck2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2969
                  Entropy (8bit):4.938822049150205
                  Encrypted:false
                  SSDEEP:48:3fdZr88CF99IvgqQ5Bo6z+pEm7T7Kcgafsr9T:1Zr5YIv0gUcHErN
                  MD5:740CEAC9E5488A7E946297FB17E42027
                  SHA1:396D33E38834AFB5258793B940520D60B7CDE0B8
                  SHA-256:2744B8F0A8D7F2739D357E7E44332E81CBB675F3929ACDD1DBF1E1CCD250F0E4
                  SHA-512:DB24A1661B9DD57EDCF6C25BE02BCBFF39E09DADACA83808C097492957D05B14545C941734EB5B4DBBDCE7BF6D83AE48CDB181D4372ECB1C7336FD656296F83C
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="114" Height="32">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Image>.. <Version>1</Version>.. <ID>9413</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <Arr

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\vul1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2967
                  Entropy (8bit):4.9297467711736465
                  Encrypted:false
                  SSDEEP:48:3firRG8CF99gvgqQ5Bo6z+pEm7T7KcgalXr9T:qrVYgv0gUcH1rN
                  MD5:DF850A7D7D74D68A6345C7172846C01D
                  SHA1:0BD0E7645ACADF57D0F23F4EF9D847A3984BFF90
                  SHA-256:CEA7BB8256D6869B15DF0986FBC6DB068EBE06037CA69D441430F7834BD084EC
                  SHA-512:AEC6BDB043C882535E927C50201E5CC4A383969677BE29F1103550B48405C23E7952C8E7F70FF9CA71DA4EB39C1365A7B0274DE604C125A080D9F50F8D95627A
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Image>.. <Version>1</Version>.. <ID>37193</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <Arr

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\ICONS1\vul5.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2970
                  Entropy (8bit):4.934539334030604
                  Encrypted:false
                  SSDEEP:48:3firRG8CF99svgqQ5Bo6z+pEm7T7Kcgaslr9T:qrVYsv0gUcHkrN
                  MD5:FFFD4057BB5EFDDFC4415AF9D2B609EF
                  SHA1:6A596D2E1088B3AAF9644E56815778C594A2D1D3
                  SHA-256:71F8E32FF809C28E28BA15EE26872F3DCCDB6AD3E3B11AAB07D96037370475AB
                  SHA-512:C7D27545966294A1DDBDBCD4862F9FA8AB4D876B20CD18A363F5966643C099620B0FFF77D13E27820E64B29CC21AFCBA4025C6535864D2C711A024F926993598
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Image>.. <Version>1</Version>.. <ID>37188</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <Arr

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light1-black.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.8857931112731405
                  Encrypted:false
                  SSDEEP:24:JdfjXrKADvKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7A:3fjrxvjgqQ5Bo6z+pEm7T7KcdWr9T
                  MD5:7DC32B57DB0DBE4650A1284188A39911
                  SHA1:0B3B9C22443EDCF2D4D81039F618C331F10630D5
                  SHA-256:3A4247B3768EB1378C50943085D09DAF812ADCDAF3E0D37DAD4A3CDD6BB1A591
                  SHA-512:6CF3FE5BD5D50382477C9BB2B60280DE88D93764887996FB0258F57D91D6E2AD420F14AA641E745DEE80151C022188BB91B23D2FD7B88F06A88B94A2966D327F
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light1-black" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>8</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light1-blue.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2622
                  Entropy (8bit):4.879320704442801
                  Encrypted:false
                  SSDEEP:24:JdfcXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcx:3forTgqQ5Bo6z+pEm7T7KcdNr9T
                  MD5:96779FA99DC9B1F73072EE1855355EC9
                  SHA1:161ECA086D72B4FFB7AAB6EADED995F7C27F0E8A
                  SHA-256:3130B961BC5E2334EF02B33B893A949588B2995D298BFFEB10A2F39FC497E68D
                  SHA-512:1AF2454A9C78FB717E612D4DCE6C11F09942287BFC20E7FD20A8E540558A128BE333DD723E0EC78041CCD0C583DC411E34EA04FD73627F6375694F2C102FBA83
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light1-blue" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light1-brown.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4965
                  Entropy (8bit):4.839394539246736
                  Encrypted:false
                  SSDEEP:48:3fwrTgqQ5Bo6z+pEm7T7KcdtwrfgqQ5Bo6z+pEm7T7Kcd3DZr9T:4rT0gUcdtwrf0gUcdNrN
                  MD5:5C6D017A9A24707E396EAD84762C8D21
                  SHA1:E1EDD20341CFD1455AD3E9F5D2E33AA16F75D8FD
                  SHA-256:638FA3C47E57FE5CC706BCB8FE52AB0BB11C21BC455D95F342D21EE763D60D34
                  SHA-512:7C532DE8EC79E475DA528DF485DCE65879867227AE1B4F1284D099B7CE55C6FD6381604B19814B18A53D726ED079A912528A71179F8546071361305D65329705
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light1-brown" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light1-dgrey.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.881245541121286
                  Encrypted:false
                  SSDEEP:24:Jdf/XrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcJ:3ffrTgqQ5Bo6z+pEm7T7KcdRr9T
                  MD5:C3E4E7B5447E669B5C3D185A5ABFA0D7
                  SHA1:E083F966087525B3C4C72924E3A9C24F3F5671F9
                  SHA-256:F62883F532DE67C77B014E36DBFEBCF0A30FC3BBD1E284BFA11E871B7A78A984
                  SHA-512:A792834DC507E75D7A745CB2BF9E04B68646E0AB4EBB26C1F9164699E09F14285C7D1354B49CAD7226292B4C9844B34AF15A09D51B28C42002E9F2AA554DFB50
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light1-dgrey" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light1-green.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.874989335698993
                  Encrypted:false
                  SSDEEP:24:JdfbXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcy:3fLrTgqQ5Bo6z+pEm7T7KcdDar9T
                  MD5:7F32BAE4A3B9DDD41E5073D342637D5F
                  SHA1:F05B410A33F6C0C43DCC55808034276555CC1F46
                  SHA-256:6FACCEA4C68F3FCBF7AE4D0FB183D2727677A6A345615DFF83A7347DF989C7F3
                  SHA-512:FD87905C13CC5DB24F41FA9625270F3483730DC18AD45B07AF4277D964E3E0BF65EFF218E83A827BC716C1D0835BB3F6DE21049955832852AFC4A5CFE4CBFF86
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light1-green" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light1-grey.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2622
                  Entropy (8bit):4.879520891853431
                  Encrypted:false
                  SSDEEP:24:Jdf7XrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcL:3frrTgqQ5Bo6z+pEm7T7Kcdzr9T
                  MD5:E3842078D57D37A4F77DAA6977EDFDC3
                  SHA1:6D22658A64B4B05CAB8EB01ED22EB19A17348768
                  SHA-256:69B14377BB5A460B7817F682B9BD8449BFEBAEDDCE3A440B3B8B3B399B3B9233
                  SHA-512:0AE22932EF927C38E48972E6630418F715E40EB4EFF56031FC1C2BBA0328001D0203D7F279B2E14B2C3BF892FCD1DD1134315E2CE71B5BD12F44279FCE93EC47
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light1-grey" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light1-lblue.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.8804342150321345
                  Encrypted:false
                  SSDEEP:24:JdfilXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KJ:3fitrTgqQ5Bo6z+pEm7T7Kcdngr9T
                  MD5:38F09C3BA34C0F89FC3220E3F71DEEE7
                  SHA1:B5141BB21C2A3612D2C78CD5DD402E3E7605F012
                  SHA-256:902812F6D1B0D3134AC57D11A306034C501464006C0E93EAB6752548008A75D4
                  SHA-512:13EBC6DE98C2D9BA910B376A87FABEB1557B91CA9A2F4AD66C13DAE5E0CA331A2474B727554C76A59CBB546DBA42F00716A7E8EE979EC44AA25B650FC4BD8CEB
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light1-lblue" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light1-mag.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.877441934803257
                  Encrypted:false
                  SSDEEP:24:JdfPXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kch:3fPrTgqQ5Bo6z+pEm7T7Kcdtr9T
                  MD5:BD4C14691B2422D695F33AB0273A5E96
                  SHA1:3DDAB91019C0759F3B8C730E955F2110C62E1426
                  SHA-256:5BFECE38A9450D3E474E911F90F39D5956D6EDAA6568A600E3121E4744DA0454
                  SHA-512:442FFFE21AF5120EA05F3CA393BF34F7E77BFDE21EA049D145BC6DAD8B22690E5660C150800E153152ADEC0A8E7A7D4CB6AF29B22419C5436E72D3725847AB9C
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light1-mag" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light1-orange.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2626
                  Entropy (8bit):4.876730153087801
                  Encrypted:false
                  SSDEEP:24:JdfmXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcM:3fKrTgqQ5Bo6z+pEm7T7Kcdcr9T
                  MD5:D535D55CB963B76CFE6D1990F5259DAF
                  SHA1:170EF06349718F918B21334ED9B1F5FF3FDD97A2
                  SHA-256:C02E3CF1961CE0D677FB6331B14371CB5F6CBEFD6454B27CB74BA16E1AC9936A
                  SHA-512:7ED0AFDB15FEE2F02C18BFF476F92741BED3852981DF28B9E22E35FF7B1858183193D8AEAC61827E280F0FF163D5384F0DFD6FAEA1E528847FE01CFE0AF030DD
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light1-orange" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light1-purple.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4968
                  Entropy (8bit):4.833350338044589
                  Encrypted:false
                  SSDEEP:48:3fCrTgqQ5Bo6z+pEm7T7Kcd3rfgqQ5Bo6z+pEm7T7KcdmXr9T:KrT0gUcd3rf0gUcd0rN
                  MD5:C16849E045A42A251C902E5D11EA18DE
                  SHA1:2E71CBC89A60CCEAC8EFFB58E98C6F81F5BAFDD7
                  SHA-256:AC707E8BD522F78E07C6EE8EA807769AB62502EFCE841E05B0E592E368002699
                  SHA-512:CCAC8B199E50073EF0D0F0839DEC0E5EB72702D802A899717226A7BB9AE40A9B640B2414BBEF1FA0FD71CB60C79706DD57D5DA4B0FA9495891EB2546E6E22A08
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light1-purple" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light1-red.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.877370204741369
                  Encrypted:false
                  SSDEEP:24:JdfHXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcX:3f3rTgqQ5Bo6z+pEm7T7KcdXr9T
                  MD5:E95FF012727C07EB97ABAFC2D848B718
                  SHA1:391323BEDFF8C09DF17C1649D1583A26AB15BF7E
                  SHA-256:E9B7A4B0DF1CF4588C248E08174BA5A21C229F274E34AA8EA2728B940294F468
                  SHA-512:626F8DDB50AB6DF2F1F2F994F56CAF4837076F23BECC02DF8C9C02DC238397C388517EC5F92071942E6091BD18E01F78947BD25EE85A1EB68C6EDDF4D1235D9A
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light1-red" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light1-white.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.8831664451144166
                  Encrypted:false
                  SSDEEP:24:JdfZXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcU:3fhrTgqQ5Bo6z+pEm7T7KcdAr9T
                  MD5:6DF0F3A0ED524DD9F9C4900DCCA3A3E9
                  SHA1:5FCE1CFDB8766181A621FDBE7427B379C203BB1A
                  SHA-256:88C97F51905AF70304D5ACE59F72A5130CD3784B7898A3769DD978782DD67301
                  SHA-512:24B1FFBA061D8CA8D2335C5F57534722EF445D8F41E76FAD0BEC4EA36DC8CD2088ADAD6ADDD85B94D8642CA9A9A775D829348D115A58C2708EA602F558BF45C8
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light1-white" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light1-yellow.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2626
                  Entropy (8bit):4.884067792858217
                  Encrypted:false
                  SSDEEP:24:JdfAXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcV:3f8r8gqQ5Bo6z+pEm7T7Kcdlr9T
                  MD5:F7A39F79E356D2F55867A72915693345
                  SHA1:6CE82844733B79B095CFDC6E155D87A8D96DA0FD
                  SHA-256:483B0F2AE407D0BD615F91C39A46380A6D865268FD374F28B93B69C07C8BCF92
                  SHA-512:B4E8EF73439F9028E198F7AFA100545408BF24061129342541791C5D4DD64F5DF25C5876AF09194D3330ECE7087C5982C16397053689BA6E55D6F6F15D4E189D
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light1-yellow" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light2-black.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.882352843363544
                  Encrypted:false
                  SSDEEP:24:JdfuXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kct:3fCrTgqQ5Bo6z+pEm7T7Kcddr9T
                  MD5:1C10270680AD1D85B18CF19222BE3356
                  SHA1:47399E51DBF4FEFE8873AD7A895B532E4BC88D17
                  SHA-256:110D093772B74C4555A1506C813851AFE14483F9B20CA607C8E6ACCFEDBF51FB
                  SHA-512:0FCE53B1A6D41D820AA2AB9477DEBE3BF5EF4E6F079A53006B63C6F640C6F04578128AA052587340F23097DF0CA7C4B4E4E1A9367E140BB4313F5E69C5CD269E
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light2-black" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light2-blue.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4962
                  Entropy (8bit):4.833699871804018
                  Encrypted:false
                  SSDEEP:48:3fvr8gqQ5Bo6z+pEm7T7Kcdrer8vjgqQ5Bo6z+pEm7T7KcdMJr9T:Xr80gUcdSr8vj0gUcdyrN
                  MD5:7007C4F0B079320E1560751BEFF513DF
                  SHA1:7200EF3EF4FB8024F09D086575BD1F3347A3102D
                  SHA-256:6AB626E3D53DB434B50099F06D2C44B1ACD9CF9C89557FE62DC9541748DF4028
                  SHA-512:24C3775AAB6309AEA3B4CC6855D086D26AEDB81139EC06EAB4EB68747BE8F5DB95C9222E843B61D4D8DD5E20C23C9E76F3FF0FFCCE7AAF433627357B8251B3CC
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light2-blue" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light2-brown.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.884058730870712
                  Encrypted:false
                  SSDEEP:24:JdfFLXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KL:3fxrTgqQ5Bo6z+pEm7T7Kcd3er9T
                  MD5:99C42BAB4AA47E71FAF79BF7727AD1C1
                  SHA1:8F3E1E95D1C414DB496B8C191A5416E9614BA11B
                  SHA-256:C300322739573309A4C18DAFBF2E775C14911440C1554ACDFCD72F9EE83C350E
                  SHA-512:793670BE5CFD8D614F11373DDADF84DB94098B96EB65038292DC8A744AE959221BFCA6D0473483B2B393BD424B2444D32DC7B5AE7DF3D62A5F1B494B7DEF675D
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light2-brown" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light2-dgrey.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.880810603010939
                  Encrypted:false
                  SSDEEP:24:JdfSXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcU:3f2r8gqQ5Bo6z+pEm7T7Kcd92r9T
                  MD5:8BFB497FE1518C623B74E24115D95723
                  SHA1:01FADBBD3D0E6F96FA582456A3FE0B528D21E54E
                  SHA-256:A5CCFE663AE916D33E1B1F099DB2FD4CD5D037E8B21A0069E4418701B1DEB10A
                  SHA-512:1DE3B5EDF652A394D52FE93F463DE218B199093B44447D5B6162A982478EAF8AE15971D3A408BA3C03FFE5EA680C8EB0C92028B90B6B69B0A54D147E0A45A9EA
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light2-dgrey" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light2-green.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.873508258722715
                  Encrypted:false
                  SSDEEP:24:JdfOXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc0:3firTgqQ5Bo6z+pEm7T7Kcdor9T
                  MD5:F06A73A7323B807DE8829A5C58F2B796
                  SHA1:B620569265B1BDB146D3793487B1923548BDF811
                  SHA-256:C304D22C04F4C5721D46F4D1DFCA519F6BE25078999C7741BBB7CDCFF0AF3B76
                  SHA-512:D6CC0BBC33ABA79BE5327C6935A3B62A32C4D9DC321A1BA8175842EF6C7F20659EDE1BE4D1EC1DEEA767B6D5E92F6B4F01B7B158A38DAE1E3E6B2FA749473E05
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light2-green" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light2-grey.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2622
                  Entropy (8bit):4.876954908241009
                  Encrypted:false
                  SSDEEP:24:JdfMXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcn:3f4rTgqQ5Bo6z+pEm7T7KcdLr9T
                  MD5:D4D20617754955E4A929BA88CE8D818B
                  SHA1:FA7B7759CEBB6B670095AC8E313C58B482FAA37B
                  SHA-256:1ABFF1AE0D71388DA457C57E5C05F18DA7BA647935921D108C00A5DFAFC9D3DB
                  SHA-512:FE9A6042DAED92819A8BA30556AC4D77D954054768FB10764831E6B6EDDE099015595246EDB5B72E44A2756D01F1ED1B698B08C3CF59ACA6EC1573D3B5C37754
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light2-grey" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light2-lblue.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.878440700738543
                  Encrypted:false
                  SSDEEP:24:JdfBXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcu:3f5rTgqQ5Bo6z+pEm7T7Kcdmr9T
                  MD5:B259B023DE60AF9429B851BCA53E8675
                  SHA1:F4688AE3A734D7A51FEF0AD7797AB9A822F04A75
                  SHA-256:61C085F868BF21F9968892C0EDA033E5046553EB6E52E8643BC2C7068AE7F790
                  SHA-512:4CDC5578E4DF6B1495AD559E4113665A0D160B7E3E5E6373E7C184034EA4937A90AE1F32A4C3952753F64FB8512F9914E4C19B3B7C943A54AA49C55799A2A552
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light2-lblue" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light2-mag.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.877598981139653
                  Encrypted:false
                  SSDEEP:24:JdfqxXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KU:3fCrTgqQ5Bo6z+pEm7T7Kcd3Vr9T
                  MD5:A9419A1331F7B1DAB95E22561E71AC87
                  SHA1:0C0D1F58D38CC5CD355E0C96DB32A0476F995EC2
                  SHA-256:44D8E113479D249C1472189EB596421443794C3BDE739E0DCA07F5610B0B51DA
                  SHA-512:8EC25AEA6D0C6730723B10730ED8D75B88D6B2381A19344894308649FAE1CB6D8B01A426336352BB42134AEE3736B4543D9E7330A2D79C750611D4E01E35882D
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light2-mag" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light2-orange.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2626
                  Entropy (8bit):4.875714645627952
                  Encrypted:false
                  SSDEEP:24:JdfFXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc3:3fNrTgqQ5Bo6z+pEm7T7KcdPr9T
                  MD5:E978B9F39D7420F857A4C623C688EEA9
                  SHA1:C8EA5964277D75AF13B62251D82C67430046DD8A
                  SHA-256:B2B8A3C6A2CCBD2CA1496650CD70CC13E7B34D6448A11707323A593F09BBD972
                  SHA-512:9BF75A3CA4C1EFE90A1BD1D2A389B7450C50584642FF77CBA5C899FFF30B37B921ED539AD2D9ED77E8721B034730F6C25545AAED977322898FDA720652F6C3E3
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light2-orange" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light2-red.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.877721558581695
                  Encrypted:false
                  SSDEEP:24:Jdf+XrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kco:3fyrTgqQ5Bo6z+pEm7T7Kcd4r9T
                  MD5:51FB28BE8453745BAA259F8A70AFB04E
                  SHA1:8F28745893B62FA665CBD2EB369D643E081F56E4
                  SHA-256:2196185FBD1A3BF6F44B270542DB788D79AA3A68BE150D84C1BEA2BD05B0ECE3
                  SHA-512:616185B4C7554D89933A5A05C818726B55ACEDD7DB79583B161B6F57BBB6D2B35C4E2C596CEF29304524B7CAC5F97323FE0F7091F6233D14B2A32EACF7787040
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light2-red" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light2-white.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.8818811208169866
                  Encrypted:false
                  SSDEEP:24:JdfcXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcz:3forTgqQ5Bo6z+pEm7T7KcdTr9T
                  MD5:1FE5CFC19EDDC575C915699D3CDF9DE4
                  SHA1:F759C0B0CB265CABCBA998D909337329B50AD925
                  SHA-256:D05791514A9B3A29758D6D26D59186885C0EC45D5406581347D767EEC53A6CB4
                  SHA-512:1942D5ECF31036CED9540B2D047A893077DFE2980FCEE656C59913F427CC51E493AF20F8A4D16787458F5D5DCBF0D0538A74E0D626F9B2D8F1589C1AA05363E4
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light2-white" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light2-yellow.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):7312
                  Entropy (8bit):4.819419780110696
                  Encrypted:false
                  SSDEEP:48:3fPrhgqQ5Bo6z+pEm7T7KcdoOr3gqQ5Bo6z+pEm7T7KcdnwOrYgqQ5Bo6z+pEm7k:nrh0gUcdfr30gUcdXrY0gUcdyrN
                  MD5:A4794B91CCADA792B67F580E00059BC7
                  SHA1:5B598EF4121723ECD3840C7A40A8D2BD2E0A9EEA
                  SHA-256:649E1D980EE8220F7F496123A9564041295E4D0455C9976F258F01C2F54396AB
                  SHA-512:7FD0BA32B291E52CB12F6E3C34019D199B0BC8AF36690E5D71CCFDB23CB6A88EAAE9D377C8605ECE6BBF102A289A7304B494B3E82201331D9862D7DFFA805912
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light2-yellow" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>20</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light2_blue.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4385
                  Entropy (8bit):4.9176565371819185
                  Encrypted:false
                  SSDEEP:48:3f6r88CF990vgqQ5Bo6z+pEm7T7KcgatZP9TlZWD5znLRD5znjk0bT:Cr5Y0v0gUcHtzlZcDVN
                  MD5:84DB602B5A47209D2A05036397610C0C
                  SHA1:FAFA778DDCC998675CD04D89D3A5B2C0F83F75E2
                  SHA-256:F3D78E98F06DBD0021FAE8D84945612257B10EC65E45CCBE620FDE82B381BD38
                  SHA-512:438B3EA77E5BB894674B12A1AD14079796F42F701376FF4BD2E4327C5E72D9E8426873E979CA12E92C9284E1789BF23A52A1B572B88DEB0E28F64BD4582E9DEE
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="17" Height="17">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Button>.. <Version>1</Version>.. <ID>930</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <Arra

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light2_green.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4252
                  Entropy (8bit):4.922379182064054
                  Encrypted:false
                  SSDEEP:48:3f6r88CF99tvgqQ5Bo6z+pEm7T7KcgatZP9TlZWDPJ+LqHjk0bT:Cr5Ytv0gUcHtzlZcTDN
                  MD5:89823BB2A8BA9CAF17D83FEC980F0DF4
                  SHA1:AB7D3EAC037DA15547E4F31F2B47D118EDBDE06D
                  SHA-256:7257AF9B79B14B1D9665B435DA470556E0542B27D3D1D98F90AD76F9B5DE2E2D
                  SHA-512:54F22855B5E1CCE3EF4ECE21AE044B9E7701948113B1A0CBE22853D277D7BEB7342DD8FBAFFDCD91A3577E8F8C96269B3D237B4FA21DE26AB0A05B4F759D9CE2
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="17" Height="17">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Button>.. <Version>1</Version>.. <ID>922</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <Arra

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light2_orange.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4251
                  Entropy (8bit):4.92432011953928
                  Encrypted:false
                  SSDEEP:48:3f6r88CF99WvgqQ5Bo6z+pEm7T7KcgatZP9TlZWDSEx6LqHjk0bT:Cr5YWv0gUcHtzlZcPJDN
                  MD5:2CF338EF7D5C1257AC4F6D58DCABC378
                  SHA1:5BFB3C8EFD67DDF6AB39962134D1BAC998AB5388
                  SHA-256:63594E58827CDDF422F130D85A04322DC4D7CDD64006B47C6C88A7A0B33D9CAD
                  SHA-512:5FF43AE1DBB290399A57F0C6F00315F1FCE8268D1F8D67B788E21F4E0FF84C8FB731AB4E74DA01446464D8EB79131B77FD31C1F4F48441D4DF873D40B7CA8EF6
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="17" Height="17">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Button>.. <Version>1</Version>.. <ID>936</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <Arra

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light2_red.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4253
                  Entropy (8bit):4.931711408983514
                  Encrypted:false
                  SSDEEP:48:3f6r88CF99KvgqQ5Bo6z+pEm7T7KcgatZP9TlZWDhjqqHjk0bT:Cr5YKv0gUcHtzlZc7DN
                  MD5:7204B0FEB5A19E0168E2C8650A26DD86
                  SHA1:ACE6C8CCF65FC5325B68C001052BBE6C1C1EC2A8
                  SHA-256:23ED1A87F90F820D602746AC61FC617B2C7D43A79B3EC58F124E8F2ED8892C63
                  SHA-512:E13712A2D396E36FA973E06B1F746352B0905D60BE1452A5C98E1D32531466CAB3FED125F116F68629EB1F51E6C56F3163A633EA8F4D57920EE75C9FD9A08ADC
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="17" Height="17">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Button>.. <Version>1</Version>.. <ID>411</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <Arra

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light3-black.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.885154060478521
                  Encrypted:false
                  SSDEEP:24:JdfntXrKADvKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXbC:3fnFrxvjgqQ5Bo6z+pEm7T7KcdVNIr9T
                  MD5:8D6133D525A9CBAB38F18CA269017AB2
                  SHA1:2FCF2853C371F39B3107040D46DFB036AA9E0ADD
                  SHA-256:A017F94B6DA4D93A576DB6E66FCF69DCF9355ED97BECBD0F144023574F17A80A
                  SHA-512:6783EFC9A09736495DD289CBC0DD0A2162CD0D06ABC6F005695C2F8D51DD2130B45F718055163AC201754A7418F76D4223B34BCB5B089F6157D53CDDE131E603
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light3-black" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>8</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light3-blue.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2622
                  Entropy (8bit):4.880459877842697
                  Encrypted:false
                  SSDEEP:24:JdfCXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcc:3fGr8gqQ5Bo6z+pEm7T7KcdUr9T
                  MD5:7CFA870C9F41A0597DEAA730E5877E48
                  SHA1:8D07153C9858B20C421C8BDE713D92880DADE33E
                  SHA-256:9707641051F0787332201F9FE3BE86BD1F327E1AE6E0419393246F3CACFEF250
                  SHA-512:656D58736CF7A80C6C61D265007DAA18C20562817480EF32889EB4FF0105FF2B95648910ECE886C6E7F1641C5A0A09A18B398F37C4723A41BD44AF3B1A53089E
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light3-blue" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light3-brown.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2625
                  Entropy (8bit):4.887979756286946
                  Encrypted:false
                  SSDEEP:24:JdfQLXrKAKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kx:3f6rZgqQ5Bo6z+pEm7T7Kcdcr9T
                  MD5:CC597F662196EA45AA02548CF4E7C808
                  SHA1:9A11B18267F47C1C7DB3B32055F6C2420E146B14
                  SHA-256:8FBE7D6F74A172AADF47236CAA8980E99FAF24E1F133649B64AB36833A05AA49
                  SHA-512:76B83B41ED6F6728D83639E546B6F65AF15821D9D37C0FEC9AF526875128E44724B8EE800831DC1DC1FA7B380D351F9A53F961F5B4C3C52408453C491D088177
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light3-brown" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>11</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light3-dgrey.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2625
                  Entropy (8bit):4.885002209648186
                  Encrypted:false
                  SSDEEP:24:Jdf9XrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcr:3f1rQgqQ5Bo6z+pEm7T7KcdDzr9T
                  MD5:BF0ED58B7283BF7A84DCAA8E9C87EA0A
                  SHA1:35E6571DF16DE68E54B2E3CF3C39DEDCE5FCF4FC
                  SHA-256:BA9832BD518C19FAE91C241930D55FE803C705E418DB9F8D9021A0618F5A9730
                  SHA-512:85FC01FF88A068C4515095FDFD0D5BA302A27E5CF966F2827508249350C91F4906AB13983398A4A6074E090D8F959052543DA0D93992C079CF933469F2D88B0E
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light3-dgrey" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>12</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light3-green.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2625
                  Entropy (8bit):4.87801209349119
                  Encrypted:false
                  SSDEEP:24:JdfFXrKATAOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kz:3fNr3gqQ5Bo6z+pEm7T7Kcd+r9T
                  MD5:9987B552F61105E98281200E4604D98B
                  SHA1:0D2C0176C301AF8D5E2623832902C4BD0E2FEE83
                  SHA-256:CD878E17BCB272A8BA9728F54A1301614A0A3276BBE2F5688FE7A7EFE17F7C4B
                  SHA-512:905186DFAD06C62E2831C101B400FCEA146BEA7D88B9781C949F625230336D1265257C073DB8102BA1DB2CB6BC7F82C4838FE1049E06353CBD434C9C18DB1039
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light3-green" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>13</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light3-grey.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2623
                  Entropy (8bit):4.883398625454614
                  Encrypted:false
                  SSDEEP:24:JdfdXrKAJOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcX:3fVrmgqQ5Bo6z+pEm7T7Kcd7r9T
                  MD5:4DCED8BB3CCE7A0700D6B7845AECAF84
                  SHA1:2219DD0380D5C760B8D0F6990CC937585E6B5659
                  SHA-256:D0B50324AF28AC90DCA73BED6FF1029BC2F37672A15EC0C4DCFD8F8C7FCD6110
                  SHA-512:7306CACA9967E97F0EC665587BACD577721783CBBBCD437F9D4DB8625B4C4110858D4280589CE432B76D8086472971FAAE5B1D9F26FE4511DB27F51711D3D386
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light3-grey" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>14</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light3-lblue.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2625
                  Entropy (8bit):4.882325822368118
                  Encrypted:false
                  SSDEEP:24:Jdf2tXrKAGOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Ka:3f2FrlgqQ5Bo6z+pEm7T7KcdOIr9T
                  MD5:AAB5FF09C6F0F6A012437D4208766D21
                  SHA1:19CB2E1C722F5BE575C21C63E289F1E3240E06B3
                  SHA-256:F753B632EB8F54E67E745CB73EDA1EBF86CE114DC647F899A1511A585ACE5AE6
                  SHA-512:03A750004C275F6721DF6438C5DBA008F5D2882F6D5D0FEE5D27E776F4FF31CAEAACF81F65DC2FE7D308B1C67C653688E167DAFABD2CB88B0578F5C1098D93ED
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light3-lblue" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>15</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light3-mag.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2621
                  Entropy (8bit):4.879552014912149
                  Encrypted:false
                  SSDEEP:24:JdfTNXrKACKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7e:3fTlrUjgqQ5Bo6z+pEm7T7Kcdwr9T
                  MD5:43FD4E2C37A2D877524049C13495A940
                  SHA1:178DF5E7AC0A97A83BAD645369D0D22EA6E73C3B
                  SHA-256:2871A1467CE9B6C2C63DF42BF05197222B6EC218554CC2282E7B1AEBC0DCBABB
                  SHA-512:01A46B4CA079E915366DB00E28417C1209225A513024BE5AC62F486287BD9D58E17097C84E24294C6D0C3B906E05832900D7066A54EBA967A0A5B05B4B47B39D
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light3-mag" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>16</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light3-orange.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2627
                  Entropy (8bit):4.878630664366478
                  Encrypted:false
                  SSDEEP:24:Jdf4XrKAAOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcZ:3fkrzgqQ5Bo6z+pEm7T7KcdBr9T
                  MD5:7A92784783F3B83CA8513BF43D97EFB0
                  SHA1:A693B05C2309F0BEAF6F0C5EAAB52D430DF7D3E4
                  SHA-256:E446A2935694C23EED3571E01B4CE3E44D7523C82316DAD8C61687119BE87712
                  SHA-512:15B93D5E48A93709B1F3EF48144B1C94AF1D547BA62CCB339D8ABF2B32D1113027175072B61656C140D149B36B54E4A14B3EC26975C2FC87585B22B5B5B14559
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light3-orange" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>17</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light3-red.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2621
                  Entropy (8bit):4.881074116153985
                  Encrypted:false
                  SSDEEP:24:JdfZXrKAVOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcG:3fhrigqQ5Bo6z+pEm7T7Kcd6r9T
                  MD5:42DC738FC09119ED872CCBD95506F2C2
                  SHA1:3DEA364C08B633AFC2BEE43C6CB7539E6B886E14
                  SHA-256:D43D9D2F2C9E5985A76C1358E1DFAFB014196BF90BA5CB9E26D95F89B0E3ECFC
                  SHA-512:B997E4B01415C1CAE5A6A3459FD7529B80E164261F5234A8D1A14AC70B698279EF1D7404FD34A90939F9423A9752D59BCCCDAA61D84955F7A543F96518C36F0D
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light3-red" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>18</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light3-white.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.884554741465797
                  Encrypted:false
                  SSDEEP:24:JdfrXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcq:3f7rTgqQ5Bo6z+pEm7T7KcdGr9T
                  MD5:1CED8962AACD4D1E3AC1C0F66576DDB7
                  SHA1:4D7B99CDF59F45899822274AA9540CB35B8FF773
                  SHA-256:9BAF0D41E9A30B68A8877C87B6F9E6E3280E38C8DD7C1D63589BF8FF8A4C4DBA
                  SHA-512:888A33D79A464484BA0BCD6A4E32172B3DEAF1F30E62609C5D1CCAC759EE6C5FAAD57A03C5455C129E0F4A4F9A9692CB13035FD7AB85E61AF5279225E7473D7B
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light3-white" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light3-yellow.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):7312
                  Entropy (8bit):4.818661484319467
                  Encrypted:false
                  SSDEEP:48:3f2rCgqQ5Bo6z+pEm7T7KcdYjrYgqQ5Bo6z+pEm7T7KcdLrzgqQ5Bo6z+pEm7T77:OrC0gUcdKrY0gUcdLrz0gUcdJrN
                  MD5:0FA367740AAB7849A11E3B5FC36E4358
                  SHA1:559C7BC1A3BEEB19DC2D1FC542B30A66A242F971
                  SHA-256:379F5F72189651DEC307EFC177820C9F8497DD310D7139EE21EF8310F681B84E
                  SHA-512:2750CD64DC30897A15F78413B23AD507F67092CB524D59E0848401B148B921DF6B0ABCF4885663AB16F5A9BA6C48BB67DC7CBB5C5DCA0C561526790B47A0DE6D
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light3-yellow" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>9</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light4-blue.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2622
                  Entropy (8bit):4.881081162877106
                  Encrypted:false
                  SSDEEP:24:JdfdXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcO:3fVrTgqQ5Bo6z+pEm7T7Kcdlwr9T
                  MD5:685BBD567150C629732828244F39E52B
                  SHA1:7C2752B34918C3940DFD4E8BD473AE421D24E2A2
                  SHA-256:646DA0072BD61103AEFD9DA59E77539342918BC17EF1C36E09DDD8544D40F17F
                  SHA-512:DD2904BD6455CF38C0CE03756F7BFA225584DBF277B6F15E3C3C8FA4D042BBD1F962EC25B6D73053B260C9AA7B4E06028C8B68521E8C98570F09E231DA6FF924
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light4-blue" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light4-brown.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.888110269362257
                  Encrypted:false
                  SSDEEP:24:JdfXLXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7K+:3fLr8gqQ5Bo6z+pEm7T7KcdHr9T
                  MD5:74D8E0DCC6C30AF078758184AF4AA363
                  SHA1:4BBF5D18A9A9FE22059E7E66C1B14DB9BC0D6BEE
                  SHA-256:3D1A8B223EE6C96CF191A764000CD89B4149E8D6DFBA838F8AE56641A661FE30
                  SHA-512:49CEC3A8D7CA4218205B7B5C53DA81374908678DD7A1AB056561E52C212860FF69140C4D5853F00BEC9EF405890100ABBBBDEE61A9100D78BCD5A13D1D686C70
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light4-brown" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light4-dgrey.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.885300172237281
                  Encrypted:false
                  SSDEEP:24:JdfoXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcr:3f0rTgqQ5Bo6z+pEm7T7KcdHr9T
                  MD5:6027F4F00D69CB01E1AA71846A16DFBB
                  SHA1:B24B4D4785A7B051E1C9F68B4411858A2543501E
                  SHA-256:FE2DFE50A06E515B147577FCAF4512C2D9128FF40BEF192730BCCEFC595A35DA
                  SHA-512:36D2948A1ACDFB2B0C35C738354E8188DCF6C9CC3CC64A446D9173A846DB8F54782A56449B7F736CD8F27E0E56DBCE0781823B47EFF0553F7DF2F12E531E89CF
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light4-dgrey" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light4-green.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.8785065232244635
                  Encrypted:false
                  SSDEEP:24:Jdf4XrKAxOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcB:3fkrCgqQ5Bo6z+pEm7T7Kcdo8r9T
                  MD5:CC225E76F1BDA1C977C1FF6EFEDD39A4
                  SHA1:27DCE1FD47969D5948D3FD8337610D47FEB25756
                  SHA-256:7C13A4B40B3204B227618892283E17B33CD2AC604CFCF5F4300F3C1C9E258C65
                  SHA-512:841DDBDFF0BB31B21A3C67C64B1A1E678639A41AF90396BE6F24347A0499968023FD99C244D2F84F15E15E3C002473028684725163017B7EB527D1F18C523E72
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light4-green" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>9</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light4-grey.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2622
                  Entropy (8bit):4.882670705598956
                  Encrypted:false
                  SSDEEP:24:Jdf+XrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc2:3fyrTgqQ5Bo6z+pEm7T7KcdOr9T
                  MD5:E2F9F2254E6172A2C5D7055364276143
                  SHA1:A8E73BF98E4AE4CE4DCEB4A115EE8E72561FA5BD
                  SHA-256:F8A300317F8A331D126C0664F4A14A29A153A50B942D6484592FEC5C7B524926
                  SHA-512:A8769DF96E16BFF021313AE836EE7EAE2CE02A8291F00D8D56578D1ECD0F7ECE8BC074C7B78E7E5AFFF60449A04D8141DC951B39E3081916538E9D882BFB2F73
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light4-grey" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light4-lblue.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2625
                  Entropy (8bit):4.883845954162867
                  Encrypted:false
                  SSDEEP:24:Jdf7XrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcd:3frrQgqQ5Bo6z+pEm7T7Kcdxr9T
                  MD5:22CECCA6F41D260B4A6DFC2D58478871
                  SHA1:875C3D1F9A453CE0A24BFD850FEC07BF45551B64
                  SHA-256:2210F4C27EFF69FE1AEF8BFACD3AFAB64C9FB572400D8BAA7DA42B01FEB3D6AE
                  SHA-512:EB40C707899C1C58DE46C19F2D416C15E9AC7024C07E27E97D73D879FD91CB37EBA7037ED36AC041115518A1CF7B1114171A6D80EB00D113A62287D85F58AE15
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light4-lblue" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>12</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light4-mag.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2621
                  Entropy (8bit):4.881612394727271
                  Encrypted:false
                  SSDEEP:24:JdfAXrKATAOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kb:3f8r3gqQ5Bo6z+pEm7T7Kcdir9T
                  MD5:58E9F13C23134E6E86D9E2639E8C5D6B
                  SHA1:4BAA3BDC5FB1DC9A227A4DE6E8222B3AEEBCB616
                  SHA-256:F33B474FBDCA00731D53CEC08B5D51DBB530158EEB707699974B03F3DBD52AFE
                  SHA-512:59D683301ABB9BAAD7D8DDEFBF6D0AE2C95B6BE0213C27E2EECECBE6B907273733C37F052DA1C38462C457805EBFF01E2B8B4C419212F3E74A1608C39B120A5F
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light4-mag" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>13</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light4-orange.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2627
                  Entropy (8bit):4.879923637745188
                  Encrypted:false
                  SSDEEP:24:JdfPXrKAJOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc1:3fPrmgqQ5Bo6z+pEm7T7KcdRr9T
                  MD5:C6610819823525F9C49B43E475C3BE49
                  SHA1:0012C97C8373C9F25489C5F57836218F61640A7E
                  SHA-256:0FEC97434C7ADEE03AE3DAC88574FD5E5EFFCFA2291E4E431801A237795A6B08
                  SHA-512:19C406872343A9546719ED98C21C8B1CAD5C572836B4F3E12E4AD990DE8FEAE2E96A374D415DBBEDC66B121587CDD17D869864D85431D08FF909194F67A70E0A
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light4-orange" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>14</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light4-red.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2621
                  Entropy (8bit):4.880925180814205
                  Encrypted:false
                  SSDEEP:24:JdfoXrKAGOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcw:3f0rlgqQ5Bo6z+pEm7T7Kcdsr9T
                  MD5:9FBD723612E734E8676F226FB33B3F1B
                  SHA1:4EDE02C12A9BA908C54397D80D3F0B37DED1C327
                  SHA-256:A785B994A156975C709E6B29171BF7C4950AFBA474DE5AFFBB8ABA0C0F065752
                  SHA-512:1E6EE6654CA65D1113FDFF44F9AAEC73DC39AFB08F2D4F3DD35653083E3A1E3CEDABAB8AACE46FD53C95C017E2F19CCB5119C011351A0CF423A67CB76889056B
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light4-red" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>15</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light4-white.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.886553641045765
                  Encrypted:false
                  SSDEEP:24:Jdf+XrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcO:3fyr8gqQ5Bo6z+pEm7T7Kcd6r9T
                  MD5:698B025FCF14463752477129C656587D
                  SHA1:413DBD6B68D4620D84D7C75B239C378500AF7FBB
                  SHA-256:1E07A0BD118DBE42F031470924A4C8DB2EECDAF447F47F28487DF78FDCC9DD84
                  SHA-512:2095D835E7B56E769E9694144AF8131AF471EFA635A40CD4F42312CF58F33D42A7A71A39EAFD7E4BA0F587A47752367376181B016A9E962E479E71CEA5D540D9
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light4-white" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light4-yellow.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):7312
                  Entropy (8bit):4.821604057242406
                  Encrypted:false
                  SSDEEP:48:3fEarzgqQ5Bo6z+pEm7T7Kcde3r7gqQ5Bo6z+pEm7T7KcdGM3rfgqQ5Bo6z+pEme:xrz0gUcd6r70gUcdLrf0gUcd0rN
                  MD5:EE6553153A5FF92701AA94376E864D03
                  SHA1:59C715BA71CE47699653F415A6F01E65A07CF7DB
                  SHA-256:F973676FD7D567DD75125F4E5A8AB397D3F91A51E1932C44BD6DF6CADE9B0512
                  SHA-512:9BA8648B48DF50448D6863D8E291292194EDCF61545CD35C181D36CEDFAC1F4D3C69274EE2ED5B6ADBBE8CF8670BB558742AB2AB3F4F5FD1B96F192804479927
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light4-yellow" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>17</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light_blue.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):3267
                  Entropy (8bit):4.932502318863984
                  Encrypted:false
                  SSDEEP:48:3f6r88CF991vgqQ5Bo6z+pEm7T7Kcga/TxfcIg9WT:Cr5Y1v0gUcHb1
                  MD5:BC1ED3DA8F6F4A1446308705F38A2CDC
                  SHA1:1B7A2C2032C575BEA2502122E7443A1284D2A194
                  SHA-256:A6F03ABDEC76D91CB923F98F8E0B13822F6415F06F750C1A0DD0CA713C096766
                  SHA-512:2AAD6D805760ACE7A781BC4F94726E1AB0550CE4E5FED62AFBAB5C761C59788BDB76E09E630604F533D8A787C45EDE2E3B317C8CC02194D9947043F0DF0D5F56
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="17" Height="17">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Ellipse>.. <Version>1</Version>.. <ID>379</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <Arr

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light_green.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):3272
                  Entropy (8bit):4.930445626576388
                  Encrypted:false
                  SSDEEP:48:3f6r88CF99LXVvgqQ5Bo6z+pEm7T7Kcga/T3McIg9WT:Cr5YLFv0gUcHba
                  MD5:CFA1D97CCD5909C68AC80DBDD95DF59A
                  SHA1:916CDD0380397397CDBD19BB3C324F69E6B1AAB5
                  SHA-256:DD5FE09120BA7DA46141051F73A12586852C60787788ED943EBA3980713FDE42
                  SHA-512:C21F851D293DF1D281B802E730A8F1A5EFA3A12A725C1C1BEBF4BF41D27788B907822FA174A2437402CEA1829C51F52B95784428E9A94A94F52DEFF5B99D0C29
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="17" Height="17">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Ellipse>.. <Version>1</Version>.. <ID>89</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <Arra

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light_orange.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):3277
                  Entropy (8bit):4.953511947290731
                  Encrypted:false
                  SSDEEP:48:3f6r88CF99mvgqQ5Bo6z+pEm7T7Kcga/TgIg9WT:Cr5Ymv0gUcHbL
                  MD5:3C08E4426D6559D54451D80034539988
                  SHA1:244CFB3E69B1EA2FE393E7C197C947AD27BD316A
                  SHA-256:D3D6AE58E1DD0B803F9033C2985A57E24EC299799F0374986358B6FEEC7BA3D3
                  SHA-512:D481C4B5202F9F1C268555C01C8210D9ECBDB3F3F7A2BF1283C4E3852E895C26D58EF565914BC9C0D95E893FC8068EE5E8BFE9AAE0319A0ED74AF56CBE192CFB
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="17" Height="17">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Ellipse>.. <Version>1</Version>.. <ID>387</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <Arr

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light_purple.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):3268
                  Entropy (8bit):4.931456141722204
                  Encrypted:false
                  SSDEEP:48:3f6r88CF99ivgqQ5Bo6z+pEm7T7Kcga/TvccIg9WT:Cr5Yiv0gUcHbS
                  MD5:91347CEEF8A82BB7C97CE6D8F01EB15A
                  SHA1:E2AF78E5675FCA2BD27BDEC8C49E52F40DDDB897
                  SHA-256:CB62550643E46E232C8EFBE7187DF3EAFD5D1E2C10736A9B6CBCC874DD46FC02
                  SHA-512:7A7578866169F3BFB12AD330B48616BCCD4C3D0F7D4EC325250E0B162CB469C17CC417CA5ACBB4757917FD06707DAE61BC55A6FB3916CA06A89335301E24AD90
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="17" Height="17">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Ellipse>.. <Version>1</Version>.. <ID>383</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <Arr

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\LIGHT\light_red.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):8868
                  Entropy (8bit):4.659674347966352
                  Encrypted:false
                  SSDEEP:96:Cr5Fdv0gUcHJlfUg0M3+RtfUg0ieeLbkxm:+TJJ1p+RdEeLbkg
                  MD5:A68DB5F7C7E7141EB2A35F5A93D22FEF
                  SHA1:A3D42040AB6EE7878959388023624FBA85E2E5CE
                  SHA-256:6570C0168BCF6F856069A18D52008C6B2AAFE93E50721595C5B538F2D4715041
                  SHA-512:F1107C83784FD959AFA437273536D6A33714022C5402BEDBE9FC663CF3BB36D294935596F98DC9ACBF14C828474270650D53105D7BFBC8CF50F9EFA4AA942F41
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="17" Height="17">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Colors>.. <Color Name="" Red="245" Green="46" Blue="136" Alpha="255" />.. </Colors>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <ElementGroup>.. <Version>1</Version>.. <ID>215</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alph

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\PANEL\1-current.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2619
                  Entropy (8bit):4.873049151953132
                  Encrypted:false
                  SSDEEP:24:JdfBLXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KE:3fVrTgqQ5Bo6z+pEm7T7KcdVr9T
                  MD5:DE9B23E884F01446BD0A77AEF51C0213
                  SHA1:65E2C3EB661A9EC71BACC9D26F1E04260980993A
                  SHA-256:5BFD060C8D0ACC9A79E36D2813006A49727704B3A903D9D9D5A44DFE412ECA58
                  SHA-512:31536DFC733FA2081628A452CA285EDB4E5ECF5FA24055236265FEF98C395A8497C8C5D27C6B965DDDEBAF8ADFF5636246DBD0F6688CD97255DEAEAFEA753C8B
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="1-current" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\PANEL\1-reference.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2623
                  Entropy (8bit):4.871598927440086
                  Encrypted:false
                  SSDEEP:24:JdfDJXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KM:3ftrTgqQ5Bo6z+pEm7T7Kcd2Jyr9T
                  MD5:B6A63143BB762081FD4042B500CCDAD6
                  SHA1:41F2FE071CE08DF1C3E887DE3D86744ECB36F78A
                  SHA-256:F22E8785E6FF02A60447D50B743FCE22EB9C810A50EE65ED3FCF9536DD4332C2
                  SHA-512:144DCD16415C35B10624AB04F540BA3957E89DE87AB4BC30E6783E038FC6934D6E75463FF18A0E9FA51A74DD9C3CEB0EBBE58F05D1582992AB5A6F6EA2444CF2
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="1-reference" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\PANEL\1-speed.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.873675628492265
                  Encrypted:false
                  SSDEEP:24:Jdf3XrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc/:3fHrTgqQ5Bo6z+pEm7T7KcdLr9T
                  MD5:6F600F9DE19E9F10C1C4052D14C135F8
                  SHA1:BA406A83E6CEA725492664F39DE1CBB788705B6A
                  SHA-256:C8404F645F22FF10102E407912CE781B2287924546E3F5AE03D612D418C0275F
                  SHA-512:972E110F6017FAD023753ACD59AD3856C944DA7D0A3AEC297712F3DBE02D358FA85F4BBEFF7A972B3DF6FCC834BD289E7A29EF02E36CECF1A42429D8C9861BE9
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="1-speed" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\PANEL\1-voltage.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2619
                  Entropy (8bit):4.873421507345803
                  Encrypted:false
                  SSDEEP:24:JdfsfLXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7H:3fqrTgqQ5Bo6z+pEm7T7KcdTxr9T
                  MD5:99FE2F750F2C3789643DC35DD967308F
                  SHA1:30A31AF3E5FA550158A7D9ACADB51E62231828D0
                  SHA-256:07123F7FF6F52D55E323A56D2FF7DB8D10110983B0F57347909689BCB98FBCDC
                  SHA-512:1906AE1B2C1A3C2EFB30C99EB89A6FFC5C72F39B09907596DE636CFF9B45033DA15D3A3B94D3F53F00EE6EE57EEA705D16D985437B4CC4AF62229BF774386E0F
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="1-voltage" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\PANEL\current.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2616
                  Entropy (8bit):4.866888828935246
                  Encrypted:false
                  SSDEEP:24:JdfXLXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kh:3frrTgqQ5Bo6z+pEm7T7Kcd9Er9T
                  MD5:8F0516CE13DDCCFEB15DF172894ED31B
                  SHA1:01959F84966ED0BD44D1343B4FA8E62410F397EF
                  SHA-256:C5A89CC9B16A1D1FD286580049C927A62A332338E62355404DBC719630E4E960
                  SHA-512:B3706ADC2A86347CA29B5CFFC8E1A23247BDE90AB74B25E8102A8F6C0BB48702401602747E84C03E07DAC303F645E237861B6E2CE6EA15ADE370403570284F66
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="current" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\PANEL\l-speed.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):72075
                  Entropy (8bit):4.57463556605904
                  Encrypted:false
                  SSDEEP:1536:VmvUKUAUcUeUAU6U20UUUXxPHwVqhItW5bPiZAL3C08nWD4Ofe7D2kGeUJ:VmvUKUAUcUeUAU6UTUUUXxPHwVqhItWt
                  MD5:9B850A41B88E7E833582677F6232B237
                  SHA1:7686A1A7D7683C3A8B73437AA953F908F1A592BC
                  SHA-256:40AB6BD81920C8EBA9CD4CBC76579AE68DC12362B432AAFCFB0A7FB59D04B1E2
                  SHA-512:6B19F0DB9C59FD5F18DB6B13A07E817A3114F62B57CFE78FE521407EDAF217F2C7DAA39AC116DA880B27CBB43D017DA0E0E161839E5F88633D3ACF41689ADA8E
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="" Width="515" Height="266">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="255" Green="255" Blue="255" Alpha="255" />.. <Event />.. <DefaultControlBackColor>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <ElementGroup>.. <Version>1</Version>.. <ID>5517</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>False</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\PANEL\reference.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.864273059253574
                  Encrypted:false
                  SSDEEP:24:JdfHXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcd:3f3rTgqQ5Bo6z+pEm7T7Kcd1r9T
                  MD5:FD28E82F0A5091A440C4571E0A8A3640
                  SHA1:3BA7D2037D6A3964240BD07EBBFDC5C341E686C4
                  SHA-256:9D5CE44EDBF13D86D98AF1A4447CCBDA1F25255DCBDC203E2298BBB15551DFE4
                  SHA-512:C213ED13CAB964DD20944D8E89217CEF7313183A502664F609002ABEE329F1E7E44262E897383360FCD21E7D5DA6A87ECADB6458E3F9262CA466C83DD600912C
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="reference" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\PANEL\speed.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.868924493438331
                  Encrypted:false
                  SSDEEP:24:JdfhXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc8:3fZrTgqQ5Bo6z+pEm7T7KcdDwr9T
                  MD5:9146FE30E64173B7185BD3BD30794291
                  SHA1:74490807AE277834B5521CB82101C9819C166795
                  SHA-256:A88F071EBBD07AAA645A09751F97B2A15AE5F3D450A00B66213F45CC5F7B7875
                  SHA-512:F230057CB403BCC596444772C9BCDA0F9CA8F88DA57A648C5FC2E2A7227E9D15704B00E0B728A34479D096437F000C76A771C8DEB0CDFAEF3508FDB121EA3E57
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="speed" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\PANEL\voltage.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2616
                  Entropy (8bit):4.866879183264328
                  Encrypted:false
                  SSDEEP:24:JdfyfLXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7S:3fUrTgqQ5Bo6z+pEm7T7Kcdsr9T
                  MD5:DEBE20225821B10785DABF57A8224C01
                  SHA1:163DB50D91593208E120FEFD5BDE25BF59B2E9FC
                  SHA-256:86EF24A6E1DA04D8E27DCEB875321A65ABC8689BD34EF495EC62C96AC48DEC70
                  SHA-512:AA86F9B2D8092786BA5AC7B64E33F9C62266AFB9AA4142E230D63205149CD75C23D06979D809F3A5049B949A179BD0626D7AEED3216B019A33362867E34CBE1B
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="voltage" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\drection\arrowrot1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2621
                  Entropy (8bit):4.871631989916262
                  Encrypted:false
                  SSDEEP:24:JdfC6XrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kk:3fCurTgqQ5Bo6z+pEm7T7KcdFr9T
                  MD5:26ADED28478DFB47DD8F761A37A0768F
                  SHA1:449FB27E13FB67524081DE5B666830B9E3CBF2A9
                  SHA-256:E0C660A3F7B3A28B6B7840DB1AEA77A5EDEB50CABC55308FCE6266410BB9E03F
                  SHA-512:F34F6EC9C23283E7A4BA75653FD95EBF5A04F37984A20C11F7F9F479D9648FF633338FE880B65B7AAD5ACC821A00782CA69FEEDF7592F843EECDCACC3D6E6906
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="arrowrot1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\drection\arrowrot2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2621
                  Entropy (8bit):4.872505953721919
                  Encrypted:false
                  SSDEEP:24:JdfCzXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Ko:3fCTr8gqQ5Bo6z+pEm7T7KcdJr9T
                  MD5:3A716BA980036376CF8D6BB9D366F2A0
                  SHA1:31113FB918D1DAB28736918CC415FB8960FACB3E
                  SHA-256:3ACF04578CAEF67FF2DCCD013F0E000BBCD4C8656BCF405384306163D07F5F1E
                  SHA-512:989EA974B6283E09761B8995C0FDDE4CDA9908D23B70169C4AB3DC6D9D24653E0D2B8C6F1B1F4E37031D417A827A508ECA174F29572D903270674145BD798EC0
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="arrowrot2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\drection\arrowrot3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2621
                  Entropy (8bit):4.872966025221864
                  Encrypted:false
                  SSDEEP:24:JdfCgXrKADvKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXbg:3fCcrxvjgqQ5Bo6z+pEm7T7Kcdar9T
                  MD5:09DB0E87F6DCEF22AEDA9EE788DB8B17
                  SHA1:5D75E09CCF96E2B5F417B99C9E8814924EF5CD6D
                  SHA-256:7C87E5C198F98261CA6A057AF9B3DA8AF814231F62BE0E0F8301F317D10102DC
                  SHA-512:FF8E84FA8E0CF51D1D017DC67FCFA47B58C034CEAB671E3C5805682BD24E837DB76D5FDC86251DE5E18E9B48F36BC092F1B1ABB8B9E777F1EC86F4BE24BEC0B6
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="arrowrot3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>8</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\drection\arrowrot4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2621
                  Entropy (8bit):4.873284986144645
                  Encrypted:false
                  SSDEEP:24:JdfCJXrKAxOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7K5:3fCxrCgqQ5Bo6z+pEm7T7KcdAr9T
                  MD5:5BBD1039436920A7E382B060E5B2EC6D
                  SHA1:0DD72D789B98A19A1C9BEF3653DCEBDB4E4AAAAA
                  SHA-256:2FBCA0C0A5511EDE63C694673A021AE3EA128C426E817A9438F48D4B646B8594
                  SHA-512:37DED9517DBA2B7ACAD2B6951DC501CFB7EC9ED4E7A8420D364554DF04FA261DF75E2D7685A96875C28117163FA555F07AA497BA87DFA0DA1442BEA5CA6584DF
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="arrowrot4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>9</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\drection\arrowrot5.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2622
                  Entropy (8bit):4.871156756281318
                  Encrypted:false
                  SSDEEP:24:JdfCGXrKANOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kz:3fCqr6gqQ5Bo6z+pEm7T7KcdKr9T
                  MD5:EBF813B5E553B31950618D7531B6B95D
                  SHA1:DDC369C4BBEC7E80FF34545A78C7E90B8E2F03D5
                  SHA-256:7A83290F1A0CEA77B244A4C97123428F7DD1EAE0872BCC3D5F135E8361418197
                  SHA-512:95A6BB4FA6665F711FFDF64518CC76DD74B8700F19D6D12A82359F858448E9617B8A06A95F664353973B4DE7B02E837953D2C9204D4A7CDC312553682DDDB387
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="arrowrot5" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>10</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\drection\arrowrot6.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2622
                  Entropy (8bit):4.872803566731037
                  Encrypted:false
                  SSDEEP:24:JdfC/XrKAKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7K/:3fCfrZgqQ5Bo6z+pEm7T7Kcd+r9T
                  MD5:D03C693D744989C4C8D00BA300A22590
                  SHA1:634EA7BB4FB80EEF9E50D2FDC87ABE3664A8DCE4
                  SHA-256:3782880052503CC51D6FDB77C959C4149DE906339FC2A25EF6F3258FDFF10797
                  SHA-512:B5E9F9AF8AF1991A63DA95B45302B59FFDA4ECD968E2516A4E484E7FA59CDADC4AB04288395E316621DE934CDAF06659415AA3FCC189C14F236F68322BC38F43
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="arrowrot6" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>11</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\drection\arrowrot7.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2622
                  Entropy (8bit):4.8759090156331615
                  Encrypted:false
                  SSDEEP:24:JdfCcXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kx:3fCorQgqQ5Bo6z+pEm7T7Kcdkr9T
                  MD5:D81F3C0816EA27EDA4B2E3696EB95CFA
                  SHA1:828BB3AB30C52FC5F5016B6B43076D79F8035659
                  SHA-256:BF639745068FF2B51AD259864D8BD88638CCD97A977D7B46CE23ECA92D2292C5
                  SHA-512:0BFF027185B8DD5C51734854A3042C6AE4D098B7C1BE5D008005301818F24B4FCAB006BB19CB5E75EDF930CF65C2864F8641AD814950D49407B4FB383B0B1E91
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="arrowrot7" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>12</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\drection\arrowrot8.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2622
                  Entropy (8bit):4.874218562320918
                  Encrypted:false
                  SSDEEP:24:JdfCpLXrKATAOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXbM:3fCpbr3gqQ5Bo6z+pEm7T7Kcd+r9T
                  MD5:45F8E03060CF78C348BB9C681A110ABC
                  SHA1:75C9FDC5E52E6C1CCFB7308DA58F7516A8D40EE2
                  SHA-256:99D81A1E07AC69788DDCF03760EF3BCAC76AF7B27996C86DC5C955CD20743628
                  SHA-512:E019C5D4B2926114259E3B8AB1799B1F70F13DCB4F5B324E072B0F43F589CA0608B84F9C9360DEBFEF9A6B50EC6022FC0B81BE9272014611A7C91DE684D2F7A5
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="arrowrot8" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>13</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\drection\arrowrot9.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2621
                  Entropy (8bit):4.87417872883854
                  Encrypted:false
                  SSDEEP:24:JdfCCXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7K5:3fCGr8gqQ5Bo6z+pEm7T7KcdEr9T
                  MD5:AB1DAB022471B96CA88A2A626A4AE54A
                  SHA1:1DA581081C7D0C77774B58F391B807840962D9B3
                  SHA-256:A7C6B30478BACE1E4513CE5D585CF2B5CC2F27F13B22D4C58CB881BE0D549E54
                  SHA-512:DFBA93CC9F04AEFF703B93C4F4A9B6423A9853E3FD3B2D919069C5D03AC14B7BC946DCD837B75063E31AE698C21D813810C065CD0465DCA57EBDF0AC58E2EACF
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="arrowrot9" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\drection\east.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2614
                  Entropy (8bit):4.866766606586122
                  Encrypted:false
                  SSDEEP:24:JdfzjLXrKAJOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb70:3f7rmgqQ5Bo6z+pEm7T7KcdmGQr9T
                  MD5:6B821DE11B2472037408192ADCA91A35
                  SHA1:B7EE1E27D6373B0705B348DCD11E4C28BEE0FFD0
                  SHA-256:893CD1C48D6298364316B7A1F5A48725BF4EED493556F647B4F6719C26787298
                  SHA-512:90D7C5CBFF6C9CDF3449BDF3094227916889EB6FB5C9B516D578F3084E0060AD117A1B37CEBE14A0288950C540E96C549C50A3026A8EAAE8835959C4B2CE71D5
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="east" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>14</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\drection\north-east.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2625
                  Entropy (8bit):4.874589917938874
                  Encrypted:false
                  SSDEEP:24:Jdf1LXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7K1:3fRr8gqQ5Bo6z+pEm7T7Kcdmr9T
                  MD5:2801FCB5CB025C678710F89B14E20708
                  SHA1:7D7A0A6FB6EFB681E66ADB3A39C595A028BB5089
                  SHA-256:48F7EF86B0932A5A4ADC3D42CE083A253652CF4AAF2D55056DEE735D26164110
                  SHA-512:EF7B152029CDE4F944F8EF1689CFCC81A8B8FD9F0DBABE8D803BCE123287CC31A2129CCBDB8A7E9DCF8DFCE8466BF6CA62258D2DA1F3739F7C82D25F161AB49E
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="north-east" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\drection\north-west.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2625
                  Entropy (8bit):4.879314166197448
                  Encrypted:false
                  SSDEEP:24:JdfbLXrKADvKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXbi:3fHrxvjgqQ5Bo6z+pEm7T7Kcdwr9T
                  MD5:D736BE341B84AA231ED86DEE9A318603
                  SHA1:119C6956BBE22F86F95AC777841E7DA401820622
                  SHA-256:AC769502A60239D4C2062FCA4C6958969B225146FA4DE215080B30DFF546EE46
                  SHA-512:458EA61D26163CB975AD566CFE3145282F61930A6A912A672A0CC17CCCBDFE915F5CAF3DE9C814463BEC8437B812340AB0D786FAA0D24E72FBF407FBC601E458
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="north-west" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>8</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\drection\north.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.87129436751366
                  Encrypted:false
                  SSDEEP:24:Jdf00LXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7m:3flbrTgqQ5Bo6z+pEm7T7KcdIr9T
                  MD5:327176E8161F073A580AEDBE470A742C
                  SHA1:405F934060947F50AFFFA5868777ACBEFA4C4EC5
                  SHA-256:1B762F73D4B65A8CA60BDFCA6546FA69D9FA801540638072811B6869ECDF8F15
                  SHA-512:EE5C1507CAD94E3E61DC5F922AC0971BD837EFF8D968AD08F71DACA8B2FB76294116E0C69C8D848CDA0458F3FC72F34431BDFDE59B1A298037D7AAF13145D550
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="north" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\drection\south-east.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2626
                  Entropy (8bit):4.873657520284355
                  Encrypted:false
                  SSDEEP:24:JdfMWjLXrKANOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXbR:3fMer6gqQ5Bo6z+pEm7T7KcdMUhDr9T
                  MD5:45EE9F1E3F959B341740B5CC51B83880
                  SHA1:25F58478CF5085E73B888F7DAA6036E2FAD8773B
                  SHA-256:289B48BA6EE30772C4092B94BD456879F7487285D5B5C481B9B03D8BA79A7B1D
                  SHA-512:C353E3AC5B1DEE6D31977A442AF9C624281012645E7D7155D9A3EF4F3102D44638191E8D41A147215ABBAAA55D53ED615C0F0C8AA70468D9FC2D5CEC299565D5
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="south-east" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>10</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\drection\south-west.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2626
                  Entropy (8bit):4.879738913290256
                  Encrypted:false
                  SSDEEP:24:JdfNLXrKAKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Ki:3fJrZgqQ5Bo6z+pEm7T7KcdZ/r9T
                  MD5:E9861736AF2FADBE503E5EDD8D548DF5
                  SHA1:682CB390C6A09EDD0EBD0277B91C9F1EC22EE08F
                  SHA-256:C5E7B01385609C4C4EE5D90E9BEBCA2B6331EDDCF298FB034D62A875D1FAA580
                  SHA-512:05F710A9FADCC4FFE50A22406E2B73C126B40E0B810812F707C901A1C7006D5D4F412D1B66574E00FE559196B7CE760BF77BD4879B93439F6C10D4C3E02B383F
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="south-west" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>11</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\drection\south.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.871693462321019
                  Encrypted:false
                  SSDEEP:24:JdfTLXrKAxOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7K0:3fTbrCgqQ5Bo6z+pEm7T7KcdC/sr9T
                  MD5:3FBE0757A0B00E9F3211C03535764153
                  SHA1:A1333B4E178ED2BB778ED6481BB97BCE6F0D3022
                  SHA-256:9F03A39CE448BE8CF264487A7817CCE5CE52C15A8D0204B4EC29F0F129F671E8
                  SHA-512:8A0BA97F010EB2F64AC849A6457BDBC57C430DB758FC0107F6872C05E99BDD7C24D1C4E44381411BB350F6B8A96CB15E71781D10C34ADFEF8D026F9043FDC442
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="south" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>9</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\drection\west.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2614
                  Entropy (8bit):4.873076859533318
                  Encrypted:false
                  SSDEEP:24:JdfJLXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7K+:3fdrQgqQ5Bo6z+pEm7T7KcdVr9T
                  MD5:43881961C75FD065C63C9194B07AFB1A
                  SHA1:20E3F833EEC9C9891FE3D7554D9FFEB4BC6A954D
                  SHA-256:A8B080AFF29082187D77E40C428B8F95F11DA0D7057925EB81BA07EDC54B9045
                  SHA-512:53F0C8F4A9B9516FA752B9CD16704C9DED68B608F7053A537F07D573EA29A4A7BC736B256972E577FAECD90ADE526F13683722ABBBF826C6A9AF7AC1D461AEE6
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="west" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>12</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\calculator.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2621
                  Entropy (8bit):4.864878363972151
                  Encrypted:false
                  SSDEEP:24:JdfuXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcq:3fCrTgqQ5Bo6z+pEm7T7Kcdn2r9T
                  MD5:B967E1AC279FF6233252E7F54470B695
                  SHA1:C8A3DA4D0408A299D9DEDA74E63FC4DCF8CF61A7
                  SHA-256:6AFDD900BF4D7ED111479BA3296493CBBD2E981F799F06B2F6D2400EADDC3FBB
                  SHA-512:D1A537A4F0D6C57727ADCF80CE7B57D4736A484C92DD3D86E28357D8018DD47388460D14FFD34DE26ED58604FFD729146AFEEE0F98A7B237A8F85DA0901E7A2B
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="calculator" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\checked.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.871881229073042
                  Encrypted:false
                  SSDEEP:24:JdfjXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kce:3fjrTgqQ5Bo6z+pEm7T7KcdWr9T
                  MD5:A84D090AB7D213C060FB57A0B9A434E2
                  SHA1:8CD96C51FF6065F2A48A71D6808824A6BA9724A1
                  SHA-256:2443AC225F9B5643D0764FCB55346A35D546A3A136DCDF38D678CBD4197DDDCE
                  SHA-512:01BB6FEED420DCABCA469205E274C1751B2CF215E4865CBAD02A52618A07D0FFF055DDCA27886E63070840C75B0345EABC92FB33C05D8C6F6F1DA36942B35A3C
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="checked" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\clip.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4943
                  Entropy (8bit):4.82333953738421
                  Encrypted:false
                  SSDEEP:48:3fQr8gqQ5Bo6z+pEm7T7KcdVurYgqQ5Bo6z+pEm7T7Kcd8Rr9T:Yr80gUcdVurY0gUcdkrN
                  MD5:E6F1CACA3824896F173AFB2827C34442
                  SHA1:62AD526994E1F83A0E0EA87C8425F46EA8907376
                  SHA-256:40F118801F135F2AB13BF93807522E9B73E33CED45569034E2D9E930EEFED08F
                  SHA-512:C8CFC72B07701EC8B5A636C90697346F750A95F37679761485E58CB68CFA2D00BC66CC5C32899675D09E3FEB77CDBF4FB4DE4C4F6FDC44D054CB246FA8E90AE5
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="clip" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Scal

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\close.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2611
                  Entropy (8bit):4.866888022236279
                  Encrypted:false
                  SSDEEP:24:JdfCXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcY:3fGr8gqQ5Bo6z+pEm7T7Kcd4r9T
                  MD5:44190B3740286121133202841A8EFF66
                  SHA1:23E750596DC1CE61A8125583A40DED97CED77EEB
                  SHA-256:C6AE18C48F68697C93A6AADA76069CC16DE3B308C7F615D3EEFF2AB3DCA07251
                  SHA-512:42802E3487B3271C405F9A430ECA39B5B73EC66C614F4B82A8EEAA14888D691402DF340C95053B8EEED3DC54BBF0F03E0D78C35D751C6679F8524C89110C116E
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="close" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\crane.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2611
                  Entropy (8bit):4.867536091299319
                  Encrypted:false
                  SSDEEP:24:JdfnXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcj:3fXrTgqQ5Bo6z+pEm7T7Kcd/r9T
                  MD5:7CBCB7B724B7B0C5E89D626F816F20E8
                  SHA1:CC623387963D2163B8021A024504D4BA5FA6AA26
                  SHA-256:ED3C9A2E542CBDE4064D619C27F574B048AE313245192BEC5B302F90663C3101
                  SHA-512:F4667159B51E5E891A034E3E4331043ACD195915F66CAC831CBA1F750C65C28F7402F180E6A0FF024457C9E07005BA7E27D629C352E34FF401BCD4F9885A860F
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="crane" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\cross.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2611
                  Entropy (8bit):4.867034169008835
                  Encrypted:false
                  SSDEEP:24:JdfILXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7K4:3fIbrTgqQ5Bo6z+pEm7T7Kcddr9T
                  MD5:DC38183DFE00356EF9D11317FFBA418D
                  SHA1:044E76A090F1E3C75010808C88C7DBAACBBB3473
                  SHA-256:1CF0C8EAB3B9386D70FCBE38E065380353694E28086A94A39EC57BF452D8F3B5
                  SHA-512:EB472C9ED90749D29F334AC1D6713D543B20729CE4FA274AA4714E8CBBA27DCD7A5E5E12CB2AC37FE7776A3077EACF9029418D6E7E586E1C00F275FCAA7C939E
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="cross" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\curs.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2609
                  Entropy (8bit):4.867357166822877
                  Encrypted:false
                  SSDEEP:24:JdfQ6XrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kl:3fNrTgqQ5Bo6z+pEm7T7Kcdar9T
                  MD5:1C4795AF550276A24E184E384DEA368E
                  SHA1:19C800F7EE97F41A382F366E77158DADAAEEC647
                  SHA-256:C756797A65FE19798B4E7DC2A5DB07696133853C5F939D6550C458089081B383
                  SHA-512:E4F5B6B3E3D77DE8D8BDC89FC9F032C578F5A42AEDDEB1D029D8B1978E6FE0078AE6892E336BDEF4238AB8D0CEE7CC2B704144E7AF646B3B45D5D96D0C784D79
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="curs" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Scal

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\dguide.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2613
                  Entropy (8bit):4.871841913859792
                  Encrypted:false
                  SSDEEP:24:Jdf2XrKADvKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb76:3f6rxvjgqQ5Bo6z+pEm7T7KcdwBr9T
                  MD5:3E850C74B8536792069784000C0A1639
                  SHA1:D12304C9494A14C564E44B94F6CDDE85CE0D02D3
                  SHA-256:7A67A62DBB1A5BAEA476C6F0A74047F8B38C82371FAAE3D11D84125CBD595784
                  SHA-512:6BBE61D655277E6AE376A6F02102B6365E52F1475256CD8815E789A43ABBB93417BFB02A05761C5CADF19E097EC3D6E80A6789D3D7D1C5E48462002819C21E13
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="dguide" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>8</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\disc1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2611
                  Entropy (8bit):4.87173419126661
                  Encrypted:false
                  SSDEEP:24:JdfmXrKAxOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcT:3fKrCgqQ5Bo6z+pEm7T7Kcdvr9T
                  MD5:33625C065D2411886B9B291F3C518545
                  SHA1:B9B238CFE20B4C97C65A0DD5999EA70B62063A8A
                  SHA-256:37663DBF71D1139A78675D783907579FD17DC25903272DC7F90A50191E3BBF76
                  SHA-512:1D4DB29C63DF0765FFD3413D60B424284C391D4A21810DE4017F8FB4D1D7FA62DB6519F1548A82766F7B6EA513C51F010D82CCD7368D8716664B92D9AA1DB591
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="disc1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>9</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\disc2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.872156055367572
                  Encrypted:false
                  SSDEEP:24:JdffXrKANOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kch:3f/r6gqQ5Bo6z+pEm7T7KcdNr9T
                  MD5:0C3B94A03452A7930529E33288530F71
                  SHA1:D9207BD698AA47B051F665D2D46D85A27E404383
                  SHA-256:9812FBEF7900344BF02F63DAB385563AF464EF878EB6C36AF6A61EC4D42DA832
                  SHA-512:94C2A391694C13318C01A6A0F9AB8CF01A088660D39B599967F106AF42855F964C96A0A48803CF3017622D65DC7D4C6AA3A068795CFC2603BD7BFBF20565BE4A
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="disc2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>10</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\dnar.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2607
                  Entropy (8bit):4.864879146227736
                  Encrypted:false
                  SSDEEP:24:JdfjzXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Ka:3f/rTgqQ5Bo6z+pEm7T7KcdBr9T
                  MD5:B2AE5901B3E8E33D21C6203CE4D5B2CE
                  SHA1:D26A1A3075E75C42741B82FACFE49B4C68251886
                  SHA-256:3E6E72DA8F9EC4357855D09A91A0BC4208735F9DD27D4D0827DF894A775D7153
                  SHA-512:269C39B72237F5B6632976B735643107E05572029D0493E3F25EC1BE77E8406B3C57EB58DA35F619578BA5E86D30B5B19C719E74661404AAF66F3C0F1D492D72
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="dnar" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Scal

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\dnar1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2610
                  Entropy (8bit):4.868312577271115
                  Encrypted:false
                  SSDEEP:24:JdfGXrKAxOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcL:3fqrCgqQ5Bo6z+pEm7T7Kcdvr9T
                  MD5:A467D49D2528B69C16AE92CDC3ABBC99
                  SHA1:9A55B7DFE048DAD3B5169C4FE0CFD0E88BE0254E
                  SHA-256:D93C42AD4C75564C44784EEF6DDDF1DD5A2FD15BF2B276BFEA39BDF7C57ECF5C
                  SHA-512:FBBB548316557E0AE5576B45F11A6C2329F075E282F7DE7886DA4DF8089195B099C5A3F8235F5ECE34ED32C8CB10A8514EE95B04D7888E89A54704BC77B975EF
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="dnar1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>9</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\dnar2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2610
                  Entropy (8bit):4.866912255083689
                  Encrypted:false
                  SSDEEP:24:Jdf/XrKANOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc7:3ffr6gqQ5Bo6z+pEm7T7KcdDrr9T
                  MD5:E099B18FBA942655594E2B33048BA9B5
                  SHA1:51CE0AD67E0BF2B79DCC8CF54668DE989854A3C5
                  SHA-256:5D55BCFC4F50BF8D01397C507855689AEC6FDBE567DCE4C42A37DA272F6C4368
                  SHA-512:799AB67DDD43DDEEA1692AAA12D0FD2E62557905A7D4D703E92704CE27203AC099A04D57FC53B244F02ADE1FE0DB36CD992709ACC9E8080141F16354311EFF84
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="dnar2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>10</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\ffwd.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2610
                  Entropy (8bit):4.876077949141088
                  Encrypted:false
                  SSDEEP:24:JdfpXrKATAOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kr:3fRr3gqQ5Bo6z+pEm7T7KcdVvmr9T
                  MD5:22DC3186580B5EB008112EB6CBF39FF0
                  SHA1:CA38A90812562E887FB88521429CC123EF42CEA8
                  SHA-256:41DE0D526CA94CA97F28FB4AC315FF269D3D8D431F20A493E1F8F49A31855542
                  SHA-512:DDA879C98E65DE0C60A5766B3D583E1AA6B2C9F7F9AFA3A0E84477FA6B42939E56CA7875F26BBB0728141DF17271D6E010FF56C384D013691EC6EF2F9BCBB419
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="ffwd" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>13</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\form.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2610
                  Entropy (8bit):4.8656964224361134
                  Encrypted:false
                  SSDEEP:24:JdfUXrKAKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcd:3fQrZgqQ5Bo6z+pEm7T7KcdBr9T
                  MD5:B9F8DD86660D4531AED4274E098B54E1
                  SHA1:0AEF56FBDD3189262C4032DD772ABC5E6AF6FEFC
                  SHA-256:6E307BEB2140B4A7FB6041F87D51B587B8E3ADD34CE9F844B4A8E95B78AEFA7E
                  SHA-512:F91CC843BD2B1BE2AE11F1E173C3BBD729662E6BD0B31074D4DE2D32EC68CABD37687A3916DB69BEEC43E4D71426A6BCB65FF9E5B8B55C44EABB3248FB506540
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="form" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>11</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\gantry.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2613
                  Entropy (8bit):4.8717515555171635
                  Encrypted:false
                  SSDEEP:24:JdfZXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcS:3fhr8gqQ5Bo6z+pEm7T7Kcd+r9T
                  MD5:567B5E732F0C00E655320DCF692D3DF3
                  SHA1:6F5D9A4E2D3B6054E1778AAC53059E2D2612CEEB
                  SHA-256:226B06FFB51B76F9D0D75A3FB2B6B4186E5450C5F0B8C606E36A9B15A1246D32
                  SHA-512:957D3EFDF88A9F29170BDBE05922A44F60A0BFA2AE28060B9D7758715D275C79D93F524CBBB96C8993BCF52FE4BC282A608563D4C54B70BD7DCB3A3C6354FCC1
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="gantry" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\hand.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2610
                  Entropy (8bit):4.872076158731204
                  Encrypted:false
                  SSDEEP:24:JdfvXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kco:3fvrQgqQ5Bo6z+pEm7T7KcdYr9T
                  MD5:D9AC9BAA40B94229AC0498576F8B10FB
                  SHA1:0AD85E016E43E738C1F9FF2A8AECA8AC3657F33D
                  SHA-256:25EF65631BCBB7C13837654E58984D64CEE6DDE34363810E241064FBFDB94023
                  SHA-512:0EAA62A2A4916D44BCA6A8E14739FA568FC1DABC9BC431CD753764B8B6054128D09D37F2B90B933E055EA3CC504E6E3616D32FFAEF01DE091C93DA0A8F935BB4
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="hand" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>12</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\help2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.871950940980658
                  Encrypted:false
                  SSDEEP:24:Jdf5XrKAKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc1:3fBrZgqQ5Bo6z+pEm7T7KcdDwI7r9T
                  MD5:0344E0A2BE5AC88064661207FA144919
                  SHA1:E68C327ECD7A0F9067C0B4E9690976632CB5C90A
                  SHA-256:16421B4778714D4F0AF25715FCB70E375D913DC8A5ADA6F38DC15BE558FC8DF1
                  SHA-512:7AC12CB01654A9208976096AC493134467FCE7457A14BF6DD5108D34197866F1BDC2E743804A663D1A3368B33BDC5905E9DB0DD9A9F4A6DBE5C23FFC1CD43BFA
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="help2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>11</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\help3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.87320934698288
                  Encrypted:false
                  SSDEEP:24:Jdf2XrKAyOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcF:3f6rhgqQ5Bo6z+pEm7T7KcdBr9T
                  MD5:24C93BA7834132DA36D638FE696BBCC1
                  SHA1:DD7D96A9756D979CD4EB75EE725CE7CD3CC357FB
                  SHA-256:34A3E67C0A56CFE5457B88C8147E03773574AE80B6714AC560559D558B49F04A
                  SHA-512:D6E25860A1EEAFE6C43948D61349F8284C2923D0E4280A21B9F053B67B8B87CE736A687A5AD6868E75DB9B4027B7094616D11E4EB75363C242EDEC6E4980F44A
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="help3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>19</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\info.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4944
                  Entropy (8bit):4.822621012365228
                  Encrypted:false
                  SSDEEP:48:3firlgqQ5Bo6z+pEm7T7KcdBrYgqQ5Bo6z+pEm7T7Kcdivr9T:arl0gUcdBrY0gUcdkrN
                  MD5:AD6A157CDD28A1FAC7E4A001FDC60A9B
                  SHA1:3759A72B3206F8B4988E556C8D9C7A70586082A2
                  SHA-256:5B1907B8B3089203F1C35A81EDBF0E6D3C9D2391441C2DD15A542A6FEEF2F05A
                  SHA-512:CBF344FAE552BD5F284B4E03916D85C19615837693D8D592FBC9D505C6D3622EEFA1A5384EC77D65BBB40216195BA092873BD3D9360A9DEB408AC8E77D8424A1
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="info" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>15</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\key.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4942
                  Entropy (8bit):4.828108938918002
                  Encrypted:false
                  SSDEEP:48:3flr3gqQ5Bo6z+pEm7T7KcdDUr3gqQ5Bo6z+pEm7T7Kcd+Ir9T:dr30gUcdQr30gUcd1rN
                  MD5:3A73B39B155941473950BB7F2F3E47F7
                  SHA1:501482E54132FB3DA2D9875183070C2EBBEE29E4
                  SHA-256:F03664E6B484E83A66B022CF84485B0846D440B3E4FCBD2D7812DE3A507AE0A6
                  SHA-512:4E3622279168D1EDF14E4E1407667810BE9EAE1BCDCA077B2BFFABC95B3A0D4930DFDFDCF2FF232EDCCB876D881ED40B48C9BADD0BA02C896EE1CF5A0D3A34C1
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="key" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>13</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Scal

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\last.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2609
                  Entropy (8bit):4.8642938112251235
                  Encrypted:false
                  SSDEEP:24:Jdf0LXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7K2:3furTgqQ5Bo6z+pEm7T7Kcdpr9T
                  MD5:C4F7501BCED08A8D1746C938AD14CBCA
                  SHA1:946FC1A7DE6D86FEE407F94D8DB59A84D85E66A3
                  SHA-256:455C1D93AAA3755FAF8D2AEA7CBD7B14D3A3E3443EFC21B53A950364D908FFBC
                  SHA-512:D915672FEE6F35C83DD0F5F352BF955963271BAD321E92C89A6759A614217328D039293E21C176D9D0C82B0DCC6DB5CE39168994C1FFC5A16771DC00A86F78EE
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="last" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Scal

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\last1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2611
                  Entropy (8bit):4.865473851215953
                  Encrypted:false
                  SSDEEP:24:JdfJXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcy:3fxr8gqQ5Bo6z+pEm7T7KcdWr9T
                  MD5:E617D3D737812075FDFF9F7DF9B9FAC3
                  SHA1:4524DDA3914F468D96FD9ADE23F80B39729686CD
                  SHA-256:3E05221E96874E92933DCB4C704955D578DDAF988E90151BCB78AB78C2D25CCD
                  SHA-512:15624A8A3DEB97A4FF1626C3CE8976B0650F74DCA04617DEC0C906AD7CBC6A2DD02C0774BD8FB090EAB8EF23ECE9E877D8F49A62134216B696DAE2CC7E45152A
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="last1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\last2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.8677613040734355
                  Encrypted:false
                  SSDEEP:24:JdfcXrKAVOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcI:3forigqQ5Bo6z+pEm7T7KcdEr9T
                  MD5:89E7DC17DBDBBFEB63601373BF922D52
                  SHA1:09379830EE699892914A9AC7E2D222446D8B7F47
                  SHA-256:071E18CB9D8611E5DD3B5A84C1374E770735C906AF73C8A7531D8B6FB6EC1A4A
                  SHA-512:1312EB41AE417A27D4454EE28B01E69BF3AAA9A439E2DE51325CDF05474FE88937ED6D5E54EBD1E8E63961460F6DC4593E9256B6EA7105E651F4ACC40D23D345
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="last2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>18</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\left1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2610
                  Entropy (8bit):4.8661361901269515
                  Encrypted:false
                  SSDEEP:24:JdfeXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kch:3fSrTgqQ5Bo6z+pEm7T7Kcd9r9T
                  MD5:456DF4F96596A89F775228D91D424148
                  SHA1:129CA140F32C02DF8D419BC36F7C0CA8802052E8
                  SHA-256:AA03DBE576B0B1586CAD889B1572FB835091916562B95AFF0071C57B0EEAB945
                  SHA-512:62BD269DF4455B7D8108BA805AB65200045AD141FD59BB0223CF5B077B74642D0DB121A7959B429CC0588B7A6E63478811FAC604BEC98DD834B681166C56E704
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="left1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\left2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2610
                  Entropy (8bit):4.866961212738508
                  Encrypted:false
                  SSDEEP:24:JdfXXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcn:3fnr8gqQ5Bo6z+pEm7T7KcdKIr9T
                  MD5:765ECFE852205178E46CAD99C94C1504
                  SHA1:17CA0A759A33CF9E00D4F323F480680051E6D910
                  SHA-256:E58F7E6DF6299508D045D0E21BBCF7CF29ABE64E07B1D8C190F715638C431E50
                  SHA-512:64853694B250FB69DADAE3D0D21808615574C9F748BB80AB175209BC4F95F22B76E610AE7C6919A1EAAA94A7B699CE204956A6A220A4867695E222BCE3128D88
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="left2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\left3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2610
                  Entropy (8bit):4.870693215776714
                  Encrypted:false
                  SSDEEP:24:JdfUXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcq:3fQrTgqQ5Bo6z+pEm7T7Kcdur9T
                  MD5:E93D40A058CAE4E2DE086EFE61A90DDD
                  SHA1:41F4378333B286CA7418CE90AC1E23A88BF0AEE3
                  SHA-256:90F576FCE54D79D25709B9E230F4FDE00AE1B7B653E7636E139AE2395901B4BE
                  SHA-512:23C0285FE4D0C7D22FB01A414F3E5B11F36038CAC519E54745B7F564CDF44B602CB63B5CDD46E389E2DC4D149D9BD1E3F198DB8164DFA9172780D25FCD86A301
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="left3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\left4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2611
                  Entropy (8bit):4.87115419914538
                  Encrypted:false
                  SSDEEP:24:JdfFXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcn:3fNrTgqQ5Bo6z+pEm7T7KcdXr9T
                  MD5:3705ABD77A53ED8D6C179E5956FB8236
                  SHA1:F9D6B785E4021051883F367B9E9AC8ABCC44DCB9
                  SHA-256:1B34C91463D91B8E2974B17B254A9655DB0CB7FD2BC932793FBCD198DF59749C
                  SHA-512:05487E6840FF0DEE1405EF989442E996578E8FEB57B06BB1660FAED6429D26072171E2FD58D7B2111616C575C4CE35D264E8ED09E6B25EDDA50AF32D73AB5ECC
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="left4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\menu.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2609
                  Entropy (8bit):4.8659537042572225
                  Encrypted:false
                  SSDEEP:24:JdfxXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcX:3fJrTgqQ5Bo6z+pEm7T7KcdKIr9T
                  MD5:E1166592C25F680E5BE9118B6AC73B84
                  SHA1:26FC01F4D99DEAF4AE7893CAE31EBC3C9F96212B
                  SHA-256:C68A08D26FB8264864A8F1ECA5BB22A08A510D1D85699DD768925C80958079D0
                  SHA-512:D6547ED8D7E20D017DCEB72D686067183502B3463F1104E9F50D24FE1F2944B0FF5E686CC9ED51E1E266C635708B2F441B594077F8A9830860FB0A95BB459091
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="menu" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Scal

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\mgtr.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2609
                  Entropy (8bit):4.867831055100596
                  Encrypted:false
                  SSDEEP:24:JdfkXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kch:3fAr8gqQ5Bo6z+pEm7T7KcdGrIBr9T
                  MD5:BCD604DE2122A94B668B0F0694537F97
                  SHA1:3436542FEF40B63A039405CB56CEAB9D4127906E
                  SHA-256:5E1DD6FA15E4C57E17ABDB7FC1EFD7FFDF300F485BE6C6E83BC1AE3CBFBDB9B0
                  SHA-512:149E7F49DA44451E85BDB13A78C3989080DD48C73FD6D619CA66596748D13A4D72F16292359CB3E488128E486D637E583C3977E57E085BA62143EE7D409A2FD8
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="mgtr" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Scal

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\minmax.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2613
                  Entropy (8bit):4.868067263450398
                  Encrypted:false
                  SSDEEP:24:JdfQXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kct:3fsrTgqQ5Bo6z+pEm7T7Kcd3FXr9T
                  MD5:3452A1E924E93EDEA0080C8DD1D2252F
                  SHA1:F9A4A870581C236C0DFA328650CBF0A6D6D58FAA
                  SHA-256:1E944DCD74612450BD09EB5365C4AC46437F2B7F94E144486E9F17921F3281F3
                  SHA-512:679064FC8BCA6265CAC112CAE7292137152F33BD4B7AC9BD647D417F998604320BC2E16AD87FD900C3C3AFD517675E768BDE411C60DF2260FC7B617D377FE555
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="minmax" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\msge1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.872902483170874
                  Encrypted:false
                  SSDEEP:24:JdfhXrKATAOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Ky:3fZr3gqQ5Bo6z+pEm7T7Kcdvr9T
                  MD5:D04019CE4199B6FF5E99C6C607DAB507
                  SHA1:9FB539ACCFC87AB1E76BFDFA8899CB03B6B04CE8
                  SHA-256:87D1521DC2C955C141A659AE68517498468CBE64BE89581588E442137384F795
                  SHA-512:7BBE65FA6CB30BE9A89ED4772623E526F866E6F7082F5EA525E71555D4927DCDA6985BF984974BEF06E29210F5E8A73569B8CCF71ABB806A81062C16019216E7
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="msge1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>13</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\msge2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.872708670986082
                  Encrypted:false
                  SSDEEP:24:Jdf0XrKAGOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcL:3fwrlgqQ5Bo6z+pEm7T7KcdHr9T
                  MD5:8DD7208D50819EC971E668F993EA99E4
                  SHA1:403710B22FECB7EF24707C7B27CD9B1A1D03F6A1
                  SHA-256:9ED3578C53FF99CF98D90BCFF833CAB470537DCE31BB1806845CD2E44600A05C
                  SHA-512:7D59EB61209A2BAF8F89C888BA77D18DC05E9406E9F2BCC2EFA5370F2D319C91AAAE7644B75DF1CC038FC443601E5E5327AFD9AC0DD9D59EBFCE4F8F72216908
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="msge2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>15</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\msge3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.872515846122686
                  Encrypted:false
                  SSDEEP:24:Jdf3XrKACKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KN:3fHrUjgqQ5Bo6z+pEm7T7KcdE3r9T
                  MD5:8CE0A6D5359EB9C71B3FF8E201C3A06E
                  SHA1:16871B640C3E51B0ABE7A5FAD5F4604D7A811804
                  SHA-256:EA79A87F25CE0C8969BE49DB8F7F6390EC9A74C11C9D09BC992C52038E99C6B6
                  SHA-512:823637A1E19840E74B95BE9E13B171870B45973DDFF15DCEABCA584A69369284400D1277DD61F7C35D3AC75F960D4389E137F762C2B9B7863256EDFA8EF16232
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="msge3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>16</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\music.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.869007443035907
                  Encrypted:false
                  SSDEEP:24:JdftXrKAAOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcP:3fFrzgqQ5Bo6z+pEm7T7KcdqrMr9T
                  MD5:16F2D28CC2CD0AC77D2EB50F540C2DF6
                  SHA1:5A22B0369E4A73F0D06177368757D88638EC05D7
                  SHA-256:AD1939BC2647B895F0EEC30F3DE99D68C90BD4111A5B9023CC9DD17FB56A7DA1
                  SHA-512:1F8CF07F4122A8B9096D353D91A5F42B94BA35406BAD1BB06FDC35818DA60E81559FC83A0520E58E3B85DFEA1F3CCE35E0152F9ECA29F87E0F372CAA4E17CFE1
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="music" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>17</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\next.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2610
                  Entropy (8bit):4.864906229945254
                  Encrypted:false
                  SSDEEP:24:JdfxxLXrKAy2OgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXbr:3fxlrM3gqQ5Bo6z+pEm7T7Kcdosr9T
                  MD5:B8738BE1C3AECBAF6B4FAA5B216D32AF
                  SHA1:4B05973C9D0517A2751C03ADD2AF4CE538C9864F
                  SHA-256:5F3892239063AA94A95A0F5E9BCC9A59B69CF8593610AB7A4F86BC0103C69824
                  SHA-512:990A20256D20D8ED565D825B8AB2036A6DBB60486C7F89292CB79C715841CDDDC905C67FB2D9592FADBA977CCEB5C07E227AEB174CF0CFE77B6AE836428E7422
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="next" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>21</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\next1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.867295298819052
                  Encrypted:false
                  SSDEEP:24:JdfmXrKAwOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcX:3fKr/gqQ5Bo6z+pEm7T7KcdxRr9T
                  MD5:C7483425A624C376F04F65FFF7C2A61A
                  SHA1:060F442E64E52A67986B9944D160D2FB9DC8DC9B
                  SHA-256:E0462433FCA98BAA0B17D57D4F1DDCFD22BD78409D0082CBD2C8C2773247E367
                  SHA-512:A232B3DE2403BBAD62EEB7F7C607B0BEF901B4E92318A5730F9314A11C30D20F507F682817F242DF4DD0E0E734F905B9B189C0389CA484FE8F69A64D294CE1E3
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="next1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>22</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\note.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2610
                  Entropy (8bit):4.862626239598813
                  Encrypted:false
                  SSDEEP:24:JdfyXrKA6OgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcf:3fWrtgqQ5Bo6z+pEm7T7Kcdjr9T
                  MD5:4D1A45E13C8DC6BC357B1D49DEAD3AE4
                  SHA1:C6FEFD198B7C6B973BA0B028E4AA095CD6056095
                  SHA-256:B4E5F5AF028FC91D6591D181BDAE23AAFFA22AD0A3E3131307B13DCDAED71622
                  SHA-512:B3FD255F67A62A949FA55B7CE1458C3AC85A234DE0CB75F04E52E699EE3F0563A0653302E70FE7A2031FFF048BB82E58EF78A9A63549DF9061976DE2E1AA656C
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="note" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>24</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\open.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2609
                  Entropy (8bit):4.863837323261
                  Encrypted:false
                  SSDEEP:24:JdfuXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcn:3fCrTgqQ5Bo6z+pEm7T7KcdVVr9T
                  MD5:219709EF54E46D0AD856C11B6A0526A8
                  SHA1:603511F70E1C6CC57075AAE0B0C6266E47F6066C
                  SHA-256:0D7AEC87F833F2CCAEEA7B9FF0DBD278F65772E2EECE13271BCA09E2E49D51C4
                  SHA-512:FABE6814D5737330C684C6D50C536518FB71FBDD9D3A8DFF4FFEE5A19B3C422ED78871BE604B6EFC3AE2158F67E21C2143EFDF3652220CE4DABC747947723A55
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="open" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Scal

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\pen.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2607
                  Entropy (8bit):4.86397027079863
                  Encrypted:false
                  SSDEEP:24:Jdf5XrKANOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcY:3fBr6gqQ5Bo6z+pEm7T7KcdvMr9T
                  MD5:74766A9FE8B04395866AACBB34585557
                  SHA1:8D224A15DFF13F319EE759790C9815B51603C749
                  SHA-256:5BAF4B3FCA0B4C754CDC8B8840E1F454344D0CA2D6EA0D38B04DE863F849AF3B
                  SHA-512:F7E7ECEE517376731C291C0C5553953546A8EF9D2454F2AC73847B1AAD5F7BA1B107482AA744F11FA05BC1F480B4696CEEA6060D3A85D201F64C25A48CD34A22
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="pen" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>10</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Scal

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\prev.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2610
                  Entropy (8bit):4.867799986785287
                  Encrypted:false
                  SSDEEP:24:JdffXrKA9OgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc9:3f/rOgqQ5Bo6z+pEm7T7KcdJr9T
                  MD5:6BE4C3415DC5104BD88142CE9BC6AB78
                  SHA1:641D52F005E7D15E418762D856BD03014E80708B
                  SHA-256:184897DC654C1902ADA2949EE171B09FA93493284B3A3BAE982853350EA1217E
                  SHA-512:79AC8E8F4ED576E7C922DAC391A1D7A3979996E7D8FCD9CBA164F86FDB841F3815F121059DB7706E5E051C3B37AF0A7E243C4F450F32E7FC4A0FAE0B2DF916F7
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="prev" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>25</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\print.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2611
                  Entropy (8bit):4.866767789810993
                  Encrypted:false
                  SSDEEP:24:JdflLXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7K5:3fhrTgqQ5Bo6z+pEm7T7Kcdgr9T
                  MD5:D36CA0F14BE2319B366B787F106D5700
                  SHA1:BC44AA2D9BE806577395F0B07B4A43DA8F4FE3C7
                  SHA-256:B17DDCA8756F0ACFB7F71F63F1D19C41F446A486CAD312AFC75702BF02E85C5A
                  SHA-512:73949D818720DE0FB9938894F426C71DA1737CB44077EE43401BCDCA006C99FB50396E6957FECA0B3139BD69E0D06A374E0F15B73C9C3A438301815657C6E7E9
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="print" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\samples.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2616
                  Entropy (8bit):4.868483870974144
                  Encrypted:false
                  SSDEEP:24:JdflXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kco:3ftrQgqQ5Bo6z+pEm7T7KcdQr9T
                  MD5:463D55D9DAA56F5F02F659E449C77528
                  SHA1:53824E7610DDF1C0F78D4696A353BF8BA1F860E1
                  SHA-256:D590D14F6B65790739CE50C1E9A73D78E5E3C8E12867BC8236F4CED28B11A22C
                  SHA-512:5D4F94D7C392D75054ED0CF2B3A8354897EB0AD6BDECA283011D88EB0E529D2F55E579951AD9B03F46AC30AC43C64C183F8D1A12EF01A9F7EA575A515577C4ED
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="samples" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>12</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\scr1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2609
                  Entropy (8bit):4.867346838338509
                  Encrypted:false
                  SSDEEP:24:JdfhXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kck:3fZr8gqQ5Bo6z+pEm7T7KcdzMxr9T
                  MD5:64A322787FF717B68D62FF5A37D63AD7
                  SHA1:1EB2D927E87D64CD6D784C1A0352D2E78FB8C104
                  SHA-256:64104933FE06DE96A6D05F9FE08B6208D71FC57A9138E83FF71BE050673ACB1E
                  SHA-512:2961739A45D23E187301BF9B3FBBB4A59E93C3C9FD5280C4CE81D1227F4F6EBC650C4E9B1AA97212FB44227CF7429AE0A2BA35F3293F3C87439808BA9BA53D21
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="scr1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Scal

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\scr2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2609
                  Entropy (8bit):4.8700017644352265
                  Encrypted:false
                  SSDEEP:24:Jdf0XrKADvKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7X:3fwrxvjgqQ5Bo6z+pEm7T7KcdTM0r9T
                  MD5:03100C1526F1D7E9212ECD70F398C1B4
                  SHA1:CA8F27FF931C0D61E71AFBE8ABBBF664CCBFA711
                  SHA-256:D36FE633FB3472F2655D88A577A0E0F6F6E48441478F960333750BEB55832C44
                  SHA-512:2D61CCFD47D1699FC78BBF90334EA9B901A8084852058414EF75752923F43DCEB0C5D17F187A9A947769DD7DD580F5EACA24762B96A123C3815EB10AC00540DD
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="scr2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>8</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Scal

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\scr3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2609
                  Entropy (8bit):4.870938562952119
                  Encrypted:false
                  SSDEEP:24:Jdf3XrKAxOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcT:3fHrCgqQ5Bo6z+pEm7T7KcdwM/r9T
                  MD5:4C9795F18C1F78A3559E146A078452CE
                  SHA1:9158C0E4F6846D0E26D6782FA14B9DFD73BF5D40
                  SHA-256:6BF3B35B93A4FB037804F0675DED8F7ADC5DB20CD3AD19C492BD059627D68558
                  SHA-512:16DA8A292324A1E5D947C4D4F45AB7D02E6D845F54776C84EF615AA30E01316D9E0C81D88CBB272EEA4A2BFD98E3DEBAAF924A52CDA2946FA18C74D64141140F
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="scr3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>9</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Scal

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\scr4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2610
                  Entropy (8bit):4.869727325609761
                  Encrypted:false
                  SSDEEP:24:JdfSXrKANOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc8:3f2r6gqQ5Bo6z+pEm7T7KcdCMKr9T
                  MD5:CBA1EFC7A85E9AD5E8EBC5B3535C0D38
                  SHA1:551014A952B3EA4E2D026AD4DD92A0924A03653A
                  SHA-256:CE866D4917D40E4E89F913CFABE0D4CD0E4A3D0F627520D4D59DAE03610EEE65
                  SHA-512:A63369150D641B29F316ADFB00B6AD6303692BA89B1D6C45A247CF89CF0FCABC56FB620711E2F5E81B6FF2AAF66F1DF6E21B2CF83E3802B3F9CFD324B164E739
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="scr4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>10</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\scr5.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2610
                  Entropy (8bit):4.870131748262211
                  Encrypted:false
                  SSDEEP:24:JdfdzXrKAKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kb:3fdTrZgqQ5Bo6z+pEm7T7KcdHM93r9T
                  MD5:1351CFC11460757681771B136DF60EDE
                  SHA1:792741FEFE62153515BA51761E6CC055C9F3C429
                  SHA-256:BA42BFDD5E02FCA3BE042AB3834BAC5AC04A404A830D2E9092FC1793FDFEE0D3
                  SHA-512:D19BD7E7BFAFB4CA7A0C8F818A1221360253A5313D12011A299FBC6F84B5F6A5E75DB3DBA754264F7A45CBE17089E51968FC1C8E9579A6986863DF8BBB54DDD3
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="scr5" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>11</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\scr6.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4944
                  Entropy (8bit):4.826510350152774
                  Encrypted:false
                  SSDEEP:48:3fkrQgqQ5Bo6z+pEm7T7KcdckMArYgqQ5Bo6z+pEm7T7Kcdhtr9T:srQ0gUcdcbArY0gUcdLrN
                  MD5:B793D39EDB551CFCCC8F988824C5C122
                  SHA1:F812EF647D640E1B14D8EBC311E3D35901E0086E
                  SHA-256:5627C2266C263440ECCA74798FCA95105935FA0BB8531F3A516C9D498496550F
                  SHA-512:8508F442B22BE0B1F9426C446DCD4D59213FDC909BE24935F30D167C742AADF9A9469C5472754801C1F0B8E866F2D558D5BBF2DA9F17D744FD857DE5EAA4CDD4
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="scr6" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>12</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\select.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2614
                  Entropy (8bit):4.86602685932525
                  Encrypted:false
                  SSDEEP:24:JdfYLXrKAKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KD:3fqrZgqQ5Bo6z+pEm7T7Kcd2Tr9T
                  MD5:4D1DC98B620607B7A4219929F39EC2D2
                  SHA1:E464EAC2EA8A97BC89DA2F2F20E6104FC4A58694
                  SHA-256:BC0F36837A720CE55B4F5533412AE621E035BC8511A011956A6187BCE4BC7D58
                  SHA-512:804FC2EC25882232EEF7541C7E071F322F2C52D51DA642E508B38292A528E77988E5C8DB965E7868C404F9FD9AA9795582689AD3476777F9DBE3285DD362DFE6
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="select" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>11</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\shutdown.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2618
                  Entropy (8bit):4.878075557166131
                  Encrypted:false
                  SSDEEP:24:JdfWLXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc:3fIrTgqQ5Bo6z+pEm7T7KcdVr9T
                  MD5:D95ABFEA8A808F8E43FD734A80CF3192
                  SHA1:3F0797B90ECDDE556ACA0E2489BC98D750F788F8
                  SHA-256:4494F5B46B8A9701B8050500285938EEA14157B59B1CAF665C6972E36DDCB597
                  SHA-512:B3F173F645019A0496F796CFC75969AF888875136FEC2AB3AE41482F178F97515F5CE396B07FEBBAC974D03CC93720B967A75644E15D805D7417CEBB8548E197
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="shutdown" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\skew.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2609
                  Entropy (8bit):4.87589719243533
                  Encrypted:false
                  SSDEEP:24:JdfQXrKAxOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcq:3fsrCgqQ5Bo6z+pEm7T7Kcd0d3r9T
                  MD5:5D74650016059EE37BEAE9E04D0030B2
                  SHA1:C3BB0ED5648F4AEC32E111155F2E3B9AE49503DD
                  SHA-256:A12723898234E08CEB699B66F5C01A34974D6CC1AD5306D053429FCB02AF369F
                  SHA-512:ED16A1D8B8151FF306D9BD3962D69A71F25759EBAA0F78534BB90C3BA396328E087CFE9975CE4E7F8ACDB88F3FA8832EB4986AE96FEB8B0041CB667A75690139
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="skew" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>9</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Scal

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\stop.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2610
                  Entropy (8bit):4.868166878156345
                  Encrypted:false
                  SSDEEP:24:Jdf2XrKAVOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc8:3f6rigqQ5Bo6z+pEm7T7KcdAr9T
                  MD5:DCCB0BE14858A351698AC8BF80701BBE
                  SHA1:3FD2A6857BF2AD36349E82EABB0487D63A04E8CE
                  SHA-256:F247821DF2FA8DBA598C9C9DA966515B065CEF4988D0E9B739BF5C3EDE4140BE
                  SHA-512:7F7BEF68CC7D9E3455D0E5E5B754AAAD9ABD118ADF2086210B9A8A47247D8BEE16FF1537AC6D7C3197D49584A463EF7204CCF3270C7DFFBF3BDCE2BCECC4EBA2
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="stop" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>18</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\stop1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2610
                  Entropy (8bit):4.86755385653349
                  Encrypted:false
                  SSDEEP:24:JdfNXrKAyOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcu:3flrhgqQ5Bo6z+pEm7T7KcdOr9T
                  MD5:ABFC3A511F3418750CB98CC44959CAAF
                  SHA1:D70729F622A5B09ABF4D5A01A5E26B8F4CD485EC
                  SHA-256:FF7DC2E7BF401B577BF37BAAC61CBF5331AD81E5277F3BEDD8E7B7F3BDFC7CC5
                  SHA-512:7F2A78923C3EEAD5845587C7D9A180CCD448FB92CECB6E779B0BDCDB64ADA02AE6FD6E2C11FC413DABE6D919DA93A46703A38B7FC2D0B44083FC539C96C09CB3
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="stop1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>19</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\tag.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2608
                  Entropy (8bit):4.868726005184967
                  Encrypted:false
                  SSDEEP:24:JdfuXrKATAOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KK:3fCr3gqQ5Bo6z+pEm7T7KcdXr9T
                  MD5:DBFF611A787B01034D4D1D9CA3DBF1FC
                  SHA1:00CF1EB6CB633F0F0118413383642F858D252AEF
                  SHA-256:AB256B1518B5A9CCDF11C727B69B8E19F5866850DDFFCA582945474C017530FA
                  SHA-512:11E7C8639918D894008FA9CE9E132516BA4A79A5C24AF917C95B7BE1B2E8D508F114C119FA28AF3D3B929B175C8A7CCB3F6B2C8109A11C22C76197A9FC6B9DE5
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="tag" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>13</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Scal

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\tagview.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4953
                  Entropy (8bit):4.829210303196068
                  Encrypted:false
                  SSDEEP:48:3fTr8gqQ5Bo6z+pEm7T7Kcdiyr3gqQ5Bo6z+pEm7T7KcdzMtr9T:br80gUcdLr30gUcdYtrN
                  MD5:DFB4505189A7E3BD665195BF9AEF9FF1
                  SHA1:6477EF556201657B684B572C25E779D63835EB75
                  SHA-256:0567A69E7DAE16570FDFFEF5B12FD12249129B267E2B724F016C4FFC44740F6D
                  SHA-512:3630A26340710F7A1076452ABD096CEE143C4F4501D5A1A9883213AAAC606313F23B501CF0FCE9EE656E22EE9D8B74361C18BD4E994A92BED30157A6E3D0EAC4
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="tagview" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\tick.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4945
                  Entropy (8bit):4.823255891856747
                  Encrypted:false
                  SSDEEP:48:3f3rhgqQ5Bo6z+pEm7T7KcdArNgqQ5Bo6z+pEm7T7KcdMZOr9T:/rh0gUcdArN0gUcdM8rN
                  MD5:0E8AB8634CB28BE76C6FF46CE4A8670A
                  SHA1:9D50643529072F70F1A6D3124F21258E7D6F062B
                  SHA-256:B10A8F8D335825B5949DFDF6785B1DF5FF493D7810163BFD166A2B44E124CC2D
                  SHA-512:72DE3639D7216C059D7E3BC673BD37787A9121A8DDD4F0FD370B677E0427399ADF04EC2EB465B955E682B156854849A97DF1221D79388496C230D71322FD7D83
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="tick" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>20</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\tmbs.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4943
                  Entropy (8bit):4.825050254239926
                  Encrypted:false
                  SSDEEP:48:3fqr8gqQ5Bo6z+pEm7T7KcdVrYgqQ5Bo6z+pEm7T7Kcdunr9T:Cr80gUcdVrY0gUcd0rN
                  MD5:5CF94F1E1C0303BDAD47013CC77AE52E
                  SHA1:93200911D92F297E63665AF7088FE0448DF43B83
                  SHA-256:4943E1353E03E3DB08A7D936672D072287D6BA60C049F247284C4F8F0ADF5B97
                  SHA-512:5F8F4093B8775B07842E817D0C9E357DD72633AC9C75E0DD7D1D9534926459FEB8CF9DD22DA387809C7651B1FA632A6751D5D00BDBD2AD846A4FFEA23E0EFB7B
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="tmbs" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Scal

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\to front.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2617
                  Entropy (8bit):4.864310131944759
                  Encrypted:false
                  SSDEEP:24:JdfmxLXrKADvKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXX:3fUrxvjgqQ5Bo6z+pEm7T7Kcdtr9T
                  MD5:7F99E51C117A9EDBA072C13359D957AE
                  SHA1:6CB1E2DA56A26D5FE607DD262499CF1DEC133FDF
                  SHA-256:8AC11A67CCCA468A2491F1D3E10DA70E70901A2EA63E37961131FF8A21A8A04D
                  SHA-512:DD71474E6198FF4074802365F73353278062597063C10BFF41AED4DA12ACC4E97877B1FE232C80F6F45CC3CA5181EF57110830B89342D6AFD0779362DB9B25AE
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="to front" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>8</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\trend1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2613
                  Entropy (8bit):4.869602578708541
                  Encrypted:false
                  SSDEEP:24:JdfkXrKAxOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcB:3fArCgqQ5Bo6z+pEm7T7Kcdtr9T
                  MD5:D8A6708E2049D4F2C8C6215306EEF3D8
                  SHA1:ADF1A176102A5BAA750F0CEFD72B63AA1EA34AA6
                  SHA-256:76B5DE039F14661FA5F7BD68F8F299DB5052FC59F0B002EDB7BA35AEC682EBB9
                  SHA-512:FAE0BE09B78A846300942FF76D1265FCFDE20F4C0F57501EA1A186BBE0D84D1B48FC12DAC829C2ACDD0A47DBDC7DD9978EE7F8561AAE4A841F171CC35378EFA0
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="trend1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>9</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\trend2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2614
                  Entropy (8bit):4.870759773234296
                  Encrypted:false
                  SSDEEP:24:JdfRXrKANOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcm:3fpr6gqQ5Bo6z+pEm7T7KcdFsr9T
                  MD5:D9CBAB9A4C582A70A864177711AA727F
                  SHA1:6F42A71A84C7EDD6027AC449CB7FCE23A570AC0F
                  SHA-256:C95626DCA8CF5750A1519D4CC001312D9909410BD0AF016F39A7BB8FC03BE2EF
                  SHA-512:7D85A09EE79FE8D84AE54656B5A4493E228B9F58BDA99292B3EFF27918961DA5F53AF5CE9EDFB485DFFE98F81F503030CD94FF1905AB62AECCE4BF3C6C668FA2
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="trend2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>10</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\trend3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2614
                  Entropy (8bit):4.871258465430518
                  Encrypted:false
                  SSDEEP:24:JdfuXrKAKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc1:3fCrZgqQ5Bo6z+pEm7T7Kcdpr9T
                  MD5:04E27A62FCAE032AF8F979853F0E93CF
                  SHA1:EC3AB262021FF0B54B837FD5EAA36160324EA389
                  SHA-256:F0E60FB99933998F5C4F770420AAD3CE0C698F22CA5B60B30520DC2C623D64D7
                  SHA-512:79A44FD652A7E8248F49428F7955643521DC48919C040569603BBCB351FDAF753A3F209D055C28548F687C55F4CB036CC3AFB4BF1D70A60CAFD7A02E6ABF6C0B
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="trend3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>11</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\trend4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2537
                  Entropy (8bit):4.874032832847899
                  Encrypted:false
                  SSDEEP:24:Jdf7XrKQEvOgqQjKXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kb:3frrDgqQuBo6z+pEm7T7KcdVk26T
                  MD5:34A63E99D181A8888D11E8BD4A78F0CD
                  SHA1:EB4B135A257A6F273E26E3F1EA266BCA282CE4C5
                  SHA-256:3A6A62B443752FBAE925543B41BBEACF6E0BB63804F5DA50E06DBC8A5668DB5B
                  SHA-512:E76EFD87CA1498744A30B3E9F7F2457965D039FFB19B0D9A9EB88C11B30FD943A2F39B719107BA48EDB1B0434A5C5E749CD067F846E765FA453951E9A8D1EA95
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="trend4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Symbol>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\trsp.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4944
                  Entropy (8bit):4.8233434998279625
                  Encrypted:false
                  SSDEEP:48:3fzrQgqQ5Bo6z+pEm7T7Kcd+rYgqQ5Bo6z+pEm7T7KcdYSr9T:7rQ0gUcd+rY0gUcdXrN
                  MD5:D19F813709D753F91E4555F60907DD1C
                  SHA1:D93CCCDF118BCCD2B0F89EC8BE3ECA3D493E15BB
                  SHA-256:9A71D82B30C96C69745C2DBAFA2605FCF3B4D82FE14310004C8F922E2139CDCF
                  SHA-512:AFF510BD18EC1D7AD13C4479C42B47A0D849D209480026796BCB02077F30AC662FCF3D85F0FF6F811A9BF40D9203A1BD256540EA4C072BB45DB2A92F35D94E40
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="trsp" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>12</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\unchecked.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.871914902374041
                  Encrypted:false
                  SSDEEP:24:JdfOXrKANOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcU:3fir6gqQ5Bo6z+pEm7T7Kcdsr9T
                  MD5:587305707D2E9C1DB3ABDA5D4D125D93
                  SHA1:85C3BF5457EC1ED0F65B6C595BB64129DD6BCFB0
                  SHA-256:796EB98AA133DA4DE9A55C7FA1D256B2180FA62B3CFA028D453D3D6A84AFEFFC
                  SHA-512:AB5826AD031FC28D2617C0A493CE328822DA151FEF897C267ACBE1404563B788D1CF32CF9299C3DC772768E7798C28104F6874069E60AC06E2AA44A8BC728BE2
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="unchecked" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>10</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\up.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2603
                  Entropy (8bit):4.865817421557444
                  Encrypted:false
                  SSDEEP:24:Jdf/XrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcG:3ffrTgqQ5Bo6z+pEm7T7Kcdxo7r9T
                  MD5:E6A7216D687217E8ED6CE2F7C6C8E07A
                  SHA1:407649430AD03AB2F8D5AC366D43D6F8D2D082E6
                  SHA-256:556D212E29BCBBF2A8F6118BC4E6FEAD720FBFC222DA5503AB2C0E3C449FBAAA
                  SHA-512:5894B07722F95EA07F5FB20DB4E54876646CE6B55423995B19732B8F06DEC6853AC64C1BEBB43BAE471812CF790CDF168DEF414B10A894AE7AD8F24BC146EAB0
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="up" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <ScaleV

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\up1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4866
                  Entropy (8bit):4.828144843006495
                  Encrypted:false
                  SSDEEP:48:3fKrsgqQuBo6z+pEm7T7Kcd3VK+k2ygqQ5Bo6z+pEm7T7KcdTr9T:irsxgUcdFDk2y0gUcdTrN
                  MD5:BEA95D88B94F1538996FA49132FA1F94
                  SHA1:8CC75253F2F6B5A50F8755AD693198282333F4B3
                  SHA-256:1EF62FCCEEF0D18DC64FB399D792BF8236B53C7ADB34E612E5274C2700AF49D4
                  SHA-512:045D77F5CB256607EF887DF01CF57631FB22BF7A4E83A71F090A21C9A443A959680F6730BB3E1C37C8D97B670476177946A133BBA01E1C0818F38D560EAC1059
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="up1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Symbol>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\waste empty.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2623
                  Entropy (8bit):4.8738927873167635
                  Encrypted:false
                  SSDEEP:24:JdflXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc0:3ftr8gqQ5Bo6z+pEm7T7Kcd3JyCE3r9T
                  MD5:F372CF0033AE0540C73689B95B96FA99
                  SHA1:2DE28A75CC95FDC040870E36F8872FC183026691
                  SHA-256:2D90A4F5296D6390D98621A4B7BD523746549A5FB3C61152CD123C217CD7C5D5
                  SHA-512:DDAB1071C55E03F9A509B9A7CF5D0D1F65AB056B349427206E6D6A9F2712AF9DAB25BEB34E170D97C8EBCC2D8421461D65EEB92C61CC59D24B67F666279A21D9
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="waste empty" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\waste full.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2621
                  Entropy (8bit):4.870392605254192
                  Encrypted:false
                  SSDEEP:24:JdfBXrKADvKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7V:3f5rxvjgqQ5Bo6z+pEm7T7KcdCylr9T
                  MD5:76D2B52DD426AFA68DD3D8C5482E61F2
                  SHA1:B7E4B5B733A862C2C7830FA3DFE05FD91AA0C023
                  SHA-256:A0683D9E9A4E1F8AB304CAC64F939868081C16BE8B830C69BAB80EA07E957060
                  SHA-512:AE6C5282C96D876B50992920ECEBAECD669E83D5A8FDED8CD8C023AA87DC3C352C61FD0BEABCDAB874AC4EF475CE4DFABB01E434763CA34B9C36F7542BBD8908
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="waste full" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>8</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\weight.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2613
                  Entropy (8bit):4.876434933415548
                  Encrypted:false
                  SSDEEP:24:JdfM/LXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7M:3fMTrTgqQ5Bo6z+pEm7T7KcdC3r9T
                  MD5:DFEA8924D691D0A766FC570B4B96AA24
                  SHA1:280A249CB363A3015272AE477E8E7F96A55E83FB
                  SHA-256:383264C0B748D6A85FEBAAD78B57B41A6FA0498CD26B284A1296A1E8F2A93BB0
                  SHA-512:D2ECCAD9CE4F3340030677A95C1C43EEEB785FBC7863F6CBFDCC10D31C8BA116028BDE4A1665FF4BBBE6FF5F047E5D082F0566595BBE87EA6F03FB7778B13BCA
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="weight" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\wheel.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.8740359570488545
                  Encrypted:false
                  SSDEEP:24:Jdf1XrKAKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc1:3fdrZgqQ5Bo6z+pEm7T7Kcddr9T
                  MD5:0DF0AA2F047DA3EA549217B3BE21CCF9
                  SHA1:C0FAC1311C0388F58F685531E9C9BD8ABBD38B54
                  SHA-256:17C8B02568A6BAC4B45A6AB31D8C8019999A0822300072260E8861F648145B2B
                  SHA-512:D16877566189BAD3D708B5F04E17C18ED782F9FBF20D8CB31931133622DF3B00A9D30B26B2AAD367BA735775E7AE575D1BAFE203910689F5F78DF15E28413572
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="wheel" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>11</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\wordpod.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2616
                  Entropy (8bit):4.877898181568168
                  Encrypted:false
                  SSDEEP:24:JdfntXrKAJOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KV:3fnFrmgqQ5Bo6z+pEm7T7KcdXkr9T
                  MD5:73B329C0BD20423AD296176CEE0D6DA8
                  SHA1:05E717991085C21E23BD64CCE4D3782320629936
                  SHA-256:B64E0269A70D60E9FDA02D2414CAF6434D93959142C69EC8791E177DF5D4BFB0
                  SHA-512:B868026E1EFC73B51FAEBF5E505A937A99DFB7768C1A382249FF9FC3E90D8F39E9414574C2DA218BB02B568EAAF32AF57C8442B07126EB4BD7DAE290AC9017F9
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="wordpod" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>14</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\zmin.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2609
                  Entropy (8bit):4.868710028323576
                  Encrypted:false
                  SSDEEP:24:Jdf8XrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc2:3fIr8gqQ5Bo6z+pEm7T7Kcdmr9T
                  MD5:4FC6EF00D136CAC7BF00E62D8AF88070
                  SHA1:DCE3C99C78D3EF4465BBE9B47ADC4BB214393C93
                  SHA-256:FD424D3F2B623584182963721323C204938B11423624F2C2B53665C62ACB05B4
                  SHA-512:5739B40F8FD66CCE902F8E517ABF4EBDD2D2625F6A3A38FDCBF593329BAE67D2E3B59A77A088D37EFB411153C7A8B9F7692CFD82D5628DFE10CFC20C98767C42
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="zmin" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Scal

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons2\zmout.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2611
                  Entropy (8bit):4.871578617601111
                  Encrypted:false
                  SSDEEP:24:JdfRLXrKAxOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KN:3fFrCgqQ5Bo6z+pEm7T7Kcdgpr9T
                  MD5:610922516AAE7F326BB39370EB4A5E8F
                  SHA1:81319C69B592674ECFF625D285B4F4C7AB616D38
                  SHA-256:81C160B40AA5C1380D1E933870BDB402DCF8E826A3A2091BAD523686C0448624
                  SHA-512:E425811F92D11ACBE982551C25E9FA49DB18E85FB85B77FDC25542BF8AEB210D25B1DCF06250A1737BC1C8B7274F73303E35B2EF15755A023A40F5427AE3F697
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="zmout" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>9</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\ZPMC1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2611
                  Entropy (8bit):4.878159414630336
                  Encrypted:false
                  SSDEEP:24:JdfXXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcZ:3fnrTgqQ5Bo6z+pEm7T7KcdVr9T
                  MD5:840DD0CE2198850F32C3D93084C5D583
                  SHA1:9D71E57984EFCB4EB544F12631D0EE7936AC367E
                  SHA-256:6BEA4E25DF89D0DC8AAF2DE656F0B7E9CCB6C83489BA71E8474D711BD5F9B252
                  SHA-512:65B38D2AAD9F666E3A6266793601A8468856304DDD5649D113610FBFCC8C48309B504CD327EB562DB9040BBB17A04DC9AEFD74385DAE97722A4DB82CEA6A9891
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="ZPMC1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\ZPMC2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2611
                  Entropy (8bit):4.8800088674925775
                  Encrypted:false
                  SSDEEP:24:JdfeXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcu:3fSrTgqQ5Bo6z+pEm7T7KcdKr9T
                  MD5:CA45BE2F8ADCC754D237CDEA597A1765
                  SHA1:EF7CD0ED8A9F941ABFD275465342EA9C419ECEE8
                  SHA-256:C187B9E60945AE53000694FA9530C5B452B5B353722A4A5011B062D4D9E0A913
                  SHA-512:753A85DD6260AE230549D2BCC886CCFFE20A42C48212A8AB81AC9796D9FA08A46D4EBB62FC05803EEDE7A9E874BA80DD28A42E261A995065AA6D8F41D331BC48
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="ZPMC2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\alarm1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.867025958505952
                  Encrypted:false
                  SSDEEP:24:JdfGXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc4:3fqrTgqQ5Bo6z+pEm7T7KcdDgr9T
                  MD5:8C4E962BAA35D3FE1250EAF112BB8873
                  SHA1:DC76977093319E388C886BAA5C0CCC4C7A4FC63F
                  SHA-256:8B9E0A9C95631555121CE65B4385186F3C5038651996F41482E6BB1A9001283F
                  SHA-512:21E0D090886D644868F443ABC1BA8D9AD22E20165C28FF2E72B397C57D04503F8BEAD6B7944328E50DC1C1FE2BAC4AF3E8D7B7A1F42F627E0C1DAA67DBB0375B
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="alarm1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\alarm2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.868478527853132
                  Encrypted:false
                  SSDEEP:24:Jdf/XrKADvKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7d:3ffrxvjgqQ5Bo6z+pEm7T7KcdXr9T
                  MD5:946E1A6BF6A29E736A9CC4D1A485A810
                  SHA1:7353E0E88F215516D837B0C1A8D55A8BB39AF0A4
                  SHA-256:DB19A614632FCB27B75B4434634062A8A9839450B417266F045AB73F9798DC61
                  SHA-512:C32F540A6A8F5EF9D999CACE14DB0CD101E843C62F1DC2D28F9110622A5EC31757C72B8A6BA6FCEC6DC2E7F24AF76F7D220E83654D27AEBE4C426A4751D7767D
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="alarm2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>8</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\alarm2_s.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2616
                  Entropy (8bit):4.8725800049041785
                  Encrypted:false
                  SSDEEP:24:JdfMKXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Ku:3fVr8gqQ5Bo6z+pEm7T7Kcd/r9T
                  MD5:860CAF3CCF6E4AE7C0BDC330BF7BD8AF
                  SHA1:28923AD34CE27AD0D420B3D525B21597B92D0772
                  SHA-256:EE2CEED5A9B026640816BF860FD490DEB24745971FFA7570529702C0DF8FBB1A
                  SHA-512:1EF97B52FE28F6ED041221B8FA476F46ADE78AF3BB23F2AE9BBF21B0180C0D3CAE673FEBFF6296D4BF8B53D69C10907C84D70ADD1442C8090FA38214570B5191
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="alarm2_s" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\alarm3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2613
                  Entropy (8bit):4.868893884394084
                  Encrypted:false
                  SSDEEP:24:JdfcXrKAGOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc2:3forlgqQ5Bo6z+pEm7T7KcdVQr9T
                  MD5:7479B534506C683C84A2F23A51CC7658
                  SHA1:60E7ECF071F72EB371813B3035474378239DCFF6
                  SHA-256:D9F2E1522ACF66F52040A910B7B36E59E95D5FB739E5A0600E08A58DACA7E51D
                  SHA-512:D94AE6C4283DD1BA5BD9C08005ED6C2D09354BE6A99B4927408FBE8A4193C790C32E19455E272F16EBC76C253C9BE6564639CA20936467455A83F457B07A2073
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="alarm3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>15</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\alarm3_m.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2617
                  Entropy (8bit):4.87470060557974
                  Encrypted:false
                  SSDEEP:24:Jdf8XrKACKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KM:3fIrUjgqQ5Bo6z+pEm7T7Kcd1r9T
                  MD5:34FF83AF1C044BFC72E75FF666BB5254
                  SHA1:FBD25CA37158CBA47BFDE40B762A1CF9A2E33482
                  SHA-256:CC1D84F9009A423FD2C4BA5BD0C3FE7B564AECB8856C0C5A6257FC57C3094A13
                  SHA-512:C7FBE80BE8AC57EC4A4145638CDC295380D32750BC16070851838FF59BFCD6083386E2351DD5E43C803AEFF6D253626FCD54D89D3B252D8925DEE01C41745C13
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="alarm3_m" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>16</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\alarm3_s.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2617
                  Entropy (8bit):4.873396280995911
                  Encrypted:false
                  SSDEEP:24:JdfyXrKATAOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Ki:3fWr3gqQ5Bo6z+pEm7T7Kcdjr9T
                  MD5:1F8AF95A162524F7316EB2E52A5AAC51
                  SHA1:8CDE938D436BF46CC2418E5415A8E2025B84C7F6
                  SHA-256:4F7E4E9EFE2E134801CFCBFB6C5B495FF907D3E0CA91BD96E4226F8B14FAC108
                  SHA-512:8D882E2D6033E0D390D80D7F9636358EE208CF9591CE345C5B6861FF2083686BA9E32BB4A962BEBF6E3522F5E585C1ECE3A9EB709957F8B5A5D703BAF51F0A47
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="alarm3_s" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>13</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\alarm4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2613
                  Entropy (8bit):4.869001767756912
                  Encrypted:false
                  SSDEEP:24:JdfHtXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7K2:3flrQgqQ5Bo6z+pEm7T7Kcdzr9T
                  MD5:E777A6959CE011CAB0475769A236D774
                  SHA1:4C1974ABCA6E20361488D362B7B370C6E36BAFCA
                  SHA-256:6F13D16AB921CC38520BC6170CF283C1CE9980BB4ECB7A79D857BD8D70B7281A
                  SHA-512:749534CBB731FCF67068E809D754B453B8ED1A9923351BFE44EEC74E47C6EC1B235A5F361A5C4FB21DD27566798123A678843BCEAD7A870921D50005BD13AC5B
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="alarm4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>12</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\alarm4_n.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2616
                  Entropy (8bit):4.873318924726888
                  Encrypted:false
                  SSDEEP:24:JdfH8XrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KP:3for8gqQ5Bo6z+pEm7T7KcdCr9T
                  MD5:D0302556B67819AB042E0C82A0CA5DC5
                  SHA1:251F2907F13452A50B73FFCD902037AD11CA59E9
                  SHA-256:218A9204FFD7F301BD2500EF75A4CF45ECC4CC723290D7F02049C10B0803CE14
                  SHA-512:52E97976892CA95FF5F012DFB29CC22F8C447040C69222D15FC95F46A1589807998791ED9C5DEA07E25565E08B88E953B44B099B9751B8DE67ED63928CDD319B
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="alarm4_n" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\alarm5.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2613
                  Entropy (8bit):4.866923972990231
                  Encrypted:false
                  SSDEEP:24:Jdf6XrKAKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc5:3furZgqQ5Bo6z+pEm7T7KcdJr9T
                  MD5:E3C0B0F3EA5FD80F5E7C943716D608D3
                  SHA1:F395A424E24025BF2238BFEF63D28496A1743FD7
                  SHA-256:9E361FFDE00250FA2F036B555659FFD4E4291BD082AE765A5BF808E9FCAA943C
                  SHA-512:51D848DA2861AA8D0A62E398E4F6C1FB99523EB24A709AC87B497239F3C99E6177A3F62FFA0E9B1623B4DC117627343DD90231EEA3D74040F5C305120AC63D5B
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="alarm5" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>11</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\alarm6.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.869075114543688
                  Encrypted:false
                  SSDEEP:24:JdffLXrKAxOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kw:3ffbrCgqQ5Bo6z+pEm7T7KcdRvr9T
                  MD5:57326420CF37769A6566AF4100E9AC24
                  SHA1:6405B2018F39A8D37E21FCA5E11FB173C5C756DF
                  SHA-256:BE0CD956B994BBD3DB1528C5837D3215ED9769C97EBC0D8CAAE5ACC336F9C45A
                  SHA-512:E35593FC1A50E08FFD97A09BA27872563F2E4E3313903FBBF7578444ABC15ABED77D06D5C552CD9139CC139F2ED223D595B5EDFF2631350663FF06872730AF5A
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="alarm6" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>9</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\alarm6_n.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2617
                  Entropy (8bit):4.873212965974236
                  Encrypted:false
                  SSDEEP:24:JdfutXrKANOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KS:3fuFr6gqQ5Bo6z+pEm7T7KcdVkdIr9T
                  MD5:186094108149847CAA6B91A1A2EFBE2B
                  SHA1:45A489E548B7C659C287FAF52FAF8FEBCCFFBAA3
                  SHA-256:6C23A030F8745B69D397D524CAAC118FCD492A2160DB531DEC64B167EDF7F994
                  SHA-512:DC09029E2E3C4E1A9E6DAF88D9645FF342C65748E4DEBC8160D6F101E72A9D775208A1BCE397F9A89D03DF8FA5302676601839DA7FC89ED1CA01923144C86F12
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="alarm6_n" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>10</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\alarm7.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.869287249823757
                  Encrypted:false
                  SSDEEP:24:JdfgXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcB:3fcrTgqQ5Bo6z+pEm7T7Kcdmkr9T
                  MD5:61495D776EE466D7A8A6094A39DC9BE3
                  SHA1:FA83B3F8A563262BE1E2887CB6D44354DB5CCFBE
                  SHA-256:8D1C06D5C041655CE6A503993959F6BE6F95FFF07169AF78A5A38FD21BB099B4
                  SHA-512:2D1ACE156D2530060BACC53A596D160BD33A3EC02C65C17483F11A65B826ED289FFADC34025B6C0C6E1B26E6F8235959FA9D5912F5340FDF32534177E3A7FC82
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="alarm7" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\antena.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.860017476789618
                  Encrypted:false
                  SSDEEP:24:JdfG6XrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KB:3fGur8gqQ5Bo6z+pEm7T7KcdAr9T
                  MD5:981A01C9D0BDF61C39E5C1869A3D7AF8
                  SHA1:1DFC08F71A7831F52B4FF2F81BD33C51A8A85E18
                  SHA-256:CE3D36C6464DC3056ACD55B77C0705E6F4157B121ABDD9497759C4B475840085
                  SHA-512:2B9BC48853909F139E6A5ED369B9279F22B1BDC9253750467DAD47D4135B9191DA4793F30D954FAA7F2AD4C5E4232E8EF1B6F9CC9A0C44BAA92BC7C927029DCA
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="antena" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\computer1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2618
                  Entropy (8bit):4.869838498052841
                  Encrypted:false
                  SSDEEP:24:Jdfj6XrKADvKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb2:3fjurxvjgqQ5Bo6z+pEm7T7Kcd+jr9T
                  MD5:9B7442AA629CABDB312CFA799E7C9097
                  SHA1:40AAC8D96F79E2176C111D468FCAC3E915E4770A
                  SHA-256:C28D9EFA4D58726808008840AF07F45919FAC3E6CB180F8A7E10540EAB297691
                  SHA-512:6273CD78F0AEC35AEF627195D9177257B1DC63CED81F3A4FAF668112CB0CA6DA3108660F9B2759F2A318902AD798A30E8DE8514B771B302436F136A97A4EADFE
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="computer1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>8</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\computer2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2618
                  Entropy (8bit):4.869083470670091
                  Encrypted:false
                  SSDEEP:24:JdfPXrKAxOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kci:3fPrCgqQ5Bo6z+pEm7T7Kcd8Br9T
                  MD5:87A178F77C9CF6F68C50225CB393AD90
                  SHA1:777CF177D959944B6CA6E88C97B6D1F200B5F25B
                  SHA-256:8829F0CCC1D2911D441A279FD09BD7D59850521749B9F5EAE28D295A664192F5
                  SHA-512:7F76250ACD6409DEBEE4CCDB7E96F244EA6816C4316FF58143FF63EB675722233B3D3A65531B2E40868F0772D4977DFAAEC0842A78DA8400444B8153F60B707C
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="computer2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>9</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\computer3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.87274355360516
                  Encrypted:false
                  SSDEEP:24:JdfsXrKANOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcC:3fYr6gqQ5Bo6z+pEm7T7KcdV8r9T
                  MD5:C4F773A3C52EBE785C60B5940AFE3CF8
                  SHA1:ED915AF54D5083D4155C8AF95B90AF52A8A0527F
                  SHA-256:E5CB688AE0BC2A0799D16B0FE1525CCF6E0764B4C9E925D90D09A9B42843DDC2
                  SHA-512:368DE9F65E28B421CDDC3788C20A56B5362ED8D8714A983F54E8C32AD81E29F7CF539732F9EC55985A3E7101CDBD573937B39F588C7D423A28BC23DA39AF54C8
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="computer3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>10</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\connect1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4954
                  Entropy (8bit):4.822796993312882
                  Encrypted:false
                  SSDEEP:48:3fbrZgqQ5Bo6z+pEm7T7KcdrEV7rYgqQ5Bo6z+pEm7T7KcdRM7r9T:TrZ0gUcdurY0gUcdirN
                  MD5:6AE13492A313AD185DBFA314C1082E0D
                  SHA1:825DE9E67F6811DC5257BCBB61BAE1746DE36B95
                  SHA-256:17C23FB7CBCCB11AF2B7ADD3A836A822757BF495A3B8CDDBA4A6CBCBAEF15582
                  SHA-512:AEF8C54F0945ECDB5278CC22E7B05D9052AD5B5A596F427BC1F947FA59FB77AD5D5B66C5CF4ABF3F380EEDF082C983D137446F21FF9EDC0CBDEDD3ABEE86F3F5
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="connect1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>11</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\connect2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2617
                  Entropy (8bit):4.868857081359581
                  Encrypted:false
                  SSDEEP:24:JdfSXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcb:3f2rQgqQ5Bo6z+pEm7T7Kcd8cr9T
                  MD5:EA24FB97D944BAAC8AE75B15761B7426
                  SHA1:A6FFEE89F6F9D18D5BC9F46DBD209BFEB6A8F927
                  SHA-256:C6B86E190450D15A59A8D0ABD84B8053393246F49EC2C0A2B28F7E0E2A3D1107
                  SHA-512:A74943DAC7C4505A15EF3E19868C98968432FE88F6D7E9F574F1223A174F14B32F3EC86850470CACF2CCCF1C18B22B7CC98A66FB45DA92E0F72B0F55DFB9F9D6
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="connect2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>12</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\controller1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2623
                  Entropy (8bit):4.867635779075592
                  Encrypted:false
                  SSDEEP:24:JdfVXrKAwOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc5:3f9r/gqQ5Bo6z+pEm7T7KcdJr9T
                  MD5:83BF944B13EFCD71609944677448C9FF
                  SHA1:6C5903204A378948766D91102FF909D453747267
                  SHA-256:6E9C64B6085C9ED8C896E5EA1935A456EE10E6E378CC6B786C5E5E1C4980C421
                  SHA-512:441AAB2A75A06E369CD78A9CA2D67FD4667513BE10B895556F13C9676401EE866975AD3AD3B4A39C1EF4E5E8B66BED3894142B4DC04C09E28348B61511DC7CBE
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="controller1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>22</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\controller10.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2625
                  Entropy (8bit):4.8687752785999505
                  Encrypted:false
                  SSDEEP:24:JdfbXrKAJOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcE:3fLrmgqQ5Bo6z+pEm7T7KcdAr9T
                  MD5:5BB658A1F958A63413059A705C89EECF
                  SHA1:673030A79FEF82050FA07C46D6436B762C42F3F9
                  SHA-256:C2E63834D5E167413B8C783FC4786BCDA8C4807DA0A4D56A293DF386250A5A0B
                  SHA-512:5904CA233047FA25C9F54DC2485CA077516CB8BFC51A9D35A38EDE0874C681E795F1C72961AD7614DB12049E8C8867DA5A63EE6649939CC3556756EB8AE01265
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="controller10" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>14</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\controller11.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2625
                  Entropy (8bit):4.870118031762232
                  Encrypted:false
                  SSDEEP:24:JdfIXrKAyOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcW:3fUrhgqQ5Bo6z+pEm7T7Kcdyr9T
                  MD5:84AF2DAD2603B0FD482161D47E42B1F5
                  SHA1:D3EA0CADE4054FB4D1B989F08FB435475CF3BF8B
                  SHA-256:EBE5E8998E4AF53F9C35BB78CCA1674B0FE5CF104A0892B3C1EF952734354E78
                  SHA-512:94741AD3C3E39E523C32590B67DCDE8D882A6F43DD348FF2DA499B185B216741CFEAEAF993858867CD5D2DE11A8C60220FDCFCAE69752DD4AC8EEB19B89E3C3D
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="controller11" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>19</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\controller12.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2625
                  Entropy (8bit):4.868676449911636
                  Encrypted:false
                  SSDEEP:24:Jdf1XrKACKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KF:3fdrUjgqQ5Bo6z+pEm7T7KcdAr9T
                  MD5:2B6E8E25050C79F25CBA63EB662168F1
                  SHA1:2B1B75DA524B10349683DC67B343018586786046
                  SHA-256:6ED46F03CDA187198DC3478A47CB50E2B3D9930A935110D65EEC14F81B29EFC7
                  SHA-512:607DCF161378544C9B0F48FAE9F41369C94CB51469821A9351A029E4DC6FC68A8BC87DA6C055409C4A2641F350BA4DB2290C105FE1BA22EDB737D8D312EA6EC4
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="controller12" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>16</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\controller13.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2625
                  Entropy (8bit):4.870755247229339
                  Encrypted:false
                  SSDEEP:24:JdfiXrKAjKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kj:3fmrZgqQ5Bo6z+pEm7T7KcdPur9T
                  MD5:E5C7B3E563FB0EAA08AB9E4A105904BE
                  SHA1:63BDE75DDB3DECE072B0ECE883976F8408C9B1D3
                  SHA-256:94A99904D1C7F2AF8394FB3FD5FDC58DCC2A7B3FFE842D7D8A17EA6EDC80AFDB
                  SHA-512:6F893F5359004724DDC980217F2557BEC5A1F1EE34C661D0A254C1A8531DE356FCF4B66C7EAB001BFD71B7451E145978A2DD0A2AA638031D06A6FC6CE23201F5
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="controller13" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>28</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\controller14.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2625
                  Entropy (8bit):4.8706097175444505
                  Encrypted:false
                  SSDEEP:24:JdfHXrKAw2OgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KN:3f3rkgqQ5Bo6z+pEm7T7Kcdg7r9T
                  MD5:059F4FD07299876AA2922BFD4A83342A
                  SHA1:EFA767AFF28DD563CBD0AB9627558C958CF48E40
                  SHA-256:B8BEB962DFBAC00B8C990902B6C8E0CC77FC5192C601F50B55D92785667888D0
                  SHA-512:458523266DD951FFF3DB336544125087F8007C7A5DACB8F8A05F843E7D112CEE82401185AA2634C9962F50122739FC1E684009DD27E28359A27D8E5744A53EF8
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="controller14" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>27</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\controller2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2623
                  Entropy (8bit):4.870089343551143
                  Encrypted:false
                  SSDEEP:24:JdfoXrKAbOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcP:3f0r4gqQ5Bo6z+pEm7T7Kcd11r9T
                  MD5:209AB5D7DC2DC3B64A00F4E2FCF1DD10
                  SHA1:04F69DD826C29D5A7D8A8AD9AE391C27A250193F
                  SHA-256:3323E260867BD66DA2C4CF39CADDA3488FF570B947160AFF7E25B8985920C0DD
                  SHA-512:9FB1265AAD940BB28EBA5F32DE6AF9E33B8C3E5EF4585269BF7AF212D98D6B7A9C69FC29B8418BA98324CA58EE1AF79648B55C012FB160C68574D7F70647EB7A
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="controller2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>23</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\controller3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2623
                  Entropy (8bit):4.870750928565825
                  Encrypted:false
                  SSDEEP:24:Jdf7XrKAEOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc2:3frr7gqQ5Bo6z+pEm7T7KcdVJyr9T
                  MD5:4FB56777CF1F8464373237E5C39B2A55
                  SHA1:CB027A8AAEFDAA330E73362B1BE9E85FA229477B
                  SHA-256:001641006EC15A352F15E8C8A70EA94C77874D397B0B6C5A2F6C21849CD8B30B
                  SHA-512:E8CB563DAB8AB5707DC0E74E196A55F36EA239331A1CA830EBD0E8FFE62855B4149739791B6DE037CD70B34E22E785B29DB99B1BF0E0D08CD2C68BFEE535F37E
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="controller3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>26</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\controller4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2623
                  Entropy (8bit):4.870976964378235
                  Encrypted:false
                  SSDEEP:24:JdfuXrKA6OgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcp:3fCrtgqQ5Bo6z+pEm7T7KcdmEnr9T
                  MD5:45E90B049C885749E9591D06F4D3484B
                  SHA1:D02D5B868005A5296583C4DF5B5273C803E6C1AA
                  SHA-256:077D9719C1EF4C14A5DA36B5C8CDB7A3548AA76796DB6F147A171296CB261097
                  SHA-512:D02E22A5A2FD02C240B0C0A62A5F4D601C45926310AADC0DEB1C3884601200B176F9BA535BFDF2503F9C8D105851E29C30F484E0DF85420429C766C15D077E71
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="controller4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>24</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\controller5.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2623
                  Entropy (8bit):4.868512420833563
                  Encrypted:false
                  SSDEEP:24:JdfRXrKA9OgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcO:3fprOgqQ5Bo6z+pEm7T7KcdJ4z3r9T
                  MD5:32399F80969765D4DA1BFAFFF1ECBFE8
                  SHA1:DBC7E0EDD98A9DD2929289D31EB3281C4D9F03B5
                  SHA-256:13A872A4047FEA19DF6C825B461683D5794651F1C6B4BF7DE2315DCEA4B71DE3
                  SHA-512:E7E6E7565F4535BB469BB6769F90F2123032A9CE72468BBECFF87B4953B1383D8D2053E7506DAA0D35C9ABD5A8061DD5CBDA369FD8D290AF3AA2B7B0F9A82978
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="controller5" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>25</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\controller6.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2623
                  Entropy (8bit):4.869230495407245
                  Encrypted:false
                  SSDEEP:24:JdfkXrKATAOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KD:3fAr3gqQ5Bo6z+pEm7T7Kcdor9T
                  MD5:EE0CBE80BC949EADF38F81F1D36DDB21
                  SHA1:BDD8102535896DABE337F4EE2AD28CD018C7AB32
                  SHA-256:EFF123188A7BF5FC08C4B94853673537599A9038D626A7FE455C608A685BD076
                  SHA-512:676D31CD4840830AAD7F60C0BD9447BFDE301242B2CB4FEDCFA7463BC23E75CB6A5B3DED4EF4ECC430D31172597BB7B2E76A87BC769D1873B837433A77B13B1C
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="controller6" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>13</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\controller7.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2623
                  Entropy (8bit):4.868189111804421
                  Encrypted:false
                  SSDEEP:24:JdfnXrKAy2OgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Ke:3fXrM3gqQ5Bo6z+pEm7T7KcdNr9T
                  MD5:62A7EB40F1D8D2A2247EE61F22B6243F
                  SHA1:BEBCB51CCBCDAB3CB4D41E256506A8BEF545C80A
                  SHA-256:8E71A1AA8C5CBCD47CD5A44EEE4DDBD23914FF58B75BC7C7305DFD6E0B08ED47
                  SHA-512:FFD1917EA8135FE66A221CF3B51A8115D122E846E2BB90A030929EF8E57622E59F46062F2C5EE1F6420469C9C2743E8BE154890A0839B91981409B9D85D12430
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="controller7" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>21</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\controller8.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2623
                  Entropy (8bit):4.869743662459608
                  Encrypted:false
                  SSDEEP:24:Jdf0LXrKAVOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7K/:3f0brigqQ5Bo6z+pEm7T7KcdSlr9T
                  MD5:97AAF004501A14AE532910B5E053ECB3
                  SHA1:5E94869397F8EE3ACEC8987FC5CA12A244EE3A85
                  SHA-256:67C764252EA1B7D288A6C0665C197066AF49F92FEF37D551677C8B07F1BF37E6
                  SHA-512:46F81FA8379AF30DFAE400CD7E93F0F1D78623F4662391CF599B57B3AC1674A05AF0C1930D996E6D3F640647F5AEC583D27CF4ABD29535C03D40F1559680E360
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="controller8" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>18</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\controller9.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2623
                  Entropy (8bit):4.869781735456218
                  Encrypted:false
                  SSDEEP:24:JdfNXrKAVOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kck:3flrigqQ5Bo6z+pEm7T7Kcd9ir9T
                  MD5:4B250CBBC6D7117A0C78DFF2F3191F41
                  SHA1:634FFF3027A101141B1D54E102D37322621C8841
                  SHA-256:B2FB21A9CB701F3C479F2650DBA4990BA45843B7E6ACCEC2B2DAFF5798FF22A2
                  SHA-512:C9A12E914B4FEC527E5C6C4EFC7EEE303E5F37C3C9335EBE9F2DCE64498820F2645358765B714C7B096F644901AF23A4DB99C279162CF4A6BC571896BC621EA1
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="controller9" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>18</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\drive1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.868358333193782
                  Encrypted:false
                  SSDEEP:24:Jdf7NXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kj:3fRr8gqQ5Bo6z+pEm7T7Kcdur9T
                  MD5:97510D99A4D99020A3CE16F54F9D637E
                  SHA1:646E83B4939274FA29B0FDAA0241386093C7ECD3
                  SHA-256:36CE723EEFD38677FD0D87C735C055F90958AA742CD06E31DF4C3CD95ECEC5AC
                  SHA-512:6137888860D828C406AD1DB505B18F50A5423C8C96A79832D38BE5D07DEAF4C22D5ACB05EDB564B9160771EDBC1C8444D6E40062C40213765ECC2BD9F749AD83
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="drive1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\drive2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.869782270813425
                  Encrypted:false
                  SSDEEP:24:Jdf8XrKADvKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Y:3fIrxvjgqQ5Bo6z+pEm7T7Kcd+r9T
                  MD5:5E2EB163DB929FE67280F71B24FB8980
                  SHA1:1207C96CEB5207563B34D7A8E08A334AF28D3335
                  SHA-256:95905B3717EEA54FD84DD2020EC94CB5A9DE776A98209D793906184BC5FF5247
                  SHA-512:773AD76BD0D853376A8261EC139E9090427FD7ADE8EF9FBE85CAFBF6EA1AD7B5CEC715E0F8ECF6A56FA213FB70BED84FD653F869A7B9DA0607EA4C915E94E901
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="drive2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>8</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\fax1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2608
                  Entropy (8bit):4.868774383338009
                  Encrypted:false
                  SSDEEP:24:Jdf0XrKAxOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcj:3fwrCgqQ5Bo6z+pEm7T7Kcdrr9T
                  MD5:300832CD5B0958AB31A0B655A9682E94
                  SHA1:30B2154D94390E5070DA00CEDFA8D5DDF5963EF2
                  SHA-256:35939FD832A1E219851D226A7AF23430E5B4CD14DF2AB2C0081245D088C03C1C
                  SHA-512:DCE8125CCE3047B5FAFD872791561F4D57D0530F6A45BC00C862F81A0F750911958D1F71850EF8142110966A703DDD3F8B0183CA30EACB12D16363AF4E9F2C22
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="fax1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>9</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Scal

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\fax2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2608
                  Entropy (8bit):4.86863745451363
                  Encrypted:false
                  SSDEEP:24:JdfbtXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kw:3fZrTgqQ5Bo6z+pEm7T7Kcdhr9T
                  MD5:A0B6E6844ED7D83067DFEB247C41D7BD
                  SHA1:B0A900137D2537E0147142BC48554B2E3BE1C5B4
                  SHA-256:75F1C8139EF0B59B74DB2B945A5F2216E40AEA4A5FF40DF8D8C70E16ADDCF219
                  SHA-512:E4CEE005A5A05510E1D192E2373C49FAD2F236A6FE707AA2D11D047ACCB2664A72BD8F1988A6B7B970323E58FDED4E052D649D75586218EA43315F920809346D
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="fax2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Scal

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\keyboard1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2619
                  Entropy (8bit):4.878634547900688
                  Encrypted:false
                  SSDEEP:24:Jdf+XrKATAOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KZ:3fyr3gqQ5Bo6z+pEm7T7KcdOr9T
                  MD5:02734385A58E9CE6E5D94C34C9ED81A6
                  SHA1:FD157E3CEDBA032DBEEF249FAA45B011DAEC8094
                  SHA-256:EF4766B805A9A7A241289414DA374AD4420C6AADF4B65886DCFB9482563CACF1
                  SHA-512:A80BDB1A1E603531D613E4451D70F521151C11461717F252E1AA1A248FF16A7A3048CBA007E5A45DDB9322A8461F59A6AFBE1659F7EA14196B23B631C28091BA
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="keyboard1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>13</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\keyboard2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2618
                  Entropy (8bit):4.878757920531139
                  Encrypted:false
                  SSDEEP:24:Jdf3XrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcW:3fHr8gqQ5Bo6z+pEm7T7Kcd01r9T
                  MD5:9B3BB18DF257AAF4B3096FCE670D136D
                  SHA1:020B2C31150F08CED2F0F9E237E21E9A17800E8E
                  SHA-256:EE5D294B649325AF035826C40710330A88057635E0DE35F1363582DC5E8D3F65
                  SHA-512:D917AD286C4E892665A323853492E7BA8E1445C94F512A1934AC47D16046808F461A9B0A363130B0EE082A1E7633F37D148676D88C7D60989FDB7F8A8A48BE83
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="keyboard2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\moden1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2613
                  Entropy (8bit):4.868758925626262
                  Encrypted:false
                  SSDEEP:24:Jdf8XrKAVOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcf:3fIrigqQ5Bo6z+pEm7T7KcdXr9T
                  MD5:0932C29FA97ECBCB60F6E7806D0CA8EE
                  SHA1:1D02732DD2258555A14E528BE24E305160A0FC81
                  SHA-256:7E99260E59D5EF635EFE99CFC774EBFDD25256A035EB0432AD12DDD5EC394BAC
                  SHA-512:DB5A6493889716351A6ED7B9A14CC4111D96FEFD1B78FB5660F70D7C9B09E827792EECD236E672071A412D03D5C13F9D642C9067847D2EC4ED86DD1D1501A76A
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="moden1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>18</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\moden2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2613
                  Entropy (8bit):4.870553780557717
                  Encrypted:false
                  SSDEEP:24:JdfpXrKAGOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcv:3fRrlgqQ5Bo6z+pEm7T7KcdDHr9T
                  MD5:448C7175812F72982DF6A86E5E2D2F2A
                  SHA1:C6CF32D7003A457D5CA474DE9E9949568C871166
                  SHA-256:56A639C4602EF0C6376C2BF28FEAF2C2EB3FAE800802527155AF32CE3EB98A31
                  SHA-512:863C47B670D6AA8BEB416A596C1FDEB035AFC17908BA02F1A60B3A7A5CD88E9FEC0E0816F71E61C0338591617963CDF873CD7440AD39CE126141444014439B55
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="moden2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>15</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\moden3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2613
                  Entropy (8bit):4.873199952071279
                  Encrypted:false
                  SSDEEP:24:JdfmXrKACKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KI:3fKrUjgqQ5Bo6z+pEm7T7KcdNrr9T
                  MD5:909BA1260758C12E476DC3FD13F7A92E
                  SHA1:7568E10B6E1C7155830C40EC7F4DD96513F293FF
                  SHA-256:5E3807CE3F401E72637AC313F113A769A35FC4AA77433793185CD109E55133C3
                  SHA-512:1D111FB2B7C8DC6F0256E452BB9001411DF935AEBF4DF710913DED829AF775EA0ADF09D0B0E1F45695D16C205A7AD3755245AC4CF073B0B6FEA0CB5754090058
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="moden3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>16</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\moden4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.870395441519031
                  Encrypted:false
                  SSDEEP:24:JdfltXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KL:3flFrTgqQ5Bo6z+pEm7T7KcdpYr9T
                  MD5:9F7219FBACF50EB4C0B80E0FD4FB3AEB
                  SHA1:D421A6ACCB62005FB024066DF696FA98FDF2DE0C
                  SHA-256:573EC4EFB1FF4ECA2F49C679E780755EAAC5D63E8840FE6914B708205FB80401
                  SHA-512:B2192518800BF7FD506A825B1F7BA20BE4F9640508D2192F3937792BEA41CDD0BA5F753F0CF9E3B8C2AF6C0F1744DC61CF1307923280CD7926F36ABFF93136DC
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="moden4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\monitor1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2616
                  Entropy (8bit):4.866492683170209
                  Encrypted:false
                  SSDEEP:24:JdfAwXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KL:3fAMrTgqQ5Bo6z+pEm7T7Kcdl2Fr9T
                  MD5:FEDE9CF05BD204DC4F7AF02346192732
                  SHA1:A4DE65E2D28974D314883C7E448B698A01543F59
                  SHA-256:D975BAEA01DF10EA47FBD7A52DF7EB49B0E2459565C43EBE4366AF45253C5694
                  SHA-512:4A77ACB3A967C712E5E71A7EDC59C70CB87AC027C99CD08C5B9D8F1F04EC6BD025A2E142D20F2ECB210E461CB959FA91C39C18650249C49158F2C6E727DC5249
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="monitor1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\monitor2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2618
                  Entropy (8bit):4.8674078242951655
                  Encrypted:false
                  SSDEEP:24:JdfAdXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KM:3fAVrTgqQ5Bo6z+pEm7T7Kcd32Yr9T
                  MD5:0647186CF81D3A1C5B474D4AC522182D
                  SHA1:022995CCC1EB8EB3EFE823E6B89FAB9E2B2FA089
                  SHA-256:63A634FE66BBE1FFA8225F2F5D225DCFF1FE46DF95442E6321E1ABB52D60C7DF
                  SHA-512:106343A9D1F448C662E8C8F979D7FCE06960C65E9A4ACAB75B402390546CEA9351F61D90DDFE8CCDD0F05F52BA1DD0D4672E04E93038654EAC0CE0FCEFF2D7B5
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="monitor2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\monitor3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2617
                  Entropy (8bit):4.870375621666547
                  Encrypted:false
                  SSDEEP:24:JdfAKXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kp:3fAer8gqQ5Bo6z+pEm7T7Kcdf2Dr9T
                  MD5:83DD98C9E00DCCA342C996FB44EA8607
                  SHA1:37CC05224EEB7363C36832F4BFF796DBDB997C5D
                  SHA-256:D5D7559BA806785CD827CE8388BFBE53B95DC7F2625D0FC303E5A8C6C450BC4B
                  SHA-512:C042FF471C012B8FA78D5FD3D39AE7E1895960251D403D2F207B6A9C4AFD95D4567AFDA0D9792D6E8BEE9AFBBF1CB4E64C6BEFD6A59025729F4F6E13CF714A9E
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="monitor3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\motor1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.869037406454421
                  Encrypted:false
                  SSDEEP:24:Jdf9gXrKAxOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7K2:3f2rCgqQ5Bo6z+pEm7T7Kcdvr9T
                  MD5:1549F6C8DD224908B086D1879E675653
                  SHA1:17975955204D4BF5FAFC3F58CC1221EA587AE12D
                  SHA-256:5FEE209461B356A21B91A0F1C64B729AC8C95A6E42E68B7CEE7215791F94186A
                  SHA-512:D5CDF569A4D24218A2DFA5A702993E96FD44E5F3510B325CD95F4CC6F75F76D01EFE989D671CFF0B3708BF67670CE7276257E61C4BC342D8FF33B7EF81B5303F
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="motor1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>9</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\motor2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.869385764870976
                  Encrypted:false
                  SSDEEP:24:Jdf9NXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7K8:3fbrTgqQ5Bo6z+pEm7T7KcdvBr9T
                  MD5:601C85369DAD8243B9C2D9E49BBCB1D8
                  SHA1:4BC7365E50C49337DD63A01AEFA788222A0FB3FB
                  SHA-256:BFADB031F07B4104975523BD2301BFF65FD8212501145F6CC36D86FE3C83B011
                  SHA-512:9A395E02B8D15555BE69B7FE8DF2B7BFAA73440F021BD20FAA6747600CF3EDED8B7C595776EF0694900D167FB5F15C7535A9B901EFAA25F55A8DD81B7576D546
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="motor2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\motor2_s.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2616
                  Entropy (8bit):4.8720503986324015
                  Encrypted:false
                  SSDEEP:24:Jdf9LXrKADvKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXbV:3fZrxvjgqQ5Bo6z+pEm7T7Kcd7r9T
                  MD5:447BF14876574BDC04765741CD2954A6
                  SHA1:793072FB66977BDBD3DD79EFA542861F6B781AB0
                  SHA-256:795D9003E688E5395AD6933FC9F5A8A9CC711FCFA9B7613A0DBC8ACB1960390D
                  SHA-512:73E25567A543A5C1F2A4004027A1DB85DC619F0727F7B62D4D0622AC33DE829503EEFF96A0292A8C596835B2185DACCADB5A435B698BFB19696AE71A46E07F43
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="motor2_s" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>8</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\motor3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.868590282451455
                  Encrypted:false
                  SSDEEP:24:Jdf96XrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kl:3fkr8gqQ5Bo6z+pEm7T7Kcdkr9T
                  MD5:170F5BFD2F9B2DBC2713A95EF6888005
                  SHA1:181C2A6975CBB7ED115D9291752B63092BD91164
                  SHA-256:A3E0016B973DAD9C03921ADABBCEC9EB6B71EEEBAE93DC0D7F13BEA0C6152138
                  SHA-512:E993FFAD96E832460DAF6DBEA0A5E6D771B630F059237A3BAA090D391C6C79DC5C4CBFB820A45AC3DABD4EB010D35E82547034427413607FEF07AF88FC16C89B
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="motor3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\motor3_s.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2617
                  Entropy (8bit):4.873557589272494
                  Encrypted:false
                  SSDEEP:24:Jdf9AXrKANOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KW:3fKr6gqQ5Bo6z+pEm7T7KcdVp7r9T
                  MD5:5F2514179F1E400D2447D7AB84E05342
                  SHA1:C32E007198279BC8AB70662D2E171E1D9128D80D
                  SHA-256:C50C16F21915CB0FB5AEA791E2BEBAA685A47C102BC6E972887E7F9E48D4375B
                  SHA-512:1E63943DF8932AB712E1E326761BBF9700997ABB0F2BDBE831BB55D83EC60299C6C71F8DEE7494F38703EF286B02985F58E92B50BBEFBDC9FECEACEC32BB11CF
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="motor3_s" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>10</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\motor4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2613
                  Entropy (8bit):4.8666075351645794
                  Encrypted:false
                  SSDEEP:24:Jdf9/XrKAKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KI:3fZrZgqQ5Bo6z+pEm7T7KcdPsIr9T
                  MD5:E3B113097D8D986B273BECD315F9642F
                  SHA1:4DBE262EA902FBE3D3C415C1F81CD123B314D7A0
                  SHA-256:2DB432D2955C324057E2F15CBE459E6219F2BA399DE223ED077B530A174C1F6E
                  SHA-512:784A90014DE2D04AF45443F6350B333A36556BF4362A7F16F9F985342EFDF56176572213D8107D5719A38B58A96F0035D782B9193D0280BB387903EC35316BE2
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="motor4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>11</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\motor5.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2613
                  Entropy (8bit):4.867331025593628
                  Encrypted:false
                  SSDEEP:24:Jdf9cXrKATAOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7V:3fyr3gqQ5Bo6z+pEm7T7KcdsK3r9T
                  MD5:51FDB149998A857D32A474AA6839078B
                  SHA1:F413CAC6023DCEE2C8FB7118ED817C98B2E76A43
                  SHA-256:42919EDD186BCB19E9C31B6CE99DBD59FCDA89D003A1B0AC2C2032F05370B704
                  SHA-512:B0C8BB6B2234363220832EEE12C7F810B25A0027A87908BEC48B9A0F80160D2D3C47E57150027981D2057F9384F020A0605352907C53FACF22744178CCD419D4
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="motor5" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>13</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\network1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2616
                  Entropy (8bit):4.872941871364875
                  Encrypted:false
                  SSDEEP:24:Jdf7XrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc1:3frrTgqQ5Bo6z+pEm7T7KcdQwr9T
                  MD5:2E7E417AF158E90AD485DB0990AB207E
                  SHA1:90F639C21DE5B4F9A07C70559E4186655C698EF7
                  SHA-256:D807A078DE88DADD3E7A82C7FFEB027150610ADCFD82F2E77DC0C3CA81AAF3DB
                  SHA-512:E93D02CF9DB6C8235435B9A7741DD8FA2E76C1650AFF6D00268925B3F72CC5B33928241BA7650CF60E435889CE5F76A95075894C84F66D3D46C50076D5BD0EB1
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="network1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\network2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2616
                  Entropy (8bit):4.875068716574468
                  Encrypted:false
                  SSDEEP:24:JdfCXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcl:3fGr8gqQ5Bo6z+pEm7T7KcdHdr9T
                  MD5:D466C28995A169E753B5689EF44030A3
                  SHA1:C63FA7E6D6D79DB438F9B9EB0FD5E96CAF7CCF35
                  SHA-256:1172B53920031871DA61CE9FE7232B0F799BAEDCB68B411DF950DF0BAAF81559
                  SHA-512:4914316249A8BE9EF497CC931DF74068DD3CA796F794D298DFA139C272BAD3110C26A0701ECF556EF82A8131E46456F4E6C22B92885C5B2381620753317BE74E
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="network2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\phone1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.8673344042141835
                  Encrypted:false
                  SSDEEP:24:JdfFXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kca:3fNrTgqQ5Bo6z+pEm7T7Kcd7ur9T
                  MD5:B7B066620BCA4C5789D3DECB2D5F3BE4
                  SHA1:6C0257FEC8C1A09EDE552AB946A4BE4A2F049ED6
                  SHA-256:1C646CB8ADA221599F168BF02E0298D554A1381B02A2B57B7E1087A127218F24
                  SHA-512:7BE20882629629BCE8AF8E968D5BDF5CF2B74B9A0D9143480F1AA4DBC748A22451990580770E4106252E41458CC06EC3AE775375D6442158046783DF62F01CC8
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="phone1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\phone2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.86986377457747
                  Encrypted:false
                  SSDEEP:24:JdfYXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kck:3fEr8gqQ5Bo6z+pEm7T7KcdDkr9T
                  MD5:584BC03600D9B3FBDD4967EB0AC7FFB8
                  SHA1:DB966AE268D5710094912A40D3488EA700B5A91F
                  SHA-256:84AAD2222D20BFB49A5E06D1529557C522FBD43D09E884A6F45C9A08A0DD92A0
                  SHA-512:2672153F2B93EA5210B3B5120CBF42761AEBA87B88A5531E190CE15DF9180A7B7BB3BC01EDC6CBCB2BFA045D5D5851BCF736FC8D6F67B8FDDB19A54250F708F7
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="phone2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\plc.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2606
                  Entropy (8bit):4.8671990321220155
                  Encrypted:false
                  SSDEEP:24:JdfPXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kch:3fPrTgqQ5Bo6z+pEm7T7KcdJr9T
                  MD5:F0D166D1ADD08D6BDA765F58333F3D8D
                  SHA1:D9725CD81469AC8007B2B9EB1B7646EAE536B73F
                  SHA-256:667D839229577750147CD9A5546E1563AE489C89C452ABF7293B961258C22518
                  SHA-512:CBFA1709AD9EF09035D9C7B29228A312128F239A11B8D45B548BE29EAC90DE88E09B5A8BFEF18347F84A8B92E7CA4C854679AB23AA0AC13AC6D5C29955FE9478
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="plc" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Scale

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\printer1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4953
                  Entropy (8bit):4.823024756652637
                  Encrypted:false
                  SSDEEP:48:3f0urxvjgqQ5Bo6z+pEm7T7KcdCrYgqQ5Bo6z+pEm7T7Kcd5Cr9T:prxvj0gUcdCrY0gUcd8rN
                  MD5:8BFF4A824C2265F2DA1C016EDEFE0F91
                  SHA1:B83BF699AF934FB50F385798BDC3D92EDA3CE43E
                  SHA-256:781A63818530E2214C8C4CB84340FF79796AC3F1921ED3722F8BB168DFE5B046
                  SHA-512:D86DC8EF984F13AF11A3F24D936F335262EF389E043FEC1E21C5B4230AB8BE664BD2E48E55C055C4FF259108D6004E2E4662C1DD3503EC20FEC22DF51B1542D0
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="printer1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>8</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\printer2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2616
                  Entropy (8bit):4.868791169389454
                  Encrypted:false
                  SSDEEP:24:JdfsXrKAxOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcL:3fYrCgqQ5Bo6z+pEm7T7KcdPr9T
                  MD5:87A6AE4B5F7E8E1435DD1D8EEBF7132D
                  SHA1:6EECB199BB47467EC65BC6B1081CF3938B6A1B4C
                  SHA-256:381115F925907C1C940CEC47461FEA938C01C96108AEEC9AC6DD5B3966401C06
                  SHA-512:EBD0F23B0597F455FA7845B0E2492F2FDF80DB0CB556805829C18AA8DE5B3B9C545688F34DF7A9C0140377ABB6294AF3A62686A33C83EEFF3FE80F430DBCE5BA
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="printer2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>9</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\printer3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2617
                  Entropy (8bit):4.867331462055866
                  Encrypted:false
                  SSDEEP:24:JdfPXrKAGOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcW:3fPrlgqQ5Bo6z+pEm7T7Kcder9T
                  MD5:D660220AD6B9D700D8BBC32C424D34C5
                  SHA1:2F73639EEC4AC40AA3C5BDC1CEFCE7572B5FE78E
                  SHA-256:F53137474C3FF623DD1B1ECC68B8C88A29E03A54F8ED0A6B16A35C582C0EE725
                  SHA-512:20D4AFBFA425743F13BC585322066CBDEE72B5218C44E47BBE6157E7A7E5787A561232A5AFBE42CEBF4C898577AE82A4F4C9BCE434A55DC52C1B443E408DF87E
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="printer3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>15</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\pump1-g.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.877679749068039
                  Encrypted:false
                  SSDEEP:24:JdflNXrKAqOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kb:3f7rNgqQ5Bo6z+pEm7T7Kcdor9T
                  MD5:1F68A36FA6E2EA21AC7F0DE6175B948A
                  SHA1:44BC142DFF00B69B390B12D176F7BF2A67149B9E
                  SHA-256:3270B43034748C533E20FA959A3A0E3C7A464F3791D197B509CF2E5DF9A2C5EB
                  SHA-512:A0FF4066540574A542F5C9747E97684BC059BE228DA5FE9CFB07ED9ABEC0F71E734EA5862B562F1AF558F22DEDBE63A98B1370D09ECA5533B00A86D7D3740D10
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="pump1-g" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>42</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\pump1-r.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.876573885756538
                  Encrypted:false
                  SSDEEP:24:JdfEXrKAtKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Ku:3fgrDjgqQ5Bo6z+pEm7T7KcdGkr9T
                  MD5:6E941479C3D1BC6DBE76DA9A6083ECD2
                  SHA1:8735BD4EB87EDE5E1AF304DEF1D94C8F50555315
                  SHA-256:588DBFC64AA5FB521A4831E3E76698602D44160CAD80B7A8B7E4E7919DFA93AE
                  SHA-512:477FA54D7B8365676D154A3BBC2642FC815584917B2AF474E3392C15D792F38A1CE681B47612FA92450C0EE47F5AAD59BF4824B9852F3C33D4BF5DB735887046
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="pump1-r" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>44</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\pump1-rf.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2617
                  Entropy (8bit):4.878755522270895
                  Encrypted:false
                  SSDEEP:24:JdfSXrKALOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcP:3f2rYgqQ5Bo6z+pEm7T7KcdHr9T
                  MD5:BF90147492963AB1808BF4F3892DB26A
                  SHA1:2DFB3AD9E2D5C316AB7D80FB233099ED9F1C5980
                  SHA-256:8A80E6F3141C2AA4A91C163EF69BE197198CC4753CFAAC632646E0B9306D5845
                  SHA-512:E1F5424C9CB8D19DA3358E68926611E709A9CD0D9990993DBB7DFFFF9A4223A98052A3B5CE43394851EF7FED9D194045918685A200DBD8A24940E9E1589C265A
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="pump1-rf" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>45</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\pump2-g.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.87971502713615
                  Encrypted:false
                  SSDEEP:24:JdfqXrKAmOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc1:3f+rFgqQ5Bo6z+pEm7T7KcdBr9T
                  MD5:90DB298F25A803BB1E90386AE2B64248
                  SHA1:597CE6CA50A9B8024CB5803194F98480244BC7F6
                  SHA-256:6EABCFA3048873B6903128D3920826DE4EEBE91E29E0E8C4EF57BFF284D1FEF8
                  SHA-512:3B692ABC7BCAE52D27FA467B7C3B26D222A1E56DDCAC3DE91ADDF698EEDF01423592C68A9319FA67450FFE97EFD7881505FA6DCFDDE481926A9A3E9D4EB229A3
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="pump2-g" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>33</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\pump2-r.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.879792665488677
                  Encrypted:false
                  SSDEEP:24:JdfEMLXrKAqOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7e:3fEMbr5gqQ5Bo6z+pEm7T7KcdJer9T
                  MD5:82EA2F7941AA349832AFB54C4127935A
                  SHA1:635FD87464161010AABFA8B4C96B2D30AEA6E26C
                  SHA-256:2016F16798B5EA3BFC39D35BD34D58807F71DBAE1CF81936703D5666A462512B
                  SHA-512:04303D44FCE2BEB812E6B09EF7141DC2B2C1F7D3C9C52EF551D65698AB1BEC660B7FF2EA227AD8C59BAD5C822A6B76E6697D865CA32C11840CFEFCC2EF9CA6C8
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="pump2-r" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>37</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\pump2-rf.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2617
                  Entropy (8bit):4.87933959999271
                  Encrypted:false
                  SSDEEP:24:JdfFXrKAzOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcP:3fNrEgqQ5Bo6z+pEm7T7Kcdzr9T
                  MD5:6A8D0E713414B305F6E6B4BD59989397
                  SHA1:4ED5AB832431E655BC5EFBAD414435397DADD1FC
                  SHA-256:126FFAE55156F0D3B5DAB9B32059319DB4F35E9C00C0431EB36CD98E8A805886
                  SHA-512:B077D341C560AE0210140C5A408146266E9226D1E265AA15AD13680C9F5B9ED96D9E3A5C072F1F80AD3066377698C0D9AEBDFD876FC64D5D66E55D2632A45FC9
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="pump2-rf" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>38</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\pump3-g.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.879615820966786
                  Encrypted:false
                  SSDEEP:24:JdfblzXrKA2OgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb74:3fblTrhgqQ5Bo6z+pEm7T7KcdZIr9T
                  MD5:8787A6C663284344997DF0F4271E08E7
                  SHA1:652F4F1EBF9F7A098E385169A0F820A2F70E59AE
                  SHA-256:0928AA72553EA45D4A190B64A13DF458AAF069E8302FC4E896168DEED7AE90F8
                  SHA-512:23B77B4C47E4133922767FAAA901B3867A30D0EAEB006E786E9ABDB0390697B39C1C2F3F5BDFE28935D94D8B18CA8AAD362B4AE34E991EFA5A510C83022D335B
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="pump3-g" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>20</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\pump3-r.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.875694093932166
                  Encrypted:false
                  SSDEEP:24:JdfCXrKAy2OgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KH:3fGrM3gqQ5Bo6z+pEm7T7KcdQr9T
                  MD5:6B578872B725646748D89AE84F2AAD7C
                  SHA1:75A974225CBB420DFBFD4C0F7E56B00C73395BC9
                  SHA-256:9301041F9F2BF58AED314EA4EEE44447E953F980A79C84BE299C28E123EAFCE5
                  SHA-512:F2AFA6092B00179032E5772BF18F8640EF9972FD66C77A90A7C9C5B23AFF56F0C7FB5403F8BB142BBA0EADDC7FF8F95E81FC4CF8C60E88AB3356EDE4D0B81A0A
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="pump3-r" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>21</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\ship1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.873345867170113
                  Encrypted:false
                  SSDEEP:24:JdfzXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcO:3fTrTgqQ5Bo6z+pEm7T7Kcd6r9T
                  MD5:F3F38C27DB6D1932A62719C63127E261
                  SHA1:55BFAA481675AB99C7204131C606DF6FF4714437
                  SHA-256:99CC8CCD73BC0EE024E0C515F54285C853D21D42FC7EC5D3FF888F6EA2D2E2C4
                  SHA-512:E826D7FF9BE7A33851D77895B31FAB5FFDD4D96ACB32C713D059E815DB3F5384B755FB8B32928E7E27A9997E0E3E55DD5EEE6668E2023109951629DB9EE82899
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="ship1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\transformer1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.867143513586865
                  Encrypted:false
                  SSDEEP:24:JdfsXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kci:3fYrTgqQ5Bo6z+pEm7T7KcdOr9T
                  MD5:2FAD9161BC2D8B75CFE1697F94505D4B
                  SHA1:95DD4E9D910949FBB8EC83C439C171A13A551E4E
                  SHA-256:1B9E1019618BCBBCD6463823AB90BCD590FC1625E053227254077219AC1AE161
                  SHA-512:1D0C3A55B7F555AB800956FFF3627EE3FEFF3C7B813080C6908A10A9BD6625AB36921090FE93A91452CBA47DC77FBA757BAD37982FB7F5C96E6835AFB6466410
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="transformer1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\transformer2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4966
                  Entropy (8bit):4.825010716413678
                  Encrypted:false
                  SSDEEP:48:3fhr8gqQ5Bo6z+pEm7T7KcdDzrlgqQ5Bo6z+pEm7T7KcdKQmr9T:Zr80gUcdvrl0gUcdKlrN
                  MD5:CC9B2598FE39D6820381CD6AC1AC00B7
                  SHA1:50F3B9D56BEE47D54637ABF91822812CC2BDD149
                  SHA-256:0B6254A9D84D5781CC11D0674DC15B7DFF4E32E41FD33BDBC1E993CA90A5B264
                  SHA-512:86C6F324D0D197A3F90790F868CFD89D781178255D368FA1BDD4B7EC880B21763FA8AD6B4D090CCCFFF3F1086278DC2BA889CC92DBE1EF7921452D7828C1B5D8
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="transformer2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\truck1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):534562
                  Entropy (8bit):4.602466336172016
                  Encrypted:false
                  SSDEEP:12288:QLD0eXkGV/gLpnsVhsvdiJ8pCoPASxkDwBOByXiEZL71xYU6mQeWau6kQAXmdGm8:QLD0eXkGV/gLpnsVhsvdiJ8pCoPASxkf
                  MD5:1C56FDC377B8BC7472DA3E3354E7AA75
                  SHA1:AC41634229EA830007C8F47BF5C006DD12719D06
                  SHA-256:013A9CE3319138D1ABD41CC93464C136906B165332BE04667D90E28FAD07DBD0
                  SHA-512:38A1C96C9014344E1F4E46C9EECBC310337CB200BD829FE92AC09DC45DD61D2D7339DBD9FC01E9EEA7B8845A4B07A9E590FF7C0440D3F782D8387D085944C58B
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="truck1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <ElementGroup>.. <Version>1</Version>.. <ID>8</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="128" Green="0" Blue="0" Alpha="255" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\truck2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2614
                  Entropy (8bit):4.875632033748137
                  Encrypted:false
                  SSDEEP:24:JdfAUXrKAwOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kx:3fxr/gqQ5Bo6z+pEm7T7Kcdur9T
                  MD5:3D197C91D549B502AC6E19A7D9D5070B
                  SHA1:BA85582BA2E5C1D08E7A2DC37C8FC0D6283E11BD
                  SHA-256:AB0E4210F6231D605356CD9AAA0A2A710982A0C293732B9E482A5DB467A1F1EE
                  SHA-512:21C38EF76680604A09829C00F2CFBEDEC10EBDA5A88197A259491D152C1F1A9924379B1AB0E7048C74DEF2AA412B9E0BBDBC31C946BBC95C9325D428E39AA4C0
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="truck2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>22</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\truck3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2613
                  Entropy (8bit):4.872835363672004
                  Encrypted:false
                  SSDEEP:24:JdfAXXrKAy2OgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb72:3fqrM3gqQ5Bo6z+pEm7T7KcdQr9T
                  MD5:C2BB4612D126408903C78473B269A0C6
                  SHA1:C02C7015645B98AD0EB618976F4BD965A4679241
                  SHA-256:54EB18D8A7D9FD2459F9F8F283295D05A75DD5251C4FE6CA5970200D9F8DB432
                  SHA-512:95F84408625FA79DA54284E3C7026A4C2BC634F6EC47E59B4AE194FE9BCE0A262593A88B0D18201BE441DBB83ECF35D1F33937AF8E2E780B3302B38D770FFE91
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="truck3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>21</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\valve1-g.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2617
                  Entropy (8bit):4.8723578903860805
                  Encrypted:false
                  SSDEEP:24:JdfyGXrKANOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KV:3fPr6gqQ5Bo6z+pEm7T7Kcd1ar9T
                  MD5:98110E77BB148E123E08157AD97AFC58
                  SHA1:DF81AD7D3565BC77870712F3BF4D72889A4F191A
                  SHA-256:BB8C3B1FB3BC017DA36ACA509B3251D4A1C1655465DA5F5417826F57AC5A908C
                  SHA-512:316B13E2032032D10378CF7CC61633F025E4DA17EF2527E13A0139EF30C35022F5ACC20D030336390966798737E0316B566C2C9E0C821C046B7EF2909788ABF2
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="valve1-g" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>10</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\valve1-r.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2617
                  Entropy (8bit):4.871699243527546
                  Encrypted:false
                  SSDEEP:24:JdfydXrKAKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kt:3fcrZgqQ5Bo6z+pEm7T7Kcdgxr9T
                  MD5:4ACAD2EFE34CF0C92D188F1B020F99E9
                  SHA1:45BFB1B3BA2D60AC684EB29CAF3A102A4D364EDB
                  SHA-256:75E05CAB08CA20F9A04029C0F215392322DB955FE41AB9008DA3B99A92B71DA4
                  SHA-512:3C08406F916EC3D158E794E07998BD77354DDC3EF209205F0779C412A1A5C696A0BDDC5A94EB4F3669C7D7DBC4AE721A9AB65415428046E13AC5B526F02C4354
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="valve1-r" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>11</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\valve2-g.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2617
                  Entropy (8bit):4.875544012954508
                  Encrypted:false
                  SSDEEP:24:JdfGFXrKATAOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7t:3fGNr3gqQ5Bo6z+pEm7T7KcdLzr9T
                  MD5:ACE84DC85190BE02350320B79CAA415E
                  SHA1:951E2D932E1F80EFB544ED1491FF5D5AA3573F33
                  SHA-256:AFE379D76807EA302B282CF49497B819A6DE118960B30D178537E2B39184479E
                  SHA-512:B2992621EB76F0A89454270F93E78EBB3A696E57F9DD33959F0BF4404CC54BC49738CA1A842B8CE4C0B6A1528DCFB6FB09C9621FAFA88FB8F5FCF9B2C4112C1E
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="valve2-g" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>13</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\valve2-r.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2617
                  Entropy (8bit):4.8724227457579605
                  Encrypted:false
                  SSDEEP:24:JdfGYLXrKAGOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7E:3fGYbrlgqQ5Bo6z+pEm7T7KcdRMr9T
                  MD5:3DF8626AA279F9BC7FFAFE041020E5D0
                  SHA1:46D5DC3421C97C6EFE00B0F1ED87F9E6F6EDF4D0
                  SHA-256:B05B19C73ABADB26528D96F5C2174392AE8FAC8D57A1A261E750E6314D167301
                  SHA-512:F381C6B9C5A717EB29F5880951F3B44E347E8E2F2943601196CB284F7C255DCB5BC3B4E71547D3A487DE585C1DD40B0A8AEDE142BE8663231EC956C8590D80BD
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="valve2-r" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>15</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\valve3-g.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2617
                  Entropy (8bit):4.876643684547393
                  Encrypted:false
                  SSDEEP:24:JdflXrKACKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KG:3ftrUjgqQ5Bo6z+pEm7T7KcdVokr9T
                  MD5:261AC164773349B72DC94F6D39AA43AA
                  SHA1:F7FCFC60E3FD30A1740B4A5E2203509E05F30EC8
                  SHA-256:26793A0F8E664B79EA54F49A3A574CAC2CEF1B05C69DCE61D8CF9648B58E882B
                  SHA-512:9995DF43D858E8158FC39167BA49DDB288723E28C61979236D35BBD22C57AFE2C4ED7995BBEB851FD599B202C74169CF7803BAD42E2C14CE8EC426670D40CFF0
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="valve3-g" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>16</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\valve3-r.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4955
                  Entropy (8bit):4.82906467084764
                  Encrypted:false
                  SSDEEP:48:3fCrmgqQ5Bo6z+pEm7T7KcdMUrrCgqQ5Bo6z+pEm7T7Kcdxxrr9T:qrm0gUcdXrC0gUcd3rN
                  MD5:7CF9BECA257054386AF21F312F30F6F8
                  SHA1:AFAF155FE62B4B142A98EF4A4C2049DB2179BFD5
                  SHA-256:C4E33E4EA044A6B2C178B58F464CB96BD34FA64D4A9FDD5838CFE13152393178
                  SHA-512:E3927FFB0139024EE040A6B296EDF6FDA77A4EEA65494A56F83306F4BA79AD73EB2D822C659B8C3D446FCD5B2B3FFB6CF211285BE5D9C4D76FF0F08978C8A618
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="valve3-r" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>14</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\workstation1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2625
                  Entropy (8bit):4.8757691493549915
                  Encrypted:false
                  SSDEEP:24:JdfRGXrKANOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KB:3fgr6gqQ5Bo6z+pEm7T7Kcdp9sr9T
                  MD5:A4D94BA5D45BB553E6F9DF87E0025C90
                  SHA1:3BBA46D3CDAA7EC2A3849992735035193D7AE7F9
                  SHA-256:E91FE227ED213A3A6F1F292410F456CB3E17100E41FEBA8EE854231A1F514DE7
                  SHA-512:4FC705C2ADCF48F0D87D2382155A6697D41EE70677601B018FD2953CB27DAD5852BD2A8966FC89BF183E4FDFE2AFDB68D94D74C69060FDEA97F4C30744C8FDE7
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="workstation1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>10</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\icons\workstation2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2625
                  Entropy (8bit):4.874245339831181
                  Encrypted:false
                  SSDEEP:24:JdfR/XrKAKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KI:3fJrZgqQ5Bo6z+pEm7T7KcdNvr9T
                  MD5:CF060CC0743A6E0C3A495FAA2BBCF211
                  SHA1:10444421CD0B53679F0683BA13F753211DDF07A2
                  SHA-256:9A2A3630A2941DC860AA3C5ADAA914995B644CD07F24249C943CA4BE5DF9A828
                  SHA-512:81273BB5A69005D905C242243706D1FBF9F29B5A864E5BAB9337BFB22F8A1B2EF4D7C600FAD327E0E84CFBAE54E1DEDCEC8BD02ECD0CF9E668A509D53298CDC7
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="workstation2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>11</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\agitator1-1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.874750633607136
                  Encrypted:false
                  SSDEEP:24:JdfX6HXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7E:3fXgrTgqQ5Bo6z+pEm7T7Kcdqr9T
                  MD5:BB0661FAE87855CFC3E30A6DFA81757F
                  SHA1:71A68932033E24232B400183AA7D7BAF4B9A9622
                  SHA-256:738E079752637179D3D3FACBEEEAF0A67E997D03FD5F49D76A5C3F7F2A281C45
                  SHA-512:C03E8540821B3608B2F3E40A14949B70C9430306880C28A9FA86796FBF472719D4CCB9C080D6865E8ED13E3A68F041262EA7E8D79236CAFCA6A25B7B9EDFD768
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="agitator1-1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\agitator1-2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.873351299225751
                  Encrypted:false
                  SSDEEP:24:JdfX6OXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7u:3fXJrTgqQ5Bo6z+pEm7T7Kcd4r9T
                  MD5:881D51768371F21BD9F212BA6FE3C7CE
                  SHA1:9A55891F1A82A2A0EDBDB1E06FB0D549B93F71E8
                  SHA-256:3DDFC0FCBF924D92A3456BAE7C1663ADA08B25E753DB3D273F9A4F4890754F8E
                  SHA-512:95F646CF0C3448DD0BA96B4945DA97D0499192DAD12A599083BC5A2B4164D19FEA26A55D2B84A1B5F19B78FC16676BB7E95064AFB359FA4969067B3ACCC3D37A
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="agitator1-2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\agitator1-3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.875763018152595
                  Encrypted:false
                  SSDEEP:24:JdfX6xXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7T:3fXirTgqQ5Bo6z+pEm7T7KcdBr9T
                  MD5:B82A4614BE8B962CE08B93E224CF7E61
                  SHA1:06F3BD2418818491D8345317E9987A209E1F2A0A
                  SHA-256:0C8D50DA48033849EB24949C4D915C50D35DF1D438BF13249ECCAADBC74F0214
                  SHA-512:67EF161F5665DD1353A4C0411ED1B9DE2D794ED04E7625F24B03AE7B0C005F40D19C5516967ADBF62996457BCF5EAD6D3920E5BF0376C5A9175A83E7C17DDFBA
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="agitator1-3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\agitator1-4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4966
                  Entropy (8bit):4.830261629321
                  Encrypted:false
                  SSDEEP:48:3fXLrTgqQ5Bo6z+pEm7T7KcdyrfgqQ5Bo6z+pEm7T7KcdqQr9T:DrT0gUcdyrf0gUcd/rN
                  MD5:E2FA3A9AAB9B33D5F582B4366AE78CA0
                  SHA1:ACC94E23DE2DAD76D12DA9B8917C81DCE2BEA9F2
                  SHA-256:D9FDD35D4038B15B6466DA4D6317B013CEBAF72ADE41492C7E13DEDDC61BF8B7
                  SHA-512:DC2F8C608F76DD887C13E597299BA48483C8FB6B1D781F9EF9FE2D98E9EE06EDE8303B0435896FBF81D9A2FD4356E5937DF8E4F20D61F1D79180C12292184F87
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="agitator1-4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\agitator1-5.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.874472308568786
                  Encrypted:false
                  SSDEEP:24:JdfX6bXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7g:3fXUrTgqQ5Bo6z+pEm7T7KcdWr9T
                  MD5:CBFB365C464D130158EC08E0D9BD5CCF
                  SHA1:12D9E176D8B524A5681174898948B834DF818C53
                  SHA-256:6574C821E94384EBDF4E81E1742A606644B427555C5E118CBADA24332E4E129E
                  SHA-512:9A43FFE7AB2273B74139866C6B04D71715F3EFFB0163A98C69CB50F9FE5FD70F22189953A62B664D6CB63CE727FDB6EFCE00CD00D00CB1F7100945D70D5D400B
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="agitator1-5" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\agitator1-6.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.875724959665511
                  Encrypted:false
                  SSDEEP:24:JdfX6iXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb74:3fXdr8gqQ5Bo6z+pEm7T7Kcdmr9T
                  MD5:9CC1D737C2BC66BD832368047E23CCBA
                  SHA1:CEBEA4F37EF28C34C1C2AEFA862F0E922ECA67FC
                  SHA-256:6F493B3268498A93DAE943F44F9E430BA025491871253FD6A0381C346FB704EF
                  SHA-512:51F3FE04ACE82FAFDE3ADA619D09029CC02ECE74CF3268CD83FC39166F2EB9DD3FB93E9372F9C65E90402A85228A643356FE372322C2A35FDF6F3D08D27F4D30
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="agitator1-6" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\agitator1-7.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.87605070393848
                  Encrypted:false
                  SSDEEP:24:JdfX61XrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7L:3fXmrTgqQ5Bo6z+pEm7T7Kcd5r9T
                  MD5:B6DB1953D467F0731C45FE9265AC895D
                  SHA1:233245EEC0C625B59ED8582DC180E9702895C4C9
                  SHA-256:659D0D5B8BA1899EF1FB194666016D3333496557D0A05412025FBE83CE40D070
                  SHA-512:C85078474C48B8D274719A0424174261CBE75712A5419A0652A04F64D2BEE7FCA60F41D208F585D5B9FE75F41CD1337D93BC93C3E3CF94E6BBD5DE692FF874FB
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="agitator1-7" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\agitator1-8.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.874323543505691
                  Encrypted:false
                  SSDEEP:24:JdfX6GLXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXbZ:3fXzbrTgqQ5Bo6z+pEm7T7Kcd3r9T
                  MD5:3C8E42CD106D8E387C88C4AB104F5462
                  SHA1:99A585A293BB4D838D8F7E8D5FB8478E8754EB67
                  SHA-256:0E852A7264FE1430B122BE0DFCBD8000D7DA272DDB8B6D4931A89E73F00DFBC8
                  SHA-512:94DFF248EE8CC022E4969F8683041C14118A6A5FBFC51599D930A17EF4781A38D68A2B3DE030A96C73FC7AF1C1530D12041CBEB4B097A803D2CDB38824B5C1DC
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="agitator1-8" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\agitator1-9.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.8743817742661575
                  Encrypted:false
                  SSDEEP:24:JdfX6fXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Z:3fXIrTgqQ5Bo6z+pEm7T7KcdTr9T
                  MD5:40CB57A2E198FACB859219BE46BA1A1D
                  SHA1:DE320E52953EDBCB12EFE440FDE0115597ED76B2
                  SHA-256:0784FBE53A2AB4D73B3E0B23506B018282406C0A6FF75CA455E3B388688BFA4F
                  SHA-512:3284101F42421E576493553FB68654E884C25E298E355BCA7C085A43CD64E689312E1EC86ABCDF0DC593646B32B064B55DA9935ED408883F8AA8E63110F94A5A
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="agitator1-9" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\agitator2-1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.875614253089499
                  Encrypted:false
                  SSDEEP:24:JdfXZXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Ka:3fXhrTgqQ5Bo6z+pEm7T7Kcdhr9T
                  MD5:1EAFE106B499C85BBA8E4FF7A8E1AB45
                  SHA1:FEDDAF571045511F518ECA33389E3BCCC87430D5
                  SHA-256:A1ADADDE8480231E5C15502881DBE753952319738278DEFABEF0A078B773DEEB
                  SHA-512:DAAF96EC4B4FED4527A0708CA900D9212105483C6E73DFBA4046A30CE3DB70BE7186F7180D74629ECB4E84B196460602D383636162D467C6DD9AFF6F5EBB35B1
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="agitator2-1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\agitator2-2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.876839756605719
                  Encrypted:false
                  SSDEEP:24:JdfX2zXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb78:3fXYrTgqQ5Bo6z+pEm7T7Kcdyr9T
                  MD5:AB090D5BE82D3EA328DEAD8E91BE0AB4
                  SHA1:85C24346FCCEF96288B64EA8754339B0DE378095
                  SHA-256:A24F8502CB4DFAA7CC0F50A3604B335E25062C1C6EB3D08ABC1298D54D15A130
                  SHA-512:6D4067EEF796AE2AC4559FE96E409A242A3A2F6DC071D53AF836AAACB60C6549D133F417C0EF12650B2C5B6972D6C3B899ED2E5B54EBDB12C3B519DEE4BE7356
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="agitator2-2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\agitator2-3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.878834627500801
                  Encrypted:false
                  SSDEEP:24:JdfXPXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KD:3fXPrTgqQ5Bo6z+pEm7T7Kcdsr9T
                  MD5:2DBC787F18CDBD1D247471EFEE4A6E88
                  SHA1:E991AE04804C74D5F15B68F90B2AADEE1F5A625F
                  SHA-256:A55A8B5FE11081D897AFB797269D60AEB5C23360FDBE155CE0F74054BB0660DB
                  SHA-512:C1E6750FB2A3967847883E97684D683D71E65F77816996511BB520DB2315A08FBCFADBCF06EE45F25EA330DC5FAE13E17A6B23782D856A3D559EBB30BA322EDE
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="agitator2-3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\agitator2-4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.87897354822359
                  Encrypted:false
                  SSDEEP:24:JdfXKXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kj:3fXerTgqQ5Bo6z+pEm7T7KcdMr9T
                  MD5:EB17B16C40C42A992CECF861CC02941F
                  SHA1:27DCDE9AA2CD21BBDBAE7A4F6AAAF5DA11B819EF
                  SHA-256:A040E3F097146032A5520A597A2E1E0D5D624322DE05100B4CD632E76C65267C
                  SHA-512:1C93FA5BFD2E1B8186C8FE41B6D03557C98764F66B3AF8ABF31AE6A3E0EA548EA7240A3F8348951932257ED08E2CB1057200E662E168760874F247CD22A413E6
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="agitator2-4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\agitator2-5.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.877336377790162
                  Encrypted:false
                  SSDEEP:24:JdfXdXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KC:3fXVrTgqQ5Bo6z+pEm7T7KcdRr9T
                  MD5:EFC7291276BF8EFC7B088C3C7B9FE77B
                  SHA1:CA66F96A0DE4BA48EF8AF4FA148428E6448A5455
                  SHA-256:F67B6A1BF633F15974776F8B9792CA060FE65B9A08E93D88D8E4CC0711FC530D
                  SHA-512:71EF14A9C02AB5B0876BEA02AA0573D86E649D757C05FB81B6A1BD03DD502CD8B9420B88D5F702760C8BBBFFD71429E08BB57DED9F20C55D64BAA86BB5936746
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="agitator2-5" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\agitator2-6.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.876761006218391
                  Encrypted:false
                  SSDEEP:24:JdfX5MLXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXbe:3fXSbrTgqQ5Bo6z+pEm7T7KcdEr9T
                  MD5:7618CDC80549DE3DDFC0E6A2179EF83B
                  SHA1:87A94AF367B2AB7115DDBF492395A4DB158B49CE
                  SHA-256:992016C961B9D3154C11422A0AAADB440F171DF3E3320779A53CA61E3CA32EDA
                  SHA-512:D6C7F99013D05A2641B699C008CE68FB18C485AC626F3E396DF765A84BFC6D10A3E0A0A83C6C883EAD31147040CDEFE4E8FFA1DAE6133771F6C37141788512DF
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="agitator2-6" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\agitator2-7.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2624
                  Entropy (8bit):4.877746454686627
                  Encrypted:false
                  SSDEEP:24:JdfXDXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kk:3fXDrTgqQ5Bo6z+pEm7T7Kcdvr9T
                  MD5:14AA0E6F4FD57C0D0974A0D4E325CF40
                  SHA1:09EABE5E9999CC6DC9E900B574F52B4AC8C43766
                  SHA-256:02A6F86B42DD5DC518DE2DA966B1E863DE910E6C3033F367172797DA2CF128B5
                  SHA-512:2A83FFA5F1616E5C699B53862136ABB5013D24FFB13D110055E342DF861F13F8DCEBACB0A112D1FCAA1DE321B5EB3207D64994E5BF7E01E8C0D49537CA4048EA
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="agitator2-7" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\alarm1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.867319325836012
                  Encrypted:false
                  SSDEEP:24:JdfGXrKAAOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcP:3fqrzgqQ5Bo6z+pEm7T7Kcdjr9T
                  MD5:AAF07AB97EA82B591F289AD7E5EA3260
                  SHA1:7E35742076FE35F48F6BA59061C8C3CA702FA519
                  SHA-256:1AF5B953018AE67A67271D7AB06BB1E4DB0542170077DA0FCB7C2DBAFC248D78
                  SHA-512:27DF0DF2290A075FDE06BCC43E7A271CC7267C5B022E94C7A4A519B3700D2140BD18A1765591156871B0DB6193819501685152A64623ABC3A0138D5EE1C366B8
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="alarm1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>17</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\alarm2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2614
                  Entropy (8bit):4.8657946313172395
                  Encrypted:false
                  SSDEEP:24:Jdf/XrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcU:3ffrTgqQ5Bo6z+pEm7T7KcdUr9T
                  MD5:2890DC3C7EE8ED9437D4D8BE6E62836D
                  SHA1:67AA6059B3DBD8379D5B90C2884B7D42E33CDA73
                  SHA-256:CE2BC5A3622C6FD47A5D318F4D333668020E455D388BB355A9B750F69774208F
                  SHA-512:4868FEEDF4171B5AF012B3A38887A7A075F9C4A6F75DF1ABF3A75E69EAF60B93B070819E513250244EBA9EB0CE93DA73954E9262189EA47D2030F0DEA59666CC
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="alarm2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\alarm3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.869480802710083
                  Encrypted:false
                  SSDEEP:24:JdfcXrKAwOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcT:3for/gqQ5Bo6z+pEm7T7Kcdjr9T
                  MD5:CDA707329A88BC6E67B7C7D2879245CE
                  SHA1:1F5A193900F59D4BB1DD9FF440D07485B9A266DC
                  SHA-256:DD3C71B266758FC522E492A0BD1A788DDBB81DBC997725616FB84FE9C3D058A9
                  SHA-512:881979A35A47D5AC7ECAFEB066E08C697E93DDBF41471928CB6377BDC371EB8C6141D60408750FA154BDF3CE1E487C972D09065C16E28CB1B871A484D34707DA
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="alarm3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>22</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\alarm4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.869731289146815
                  Encrypted:false
                  SSDEEP:24:JdfHtXrKA9OgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7K0:3flrOgqQ5Bo6z+pEm7T7KcdDtr9T
                  MD5:735A412FDC2F071033E882269F0C64DA
                  SHA1:9E78607DB76FE9B1B6AC18C099F29C3ABDB20B57
                  SHA-256:C78B5E3988C28C5E51CECAD2F28D18795FED1CB38D3738CAB48E4A98B9D8464C
                  SHA-512:516D5EF74AC8D291961EB671090C72EB636835970457960E5BBA250D00A1B56E687957AA7091D2399E24D95AE13C96E4C5069B49628DDA3FFD3025EB651D7E85
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="alarm4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>25</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\alarm5.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2615
                  Entropy (8bit):4.868294203731316
                  Encrypted:false
                  SSDEEP:24:Jdf6XrKA6OgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcM:3furtgqQ5Bo6z+pEm7T7Kcdsr9T
                  MD5:E5837826CD620CE0F7C375048E966E58
                  SHA1:922ADE0A5D878BE73CA872C8A6D8F1CA662E50A0
                  SHA-256:67F730A64F708766D2199B09DA885C57ACB7E7D7179E70B2D4102C7948043474
                  SHA-512:381A211F4A29FF24DDA75B2B8DE771085ECC28D6BB27E435A17AB770E8B1CB33E6A957A13E7CDABED9A3FE4BA76A918B708002AB7C459FA0200AE9D207671713
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="alarm5" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>24</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <S

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\augor1-1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2618
                  Entropy (8bit):4.874789931373989
                  Encrypted:false
                  SSDEEP:24:JdfPHNXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7p:3fPHlrTgqQ5Bo6z+pEm7T7Kcd2Ir9T
                  MD5:15C6E38CACB49298538E0754027030FC
                  SHA1:BD0E000901116356F2BD8D79BECCE80083BFA112
                  SHA-256:BADD164788263D02ABCF3DA9EF735341CBC002DF3A7CE69246C3AA764EECB56E
                  SHA-512:2CE1A12148BA7B2B2F0DFA165D7BFD212F6DC493B2AAABD8538B02BE80801F0A2B7B183ACA8DBA663963215B1751B1D4E80FF238803869F6E2C627B97E8AD7CF
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="augor1-1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\augor1-2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2618
                  Entropy (8bit):4.87559485233378
                  Encrypted:false
                  SSDEEP:24:JdfoXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcI:3f0rTgqQ5Bo6z+pEm7T7KcdXwr9T
                  MD5:8C28229A42BA6EB70740E88E57DA7627
                  SHA1:F24C3936F94936E86B4A4161602324375EA6A93C
                  SHA-256:79480760D569C16B42B97BF20C042D4C7F79EB5EB4481A115E53BFEBCCB1D95E
                  SHA-512:9EBBF31B45735A33F5E8388C4982B71B5C163D4FCC321621FA5BCA0234E4AA0D771237A5F59578D5171016FE6A4BB04E8FFC3D57BBC624D6FE9C07C9AA082CAB
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="augor1-2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\augor1-3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2618
                  Entropy (8bit):4.875010530069622
                  Encrypted:false
                  SSDEEP:24:Jdf7XrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcL:3frrTgqQ5Bo6z+pEm7T7Kcd7r9T
                  MD5:E78ECB21FAF0BEE15D95A4405B81894D
                  SHA1:C74EDF2585E566C3EAF65C003BF8830B33FFE713
                  SHA-256:6C9B000754A854390779430ECE82B5F208B792EC84991E53E6C0FA114102BC43
                  SHA-512:BAD114BB607C32E1866775C0F06B3AC380EB2E1821903078ED7B7B06ECBD2F5F56DDB8BFF82B9AC603C8DAF2673982D0CB0793D37B232B3D95E5193CC3E6CBBD
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="augor1-3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\augor1-4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2618
                  Entropy (8bit):4.878268250217413
                  Encrypted:false
                  SSDEEP:24:JdfuXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcO:3fCrTgqQ5Bo6z+pEm7T7KcdSr9T
                  MD5:C5D99F2623697262E0CD0EB78BF4CE64
                  SHA1:D3F34586BB9CB36A28534D9984701A0CCE4C8A31
                  SHA-256:C9DB4BA2143EDAD285566B009980172849D8E4F47F0BAF332308D1532C458A4F
                  SHA-512:2696B3203B430225D201B5B741C5F35C58AC6BFB0EE3B09DB42B95ADD82865CD8C4471A237A8C0B5D9E09C3443BB47C420B87B4808147EE1D7285152D603DE78
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="augor1-4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\augor1-5.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2618
                  Entropy (8bit):4.876108594873102
                  Encrypted:false
                  SSDEEP:24:JdfRXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcd:3fprTgqQ5Bo6z+pEm7T7KcdVXr9T
                  MD5:8C18F76F2DA45908081E53B4983D07C4
                  SHA1:D80C3B51500EFB6B0AC1663E4D70054001DC201F
                  SHA-256:0DB69D4C6D9B4504AE994BC104677A09267A3B551015DB83389919B3D830B2DC
                  SHA-512:E1D1DE5E7E20B91B9111BDABC5B39C0DE665BCE7B627CAC0A786993B278E0B0E62299413A77FFCA2DC7E9A650F4398726A8F7B1E7F9492DAAFAB0DE17759DC59
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="augor1-5" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\augor1-6.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4957
                  Entropy (8bit):4.830126418907615
                  Encrypted:false
                  SSDEEP:48:3fArTgqQ5Bo6z+pEm7T7Kcd1arfgqQ5Bo6z+pEm7T7Kcd3fr9T:orT0gUcd1arf0gUcdvrN
                  MD5:A3E3D0F7772AD07633CE8B2B3692B82D
                  SHA1:0E64DF2A4FABA51C80B57FCF55C7C8EA34496188
                  SHA-256:26A1F1EBC5C24D5CAFDFDABB3529559190761AD45C01742E2CF189E751626F3B
                  SHA-512:4D6DE67240276596B63772E1918C44540C072797B5B19A6389B5FF9AF682F984417587113B5FDB82450352901D72CB4B3D6B655F318A4B74FC8A64DBB0B7B1D0
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="augor1-6" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\augor1-7.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2618
                  Entropy (8bit):4.8760505845540205
                  Encrypted:false
                  SSDEEP:24:JdfnXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kca:3fXrTgqQ5Bo6z+pEm7T7Kcder9T
                  MD5:52D8CE3AAC964E440E17584584507F76
                  SHA1:C8462100C705FAD37D81F8A9AC7EBF7E79CC64C5
                  SHA-256:9BCD724394F0DD2430B2C74B28496902431ADEEE1E1987E17CF42AFBDF921A42
                  SHA-512:658716B69CB2330BD9A766AC0E8FED327595A47C094844D93A4A7775B369D88DEE391DE388E59EE135E3C013093D8CAE9F53C25C71E434D384B7647A808BDBAF
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="augor1-7" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\augor2-1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2619
                  Entropy (8bit):4.877704948239872
                  Encrypted:false
                  SSDEEP:24:JdfXwXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KQ:3fcrTgqQ5Bo6z+pEm7T7Kcdbr9T
                  MD5:72118F2D2A021AA57E70037068C32066
                  SHA1:7CDB38395AA889B61F04A5B6F0019A770828A104
                  SHA-256:E089A6222972E0192F69DCE1BC342449EBC7A448068225E05066F6A0CA9E43FA
                  SHA-512:4B616C634AD0404D1767EB4C6430DD4096519FDDBE1C363C3FE9312C3EBC2C0F53987ED15D6ACBA17C8A0989CC6A3A4BA75FB04E95582788A7AD82A73B1CE345
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="augor2-1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\augor2-2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2619
                  Entropy (8bit):4.8767051715114444
                  Encrypted:false
                  SSDEEP:24:JdfXVzXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7c:3flrTgqQ5Bo6z+pEm7T7KcdVwr9T
                  MD5:54CF320945482BFFB4003C6F9C210BA7
                  SHA1:7DF61CEC38E8ED4269AA4264A5D35F5C3AC4492E
                  SHA-256:C9008F577E0E38FA54411119D48842492E5DF5B18A33EE84A91DA6C8CF2752C2
                  SHA-512:9BA37F02B190F705B5114090ED39112FD860483D6A79AF2E6B1388B7E8CB3E3F1BA34A448D0CE151AFE02A8D8C09F2B41D280EF78E4D4AD0BC73CE9D40674B75
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="augor2-2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\augor2-3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2619
                  Entropy (8bit):4.878020499284662
                  Encrypted:false
                  SSDEEP:24:JdfXWtXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7n:3furTgqQ5Bo6z+pEm7T7Kcd9r9T
                  MD5:B679FC2EB44A0171CC5D1570DFDCA751
                  SHA1:0D1F27CE0460A4A9CF82969B046513823AF4C7F3
                  SHA-256:E77291BD243D6FFC69963CB9AE07FA7D778E09023B70020F0EB0FB20ABF3D42E
                  SHA-512:09F47122673A90C4336AA164C395B7B31B5857AD63E165C4368A2B7505A0F8A13A403BB830DD18F891EA91068F60237B6E5F21A45B50026B192A254F09286911
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="augor2-3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\augor2-4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2619
                  Entropy (8bit):4.87869191015897
                  Encrypted:false
                  SSDEEP:24:JdfXPXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7K3:3ffrTgqQ5Bo6z+pEm7T7KcdUr9T
                  MD5:5C841462FA1238E3974EEA196716F544
                  SHA1:913249DCBF83FD03CDC08282DBFEDBC879167332
                  SHA-256:076C5B879094FF0750080CF9FAB7FB0425AF4594267FBC3028BE8544A93654BA
                  SHA-512:570E72B423B9A4A9202520E23B653C2DCA9D593EFCFB6F30DCCE9378FA02A2D025CE69EBF05B6C12333299276F5795086F527EE29857E6AAF8BD708F17879CCE
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="augor2-4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\augor2-5.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2619
                  Entropy (8bit):4.878081188925997
                  Encrypted:false
                  SSDEEP:24:JdfXsXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kx:3forTgqQ5Bo6z+pEm7T7KcdCr9T
                  MD5:743B23A876DC3063EE9F4D5BD9DB33F3
                  SHA1:E5C1AC39557C208DDC09C34667D343EA4F3EB2E4
                  SHA-256:6DD9F975E5C49A965D6C2104786F57A232E7D55EF72B35440519E284C075295B
                  SHA-512:B25DD20281AB56BCB5F5EE05E696BCE9F4D2C11C0702F281D9D456A06C3FF8A138FF18C87D74C2FDBCB42130EDB3EE31548D8C0D2EE7FE7A1AD5F0D6D6E6EE9A
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="augor2-5" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\augor2-6.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2619
                  Entropy (8bit):4.876937064289743
                  Encrypted:false
                  SSDEEP:24:JdfXLIMLXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyX1:3fFbrTgqQ5Bo6z+pEm7T7KcdPr9T
                  MD5:765647FE5495478389B248CA832E4180
                  SHA1:9A9B88C1DA1E7BBEDADA317E594F7C3F37F45EF0
                  SHA-256:36EDAD0DA17C0431CD220C331AD6DD5C62B68365118D23520B844631E5A69CD8
                  SHA-512:E612F2098963D741B6E4A10B165F0993BD31776A06FC1E90CEAB5AC5BABCD2CC15A0A695D02EB9EDC39482E3E2613A23A59A78FC85406CB7EA2FFCC1E077009B
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="augor2-6" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\augor2-7.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2619
                  Entropy (8bit):4.878879090378777
                  Encrypted:false
                  SSDEEP:24:JdfXWXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7K9:3fqrTgqQ5Bo6z+pEm7T7Kcdyr9T
                  MD5:25F2D8386EC9B20B1D046D516615A52C
                  SHA1:FAFFF3015D30CC6E1568B349DF587DA2DC099DCB
                  SHA-256:1D0442B539051F867829840B2AA5235AC197C3B3ADBC7F86E545FDCF132B7D1B
                  SHA-512:99A20EF4352B48BAC5D582B1295CCB20B3A0CF55F6910199AFB3F6F20B3215475959AF80A9E48984E7E5DCA7695983F37816E4C8CF09F4F069533768EAD7DDF9
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="augor2-7" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\augor2-8.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2619
                  Entropy (8bit):4.87658097797188
                  Encrypted:false
                  SSDEEP:24:JdfXnLXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb70:3fXbrTgqQ5Bo6z+pEm7T7KcdCr9T
                  MD5:8586DBC735A06AC78115C666C833A404
                  SHA1:DD72DCFD404C7C0F816879FDAC63686BA78CA61E
                  SHA-256:E6E5C9C9247CF6B882CA9063C08ABA7D2E7F44F9DA305D649724EAA9CFAF642C
                  SHA-512:CF9047F1046B9FBB601C18448435C9067386980F988F5BDBC94F87F6328BD532FBF74F1B6386CD1D64E3CD4C4DF0B317D0F26BC8CD671320F583F04E4ACFA26F
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="augor2-8" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\heater1-1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.873832760624973
                  Encrypted:false
                  SSDEEP:24:JdfQXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcl:3fsr8gqQ5Bo6z+pEm7T7Kcdkfsr9T
                  MD5:7E0AF6B679C9E476BA522A334494494E
                  SHA1:C1B9188A4C7153D9941B5DC2FD752C7274B45D92
                  SHA-256:AD4BDFF41E374D4B886BEDC1926685FA84C3287FB64823F5837B99F3FC89D3BE
                  SHA-512:FCAA7E9AF66FF4D04CA1F0E8CAF046AFD841E824E0C1DA76BC796989D8F942937D85CB1A3E27FC3417160513B454D39E7211A34A34F4BF9498B8FA04A2F0667C
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="heater1-1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\heater1-2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.87390399854677
                  Encrypted:false
                  SSDEEP:24:Jdf3tXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Ky:3f3FrTgqQ5Bo6z+pEm7T7KcdHYIr9T
                  MD5:A4460321B9ECBAB634D9B59E6EBEB703
                  SHA1:8558D80FDDAA89B330D72316AE181C51784D349E
                  SHA-256:B57350524CF92B2ADA4BDCC0775EFFCC2B694AE17ECAD7B16E321C367134F4F7
                  SHA-512:E8FD49181C03553F0D2B5FCFAF35F8E0E44BD1BB22C5024E5B351BCA698415A2D2BAD4F646CC2858767A7851F2F3717B823F9590FA170FF876686FA9FB93EA39
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="heater1-2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\heater1-3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.873992494757911
                  Encrypted:false
                  SSDEEP:24:JdfqXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcg:3f+rTgqQ5Bo6z+pEm7T7KcdV+r9T
                  MD5:2D098BB557EE0D517D2949517F398E7E
                  SHA1:57ED5EB427AAC896756188280E5E5AA37A32598F
                  SHA-256:B3CD0F77578855CD36D56EA56F29C16834153884F97E9C99B2381104A0A41536
                  SHA-512:D7A0E1AE890A98E82FB7DE8D188B8B986B2E330DC35261EC8A648CB2E07E8115B7ED7545CECA32E19CA51507A5B20EB48D6AA80E3810261DA9EC041AF591690A
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="heater1-3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\heater1-4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.876171929275723
                  Encrypted:false
                  SSDEEP:24:JdfvXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc0:3fvrTgqQ5Bo6z+pEm7T7Kcdarr9T
                  MD5:0AFBE0F515DB31D7591EB07487D84AD9
                  SHA1:FA54D476D2F882C6E4A0046BB31DFCF5A750FFFD
                  SHA-256:4CA07B0B57658E246A8974C59A74D4B53F6DFCECD2D395C84460AD5A3DF93FA2
                  SHA-512:DBBD6635C7815B399D066F2AE74C6E479180F87406A3B06533587FABA08B8EE91B24846FB8FDE0DEC6D843ED5DEE5D09517B6C7E6FF97D1AF6AC8E4778E55DE6
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="heater1-4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\heater1-5.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.873747613656944
                  Encrypted:false
                  SSDEEP:24:JdfMXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kch:3f4rTgqQ5Bo6z+pEm7T7Kcd4gr9T
                  MD5:CE031BDA78F258DE1C53C8CFA5E0930F
                  SHA1:346E4E9ED544C57A30933EA849234DC697B79284
                  SHA-256:B6EB83C55A306BF48009DC6D3CCEFDF89D7A4A8C9CC775988258C34CD095F4BF
                  SHA-512:7675830B79AB107BA537EC898E1750532D6817783492B82291C7C7741FDA50B0041B8301C79F895E551FB44248EBEA49823EC18D0FE38F177BCAE881756A1B59
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="heater1-5" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\heater1-6.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.873620937846839
                  Encrypted:false
                  SSDEEP:24:JdfRzXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Km:3fBrTgqQ5Bo6z+pEm7T7KcdnNr9T
                  MD5:4048F953DE06D05C50FB512241323864
                  SHA1:66650B2B731E7D442BE3050B40C9849207864F61
                  SHA-256:8460408C2BD8B7F2431646CD2B570B76B1EFFD9E4A8646DF4D03A954DD6717C8
                  SHA-512:821C4A95FD9E9EABF1AA4EAB667CBAA5F16DD727A8EFFB40957A223E6D53276C4416BC0FFEBF8C2338DABD2BE3BA194F3AA22796DE75126DE1DE7C7BC2F9628F
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="heater1-6" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\heater1-7.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.874721444901761
                  Encrypted:false
                  SSDEEP:24:Jdf2XrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcR:3f6rTgqQ5Bo6z+pEm7T7Kcdiqr9T
                  MD5:8EB630FB673499EE1F183B417F156DC8
                  SHA1:E32C6D7C90D7EEE1B185DE6249D2B24F9261A272
                  SHA-256:7B76DFB71843BC6282F0519109D4F0FC7C522CE706C515199090FB8E87397F36
                  SHA-512:1C061E1C21EA9A05439C2B34918F6565FA6931A7DA12AA1F7F32482223C1F02F93457B9B8B3278D83151AA0D57FB0AA4659BE60ED50062BF90E6F4DBB4F05A00
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="heater1-7" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\heater1-8.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.874971453310942
                  Encrypted:false
                  SSDEEP:24:JdfHLXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kx:3fHbrTgqQ5Bo6z+pEm7T7Kcdk3r9T
                  MD5:01CEA2294AACA88BB6F3AEC6DDBE4065
                  SHA1:A3D533CB21D2E5A915150E68C32711BE69F57D10
                  SHA-256:EE34E370843B143F826A9D951D2B65083ADCA613C52D06D0BAFF531364F19B8F
                  SHA-512:D184C1AF0C21854B1EC8D97250901D6D0404C37C4641266B6F9F19156E976BCFF4F521F49930278836350B9204F64A519F9CAF446A62880CD759C7DFFDB87217
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="heater1-8" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\heater1-9.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.874150259201005
                  Encrypted:false
                  SSDEEP:24:JdfYXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kci:3fErTgqQ5Bo6z+pEm7T7KcdNsr9T
                  MD5:FD579B468671C8ED8EDAE1C12EDEB394
                  SHA1:ADAB64B69669B941A1E75E53B75AA6A31F918D57
                  SHA-256:B606239BC2AC63FAD157412E27BD2E22E80B0D49E85FEEFA2E7E137A714C0C72
                  SHA-512:E481783DEFFC1EF7CD025938983D24FDECDB2AE68EE1378E3EB42F2DC96963150CB03AE9A14BB1D2DF0015A72F35A68406BF725F8043441735D77E94182403E4
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="heater1-9" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\light1-1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2618
                  Entropy (8bit):4.876970715559622
                  Encrypted:false
                  SSDEEP:24:JdfLXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcl:3fbrTgqQ5Bo6z+pEm7T7Kcdxr9T
                  MD5:4F21BABB51AD119CD8F88F882C968328
                  SHA1:BF1CA9B52C72E4075ADB0BA65D9FE3AD2E55440F
                  SHA-256:325892AF4AE210786306F0B3B55BFB34B4476A01994D0D04AFA2A678D8DBB087
                  SHA-512:EA4B0FDD17B1961CE3E021734746E9E48273B0944E2A029882CE02D17A269ECFFB26D8DBB6C77389402CBB2CDC6898E67A18951092CC411F089D310AA23E7507
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light1-1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\light1-2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2618
                  Entropy (8bit):4.878806707619347
                  Encrypted:false
                  SSDEEP:24:JdfSXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc/:3f2r8gqQ5Bo6z+pEm7T7KcdRhr9T
                  MD5:AC15BA86EA385515F7150CF01DD364EE
                  SHA1:35E7559566E4EEF58BDD91C97C9E8BC2C236F7CC
                  SHA-256:2AAF84599D4CE6213F75424F55E3B1FCB14F69B7293ADEB59ADFA0A083D3591A
                  SHA-512:534994397884F2DBCB3833EB63AD30341FEFB085F7EF0549947F7C6EAD455A0D8161511027D0DC8552BB120BE55600DEB8761D3803A0EA029300231D1485947F
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light1-2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\light1-3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2618
                  Entropy (8bit):4.879162565192702
                  Encrypted:false
                  SSDEEP:24:JdfftXrKADvKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXbC:3ftrxvjgqQ5Bo6z+pEm7T7KcdVur9T
                  MD5:9F34715B3C202480CE58CC23B8F5473C
                  SHA1:2701CD205D290873BA2A39AE7CF7A3DAE4EF98C6
                  SHA-256:A6D95760AEE69CF282A0771DF1E6BF8B2286BAEBE8795C1550BCD46B55FCEDD6
                  SHA-512:B794B2E329C1813EA4976F0AF4B2411F844ED0DD4652BB400E1AC0D1E3AC5A2F141C79683211F12C9563E0D3ADEFFB126D3DCCF5105747DF9497661B2D08AC2E
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light1-3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>8</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\light1-4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2618
                  Entropy (8bit):4.879133198441453
                  Encrypted:false
                  SSDEEP:24:JdfqFzXrKAxOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7r:3fwrCgqQ5Bo6z+pEm7T7Kcd6ir9T
                  MD5:54C74714EE95DEFAB49D1172591700A2
                  SHA1:64E34B098DC61E9B20FDFD9A45C3C48AC458D314
                  SHA-256:556DA9F81B8132472E7BA7DA2F2FD9AD48ACEFB602D1720FC2A27FDE2FE3316C
                  SHA-512:37D9AB681EAD8748D45E2063B4BCEC252F540409B219CCC2CC1242CAD5877F43A47E41FE4EFA1693AAAB32CFEB129D5F8D1167C934E790518EF058F6EA3575BF
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light1-4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>9</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\light1-5.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2619
                  Entropy (8bit):4.877756501518328
                  Encrypted:false
                  SSDEEP:24:Jdf3XrKANOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcQ:3fHr6gqQ5Bo6z+pEm7T7Kcds7r9T
                  MD5:CC8113386615189E407202774C6A6CAB
                  SHA1:F65DBEDCB4219D0D11C4A171BAA3D8206D5BF6ED
                  SHA-256:95D9FD69009FD4956C8D9D3863F269C1FEFBCD1731A3168DBECA5C37B39F2765
                  SHA-512:C0C9BA83A5F57FCB6E9BAC345BC092802B213842EB4BD367223DFF06195B9A0DFB45C216C9119523F93AFC658CC3C146A8E866E366DEA6AB6EA4867AF3818EB8
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light1-5" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>10</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\light1-6.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2619
                  Entropy (8bit):4.880326058007569
                  Encrypted:false
                  SSDEEP:24:Jdf+XrKAKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcH:3fyrZgqQ5Bo6z+pEm7T7KcdLr9T
                  MD5:9FE31F74E3B6FC18E59AE9A4D788C51C
                  SHA1:353B80F7D193A763495C4FF9B258BA9B0C1F9CC4
                  SHA-256:56817F9526BFE20A21BE8E21A2C8A1B5DD1EF965E99CFB1C007090C2156A4D53
                  SHA-512:A54E1A387C91A0DEDAC734C26576056A1F078ED7620ECC95CEF3F64D8C1D18B05D86C01172F92216C9EA5EE40FDFE5E8CBE1C055DD51E09D33DC957F69CDE246
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light1-6" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>11</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\light1-7.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2619
                  Entropy (8bit):4.88064783187985
                  Encrypted:false
                  SSDEEP:24:JdfhXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcC:3fZrQgqQ5Bo6z+pEm7T7KcdOr9T
                  MD5:824D499D6F355EB7F77E9E5051C72336
                  SHA1:86AB53B202A266C2C2139793904DCDC97687A0DE
                  SHA-256:50DFF2FCD2AB55C19F8291463D860FD14EE2D6C28F65EE88ADABE542AF33680D
                  SHA-512:221CF62EDD214981A29260D7D9E68B09C1E5ED8596A3B8FCFB9E5C87839270238AA9619C032FED1E28483BDDF972455166D7FCA4F7708E6D11086CC25C650CAB
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light1-7" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>12</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\light1-8.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2619
                  Entropy (8bit):4.880787017819751
                  Encrypted:false
                  SSDEEP:24:JdfCLXrKATAOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7S:3fCbr3gqQ5Bo6z+pEm7T7KcdPMr9T
                  MD5:91125AF480021E0C242411DDA3E0C9B8
                  SHA1:D3C2CE791FDA50B6449BA36515596CC6D6A28967
                  SHA-256:B18D91DCD73869DA0DE59ABF34B2E9335657F835E7D76B70C5022574D9683A71
                  SHA-512:868D3302B21A9843823065D94F035433FA06188B5FC183DB8E9C2E35C4E19141BB523CF10CB3F827C536CF92410188445762D8F40E30A26D8E4A56A2BDA167F4
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="light1-8" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>13</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\mashimaro1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.868646615939453
                  Encrypted:false
                  SSDEEP:24:JdfOXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc5:3firTgqQ5Bo6z+pEm7T7Kcdhr9T
                  MD5:F17FBE2CED216A657128713B295ED0F4
                  SHA1:2FCD15C6DBED8C92B4BBD1ABF404917ACCAC34B5
                  SHA-256:4E09D711FADC91AC090CD2CE8826DCC2BDCCC1F0C2798F4656DDF29CAA334596
                  SHA-512:F5106521874C14F9A324C87522909711995DEE8339B66A3E5E8F31AF7237BB954133AAAC8970032AE213F0E1E06AF85BB4369D05D04BF732B43EDCA024C008EB
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="mashimaro1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\mashimaro2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.870569633650261
                  Encrypted:false
                  SSDEEP:24:JdfHXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcU:3f3r8gqQ5Bo6z+pEm7T7KcdEr9T
                  MD5:9A72CC07E4E6231646F91D1FF28EE70F
                  SHA1:EA184881366F7A5927BFB9EC60AB74694F8E820F
                  SHA-256:352004A09900E8F1853CF1D8DD72C831B97842850573FE99A7EB66F14F969E9D
                  SHA-512:EAA4D2ECB00BF11DF41A18D5B59A5D47150BF2FCA2C6CFAC27DC163B0E1A5D641EBE2F8094E4137D7F0DA3B9B120C7FAB32AE769B8B157AAF2B7C7CBC637BBD3
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="mashimaro2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\mashimaro3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2621
                  Entropy (8bit):4.8692849563955685
                  Encrypted:false
                  SSDEEP:24:JdfEXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kck:3fgr8gqQ5Bo6z+pEm7T7Kcdxar9T
                  MD5:0DA994297F172A95CCAF3AB960B7CF59
                  SHA1:CEB1DEE12C36FF34FAB0894E3FE3B29150993936
                  SHA-256:E14CFCDE333D47EE945559F75874BD0C218EC8FBB3CA2F02376D12CB55EA348C
                  SHA-512:F73870F29704C0502E2F7F195D26FCA7E0A22666C265E033B1A610A5CBF379D8F5D7326E6668A477D00A8723931ACB389902E7062879B90E84699C1ED48FFE64
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="mashimaro3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\mashimaro4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2622
                  Entropy (8bit):4.870242070362458
                  Encrypted:false
                  SSDEEP:24:JdffNXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KL:3fflrTgqQ5Bo6z+pEm7T7Kcd67r9T
                  MD5:F97821D0AB2227EAF4D707675278E3F4
                  SHA1:6CE02D304A6BA98292B474191259EFA055B40F61
                  SHA-256:8A2EAC5957A01678384D0F66B68BF953891B923D8FF32D1E0AD2D1A55E2AFFD3
                  SHA-512:5DCAFCB9DBFC2AFCBBD8004BD6AC5C18B93973E3F003C90F9D1AD04165817D0428B2E6BBE2B39EF2DD6021CB79BEF17BB4C1D3E7DD862021E6A937E35B317109
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="mashimaro4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\mashimaro5.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.870650135444719
                  Encrypted:false
                  SSDEEP:24:JdfiXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcP:3fmr8gqQ5Bo6z+pEm7T7KcdHr9T
                  MD5:E7BFD635CE117C58E56AC0F8536B14FF
                  SHA1:97AF2DE7A689DF3DEB075BFCFFE9C0D2DDC3E566
                  SHA-256:D2DCA56FFBBD8F380BD9616C67A72014D7EB1A9FD632C3F72557D585BACA33E6
                  SHA-512:26E59B59657A6BA89A95ECB31B419D5014AFE12EF792798E4C90FE307D4A7D40A941715D8391F258BE632EC3D3F366337E8824E97E7C41C6B8DB3E5C7F8ACE24
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="mashimaro5" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\motor fan 1-1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2628
                  Entropy (8bit):4.873015003306535
                  Encrypted:false
                  SSDEEP:24:Jdf9RXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KB:3f/rTgqQ5Bo6z+pEm7T7Kcd2r9T
                  MD5:01159D62F0E28BEF7F871EB8316EDBAC
                  SHA1:80C8042F951F8BEE43F2157DC6433A7D534004F9
                  SHA-256:F356068029243FF396B230AD52EAA69C1F190750CD87AE8CFD44BD7EA36F88E8
                  SHA-512:398ECC646FE19DC70EDAA063DA62D4C3063C025D46AE004E56BB9299804EF17FA09BA3E3D1F2370374EC368EF63C5FB010B1EE32464944459E5DEA757CF1D42D
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="motor fan 1-1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\motor fan 1-2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2628
                  Entropy (8bit):4.872025755017125
                  Encrypted:false
                  SSDEEP:24:Jdf9kXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Ks:3fKrTgqQ5Bo6z+pEm7T7KcdTr9T
                  MD5:D627950A2544C6653D3424234FF28186
                  SHA1:B8B1194414F5DDC83DF05EE67E65632F1A9FC3F2
                  SHA-256:67551111DF5DE689E851BBBDB44526A242FA80B101FEFFC6267CED346961DCB2
                  SHA-512:7147ECED0EAD3A4094465EF726BD712C7518109734B0912DB18DCD6AF3257253F5512A7513885EC05F7BE1235F32C4028D09D3058DBFBE6F294D4549B7AFB4D9
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="motor fan 1-2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\motor fan 1-3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2628
                  Entropy (8bit):4.872711833031752
                  Encrypted:false
                  SSDEEP:24:Jdf9nXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kh:3fRrTgqQ5Bo6z+pEm7T7KcdGr9T
                  MD5:53693012BD46D34E9A6B2CFF0C0C0D2B
                  SHA1:FA6E2A10325E968FC1289B82B6F535B8708F6B15
                  SHA-256:0389E92288EB994A87C021238BDDDE13DD1135ED31D932EEB993C2067D25CCB4
                  SHA-512:1134297477126CD03DABD3FEE6428E22CAF6E499F560CF9D78FC7349C9FC4B9132C0EF5B48D504A744A51165E7839BF20329280FC6F2BCB96F84341DBBA3035E
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="motor fan 1-3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\motor fan 1-4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2628
                  Entropy (8bit):4.872525293840095
                  Encrypted:false
                  SSDEEP:24:Jdf9CXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7K1:3f8rTgqQ5Bo6z+pEm7T7KcdSr9T
                  MD5:33A7E6323E1ED742F38939801CE12FF3
                  SHA1:98DBD26614E50EBD7041E91A87F67D6F76B0CC34
                  SHA-256:E634CE12B4BEE394142C04C98F986E536C8EB0E56E221F14DECBCDD03E8659C3
                  SHA-512:794D796B76475B699F2099C85BEBB658BEA7BC9454E31424314CFE59DFF5D79D01E432DB8E6DA62FF0693A74862C907D8A55409008FC86C01DDFBE43B87EF974
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="motor fan 1-4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\motor fan 1-5.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2628
                  Entropy (8bit):4.869915991629562
                  Encrypted:false
                  SSDEEP:24:Jdf9VXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc:3fzrTgqQ5Bo6z+pEm7T7KcdV5r9T
                  MD5:2982CFB43549FB9D18143B9DF5E825CB
                  SHA1:C336028B6C425E77C65C45A49CB86E50478AFE1A
                  SHA-256:C8780A7D1FDB0A0AA7C4C91DD1386A6B01EF4DD94F3469813542E0042B3B60CA
                  SHA-512:AD94009D1814BE213CDA8A5EF95F869593B0BF88754D52CEFE47FB03C1C1BE7FA1E77180022609328EB9E73EF751C2ED91F9DA94829B4AE230BF69B6806BA353
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="motor fan 1-5" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\pump1-1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2618
                  Entropy (8bit):4.881126460406595
                  Encrypted:false
                  SSDEEP:24:Jdf86XrKAqOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Ky:3fJrNgqQ5Bo6z+pEm7T7Kcd/r9T
                  MD5:93C50850B7A40509B6592C451603D39B
                  SHA1:30B0450180B3833D7A6E5676A86C623E62FDF5A7
                  SHA-256:1373CD307CD96C1E065215ACE2D65CBC80D61264FE530D8458AC4977BFE9E911
                  SHA-512:2FA5AC0DB22C69CFF6831CC10C0B0E8524A4C9C7A56F84B664FCFF4D0D51CA2A0B0056610B59CDE1F73AB2FC11E603B8DD97A8A22DC4500BB40CD84DB99E3698
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="pump1-1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>42</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\pump1-2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2618
                  Entropy (8bit):4.8812065024456235
                  Encrypted:false
                  SSDEEP:24:JdfEXrKAPOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcI:3fgrEgqQ5Bo6z+pEm7T7Kcdbsr9T
                  MD5:13CBA0DB9BD47640AC43562CC9BE5685
                  SHA1:F6F2FA864AE5D1321522FB0B5F7B927AEC483816
                  SHA-256:F42A155270D9446C63A09C07399DB21051287ED425FCE1527424FCE894D0C04C
                  SHA-512:8652B15FBEC54CAD2E45983868FCB6676B6B86A700316B58023C98C078BF0D98A98D9314B7C17C6CACA9C7C820E69082EE1DCA414E818C5332C9A81DE3AD6DBB
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="pump1-2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>41</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\pump1-3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2618
                  Entropy (8bit):4.880876894853309
                  Encrypted:false
                  SSDEEP:24:JdfHXrKA0OgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcO:3f3rbgqQ5Bo6z+pEm7T7KcdCr9T
                  MD5:B020AF4693685CFF3C9EAD1FEF098E16
                  SHA1:F3A4421723DDA15F520AA761192FD2DBCF55F2E3
                  SHA-256:A5DB9BDB392251288225C9A9FB4D32AC61B4B5C967FD91C1C12EC8DA85DA3EE5
                  SHA-512:5AA935B70754B3FD4F90D23191B4669D44A2FB7E41FEFB16C7BE9EBD3A38CD376B20E3CCD3A9EB7DFD93FAF6390FD331914C4C7ED641576379F8C1F89DC00AC7
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="pump1-3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>40</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\pump1-4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2618
                  Entropy (8bit):4.882826894887298
                  Encrypted:false
                  SSDEEP:24:JdfiXrKAzOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcx:3fmrEgqQ5Bo6z+pEm7T7Kcd6Sr9T
                  MD5:98BF5A7C9C14BFA234B522BCFCEE58D5
                  SHA1:84B1BC80044595B5E7AE3675E968DB3CC7CD0B5E
                  SHA-256:C80866AEE04536F0066031C71F68579294DB581158346D2AD5345F5B2319F079
                  SHA-512:D153E7B7AD273A10AC234602EE40C45A7DD032BC70F95DF7E8072FC139D20D6229D1EA08D6E34FF9DEFE19B318B65C760FD7D0CCA8F1C49ACB7B074C8633C138
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="pump1-4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>38</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\pump1-5.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2618
                  Entropy (8bit):4.883574853642086
                  Encrypted:false
                  SSDEEP:24:Jdf1XrKAqOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kck:3fdr5gqQ5Bo6z+pEm7T7KcdDcr9T
                  MD5:BBB7BFE27607ED66C79E00A58E60783A
                  SHA1:173284B5C8A7B7D5459E6CE44D533C3C309C23C1
                  SHA-256:A28BE4C2059BB9F6057557D1F951CADAAAD852123508E8415582E04B45BAB434
                  SHA-512:BDE1F975C3FB654A31FBCD5B9C15992B87467511E1B785F8FF21310AE545CA0F07FC1A72E765DEB8D3DAA272694C509C7FB921055FD2E133FC70FE5ACD8E461C
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="pump1-5" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>37</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\ring1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.868721287282193
                  Encrypted:false
                  SSDEEP:24:JdfTXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc9:3fzr8gqQ5Bo6z+pEm7T7KcdvOMr9T
                  MD5:E8441437C46C95140A84C23035E1F64E
                  SHA1:AF45292A1AFAA0812BEC705DAA8D9ABDB4E6406F
                  SHA-256:C40B6DAF8CBC3646E74E1AD52658CBC9D02E499860B14A27D92DCFAD3F57F5E1
                  SHA-512:0ADEA7BE485349620E73FA4A399A176805D857FF80DD7A342EDC52EE826945FF59BE7E66134ED5960622CCE09372D00F32350CFAE6E12851742728EC2E773EEB
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="ring1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\ring2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.86758642032922
                  Encrypted:false
                  SSDEEP:24:JdfaXrKADvKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb78:3fOrxvjgqQ5Bo6z+pEm7T7KcdgJr9T
                  MD5:EEAABCDA8CCACA044664160640B6C9A4
                  SHA1:396885B9078AAC81E3D0576105562CB760BE10A6
                  SHA-256:BE33D033211CC30B34B9AD5A77C8E193670C777D6F69563F46D4DECC45817928
                  SHA-512:15102B51ADDA2FCC401AACD397EBB052BCD582CF1BE0B1B7B23FC391D2969596B5CF94BDE495D4FF795DB630F8E3107BC887B6C44E617BCAF60E59D80C698DD2
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="ring2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>8</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\ring3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.86988351068144
                  Encrypted:false
                  SSDEEP:24:JdftXrKAxOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcu:3fFrCgqQ5Bo6z+pEm7T7Kcd32r9T
                  MD5:FB2964650BF2CA03D78A7D3E7BAD98E8
                  SHA1:1A0AEBF993AE535A5D35F40BB9DDA3EC53EAF0CD
                  SHA-256:DA49BC5479AFFBFB38D8566648227FD7B6151953AB9827E4704E6F8B507FEC8A
                  SHA-512:CF91B5091AFA07D94F501C60A8F09CCADB16806DD779231F2237A8A7B292182D3C7C61A82BE3F5F0096EC73B9427C6D7619FDB0FF45F220E5CA9E3F32676833D
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="ring3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>9</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\ring4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2613
                  Entropy (8bit):4.870223464498669
                  Encrypted:false
                  SSDEEP:24:JdfGtXrKANOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kx:3fGFr6gqQ5Bo6z+pEm7T7KcdGjr9T
                  MD5:BF8576D674B845CB4A63F963246C915F
                  SHA1:D91B56BACC496B20ECF2E68D7EB9A79630671BF2
                  SHA-256:CCAD932AD6C1A570EE292639FCD374BAAA001A6B84858D7FE3885268C47D5585
                  SHA-512:08AE8C289EA0EE7B53EA218AB397D922754648BF737F536C652BA3983448FA3095D37A998BA79E11F4AA17BF266B68CEFCC98DEBB51332E4ED790548CC220598
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="ring4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>10</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\ring5.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2610
                  Entropy (8bit):4.867259249547325
                  Encrypted:false
                  SSDEEP:24:JdfhtXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KC:3f/r8gqQ5Bo6z+pEm7T7Kcda4r9T
                  MD5:DE7137482DB63A8B5EE51A4F37155733
                  SHA1:9936899D69D410E7BC81A042991D92FEFBE9C5CC
                  SHA-256:EDE90B1BEDB344EE91A3187E62F9736387F52560FA7C791836111D34A4A5C620
                  SHA-512:055022A813AD85FC2FD42115EA3D498055809B412C8D3C1B09EA5587BE2A9DB5EE3E9A25644607DEBB85CD01ABD8856FAE840D215A1B941BCB75C212C2B9A940
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="ring5" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\ring6.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.869976402768189
                  Encrypted:false
                  SSDEEP:24:JdfmXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcr:3fKrTgqQ5Bo6z+pEm7T7KcdRlr9T
                  MD5:F791F658876924EA532D3452A8EB4E94
                  SHA1:47C7184E9CAC1500BA49401D60FA6111AFF3A5B2
                  SHA-256:5B0C5794630DB8DCBB83CD3869A623AC0E858416C2F6664134A4F3225BC5FD86
                  SHA-512:AFC4B5D6E29FE93D8F069D51A921031DCB27E60F94E6C0BCC6716BEF9EDDD4FBC8EDED7CB9A0042748BE9253CAD8CD9D6249769243019710A57D2215E78BF86B
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="ring6" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\ring7.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.871059685277924
                  Encrypted:false
                  SSDEEP:24:JdfpXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcZ:3fRrTgqQ5Bo6z+pEm7T7Kcdsir9T
                  MD5:FA5168324577FCD7831EFCB4256205D5
                  SHA1:41034814CACEC57A71173264A0E1985C6E291B46
                  SHA-256:7F510247B93AB9B2B76E6FD36A30F46081C331C982D445C9FE1E63781EAF9E84
                  SHA-512:39931C38C6D6E06C4B28ADC39EF534D63DAEC5A543E4EB41A42A8C86CE4CECB0C7CFD1DE57E967B47AB342BC2E4DCDC7D998080011E8CB4065A3A4A70ABC19BB
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="ring7" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\roller1-1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.872541399666137
                  Encrypted:false
                  SSDEEP:24:JdfrHXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kx:3fr3rTgqQ5Bo6z+pEm7T7KcdpDsr9T
                  MD5:B7967F8598AEE0DC704F4B762E649704
                  SHA1:AFB66337DE9FC6CB6E3B8D681EDCEBDC7962030D
                  SHA-256:F293A6AFF80EBA91D5FD39D82AC6358B5A57E4EF90635D501D58C0AF7DEEE258
                  SHA-512:B4C39587369F2954EE82F286A67F29DD45F54B952677885372E223645E08F5776B2C5B4AE707F072860739430B1F13FECF1EFAC6B40C398E11EF78891B6F8EFD
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="roller1-1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\roller1-2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.874046034623782
                  Encrypted:false
                  SSDEEP:24:JdfrOXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KX:3frirTgqQ5Bo6z+pEm7T7Kcd0r9T
                  MD5:2FAD466411CEB3B9B7635866F783B167
                  SHA1:1AC7EBD37DDB3C3301728211CAF99850A2ADC3F0
                  SHA-256:4240A511E67362501A0049F7FFF14AA33E23AB7A0517D3676E45F9C137892B07
                  SHA-512:0FBF7495D9A7B0BF659CFAD13DF500DB597A6FD30C6ABC1E5CC4B9117AFCBA8F3623514BC1A9CA88A4AA3B89BD14B3EEB0B8FC86C0C5F95C700703DCA7E3F151
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="roller1-2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\roller1-3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.873757909622956
                  Encrypted:false
                  SSDEEP:24:JdfrxXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kh:3frJrTgqQ5Bo6z+pEm7T7Kcd7ir9T
                  MD5:08A6DDA6BD31BC79BAB58BC041AF775C
                  SHA1:ACBBBB4B3A702647C71013F9E3EB695B6436E016
                  SHA-256:639607CD251E68EEAAFA296E6FF0D3AF9A2FC2057428E1EB52D9C159A46F4CD6
                  SHA-512:2C17C629104355280EF9D0363ADFD36B5D1DE147D7A5BB97C1431ED507B8230CA191A153A592F306976FC35014EF710E81732E409D478D9AF5900714EBD39051
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="roller1-3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\roller1-4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.874007918032136
                  Encrypted:false
                  SSDEEP:24:JdfrIXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KC:3frUrTgqQ5Bo6z+pEm7T7KcdFr9T
                  MD5:17E6459B7B0E01DEB4E1412AC128E4B5
                  SHA1:16A013F9CFEE2527D70853838F452F4E3C075A20
                  SHA-256:0A9F25DC22078447A7B98B7ADFC65B1B85DB436FE3C51922E0736306C8A10998
                  SHA-512:57C811FF06451DEA58511611D2D45BAE6A22F8575B84C15DFDF4AFE5E5A95B2ABBCA626BF5854ED2D7DF63590EFE9B7BD4EB547EAC80FCA5A0CC99BF8E022992
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="roller1-4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\roller2-1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.872311109996622
                  Encrypted:false
                  SSDEEP:24:JdfrmXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kp:3frKrTgqQ5Bo6z+pEm7T7KcdKr9T
                  MD5:CCC74D4EEF752E37A77DC025D9D73851
                  SHA1:404BC61BFBB46078DB85F271CF749246B8F71601
                  SHA-256:850A5E1859E71A5689FB5B576900398AD3E4D6F994EA93D60F8BC40135E2B003
                  SHA-512:E09D2DC0FBB184167EDD5E0FA70A0B87E7E3A66C078ECCEFE781200ECD48068EA17353915D661EED0A661D1978FC425F0F7EC46311B24C09D8ED7D06AD060E61
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="roller2-1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\roller2-2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.872658449882026
                  Encrypted:false
                  SSDEEP:24:JdfrfXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KQ:3fr/rTgqQ5Bo6z+pEm7T7KcdzDr9T
                  MD5:C74EB432595E2721E2210D270E80BC0C
                  SHA1:B6243801E1CF0647AA29FF1898BF8C581B6DE229
                  SHA-256:B48D5F105D68ACE90273AB35EFEA428E54C28E86EE7F5D45B0AE32162979979F
                  SHA-512:E88017BC1AA992A08150166CBB7889D600AF489711BE6DDD8E22C08CE3EF5AE375C90286FFFEFCFDCC4831EF40E0B8732E892BE64538F52C1C3F47322C38C8F4
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="roller2-2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\roller2-3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.874690110031661
                  Encrypted:false
                  SSDEEP:24:Jdfr8XrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KV:3frIrTgqQ5Bo6z+pEm7T7KcdVDsr9T
                  MD5:008CDFCA15EBCD24642AF535CD7D1C20
                  SHA1:BC3506444CE0D9EAC808BA693D2FEAB58ACB2671
                  SHA-256:F0B906F61C1054E1B63884E7429B0AA6947FF1D71CA8AFBD76929E9A9AA93A95
                  SHA-512:E49EF7A0405CC926C3AF0A70420D69B1EBC8A17640B614112C1C0AB20870D48948D61719822172D815BEF3160D32C25A472879AB1A3E33541F226E1BC76F6C0C
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="roller2-3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\roller2-4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2620
                  Entropy (8bit):4.874690110031661
                  Encrypted:false
                  SSDEEP:24:JdfrtXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kp:3frFrTgqQ5Bo6z+pEm7T7KcdWr9T
                  MD5:F1910AFE0FBEF6E07EFAD710C4653610
                  SHA1:2966E21F135F8B72D6729C873CE0D4A42FCBD18C
                  SHA-256:ABBD86105F754C2AB2686ECAA78B781A65B82B39AF7CCD246B4DBEEEA6DA1AEE
                  SHA-512:9BDBFC8AFBF0A5576759741C329C14D7A6EDCAE92FE1ECBCB1252338DFA2C17AD461F107AFDDDD3D3FD4CFE60CEC67E326207AE2E85FF473681BDA12ADC73E9B
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="roller2-4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\smoke1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2614
                  Entropy (8bit):4.871382366137667
                  Encrypted:false
                  SSDEEP:24:JdfaXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kco:3fOrTgqQ5Bo6z+pEm7T7KcdmNr9T
                  MD5:F83FED62C30FB0452F0BC80215023AC7
                  SHA1:D2266292C2DC01C001F947DF41314F371232ACFE
                  SHA-256:BD912E52CD5C3D7842C13A8E584AD2EFDF7E5B0E670086F5081EA1CBC9A3E3A4
                  SHA-512:5F8CF3455E46152636118F73C512D6E074F744AA2E1050C6DD3BE01CE923CC5709958B23C642224179EC2CE5AB0522B9058C1684FA4F7B87747B44DF914D35E2
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="smoke1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\smoke2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2614
                  Entropy (8bit):4.8709666129550735
                  Encrypted:false
                  SSDEEP:24:JdfTXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kci:3fzrTgqQ5Bo6z+pEm7T7Kcd6r9T
                  MD5:0B8B7E468CBBF40B0BB2A44561761463
                  SHA1:A49E1661BBA0C856DC10E108A961128921685220
                  SHA-256:EDF7EF5EA5AB93FF603A7A7A3830FA73A38072DF9F9E391641538FACB4D47FC5
                  SHA-512:962F5C42FAD6CB2E18EE6C8E59121DC5053E6F75E75E55271BE894244E965D19C7C21C2C88AFE13FA997717E91199C27C529540BC858CDB0594B291B993EC7A5
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="smoke2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\smoke3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2614
                  Entropy (8bit):4.873112845918561
                  Encrypted:false
                  SSDEEP:24:JdfAXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcC:3f8rTgqQ5Bo6z+pEm7T7Kcdy3r9T
                  MD5:A45A50229ED8D2586C05DE556338A29F
                  SHA1:91BB4E97DF22863B4C735A52D1278866366D6954
                  SHA-256:5053CE6C568E9880FDF2B24E87AAF6072E4DFDC6E1684CC87FB5C7346F1EBC6E
                  SHA-512:0C2D3B4EC8D42C234FB8D8AD84F0AEC8CE78C47452178B98E0DA5DF78D062C2197534C87B70BCDF015E5C14BA232C51D30E99B8EB0BE92724FB12D3B6D65BEDB
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="smoke3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\smoke4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2614
                  Entropy (8bit):4.873566568870853
                  Encrypted:false
                  SSDEEP:24:JdfpXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcw:3fRrTgqQ5Bo6z+pEm7T7Kcdkr9T
                  MD5:42F43308885D84D2DB4D06D7B98C83B8
                  SHA1:EE69972ED0DBA6D2E23DC9B932C0925D27E53174
                  SHA-256:A7CE0F15B38B50BA4F36CF42BD64217B8075E36F851A4B1BACEA1656458D16D2
                  SHA-512:83113A57E326A8E3510CAE829DBF0AB51917D10BA12C69E1CE38A1D2169057D7BE9E9C8F59454D810ABE63BB9EFC8FCD00971C4E0603F36E612FF17AC948F0C0
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="smoke4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sc

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\trafic light1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2628
                  Entropy (8bit):4.873199531211347
                  Encrypted:false
                  SSDEEP:24:JdfKXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcL:3ferTgqQ5Bo6z+pEm7T7Kcdywpr9T
                  MD5:B8D8883D7FC28454AD728E0BCD98901F
                  SHA1:58F17B903063B174F0F866CA7C10675F155F56FD
                  SHA-256:94D497810F6D3195970304BD017A2B6632F176BDE751D39ACF712936292D9900
                  SHA-512:54AFC7E41A99B7F6E7F443F5C677B3D8FD5DA302E6AEFE0D7764571220ECFAA582B6CB38CD27633D4A17AF73C01EC5B28D60635989CBE7FCA0F522EB3A20C326
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="trafic light1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\trafic light2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2628
                  Entropy (8bit):4.873996277606024
                  Encrypted:false
                  SSDEEP:24:JdftNXrKAvOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KB:3ftlr8gqQ5Bo6z+pEm7T7KcdNsr9T
                  MD5:A50564BBFF9EBAF29C43DE9A83810920
                  SHA1:CE1F3AA0A0AEA0F1E5741DA16412681B9E4831CC
                  SHA-256:9013B7FD4DE78DAC796E25A1B1E5ED8D04F3DDF5A32520DCEBCD9D8E2AFAD655
                  SHA-512:EBE9CAE2E3A3CBB31A1EB5E03DC99495C735EB66C9165C6546CE0C8B26D12F6C5F4395111AF033969BE8FFB7C8831A19FD3456286D39521080B80C39B2A57F95
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="trafic light2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>7</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\trafic light3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2628
                  Entropy (8bit):4.874602680971106
                  Encrypted:false
                  SSDEEP:24:JdfwXrKADvKOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7i:3fMrxvjgqQ5Bo6z+pEm7T7Kcdw3r9T
                  MD5:9FB4D9E80AF69240911409DEE4509CD1
                  SHA1:50A48B517FEEE59587335B62E2C612EF361ADD2A
                  SHA-256:288CCA5A4CAF33FEA7E224A4F819C8C676BAD0A8CDCA76849351A25424D5D913
                  SHA-512:FBA51B386E0B92DAFBC0A46AD4478B0BC013DA2E2D2E53B37103B8F960523C9AB35B416DDF9EB5DF004A30BA6277EA466C5C7DA769E57A881BA9BAF872F9ECA7
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="trafic light3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>8</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\trafic light4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2628
                  Entropy (8bit):4.875417638904925
                  Encrypted:false
                  SSDEEP:24:JdfZXrKAxOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KcH:3fhrCgqQ5Bo6z+pEm7T7KcdCCr9T
                  MD5:34B506C5EB959B6CF43B4C2126588098
                  SHA1:74C83B17C3991D5E893F8635E45987EC4B0C81DC
                  SHA-256:D9F04DCA718412331B995C9D33ED331AACA38B318E9161ADC74BFC9E854543C4
                  SHA-512:DB4BEC42EE1522630EA906D075748B2E000F6DE7B0EE138FAFBE56EBA105A29A1A055702EA8CB3C7A0A5B76F3302AA0E7E4AFE2E07400AE816BBF1CBEAB0B136
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="trafic light4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>9</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\trafic light5.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2629
                  Entropy (8bit):4.87443644890647
                  Encrypted:false
                  SSDEEP:24:JdfWXrKANOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kcs:3far6gqQ5Bo6z+pEm7T7KcdKFr9T
                  MD5:9868846C831B6B715975C761E4A0F1D3
                  SHA1:E6D8A3154860B90526128F2CF0624A88D63667C4
                  SHA-256:DBE2D6A05929802A1B96F055AA671CA5D720F38CA6FD3F8C3AB9C95354F7FFDC
                  SHA-512:F737A9E733017FC53B09B1CC62AC9FB107C919532AF2B3A328218B8AFB4DE09AFF8AED262AED81E46C8A2DEBE080877B63ADC21EC4E666FF62A34679DFFEEE4F
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="trafic light5" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>10</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\vu1-1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.876177583808652
                  Encrypted:false
                  SSDEEP:24:JdfGHXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7Kc:3fErTgqQ5Bo6z+pEm7T7KcdMmr9T
                  MD5:11CEBCDF52F77089BE89FF3D25692F94
                  SHA1:A59E2015C2ABCD68E06A55FEFE06CDBCEDEA6156
                  SHA-256:51798BBA158C2E911898282B8896346BDA3D8D11D90E7EDE1172287A84D0B0E7
                  SHA-512:40DE339BF9E4C695854F3F152A6677ED8E1337F91A356DD8105C0E12CB4CAAE0E88937532F330374C384467ED218268602A658CA1DBBB3809838195D570764A4
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="vu1-1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\vu1-2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.878099608150133
                  Encrypted:false
                  SSDEEP:24:JdfGOXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KK:3fNrTgqQ5Bo6z+pEm7T7KcdhHr9T
                  MD5:7D306EC406236E498133F5A0F725E401
                  SHA1:806F25C03CA2C51BC63FA735EA3C1E79482DC59E
                  SHA-256:621AEDFFE093DF0FB866FF8A46551B82C628F2CAFEE58EA3B48C22B6C4CDDF68
                  SHA-512:5C5E0333166D8E1638AFA05B523AA2EEC1344AEC733EC2F9F5D574E262135AD373814E0EA3D686D987234D4400F1F19B4317800BE27C2E310486BEC78F255A6F
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="vu1-2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\vu1-3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.878303309901909
                  Encrypted:false
                  SSDEEP:24:JdfGxXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KE:3fWrTgqQ5Bo6z+pEm7T7KcdK8r9T
                  MD5:FE21C0BC812ED9673A48C3BD0B3D8D5B
                  SHA1:409637A2B18F751A9995BFDA45F82C7CB496FDB0
                  SHA-256:A8CE8EF3784F9C212A65653D5E6315D6E321280DAD8B34086C31CF4D8F3869A6
                  SHA-512:9472DCCA2D91068B60CDA14658C5843ABFEAA70AF7AD5E4B0F1DAEAFEF212B9E3D645C040D29B061BDC7FE7439896D8B27ADFA7C75A8FED3FBE98378350AB43A
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="vu1-3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\vu1-4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.877937601274611
                  Encrypted:false
                  SSDEEP:24:JdfGIXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7KV:3fnrTgqQ5Bo6z+pEm7T7KcdjOr9T
                  MD5:84948DB153C2FCA2DBE7CAE1B8CFE69D
                  SHA1:CE6734A5E3A721B0C7143178BCCD773AB29A569A
                  SHA-256:E7D0361794DBE17FADD2F32F4936C1EE52E5F7A57CE1A07763B2D8C834AC0258
                  SHA-512:1F141A57957DD5249F94A30D0D23DC80621F4D95A4E99154DC6CA39CC9C7DDEAF86BE897CE6E10BC0DA1BA1F16FABE9100ABC2699AC24B7D366CED2B0042FECE
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="vu1-4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Symbol\picture\vu1-5.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2612
                  Entropy (8bit):4.878278621981546
                  Encrypted:false
                  SSDEEP:24:JdfGttXrKAUOgqQjVXxWnOIOqOtyO8OGOKv60L86GYKI67FFOwnn5tyXb7MyXb7y:3f4FrTgqQ5Bo6z+pEm7T7KcddSr9T
                  MD5:B167D3ADAA0502702098F6B510406E10
                  SHA1:2232F44B7806A2BE3C19AED66FBD3EC0F9E594D6
                  SHA-256:A827D90E1A1ACCCB4E5F96E4DE34D6E8E775371871D778A653DBAB0361A82819
                  SHA-512:F9A126DAEAA1C737BD24E035D1F738540FF9912518735F6CF99949033A08E53AC89E2899DD81F82CC59F84918C009BC0D36AB277BFBA233B1F9992D2545BA95C
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="vu1-5" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="53" Green="106" Blue="159" Alpha="255" />.. <Event />.. <Image>.. <Version>1</Version>.. <ID>6</ID>.. <Fill>.. <Version>1</Version>.. <UseFill>True</UseFill>.. <FillType>ONOFF</FillType>.. <OnOffExpression />.. <OnColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <OffColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <MultiExpressionList />.. <MultiColorList />.. <ArrayColorList />.. <ArrayExpression />.. </Fill>.. <Transform>.. <Version>1</Version>.. <ScaleHorExpression />.. <ScaleHorMinValue>0</ScaleHorMinValue>.. <ScaleHorMaxValue>0</ScaleHorMaxValue>.. <ScaleHorMaxPercent>0</ScaleHorMaxPercent>.. <ScaleCenterX>Left</ScaleCenterX>.. <ScaleVerExpression />.. <Sca

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Lib_Net\Template\Template_2.tpl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4947
                  Entropy (8bit):4.908246775725239
                  Encrypted:false
                  SSDEEP:48:3fKrRxd8trxa5joL2kj6nvgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6Yrd:irLdSr5L1qv01GQucVzlzB4pruq5vv
                  MD5:172D43D7C1FF09E916B42F48CD3B9EF0
                  SHA1:D99024F97428FAEE9B179C2D566020B47BC68763
                  SHA-256:491E6BE8312D1DB9821DCB5F4376F4D666CF8A0FDC5F9893856E922942A137FE
                  SHA-512:8C3159AC06E3B0C961DB631806EBFF3F4B2B29EFCFBD513291B95622B0B3925612FDB3650D6D02EC85C809D9D1E616FE964EA7054683135B9BEB176665241357
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Template_2" Width="1024" Height="768" ViewPortWidth="0" ViewPortHeight="0">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>3</Version>.. <Type>Color</Type>.. <Transparency>0</Transparency>.. <ColorType>SolidColor</ColorType>.. <IsPrivate>False</IsPrivate>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <ImageStretch>None</ImageStretch>.. <ImageAlignmentX>Left</ImageAlignmentX>.. <ImageAlignmentY>Top</ImageAlignmentY>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Animation>False</Animation>.. <TagNameList />.. <ContextMenuProperty>.. <Version>1

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Symbol\CRANE.SBL

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):266191
                  Entropy (8bit):3.5550873812434216
                  Encrypted:false
                  SSDEEP:1536:R9vWKLLPB3M+JVCYpwRr6suOK15luLhbUMnhMXh1eNEUaneKhoBHIIdhEm:RFi+JVCMwRr6suOK15luLAhOEUapm
                  MD5:C0E476C0DBA0C5807554EAFEA7DBB303
                  SHA1:ED710B39C546AF4AB0CF57A4EBFFB60D1F8C85BE
                  SHA-256:55093BB9A66ED828DE31ABCACC1A448B83D54256273DB63DD9B3A07A8BEE9F03
                  SHA-512:9953B47F5A5C5A50567F59F066FEC8D1851201263FDC5BA198AE0283B40FAF703AE1ED5953A1C876C5941F0EEFCCF25275F3E80900C5772CDAE1999041E1D8D3
                  Malicious:false
                  Preview:........CDrawSymbol...............................................................................?...?..........CPositionObj.........................CDisplayObj..................................CSliderObj....................................................................................................................?...?..................................................................................................CDrawGroup...............................................................................?...?..................................................................................................CDrawRect...............................................................................?...?....................................................................................X.M_X.M_..............................~.......1...........................................................~..........?...?........~.......1....................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Symbol\PART.SBL

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:SVG XML document
                  Category:dropped
                  Size (bytes):298736
                  Entropy (8bit):5.893281686131548
                  Encrypted:false
                  SSDEEP:1536:bbLw2LGFLveQVkqF2oAmM/xtVWLkpLdj8XNb2Pr9BJBObrYbNwqlcoTBH7b4pejT:05VXVkqF2oAmiV/LaOh2cbbV
                  MD5:D208FAE310C2EE3DA117B858FEFEE82E
                  SHA1:E6309F0DEC4BE5FE44216548FD74EF978FE8F815
                  SHA-256:F2D99D90E5506AE8FAF7D2A4E4E0BE18D031691CB90EB12F53E46930735D47A0
                  SHA-512:B0A67D0353905AB854E71D4B4597BC0AD0A98FA3262A7E225ABA11E49C3CBBDD570C9F196CA078A04C3FAB1A24F8410B33B4B99A9217FCE49857073A72B0AE49
                  Malicious:false
                  Preview:........CDrawSymbol...............................................................................?...?..........CPositionObj.........................CDisplayObj..................................CSliderObj.........................................CDrawSVGImage.....................................................................+.........?...?..........................................................................#C:\Users\weiyi\Desktop\.....-2.svg.........................?.......................?....................<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">.<svg version="1.1" id="???_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. width="108.621px" height="70.69px" viewBox="0 0 108.621 70.69" enable-background="new 0 0 108.621 70.69" xml:space="pr

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\Data\Template\REPORT.TPE

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:Composite Document File V2 Document, Cannot read section info
                  Category:dropped
                  Size (bytes):3584
                  Entropy (8bit):1.4896254777277078
                  Encrypted:false
                  SSDEEP:12:rlR2FQCb77/F4lGjup7qgEH3BNSuoY1qv3ZhfKF0lk:rYUc3rShSe7Sal
                  MD5:1C1317C9A647DB4ACCD1FAD68CA1B0BC
                  SHA1:94450F51D6B5C6620AC80048E85F3867A6B44450
                  SHA-256:22A86A6F8A5ABFBAF21F2C27810AC9656A0E850651E2455158D0B3238EBB52C1
                  SHA-512:E6CDC5B2483D38F38D66306D01442040DE42B11A347F811A9ADF43F4C1F4EC2A0C23330F26275DB8680FD8843BE165A932C4A86E53446B52ECE8019C09AD34F7
                  Malicious:false
                  Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Config.dat

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:Windows boot log, header size 0, 0x2000001 valid bytes
                  Category:dropped
                  Size (bytes):226
                  Entropy (8bit):3.892289024450244
                  Encrypted:false
                  SSDEEP:6:s+tTGalw/BsfutwLhIdkXylY/sqmAwMnup:scwltxmXye/dm7Mu
                  MD5:A8344194A9125E7E07D2827BD8290C5F
                  SHA1:5867078C134B721034FD298A04010ABE87EE0DDE
                  SHA-256:F40513EDC0CF42677DA4EA2DDC48985C2C717E7DFAB44E3A6B9F6A12E5F2F790
                  SHA-512:A1B301750E7A68DD6586CD749EA34B68FBD3CC05ABFC752A4DF602E077BC6FB1B155527A0DDFA8088E5BDE96EF18202BE46125450F543C99C905E8B6D11DB71E
                  Malicious:false
                  Preview:...............................'.............8613800210500.....9600,N,8,1..........2.3.Lang.mdb<....F.............i................g..............CServerItem...AlarmServer..........EventServer..........HistorianServer.........

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\DemoDotNet.csp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):5248
                  Entropy (8bit):5.235481090841039
                  Encrypted:false
                  SSDEEP:96:62iRljsltwljnsq/QEBd8bNAVvJxE44aDf4B49yQ4F:0ReASqTYNAVct
                  MD5:695A60C75AD932CE90821A538D419F4E
                  SHA1:D55C5097D49162DF61C234B3604E9903411C70E5
                  SHA-256:D904E7DFD12A3CF3CA73AF1DE5345B926A5B4FF27063C66BC7A0DF87813D6729
                  SHA-512:B29304C369D266B102C02CE94AC7114212EB167B829411CDF4BFAF4F7594D0629A09DF01878D721050396B325480B33E118FC210F014C4EC0514FE1246C29A51
                  Malicious:false
                  Preview:....CProject.....Schema.AlarmList.AlarmValList.AdvAlarmList.AlarmDispersedList.AlarmAnalogList.AlarmExtendFieldList.EventTimeList.EventTagList.AccelList.UserList.UserGroupList.EventList.EventVarList.SettingList.Type.PrjType.StartupPrj.MainWnd.Pwd.bUnknow.dwUnknow.strUnknow.ProceduresList.MacroItemsList.System_NetConfig...........................@X.CObList........CAlarmVar......CAlarmVar.....AlmTag.AlmName.AlmDesc.VarTag.VarTagA.VarTagB.Category.Class.Cause.Resolution.DBLogIdent............DigitalAlarm.DigitalAlarm.DigitalAlarm==0.DigitalAlarm==0.............DigitalAlarmcause.DigitalAlarmResolution..CObList........CAlarmValVar......CAlarmValVar.....AlmTag.AlmName.AlmDesc.VarTag.VarTagA.VarTagB.Category.Class.Cause.Resolution.DBLogIdent.VerVal.EQVal..............ValueAlarm.ValueAlarmName.ValueAlarm=10.ValueAlarm.............ValueAlarmCause.ValueAlarmResolution....Y.......CObList........CAdvAlarmVar......CAdvAlarmVar.....AlmTag.AlmName.AlmDesc.VarTag.VarTagA.VarTagB.Category.Class.Cause.R

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\DemoDotNet.da

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):2674
                  Entropy (8bit):5.106748990487428
                  Encrypted:false
                  SSDEEP:48:19gmo9bPmjrTYmjUmjxmjEMmjTmjUmjXZmjlmjI5mjjmjD+mjRqmjVmjfmj2b/mD:19g/9r4TYBw2wH+Z0J5su+beEVb/v1Cd
                  MD5:8C25DCD4DA26465E9E0B5BC1312A1E9B
                  SHA1:7E1723BBB09B9A229464DE3690DE56657C8B14BF
                  SHA-256:DDE08BF0AEFB5DEE07658F413A04A64FAF5FA247CAD17FC92A5A022FF5F5544D
                  SHA-512:F69863BA061D9BE3C686F9291D724145B7E03061274F578BE9DDEE2FDD641AD26B6966CC96AFFBD85C0FD0CC57BB29B259C3EDEF958FEC14C83591E8AD3CFE7E
                  Malicious:false
                  Preview:..CTagDataManager.....nVer.listTagDataGroup........CObList........CTagDataGroup..CTagDataGroup.....nVer.Name.nCommunicationType.strCommunicationParam.nUpdateRate.Desc.HistorianServer.listTagData..............Memory..............CObList........CTagData..CTagData.....nVer.Name.DataType.Address.TagGroup.Desc.HistorianAddress.............AlarmLong1.LONG..Memory..L1....CTagData.....nVer.Name.DataType.Address.TagGroup.Desc.HistorianAddress.............DigitalAlarm.DIGITAL..Memory..D1....CTagData.....nVer.Name.DataType.Address.TagGroup.Desc.HistorianAddress.............ValueAlarm.INT..Memory..I1....CTagData.....nVer.Name.DataType.Address.TagGroup.Desc.HistorianAddress.............AdvanceAlarm.REAL..Memory..R1....CTagData.....nVer.Name.DataType.Address.TagGroup.Desc.HistorianAddress.............AnalogAlarm.REAL..Memory..R10....CTagData.....nVer.Name.DataType.Address.TagGroup.Desc.HistorianAddress.............EventRestriction1.DIGITAL..Memory..D2....CTagData.....nVer.Name.DataType.Address.TagGr

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\GridLines.lot

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):40
                  Entropy (8bit):2.3195179762781586
                  Encrypted:false
                  SSDEEP:3:/lnllZlGWG38ln:zhGWBln
                  MD5:3267EC2259BB5C4F05C5A51AFAEBC8E4
                  SHA1:CF99049F6DB4AE29E995B820E61B1E4D9BD29194
                  SHA-256:4604F5C50C7BBC3562D959B48754D644ADF4D572EC00D1144F794C06A4083919
                  SHA-512:A318C3850EA57DF6E39D33BEB4E3A6DFB0EBA51E8935824709E8A28B2CA2F15E5D34B4A97C1D9AFFCE2C3B2F2C3CA55D09506CDBBC5D3F9255A5DC9CCBDE4BEA
                  Malicious:false
                  Preview:....c....................... ...........

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Alarm.scn

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):103034
                  Entropy (8bit):4.892943247109546
                  Encrypted:false
                  SSDEEP:384:kkTPkCkIkFvkYGk4IDk1ksDkYGkVPknkiJkYGkrGkxkOokCkIkE6YkCkIkKuFkC4:5eNEF4l3YT1HBtzAkqa4aDJdc8
                  MD5:2028D9FCEDA8B0BCA04BC779036B1B31
                  SHA1:B3E2A60FA90EC6D11BA9B330243892C06B4D44B1
                  SHA-256:EA4396F2F860BE04E836E423D723CE150EA0865CF0E280EAB8E454414872C4FD
                  SHA-512:AF5EF6970CE7FBC8209E5E1BD3BA876AF89D1E1AE754A2E420E6DC4BB10F3171BAE4B2976F5C927743BA18B05AECAADBDB0F4ACD11CB9E32B2060FB7A0CE18CC
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Alarm" ShowMode="Overlap" X="0" Y="131" Width="774" Height="608" ViewPortWidth="0" ViewPortHeight="0">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event>.. <EventElement Event="WindowOpened" Action="Expression" Parameter="AlarmScreen_load()" Level="-1" />.. </Event>.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>3</Version>.. <Type>Color</Type>.. <Transparency>0</Transparency>.. <ColorType>SolidColor</ColorType>.. <Colors>.. <Color Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. </Colors>.. <IsPrivate>True</IsPrivate>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <ImageStretch>Fill</ImageStretch>.. <ImageAlignmentX>Center</ImageAlignmentX>.. <ImageAlignmentY>Center</ImageAlignmentY>.. </DefaultControlBackColor>.. <DefaultC

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Boom.scn

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):340035
                  Entropy (8bit):4.335245373907293
                  Encrypted:false
                  SSDEEP:6144:fFKedxrI9lGoyMllLJVESGQZNIXiIMDVDcCIEhdMCWLhwcp+uInhcMFUwdGmBr3v:fFKedxrI9lGoyMllLJVESGQZNIXiIMDl
                  MD5:7AD174FEF0D60E30AF5D949AF69A70C7
                  SHA1:AF73150AE346E9C82E1E31CFEB2A674007E2052D
                  SHA-256:CEEA285005FB2AF009C315F195E2BC0012BDCA11A25B18DF95F0CEC1F258D6DB
                  SHA-512:652375FA3D69A0A3DECABD605AE35C18C2B32FAF88F247C9ED0F7DA549A09F61655A2F3B0F172F97F548DA98F09CDA675B1FEDBA4C01B5F2D8FE386EBC45D860
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Boom" ShowMode="Overlap" X="0" Y="131" Width="774" Height="608" ViewPortWidth="0" ViewPortHeight="0">.. <Template>.. <TemplateName>Template_Realtime</TemplateName>.. <IsPrivate>True</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event>.. <EventElement Event="Periodic" Action="Expression" Parameter="RunDemo()" Level="-1" />.. </Event>.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>3</Version>.. <Type>Color</Type>.. <Transparency>0</Transparency>.. <ColorType>SolidColor</ColorType>.. <IsPrivate>True</IsPrivate>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <ImageStretch>Fill</ImageStretch>.. <ImageAlignmentX>Center</ImageAlignmentX>.. <ImageAlignmentY>Center</ImageAlignmentY>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <Default

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Crane.scn

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):932005
                  Entropy (8bit):4.283740246675634
                  Encrypted:false
                  SSDEEP:24576:HAl4zGkt/o7Jyoy1W3sXDaw18CA9tfHsIiaPIQ9tBvyOuXVFCCTu1sqXFSqQ+eys:9
                  MD5:48D7CD48DFFAD71BB2B479E576D93C5F
                  SHA1:4804360BB1603D3F119F47A268D23EEB0D9788BD
                  SHA-256:82DA846E0F3B068443C7CB05F664D90933157EF8E84A019EAB1AF5BAEA0EB77F
                  SHA-512:18E239C1182591CFB8B8B689F7CEF8BE7FAE5692B8A9248548B0297FC6A4EB3B883AA2330B6FDB2464AFA57B1E25A274CCFDEF472D6E592969A7FF8F7F185E82
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Crane" ShowTitle="False" Drag="False" TitleContent="" ShowMode="Overlap" X="0" Y="131" Width="774" Height="608" ViewPortWidth="0" ViewPortHeight="0">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event>.. <EventElement Event="Periodic" Action="Expression" Parameter="RunDemo()" Level="-1" />.. </Event>.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>3</Version>.. <Type>Color</Type>.. <Transparency>0</Transparency>.. <ColorType>SolidColor</ColorType>.. <IsPrivate>False</IsPrivate>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <ImageStretch>None</ImageStretch>.. <ImageAlignmentX>Left</ImageAlignmentX>.. <ImageAlignmentY>Top</ImageAlignmentY>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha=""

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Debug.scn

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):53520
                  Entropy (8bit):4.797026467230831
                  Encrypted:false
                  SSDEEP:1536:TyW+7BW+78qctWcHn+71T+7ByGcNI+7ImcND+7F:TyW+7BW+78qctWcHn+71T+7ByGcNI+7j
                  MD5:E36E9D1C3B0B7E2EBDBEDB42B6311F0E
                  SHA1:3544DBCC3CC5C57DB44FEC3A0EE1BAFDB7F1A773
                  SHA-256:ED24FED107238B7BFE65E7C5A314755AAE59E1B354F38DF76699B23BE7AB7408
                  SHA-512:C1424A7853F379DDD9DBBEFA30A229974FC4449068FEE51DB364F2DB143699E81A4ADA1E9824906E4944A27F57FD69A170198204DD3103E5E768A377E2AA65F7
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Debug" Width="1024" Height="768">.. <Template>.. <TemplateName>Template_Realtime</TemplateName>.. <IsPrivate>True</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZONTAL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit=

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\EStop.scn

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):166598
                  Entropy (8bit):4.8677530898932755
                  Encrypted:false
                  SSDEEP:3072:QnDFit/XxWLvktPJYtlSFac0JwryaqHEFJ0ZXPplB:QnDFit/XxWLvktPJYtlSFac0JwryaqHb
                  MD5:652FA3A0C4EED2760AF11865F8F6A7E0
                  SHA1:5CA2ABF0E15D6625D5AD09F25CA4B62477DB5422
                  SHA-256:FE46DE9B19A638269CAA65DF2F2B3EFA87E2BA5B7B9F0D26270E9946371B2BBF
                  SHA-512:13343E587B94CEF5BA37A35683F4F8B385B03DDA42C6826CB93A14A5CCCB7EA5236B4304C367A356B7C37940E0A6061E13E4C273F52EB63F2BC15C53D3BF9D98
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="EStop" ShowMode="Overlap" X="0" Y="131" Width="774" Height="608" ViewPortWidth="0" ViewPortHeight="0">.. <Template>.. <TemplateName>Template_Realtime</TemplateName>.. <IsPrivate>True</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>3</Version>.. <Type>Color</Type>.. <Transparency>0</Transparency>.. <ColorType>SolidColor</ColorType>.. <IsPrivate>True</IsPrivate>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <ImageStretch>Fill</ImageStretch>.. <ImageAlignmentX>Center</ImageAlignmentX>.. <ImageAlignmentY>Center</ImageAlignmentY>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Animation>False</Animati

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Gantry.scn

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):672853
                  Entropy (8bit):4.760605374584135
                  Encrypted:false
                  SSDEEP:12288:O16ucR6Q0yi7HpIV3ZY2NJpoA2lKXGSsp+r3I8jJsmE9ErSVAvhcCpzEqf2L28Hq:O16ucR6Q0yi7HpIV3ZY2NJpoA2lKXGSJ
                  MD5:33B265796D2C9198DAA1E897922B6BC5
                  SHA1:489A2D7FEBFD9C469C6C28F28469AC628CE24A01
                  SHA-256:1ADD836E2EAE28C613D7DD9A6A5FD510BF203428E26B100DCA38540779F0601A
                  SHA-512:F18253CE6B6A729BB542428010A3F543C2A8ED66498664763E67D935B8BBBCB2B7EAC4C670CB69985E739234CD2A6657C1C3EA98EE8E95EF2DBF9C2714006FC9
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Gantry" ShowMode="Replace" X="0" Y="0" Width="1024" Height="768" ViewPortWidth="0" ViewPortHeight="0">.. <Template>.. <TemplateName>Template_Realtime</TemplateName>.. <IsPrivate>True</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>3</Version>.. <Type>Color</Type>.. <Transparency>0</Transparency>.. <ColorType>SolidColor</ColorType>.. <IsPrivate>True</IsPrivate>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <ImageStretch>Fill</ImageStretch>.. <ImageAlignmentX>Center</ImageAlignmentX>.. <ImageAlignmentY>Center</ImageAlignmentY>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Animation>False</An

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Hoist.scn

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):337014
                  Entropy (8bit):4.8421431077982096
                  Encrypted:false
                  SSDEEP:6144:UJYsYJu4eSBIntRCVblASZkup31sQFjwtLZtxICT4N2Z9kiRKYYaQZdJCgpYislv:UJYsYJu4eSBIntRCVblASZkup31sQFjY
                  MD5:4D8C62DFED5407AB47EB7427FA7376FB
                  SHA1:715372CABBD3A048C538FEA41CD97164B46EA1CD
                  SHA-256:2F7593F10DBE954B816565FA2FDE449ACAA7026AE765D0E8FF5FE99BF7A2797B
                  SHA-512:90076EBE1BC2C20AF51871D06EB486601440EBF52E30025E96CD2ED40A59022FA5AE3D48383B9BDF48D7C2E3ED58A42340096ED769513827DDC30B04FE6156BC
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Hoist" ShowMode="Overlap" X="0" Y="131" Width="774" Height="608" ViewPortWidth="0" ViewPortHeight="0">.. <Template>.. <TemplateName>Template_Realtime</TemplateName>.. <IsPrivate>True</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event>.. <EventElement Event="Periodic" Action="Expression" Parameter="RunDemo()" Level="-1" />.. </Event>.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>3</Version>.. <Type>Color</Type>.. <Transparency>0</Transparency>.. <ColorType>SolidColor</ColorType>.. <IsPrivate>True</IsPrivate>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <ImageStretch>Fill</ImageStretch>.. <ImageAlignmentX>Center</ImageAlignmentX>.. <ImageAlignmentY>Center</ImageAlignmentY>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <D

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\ImageList.xml

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4202
                  Entropy (8bit):4.493788254018935
                  Encrypted:false
                  SSDEEP:24:JdMPtzUeSboHubp5dC0BDyLBw21zDAa2AUzsqKsKS5dNBvu56xy4gQM5RvaVd21H:3MVzUeGhbbdYAa2JoqRKS1FOtcDVRG
                  MD5:FFD62B8DC526D3BF700CAA1583556DB8
                  SHA1:2A19E34489ACF92D59C9AAE52785F5E2B67CC38D
                  SHA-256:0BF44512FE2F845B09A25EE269B4187A8CA62E3B2D8883FB0043747A5CBE840B
                  SHA-512:4DE4C36C042E66512373550F76E3972485C52BDDE0E98C8F418F1C739D7554DC454E169E9C9636F1846E1E985397AEE5F8AAA0F7BA613E37467F4522FF28BE78
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<List>.. <FileType>ImageListMgr</FileType>.. <Code>20110420161609812</Code>.. <ImageListMgr>.. <ImageList>.. <Name>Image_Symbol</Name>.. <Size Width="32" Height="32" />.. <TransparentColor Name="" Red="0" Green="0" Blue="0" Alpha="0" />.. <Images>.. <Image>active.png</Image>.. <Image>alarm list.png</Image>.. <Image>alarm.png</Image>.. <Image>alarm_connent.png</Image>.. <Image>back.png</Image>.. <Image>boom.png</Image>.. <Image>cable table.png</Image>.. <Image>communication.png</Image>.. <Image>condition.png</Image>.. <Image>control on.png</Image>.. <Image>crane parameter.png</Image>.. <Image>crane.png</Image>.. <Image>document.png</Image>.. <Image>electric drawing.png</Image>.. <Image>E-stop.png</Image>.. <Image>exit.png</Image>.. <Image>fault.png</Image>.. <Image>gantry.png</Image>.. <I

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom Reduce.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 54 x 114, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):5425
                  Entropy (8bit):7.9532609452149154
                  Encrypted:false
                  SSDEEP:96:/STKsB7YjgjebJaHR8WZ3+SQJ2Nd4NezJ6Gt6475Kf0M4mJ+6OCYqWWnkHNKw:aOsdYSNSWdVHFTKz4mJ+6zYQnyNKw
                  MD5:47A99C31A6CD0EACB11BC060E56201C7
                  SHA1:AF80D8CBC2AEDF14FFD604B91A2A9DC86EED8F23
                  SHA-256:179D3AD6507D9489AE24EB8C71CA3C1B4CB5D01A41548C7F424BD648326A8BBF
                  SHA-512:E502A7AC9F641DA19EE66E9025C0A82ACCFA402F617F71CE622BBE58D6116DF587B21DCFD90EB57FB59E7C2221D5DA2197459A5F9D1FDAF13D251ED626572A94
                  Malicious:false
                  Preview:.PNG........IHDR...6...r.......".....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..\i...u~.=....IJ.E.0M.rH......#.J,'R(........'...v~.O.$@..A..N.........%.m.ds%.2-..].......W.......U {.49;g..z....j.....i.....j......[.T*;R.Z..........g.....gp....).s.....D^w.}z..`;. ....w..8.X.P..pg... r.P...].a.`.!.+6.........;w.x..`..&...../.......G.O..-....O..cq...q0.........U...{...z.....J......h..v..-m..h\1.?H.....(0...z..Ld......9....q.q..&.c4.V..o.F......v=.9..}q.@..A. ^.xnU....."..0.1....F......d #nx..&^C....4{.x..`......P.v...6t;m.u{$,7VE...<6T.Z\.?.sz......r... W..8......._.Zl.PX...i..p.....^.Vp.3.<F......#5U...:.{.nXX....L.:.+/..b.V.&.........../.._....O>..S.P,. ..i......c..Z.[b.[M.d.0Q..YG[.A.....4.u1....s.............^...O.-.y.}.....u..^.p..|.q.....s..rE.....B..c.......N&.SSe..u..L.....\..J.f.n...n....w....~O.H.......;..L....&g..*..3..}ej.Vo....d.......q..........b.}....Uq..w.....+....S.......i.GS..."..,.K@.n.P....Y2.l...s80S8...$..J

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom_Brake_Pad1.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 7 x 46, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):664
                  Entropy (8bit):7.551942160913519
                  Encrypted:false
                  SSDEEP:12:6v/7Cfrt8ptQjtryMrpVhmzU69Tmw+i1RI9NPxddsnosqyraOn8Zgu2I1gUdZWhZ:7Dt8EXX0wYiQoyazZg2SZ
                  MD5:5B1349440EB99ED5AEE6CA4C956A3461
                  SHA1:F65953CD57DBB7C348524A0D52F6967D8D68C438
                  SHA-256:CCEA2F0A8240CB87DD680A8E5FEF186880969B4F4CD9B4263B4A5E2D2FD82D3A
                  SHA-512:AED053575CB85221D81D3CB12F1AB97284129C27A2C6279F295896BC8689868906B10E5B49759720CEDD291EBD0AEC32563BB5250685D9D27835A8E3A1365C97
                  Malicious:false
                  Preview:.PNG........IHDR................-....tEXtSoftware.Adobe ImageReadyq.e<...:IDATx.|..n.@..bQ@.....P[..I.$o.G....Fjb.DQ..B.L.&&.....Y.RWZ...X..|.>.(...../...W....r.....Q.O.!.!....|....8..q..5.......d..,.p{w..L6..r....9w.N&.......9..~.<.....-.I.=...a...r..'d/.^o.PQU(....T*...t ...4..a.V.go.Q..e..^.$..l..P.|>OpfY.U..L.R...,....l...#8...V..a.{$..... .H.l.....3(...{X..WW.L&..**.h4..V.$?{h8..j...o. '.@ .. k+I.."*t"$dL.......&.(..P.#...;A...PM..Q..=....Q...G.*(......h.A........F..q.1.A/.&h..h0...W]...n.;.[.....z6.N.......^.e.P*..jZ.#m....._-...d3..J&*4@[l.o.[.C7!,.g1!<.....~E<.....C...G..m3.qy.:..0.......|..Lp.F.}.9u....G..............IEND.B`.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom_Brake_Pad2.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 7 x 46, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):634
                  Entropy (8bit):7.576038848243588
                  Encrypted:false
                  SSDEEP:12:6v/7Cfr5sg8P+cs3TGSh8lK+PEeO2mPvd6BxjsOJqHJMQKEY5s:7Dyg8ER92ewHgGsqEGs
                  MD5:9480A069B76081406161AD98E22D7155
                  SHA1:8C169D72F1D6FB2A955BAFEDD3E46094BF84E123
                  SHA-256:44D6D81F7BF4168F2CED54813F67DBA61018EA693F3107DD0EE2B555E06E6B1C
                  SHA-512:6877700045E1593A9AD309867EB8BF555E0CC62925EF75C6B86D80FADFC07D00C25511745977C19CD6372ED546959B80221580102C4DEF87978296052A698392
                  Malicious:false
                  Preview:.PNG........IHDR................-....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.|....P....H......E1(......!.*."}.mw....W~.IVX.c.Wb.....'7...so..Z.J....{.V(.nc.....:...E8}i...j. v:_.....&..%.qi...CY...A...Bw.c........R.q.{.^..c.X.V.....F......n....p<.....GC....BPU.w,.x.=....^.3....g.:..$|..B|....z.....P\.p1....3.u........w ,W......Y..E..r.7..}V%.).. ."b(.".Y...e.&.S.u.4t...K.:..L.k.n).J...*..tJ.J. .-%...N..h..\q.U..E...9.c; .a....95.u..z,%...24.M....4.,l.W...va...3.!]S/.......E.....B.j...............S.s..,>..H.>.l.#...+.mde.c.V.z..v=O..Q....4...N']..X.......i...a.......BB..p.s...`.#..?;...3R....IEND.B`.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom_Brake_Pad3.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 7 x 46, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):664
                  Entropy (8bit):7.551942160913519
                  Encrypted:false
                  SSDEEP:12:6v/7Cfrt8ptQjtryMrpVhmzU69Tmw+i1RI9NPxddsnosqyraOn8Zgu2I1gUdZWhZ:7Dt8EXX0wYiQoyazZg2SZ
                  MD5:5B1349440EB99ED5AEE6CA4C956A3461
                  SHA1:F65953CD57DBB7C348524A0D52F6967D8D68C438
                  SHA-256:CCEA2F0A8240CB87DD680A8E5FEF186880969B4F4CD9B4263B4A5E2D2FD82D3A
                  SHA-512:AED053575CB85221D81D3CB12F1AB97284129C27A2C6279F295896BC8689868906B10E5B49759720CEDD291EBD0AEC32563BB5250685D9D27835A8E3A1365C97
                  Malicious:false
                  Preview:.PNG........IHDR................-....tEXtSoftware.Adobe ImageReadyq.e<...:IDATx.|..n.@..bQ@.....P[..I.$o.G....Fjb.DQ..B.L.&&.....Y.RWZ...X..|.>.(...../...W....r.....Q.O.!.!....|....8..q..5.......d..,.p{w..L6..r....9w.N&.......9..~.<.....-.I.=...a...r..'d/.^o.PQU(....T*...t ...4..a.V.go.Q..e..^.$..l..P.|>OpfY.U..L.R...,....l...#8...V..a.{$..... .H.l.....3(...{X..WW.L&..**.h4..V.$?{h8..j...o. '.@ .. k+I.."*t"$dL.......&.(..P.#...;A...PM..Q..=....Q...G.*(......h.A........F..q.1.A/.&h..h0...W]...n.;.[.....z6.N.......^.e.P*..jZ.#m....._-...d3..J&*4@[l.o.[.C7!,.g1!<.....~E<.....C...G..m3.qy.:..0.......|..Lp.F.}.9u....G..............IEND.B`.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom_Brake_Pad4.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 7 x 46, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):645
                  Entropy (8bit):7.586583549202146
                  Encrypted:false
                  SSDEEP:12:6v/7Cfron/cWzjfp5EwVBsZpJqBMLsBi6HFGwd54aYPFBQfWGRvBNKV:7Do0AjR5EABsZ7qB4SlGwdmaYKWGtY
                  MD5:76A6B8610D0C645237C37E9CB8B26483
                  SHA1:9DFA7B8B2FE7AAFFECFFBC7B6B334A9328BF3BC5
                  SHA-256:A644603D76DBF5ABC29F247FE624A1D5CE0CAF86A18C09DE190F2D85DA5F5C49
                  SHA-512:2410B38B33ACA575D981EEFD2931AD76C49986C039054F0473DCB8248601880FB7DC3A9646C28294A8D5937D5F1F4B40608735D1E56DA500F24C941AB72CAC26
                  Malicious:false
                  Preview:.PNG........IHDR................-....tEXtSoftware.Adobe ImageReadyq.e<...'IDATx.|.qr.P..W.....f.)N....Z=BO.\.W.....i..."FA..lZu....l.}3..~..../..uv]...[..>.....t..Z...m.....no..h l6...].4.c.d2.......].....dB..L...."X~[.b..p...w:..Z*A.].....E...-=........a..!..f........4.J/%8."|.J......"..\..//A....:;#..L.S.A\.....6?......@...a..,.hG..p..^?...5T.U...%.L.N@.$..(...m.....v......7..9..`.\*j..4M#O.F...,.(...s....H-.,.O]..[ .....s.$. \.9.Tj5P......f_....P......Q...g.W%.\...[-..$.0.?...1.%...B....4.{A5....[.8l.[.l6...[.57.&/h...j...6.`AQYW...2.Q..r.......E...S.W2.<>0....Cgy....u\..I...>o.......?.=.....c..@-.......IEND.B`.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom_Coupling1_1.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 31 x 8, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):201
                  Entropy (8bit):6.1784191605777865
                  Encrypted:false
                  SSDEEP:6:6v/lhPwSOXjnDspqYvhR+G+ZShd2iVKVsaR8J8up:6v/7mX84YvgShBVKulP
                  MD5:E9D6D5AF17299994530872555D34A533
                  SHA1:BE7F4D7AB03AE5A03D7E360301B7BA058226D250
                  SHA-256:9B160677B70FAFC60551E0FBC0586CE1F41FD3C9E847D3F8BBD0FFEF7E94D4B2
                  SHA-512:75FF28A4BABE1EFB3745D1822F5D0B060EBCAE084622703CEE685D4C2D5C8FB9C257B596B069C09CB480E8B22672DF9AD5B75A5FBD19306E2A7309BA3782F3E5
                  Malicious:false
                  Preview:.PNG........IHDR..............}$.....tEXtSoftware.Adobe ImageReadyq.e<...kIDATx.bd``..b......@b.........?x. .bd.........t.\QQ.L.-.~.:..3....l..[..~..10.?~...o.c.....XX..n9.@f5....b...Y.8t....IEND.B`.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom_Coupling1_2.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 31 x 8, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):201
                  Entropy (8bit):6.212386099316165
                  Encrypted:false
                  SSDEEP:6:6v/lhPwSOXjnDspqYhR4WezwUu0FxcdcBGCqcBzTjp:6v/7mX84YhR3LeGCqI
                  MD5:2B7AD49EEFC5DEE9A8CF957CCD31B6D4
                  SHA1:AF36AE91EFDCCDDE7FFFC7876E01A569340F5DC6
                  SHA-256:94928CC23F8B39E3877A07C710DBD382C1A258EF4161BA406B57B0037E597111
                  SHA-512:85A3E9AC6410377C7305A3364A49CB62DDAE831986B02DE3AEA371C17FE3FCB1E2283C42162EF75901D82235C6A25E8AA2B8AEED589E67AE28E9F0BE37B4CE16
                  Malicious:false
                  Preview:.PNG........IHDR..............}$.....tEXtSoftware.Adobe ImageReadyq.e<...kIDATx.bd``..b......@b.....///.l=w...bd..1......t.<$8.L.-......##...l..O..........x.....3g.2\.~..3.dV..0.............IEND.B`.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom_Coupling1_3.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 31 x 8, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):201
                  Entropy (8bit):6.306725628080315
                  Encrypted:false
                  SSDEEP:3:yionv//thPlK3tBkOX9RthwkBDsTBZtO9/7kqnYh4RxGnLeqkmvTSSQnggpOwAie:6v/lhPwSOXjnDspqYsWqqkm1QDpf49Vp
                  MD5:48AB29D8E539EAF9EE511A8669B13EDA
                  SHA1:875E2E42B6EB3D74C246B722FDABD275B0DA7437
                  SHA-256:43FF8E60C6E1377C7EE7A05F3C2FA05C82E57E1078CDEC24C839D519C2AFE2B9
                  SHA-512:6D6B829C1DB681C0E6557BE5FE7F9160CE032B2074E34CD377F147F14A144CF337CE49BCEBA18BFFBD1DDD9B11420C9B58ECA9B6313E074B6B0B8742A52B9BED
                  Malicious:false
                  Preview:.PNG........IHDR..............}$.....tEXtSoftware.Adobe ImageReadyq.e<...kIDATx.bd``..b......@b?++...##.l.....bd...&.."..t.|..`.l.........X......C.H.[~..m.......k.a`cg..............^._.....IEND.B`.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom_Coupling1_4.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 31 x 8, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):200
                  Entropy (8bit):6.245546144974289
                  Encrypted:false
                  SSDEEP:6:6v/lhPwSOXjnDspP22F3kPWZdt3fkcYH+jVp:6v/7mX8h22FUu6jHs7
                  MD5:9C4760957300A8F70B19D15ACC8BD32F
                  SHA1:0EF9CF6A5289DD5D630FC318378E8D9BBD72CBB4
                  SHA-256:10992F1C5384E24AD491C60BF4FAA451F47DBA21A8448F3FEC540647AAF9D61B
                  SHA-512:9E1A208E0BD865180D15740EBD894DBD1BB3C80A16E0A00802CA64D123E67DE422033E205F248D7045C3D703E00B8A3E1E78A1976143EE200543E963107F1834
                  Malicious:false
                  Preview:.PNG........IHDR..............}$.....tEXtSoftware.Adobe ImageReadyq.e<...jIDATx.bd``..b......@b?./..+++.l}....bd.........t.....L.-WQUc...{..-.|."...o...G..0|..i.|~.....3.-g....`.q..%{..5....IEND.B`.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom_Coupling2_1.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 32 x 8, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):231
                  Entropy (8bit):6.498750801237144
                  Encrypted:false
                  SSDEEP:6:6v/lhPanDspzzDhhzfdOddeIV0JL6TiLlmeMnxap:6v/7dpDTlsdeIV0kSldMxw
                  MD5:231A197015041B4F31D463C7705D4ED3
                  SHA1:DCCE22D1C3EE360F035B17DFD07D2865CAE933A0
                  SHA-256:922940C6D2331118A8C94071089DBCBEA797C1399BD0EE6AB03764DF418B7337
                  SHA-512:BC0913E3C537016B45878C027D8027D8B294FD45CDEA4CB57A63170AB145B60DC0D137D57240AD0D47528BB5055058235F24B0873F9CC75CD24B22B0907D5A0C
                  Malicious:false
                  Preview:.PNG........IHDR... .................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.bd``..b.....X.D.''g..'']m...7.O.........`fjJW.<}..a...`....2hhi.....`..?~0|............?|`x...].............#.:....`.q..!@....5).T......IEND.B`.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom_Coupling2_2.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 32 x 8, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):223
                  Entropy (8bit):6.386442310951584
                  Encrypted:false
                  SSDEEP:6:6v/lhPanDspkPcKzppoIk9ycRVjov8ExVHuPp:6v/7d6FLyVvEvuh
                  MD5:F30020F62B45971915EDC8E0D1DF61A1
                  SHA1:5046291FF64765D877C20E9EFC6F89619AA30204
                  SHA-256:CB5A52F7FD8789A3C191F1F45F05FCB2D0D207CF9B9639532CAD284736FF57F3
                  SHA-512:AB2ED3F92E17BE985C3AEA3744E132F1FAA3ABE17C8895BA8599DDC157FE94F210304874130E309FB4B39B17B5E32D8599493462326ACD189DCE160284100BB4
                  Malicious:false
                  Preview:.PNG........IHDR... .................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...... ...o..t..`.Gq..q.....C.+.D.NP....4...5#....6.!....)%..r. ..R..`.....PJi"..9...1.....8...b.m..:..Xk..=AyN........}.1.%-.T....IEND.B`.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom_Coupling2_3.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 32 x 8, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):225
                  Entropy (8bit):6.447937122037902
                  Encrypted:false
                  SSDEEP:6:6v/lhPanDspmRbBVftJTcctTeZgYg+mthGH/T/bp:6v/7dcRbB1f1TeFg+SGfT/1
                  MD5:FD2D6228D8F20DDE42E28FC118FB6321
                  SHA1:1F52212C6D40774FA06B2C1F07A212227B8E4709
                  SHA-256:AA0824A2923DFE8950189444A300868F0FEC43A3B043C29EB91EAC69421E03EF
                  SHA-512:3BF56CF675D88541A85F389A202A951BC5EF600BFBE17C564DE429D9934100457E48DE899B39C34F8D708137D37DD2DACD6B761E569C8DFBDF65357F0EC60761
                  Malicious:false
                  Preview:.PNG........IHDR... .................tEXtSoftware.Adobe ImageReadyq.e<....IDATx...... ...o..8.n..l.(n.*n.E...C.0z.....I...]Z.h.v.g.:.^.1..amN1.Z;>.H)..b..c..F.P..........e....>...x.Y.D....)....*Y.........1...@_....IEND.B`.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom_Coupling2_4.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 32 x 8, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):225
                  Entropy (8bit):6.402630463860767
                  Encrypted:false
                  SSDEEP:3:yionv//thPl359du8qRthwkBDsTBZtmd7NkDLd8ebjPdJCaYIzVpTLfIEzvWaWrL:6v/lhPanDsp9D58elY07LAYv7Dn+ZHdp
                  MD5:54BB2998A0F7DECABF301F2E82A6BA19
                  SHA1:DFB9AB4FCB1676B43737C70E3438EC8BE67896D6
                  SHA-256:D7E9E6E8932B49E07E239C67841D423979FED83C33BBF97E953CD6303B5E944F
                  SHA-512:80732277919CBA06658D05CB2D2455812CC1D3BC2119AE6B2106BF96554ECB7393C063AB379A175C68F474C53C975637AE89A015831DDE221F26B86097FEF90F
                  Malicious:false
                  Preview:.PNG........IHDR... .................tEXtSoftware.Adobe ImageReadyq.e<....IDATx.bd``..b.....X.D...O.///]m...'..w..... .*...HW..{.......~......7.:...`.....N..a..I.`....1(*...bVv...n.......:....`.q..!@...T."K.1Hw....IEND.B`.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom_Hyd_Brake_Close.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 48 x 50, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):2015
                  Entropy (8bit):7.860042603791524
                  Encrypted:false
                  SSDEEP:24:qvu1Ufhr9a1yy6qwTRJp2bD16NrGDna6fsbi3KAaKB6/lA/Q5m8Mh2ma9wFrF2rJ:MuSfhrbCQ2UBGTa9bFKB6/dmT7zMraM
                  MD5:E50A6476D1095884EF030F67A83F2FF3
                  SHA1:5205E0504895627AAE9CF31DEB9CFBDC8DBA4AD4
                  SHA-256:FA93F921CEEAB619795F5F7149E33700C69C73FF76F439519BA6D5E0B35D9584
                  SHA-512:CC6347B032F6648010D5F995A1BEBA3919FD0FC2620479F2033D42CCBE76ACF3989E266A392745AA668C5F41D9ABDF4BC3E6DDAEC78E48C6B07AF9138C2D3635
                  Malicious:false
                  Preview:.PNG........IHDR...0...2.......X.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Y[..G.......;...............$H`!... ........i".| ........P ..P@..eDH......D..c.hc.w....~U]n.t/=.=.....K.....sn..j.k.Z....l.E..;......8..".W06]...3x.16..G..*.<.X... @UH.....@e.x....RE..G..D`{..a.".]..W...a..;.......8|..c(.4....j..J...J*..x4Q.B.k.pqe.D.....9.O.&'........N.0......P...t.d.&?.}...".....-..........Ez......X[..z~}./.;...+Nk.......<?.a.L.......ou..gf..v.....}6...j.......... .M.|e....A..tw.R.. .I%.b./....d...N..v..c....^.p...m...v3.{|....4.....a.m...!..c.}.....)....qc>...M..x..ksLy.[..K3Ns.R.[^]...c3....`p.k..=..v.....8..o6...&.I..'.2.K......g'w....m...&}.N....../5..LG.4./j..w...8..b..'.....G..g....."!.9..b?.= ...Q..}....75.K..]y...S..>)..M.fs=..".PP......5....Y..e[VQ=.D..W..*..a3.....(..p....:.Y......a.2./...,..YGw..K....sb`<..C.]...,1...!.....Z.R.TB...w.|.....X......W.~..."*.uMW....mN.....#z.06..u..ZD....n.]u...GB..o4<..c....8($.'.G...z.......3..9...A.w....

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom_Hyd_Brake_Open.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 53 x 50, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):2046
                  Entropy (8bit):7.898488873010956
                  Encrypted:false
                  SSDEEP:48:Vbtu1oc3MFLcODCbJlVG85P/akIWm4Kv2CyP/XngopDLx:Ntu1LURklPFa9T4KgP/3XD1
                  MD5:6761196DC9350F2BB058CEC188EAAB75
                  SHA1:A4F1A2ECD16B20276566A3D18B88358C1C1832DA
                  SHA-256:A57952C64EC61E9CBB00EEEDDEFE26B03FDBA878EDBC615710D831CC413A8F60
                  SHA-512:57B9EAC0B8B3D24975018C943282FF89ED210FCD9A5472D8360B15B3BC30A30559A3E9E92F327B90040124F2412AE19E353FBE4FD0226911A91E1926C98C18ED
                  Malicious:false
                  Preview:.PNG........IHDR...5...2............tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Z].]W.^k.}....3.....L[.4...5.5....).....O.}P.../...Z.-*>.."..1.i.&H1..vZ..D..$.d...o..:.9...{..4b6..g.{...[k.....j..v..?6....EPE...F<.n&P...h=.......a..i.......s......0.d@...00u......B....t_nP.u... ...K@I.R..F?...C).PQ0../.....n..:........~.T......-.4Q..<..j..h.g....v8..Wd..*KcW.<4.p...znl.n._|......,0"...?.G..Z...^y..gk.#J.%!E.'pZ......~.hh..`D<^f.a.. ..c...._..j..,.5..|yn@.`...........(.E.mk..8R.."..R...Zu.....V.j........P....a.~..}w.y.3p.....<x.D.m..o.[|H.u.I....{y=}Ii.......Y.&xk..?...r..l%.'j.%K)wqy...nP).....?*....>.h...^=.....J...=d..........?k...15Ft`?....~l.._k...>S../.Z.]i..&.......}....+..(....1...........|.................*....V~tJ.C...C..$"...T:.4.?(.'}c.P.-....P.}B...7km.~...v"..)p...W..".'l..&0...7..h.!nM..."......H.V.D.8g.?...+."..(.QO@.......;................Jq-.<.~C..g...Dg..j0...WgN`...^Y$8....z..k.ri...........r..I..#np...;w........<..T.Z.H.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom_Motor.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 58 x 39, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):2129
                  Entropy (8bit):7.90796869672464
                  Encrypted:false
                  SSDEEP:48:mYQQMakBmywmjtW5dauFPZLDiL9onbClbEJsmoo:KZa08YoZLD8obClAsmv
                  MD5:F635F95383A39471A1F7E64E32DAD9C8
                  SHA1:3D446FD8D0E557F54D20E86D4B2D3ACFCD021124
                  SHA-256:F1E0CF2DF8BAC7EC5BF3A59859B4CD983908A9886004EEC4A6BCAC90C5378C62
                  SHA-512:7C29E05F265AE928D06A485E5AFA60D005853198C44898957B02BD6AD60AFBE1381A3C672039039FB8B3A0DCC7726D6A6352FE71CC50F544B3F1BD2F90828791
                  Malicious:false
                  Preview:.PNG........IHDR...:...'.....^.[m....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..ZYo.e..3.o...I..!..P....<.g.*.J<.......@...x@....R.D.@bUS*...J...n;q.e<c..q..%]R./....L4.;..{.........X.zowb.0....<8...Z..U..X.M..}..v4..Mg2.O$....]....LMM...2.........CCC......j.'.{...h.....'.....d2).X\.ZAK.....U[*.\.t....O....~..04j...N2...V.p..!.,K...k....c.....-W.C...:...c....0...:c..f...{...=q.96t.k....Wb.tvvJg,.kGG....r....~...v..nH$.9......wuwI"...N..#.......^I.R.<.....).a.6H...0~..6.v.@...5.+..}.TR...5(.mS`.TZY..c.....N.J...\......o?.O.......1e.....~...`.......`...........ZAU..k.{....|ybC.......... .i.z.?7.(.#..ws.......16.]d.lqnH..i.J.....=7|......@..o.o........b.x."A...}TzQ..e.99..91LcM.......f]..[..5n..8.'.|w....}.^r...={.-..I.E......(+.rP....j.233.a..".......oO>..]\>.. .q`w..R..k.Q..;H.p$.&U...4.:;,....._|u.....Aa..Z.0i.(..E.]....... ..:{0#.HT........;..P'..M.t.......j..x..@=....M...n...euuU.Y.....lv/..YtK.-zT..D#.~`..5.w.....l...A....#..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom_Reel1.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 239 x 94, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):8980
                  Entropy (8bit):7.930703695332221
                  Encrypted:false
                  SSDEEP:192:XgQfZ8f2z+wQmVjx2oR1Zowl+UHKFVORL1IeE:XgQd+wQc92iXJHKFKE
                  MD5:87D864B9309C6EF63500B3A6691F7B1C
                  SHA1:43B2432B044EE2AA0D2DF1073714EEB18333DFD5
                  SHA-256:99C20312EAC86F274DA47E7178EE01074C91A9FAC5ECEBF06D9A32B48B7D46CB
                  SHA-512:433CF9745E671D746D097AD64A810DE7B8D2586C7D903C91B85B91E92692D98C1C1C69A542CEE8D595BFB29AB9356B5B338BE8AC11F41DEBF00B721CF06FA182
                  Malicious:false
                  Preview:.PNG........IHDR.......^.......Ci....tEXtSoftware.Adobe ImageReadyq.e<..".IDATx..]y.eEy..r...;l...'(....2..........2;cLRee.?,.J..*.|.T.C..h..D.c...... .....0.........>......>.....n..z~.w..~....>..dm.}.B.-..}P...m5.s<..>t..../.V.UkN..%`.l4....G.(.B....._.V..oN....V.5.m0.L.>.[.V......B ....?.V.U...xL...,..~....m5.K<*.[..A...[.V5x..1+...[..O.\%x.nu;Yg.!..0...nu[..!..nu;.g^~Q.....[...j.:.c...!`?.ko.n..\.1......[...fs..,x.lJy~..u....C<.Q..Ep........7..$.....x...|...V<.k...<.}........~...|....0..M...>....{a.....p.{`...6.x...-....{....{..ui6.._.ntt.G.yv3.x.ag.L..~..>.u..^..y.{. .>....|.....Z.#c..\g3...........3.........X'._.>x7.....s.._..?.*l...1. .w9........x..b6<._..a..+.....yf..5I.[..y..X..v...]..2..?...~..5N........#w&....K.`6|..\...z...t..t..8...wx.%..m.....y.....~o..`w.xl...;.. .......6..?.{....?..fn..O....;.|.....cf~....2.t8/.....W.../.7yJ|lS....u.....t.w.._q..t..._...n.t<p..X.l..O..!L..>l=~.v._...h....MW0gQ..}..t...ge...s......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom_Reel10.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 239 x 94, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):8814
                  Entropy (8bit):7.920727395534069
                  Encrypted:false
                  SSDEEP:192:ZxUiASB4FmqDHzgvyyFck/sRbos4L1n71vPYF5UF:/ASCvHeyo+u17FwUF
                  MD5:FA388F4C3D28D6C82773C9250AF6C5D4
                  SHA1:5DBB5B9D4D9E9ABC4A037568DF34B4A7D508DF06
                  SHA-256:D37E45AB8F0D5F6B82C9712FFB05BA316B6046CB768F64C4C87DF4F0F1E06A68
                  SHA-512:39F371AEFD7CAB446013226ACDBC9DB4361C1F633AE043930F6FA872965442BAD9929D0BDB849799BE65E852A8B638AE22FDD3550E844ADB08F5BFBA5EAC1CAB
                  Malicious:false
                  Preview:.PNG........IHDR.......^.......Ci....tEXtSoftware.Adobe ImageReadyq.e<..".IDATx..]...Wy.g......y........%..5...P.@j.R.#.J....B UJx.!..KQ.T.8J[.-...&)$.%.I(1.Ih.N..b;....wf...<f.9s...Yy..G7.....s......s...6.^..j........jZc=^.^...m.^z.j6.....+.=..mU...;...A....0..7o.cM.X.7..Z0....y.:.D..x;...S...7o.gM..(.....;.....y....7.2.7.y;A...H.A......."^..R...J...7.y[M.6.c)...uP..7o/.x...6w:....fo.V..S...../^o.V..Y.....n..@...i....U....1.^...V?.k.`;...V...:.....u....Y...y..U...~...{..|...W..CW...=V..>Y.......i..?.3?..*..%.{....O...|.....&zlV63.o9..}.5pU.4.=_.]?....7.1?;.........a...W.J...|.T.g....r....v3W;.{<..;..a..G....k...>.-.}.-.......{.%.?.G.~.......6....s..O..od..r..l......|al.z.......ly.....,l...../.v...+.<."..]..?e1..N.'.-g..q.s..?.7#6.....x......`....\...?...o...v..l..c..........).......s..'..]..-{..f.tG_b........;...e... .2.../b.......>..4.cc..:..>l>r....I.b|. ,\.zv.r.Wc$..#..."..e...\......(.....]:..../..v...~)a~...9$+0..o.v.....N1.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom_Reel2.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 239 x 94, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):8830
                  Entropy (8bit):7.94720286710566
                  Encrypted:false
                  SSDEEP:192:jmKpKto+vH1S5cQrMBy7H6r51bHYgBvwSVGYZoc:jXuhH1f5GgBrrec
                  MD5:E098E8286BC2D3DFE9A8B966563AF27A
                  SHA1:CAE20AEE6650B3B29A52178DC3541F958D579B65
                  SHA-256:56645FF324A3E0B011BBC6CA3F438E999905AB07E63ED7133AF786D406DE0A39
                  SHA-512:EA97346EF60C51265FF54685CC6F72097A179AA52F89FC9800399EB5BA30739A4574D9769A6CB72AA647C131BE7FDFD8418EA517448B0D88EC61AA1DF5FDFDE4
                  Malicious:false
                  Preview:.PNG........IHDR.......^.......Ci....tEXtSoftware.Adobe ImageReadyq.e<.." IDATx..]y..Gy.f.]{H.t./l..`..$c....T%...."..EHRE.`...T....Q..X...B.r..$.B.......K..\6..K^i%.7}..gz...g...k2.z........7.._....q.`.m.l..u.T.jU.f..7..u.'....u[e.Umh-.?:!.6..p\7).R..>.Bv..n..Z...............LU6.Z......T ....,Z....y{.c.f:xyy..f.6...#.m6...Z.VY.jU.b.....jU.[.....7.?.Z.V.[....5o.yyi:..y.5.V.a..9.1r.F....jU.j......T..5.V.!.<.X.3.:N.U..0[......Q....y.V.a.<.....i.r.Um.is..t..r.K..........O..v......x.).~..I,{...&.wY.......|....0..M...?................>...t.......v.=.........U..Ib..c|H#. 4_<..;.{1.l.....a.......:m....t..w.~y..^..>u..O.....S...*.......D.....<.m`.0w.......::..}....}........=.R..?....Kx..;.t...1....n.`...X.9...{Cs..5......-0..]..K.......B...Q:......3...b..3......X../.....t........ow.%......#,......L.../..t{.G.....|..Oa.a.x.K.....y..g.-e.;!..;a.....c.`...{.0.o..O....[9.G..y.(..DI<>v7.]v...................r9.y......O...G.y..b...c5......v.0.d?N

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom_Reel3.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 239 x 94, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):8712
                  Entropy (8bit):7.944809461097477
                  Encrypted:false
                  SSDEEP:192:TQeo8qGULZTV/vxChB7vXKA8QTfTxoZkDsWS+ca/YaKTV:Jo1dx/ZAdmQTfNoZkDsWdca/YaoV
                  MD5:86B067A68969F866BF30C908853CF651
                  SHA1:B5ACBB57F8E21C285E4EAC8EBE03317BCFA6B06A
                  SHA-256:C611631D4AE71A75115280C17628D7EF971BA14DB31652AE1EB6A6D8DB289A8D
                  SHA-512:9185D955625ED2555A6B4A8E894F84CA99CEC08BA7AD944D20B38F4B9E74FA256F94400F9786C284076C17BB0E3B8D7D741F494312516B72810129757D594C7F
                  Malicious:false
                  Preview:.PNG........IHDR.......^.......Ci....tEXtSoftware.Adobe ImageReadyq.e<..!.IDATx..]{.$Gy..{^.....}.m|~....1......`%.D.$>B..%.%. P".<."...,..g.@..80/..k.1...M....yo.....TUwu.gzv.f..k...~.....Q..s mu...f[....hE+Z/[[.t....@.^7.......s....,Z.z.r..p^.7\.ccc.8.Cx.yX\\.O....k.v.[..,....gJ.u+.O.6-Z.z...c.#.#..J.\X.hE.a.....g...Ja....-.?..;..\d.................-Z.z....T6....hE.....?......h..yM...*...mP.7.?.r.r.TX.hE.....X.y.V..}.[...t.y.V...<.X.y.V..t......3....;ua?.....{o4...{........_..s&.'...}.......MP..f.....}....?..|:..a.?.).k.....2....l......O.........4..Z/........njl.x.k0.............d......'0....37.....8.il.x.....)v.Y....y.L....N...Q...~.6Ff.....G~..?.`.=J....x...e.....u....AEP.....'R.f..L...Q2[....o......?....x.3p...r.7T..l-.>.c.~...{.L_t...0w._.5...,.h..1.3O....._...?...w../-8....WNG...=.....[.8.P..q..........u&....1..{a.....[\..;..%....f..qm<2.o..c..<..3..;..L.g.....i0..{..........Qq^..2...f.......=...&...........*j,.3...0.z.c.K.....3_

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom_Reel4.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 239 x 94, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):8432
                  Entropy (8bit):7.940481694686175
                  Encrypted:false
                  SSDEEP:192:YWVDfpdCzS7HQw9r73xV1WKRl2jKamcxzct:Y8fXCkfhRlCuNt
                  MD5:A257D3450710AB6ADEA50DFE930151F2
                  SHA1:57F9ADEB12CEE80C617DB6D12969A50890AAA1F2
                  SHA-256:A51EF48DD1E7498437DCE349B5FBE6A21635012A79233A76F058B1AF64A2E235
                  SHA-512:3FBC73EE37E11F4BD88C37CA123D6B139A2BBDC666A5BEE6B9CF63172CC6438DC05EA8F6868818EED6E4B3D7A7598468D3BB9E9C8E8F24AE9B82C8A07FB30990
                  Malicious:false
                  Preview:.PNG........IHDR.......^.......Ci....tEXtSoftware.Adobe ImageReadyq.e<.. .IDATx..]{.$Gy..gv.n.ng.|..[...[...Qvm..#.8.......$........&.."......HH..8cc..f...6>?..c...?...{..LwU......==.s..K..n.o.......W_U....&....f..Q.Z.....?...:..q...9??........+{V.j.....t^r.WBsd..Gq...`....'....U..1o....;.o..t..K.<Z.jU[.V..S.=n.f/xm.QY.jU[.V..S..|..^...pe.Um.[...f..f.Um.......6...Y.......:..GYZ.5..V.j...c.a.z.A..\..Um9Z..L.7.c/.c\Y.jU[.V..+.Z.......*kV.j...c5.V.j..y#....y.V..y..c.z......l5.....>...h.?...Q'....6.~....m.....~..>...M.|.f..........|...t..c.|.36..k...[.2...|.]:p....?.k.[.....!.8.v~.-pS.D..n..O....<....v..'..}..g....o...|q..#d.u..._..G.C.{..*j.+. ...........@..]..L1.K...........bO......]...\/.6....o*.b......f:LQ.......ah.|..>~.L<.".m....v].Q......Z#.......d..K.......)\...2E.Z.zL..S...%v.......~.....L0..`...D....;/.....1r<...._....a./..28-...c.O<>. L]r..xd.W...O....2.....h....>..v...v........K..br..U&.>.y..'...cOk..:.....#..M..Q..m. L.|.5...

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom_Reel5.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 239 x 94, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):8384
                  Entropy (8bit):7.947621963636006
                  Encrypted:false
                  SSDEEP:192:fNAFDUlI2yibv3kBxy5wRApSAIYupIQ7QfrVsmCW3yL7Wd:C3tQmxwBSAIYuiQ7QfrVsvo
                  MD5:F34D1FB72A4D213CD40BC62DE8836481
                  SHA1:4386DAC3DEF982EF4021F4A41EF8501F8718BE1E
                  SHA-256:F689E4BCDDAEED77CD9B5DDCCE6544AD1DE7BEED441CFC7FBC5936C70F6578AC
                  SHA-512:DC9E028BEF797374644A7711FD3CAC0A48BDE890AA4FE84C6B5BB850CFFBFA7102BF612A3C6A09E82BB79D363F8AAF0E7DF3EF16BF1B6F2D7C4368F1AF7596C8
                  Malicious:false
                  Preview:.PNG........IHDR.......^.......Ci....tEXtSoftware.Adobe ImageReadyq.e<.. bIDATx..]{.].y..w_..{1............!b.......V..G.....j.I.(.*A.}HU.M.....(m.Ty.4i...$...ay...X .....{}.Gg..3.s.....3....o..}....9...1.>[..s.......X.....9q=...m..|....g....r=.Q.e...Q./.....\p.........c..C..`?.Z.k9..#.=.jr.M.E..........C..5-G9.g...7.f&!.q...(.2.<.../..L0!.j....8..c..%e.-G9V...;.6.e.\.r....Y...(G...2.....e.[.r....L..Q.2m.G9..isi..(.k..m..k.r.c.......9v.G....=...~......op.....3..[..~.d.]..=t......>....a.....?.....0.....p.'`..X..E......#.g...>.b..;.....u.Y.<..v|."......o...w....Z...........9L..F..M.._.ZK'k..^...>r;............l...}.>.....S...0.......b....i.....;..7..Ew.....b$.....b..).S..N...5tj`5.^......&..\.{..c_..o...{..*:5(.O...O..g.../g<|.....p5.V.......q..O...R..o...0....~`6..+..~4..........of)=.tI.{..o81=r......w.z..z.r.=..s&._..'.a... .]..}j7...1vu-.......e.S.t9. .{/..s..hg...fn........[...7B..Q2.p..n..-....w...?*..%.$.......4.s*a.a...;.c....0.8..%......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom_Reel6.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 239 x 94, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):8376
                  Entropy (8bit):7.945986634223832
                  Encrypted:false
                  SSDEEP:192:p50KFuUoxnNPz1avI0H1cJO3WkF6EZJZXcDq3hTFQ:p9dmnNPz+ioW26EZZQ
                  MD5:022A9D7FD075BC6A6971E6ADF127B6B4
                  SHA1:92F1F18BF6C7BCD76EFFBAB84C5AFC63DE52FDE9
                  SHA-256:565EB18E42A44C8FCE6D8D402E91078837D91A2A699D7059075C32840C1CBDB7
                  SHA-512:214D6D35AF71755C0EE9E2CCDDC22D6B4F3053E2D347915F2381B514E0C4A19D2831EED1C46EF8FF169361F8CDA60AF0B7A3F6221EEE002E36CA6120D4B28F8D
                  Malicious:false
                  Preview:.PNG........IHDR.......^.......Ci....tEXtSoftware.Adobe ImageReadyq.e<.. ZIDATx..]y.\.y....]]...i%.0..!0X.!..e-..+>...H9.q.*W*a.O.J...s..T.....r,...v.......C a%.lq..t..]I...{..~..u..7.f4;.m75H.........".. ..C...^..7.z.Z.#..w..k..&.<v...L......7.z.J.R^../~......xnn.>......w......7......@u^x.....T*..e.......[oZ.}.(0....8...o=le.1U.3g...c......VF.Ky..c?...v.x^..>l...{...f.|;w......h.k...}...>..>l..s.....F...{^.|..-..>l...{...7.^...E^y}..\ie.1=..Gq..............}...|...*.:...(.e??x.o....t.....#.s..n......?.........Q...~.....{|K../rt...c_p..3n.#..c...<..>..WWP.QJad....u............S...B0>s.._.6.S.....{oB..|5..m.8..0....;.......W..X'.....i..s........S...;....{.a.x#....{......;.xx._...}~R\....x.c<p.w...c.+.v..0..wa..4.7.<~...NA....tl......<...}..\....W0q.o.m..V......q..?}..+..7...k.8......`v)+-...N....0......".....<..L.G.B./O.z........?.]o.,...z..s6.....'`..Q..0. .O..v.rw.]YK...g...u^.t9..N.G....%7.Z.c[....*..`..q...M....,...M......P?sJ`.%.4..../.@..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom_Reel7.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 239 x 94, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):8741
                  Entropy (8bit):7.939624120727383
                  Encrypted:false
                  SSDEEP:192:70hYF4ZbwtKaNRsRwl3e9bNPus9CSTVHH27Nw+q5/XvYEyzE:7UYFvKCFl3e2Q1TVV5/vYEQE
                  MD5:E0EB6A989F549BDC6D6A6D15D52D5671
                  SHA1:C061681B24B26703BE3687C6EB6B4D999120181D
                  SHA-256:3E9FC1DB1E1755E0096D01A276C1CAD01571074A17CD7CE620AA3E96F6B25D5F
                  SHA-512:B4F6634D225EC93478E4796904A5E4954C26A15803DE2313679CF6A2841F5C055B10F63E0FF5A2AEE74A0DE159BCFF3EDDAC7E63873E887678059FF46D7C9127
                  Malicious:false
                  Preview:.PNG........IHDR.......^.......Ci....tEXtSoftware.Adobe ImageReadyq.e<..!.IDATx..}{.^.u..ow...O....Z[..%.6)Z...b.y4...m.j.4M..h..'H.......E.5Z....p.I.....AZ.+...V.).i..X._.RK.......3s.~..>..f.....{f...9sf...m....j[._.Ch....m(.#....:......kpmuu....0....%...5y...}.n.v+.~.....Y.x......y.-.Mo....1zj.(...4Ma.....s.Zh[.37.cZP...~....-......X..Y]....-..lM....Zh7<y...A oh.m)y..1D..B.ish...#!/...t.nh.mik.G#....4.fh.mi....Qj."oh.mm.m....-..}.K..IPh.........$.k.......\a....}..p....^..Ti..o.X.../..*...._.._......O..7.....7.}...0...6.!.vm..._....c.....s....o.._..*.+...m.."..y>...f..._|'............K.E.(...........a.='.?...)6.=.............u..w..O...#..~.c.ub..#...........k.{.c.r.....N.._./h..\...)...._./F..R.0.u@....f....'a..`.;_4.......U.}l|'..P.3O....*.........w.Kx..I......r.f.'.m.5..w....><...{.IX..S...7..7..Nk.......3,............~U..........8...|..q|...xf.f_y1..b8.S.....}Dbwu.9..^.X..(...P....{.[..a|l.6.J.......C8..M......?~.O....)..Y.*......_....8

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom_Reel8.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 239 x 94, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):9339
                  Entropy (8bit):7.925359112409241
                  Encrypted:false
                  SSDEEP:192:OwyrZs5b+L4q/8qabKGqxoqzEfUEF3wlQ53CX0QFFUtH0Ng:OvEb+L4S4bjzQ+RgX0QrUxZ
                  MD5:A7E1514CE58D244EE85C97606667A341
                  SHA1:B4EDDB49916F5480C5411AA3CCDFD117E2317A6D
                  SHA-256:639FAB71A18033500319E52EBAA3C134785AE318CB316F1A5CD6BE3C027FC4A4
                  SHA-512:53BA0AF7A5DA9BFF6196E0D143F37EB1864B721D3513580343E86F4F946D1C7BE98B316728DC76EC0C33DBBEC9C54EC872D76C699D7E3C9B0C221BB72B981981
                  Malicious:false
                  Preview:.PNG........IHDR.......^.......Ci....tEXtSoftware.Adobe ImageReadyq.e<..$.IDATx..}}...u.....rw,S.HK......>...hWvp...DH....N.sw@..?... 9.C......(..|..A..qlk.H...&.A.Qlk-9.H.c...L.Tu.UWuWW....3s...Xn.o^...~...%.s......'N..RF.....c......C?.6...v....L....y.[....={j.4M..._....G....yu.d...D.v:....~<B`qq.!.nN.8..4.c.3z.0.&'N..N.. /.tp...y.8..4.c#.2...t...!...6S.6;qr....mv...+.m.U^.a...Sy'.a.......5........V..|.*..2......+.h>6k..u^'N......6..8.....|$z.=.G.I...Le_..........+.d.>.su,...s.Q........mx..-......>.......g`..mv2y...m...O..S.V..l@9.?-...v.P.>.Kul.>.m...c.^.G......./...|..p.....yp|.l...'...........x....b.....?..>.'.M.....g...5.AX..g.8.'..f.=.g........).........c....G..%n.?.1W...8)..:~..a..z.m/d..=.}.....g`.._.........{~R.=...I......K....wr.~.6..'.c...........y....g.....L..3.....:.A.....=..w\.............{.mz....m.........a<...q......S....3.G.x$./<.G............s...z....}......'.F.q.5o.{..$.#...!....=.....'+..2).r....C.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Boom_Reel9.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 239 x 94, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):8719
                  Entropy (8bit):7.938274180679498
                  Encrypted:false
                  SSDEEP:192:yACfsoDCRErkhW6BM829k6GVLzGv52g7LGSLndJKNght+CzY6j2A3lcR16L:yHO2rkhWApYun9gnGSLnkCz1j28lJL
                  MD5:817EDE1E702BD09D86ECA21DB5B40D13
                  SHA1:62FB4B1453AA20295935310A25A5408381A27594
                  SHA-256:C19EF743E36BC44E8E10F8158C5F7E0755E60C505038C9F8288288B73EDE6F2C
                  SHA-512:588D70C2AFBB26C18694DB30A3729BCE259FAFAF3C498764BA3642630CBC3849949A1A7E5C9A571B6F0CDB88A6D5C26FD57FAFCEACE1965DD5AB9CAB3E7F079D
                  Malicious:false
                  Preview:.PNG........IHDR.......^.......Ci....tEXtSoftware.Adobe ImageReadyq.e<..!.IDATx..]{..Gy.zfvO:Y..e[6...%?@.ld.E..;.0....?.H.I..T.....*U.@.T.8'..*.A..........y.6.p...?......u...N.=.3==..3..iU.k}...........c...6._..j..u?8s.l%..........kKg.V...y...%?...3g+b...(4/..F).tm....X.=...}..0..kMg.V....o..SB u........k....9s6.i..c......9s.ri..c.y}.y.9....7...mv..(M..>a..x.9[I..G.y.9;.#.... ..`....w..].u..h.....='^g.V...1.7.....#....N7...ehw..Z.....:U..Z...O<..U.=..{?j..}..|~'L...j...f...#o....c.x.S.|.?...........m....t...........i.......ag.$..}..~t'l..!..v/.e./}...{`..p.[.V.c.....7...5..#.j..O.......f...|.c?.j-.A.....|..=....c.....]..Cx...ux..8..>5'nd....3...}..63..:.....~....G.}...7..M........*.}.N.......(.r.......~...-..I6u.e...f_..p.b...a...7.;...n.../.x..`..`...d.OAw/..|...W~.nB.\w".s.O~.......=H&..tw(....;..h.]..|..g.a..~.A^.....W}.n.n....0..........:)_........b0....&.....".R...L..j2...2.K..vN......7.|x..)....!...?.......<.K..u...7]....a.z.Q../

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\E-stop.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 29 x 32, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):4958
                  Entropy (8bit):7.925762807142498
                  Encrypted:false
                  SSDEEP:96:eSMllcHitlIxv9vk7C1+I4wWHLihk/xFZeM9o+vCyHgupK4XJq7uezG:eSHIIHUCD4wafho+vVH5K04BG
                  MD5:397314CBDF76020BC50BC8D8BCFEB51F
                  SHA1:5115F80A245AEA1D08790423C833F6899A0D54F4
                  SHA-256:28355CCC2C5BE7779CCE4C717D1D7546A028567A65B3CE9B0F155FE0F8EFBD50
                  SHA-512:40DC6F24C982AFBFC49EE47617E7A4F9AB44A6470D78FD4C29AF36B135CA213F7CA8EE7208849EFC55B426308C767D7D31F49DF31482CD560A93C5ECB4A9A6C7
                  Malicious:false
                  Preview:.PNG........IHDR....... ......ws|....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\E-stop_green.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):5139
                  Entropy (8bit):7.932399083052165
                  Encrypted:false
                  SSDEEP:96:27SMllcHitlIxv9vk7C1+I4wWHLihk/xqsVTrk+7amA3Aad/HmEevNH2bCWEt+YD:oSHIIHUCD4wa/LamAJTeFWbCWy+6
                  MD5:656E06E320ACB04C2A5B21EE84CFE5CF
                  SHA1:FBF5DD68A3B67C4AC584665B2441C31E7D988C74
                  SHA-256:DBFD6EEBF62A28776DCB620A006F5B73137FEFB18AE0BBC4C9E2C8B8F41DC34A
                  SHA-512:54918180A0E1913B35639220ABFAE1E36BA4425720F73D563D74E1EFACF03782CCEC6480604866A71D513CD0D3273ED30552A2DBEE26AD06ACC51225E0A8C069
                  Malicious:false
                  Preview:.PNG........IHDR... ... .....szz.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\GantryMotor.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 37 x 25, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):1260
                  Entropy (8bit):7.7872814478857
                  Encrypted:false
                  SSDEEP:24:EIepTjJIMUVxa0NH8z/8t9HTSq0jPSJepwtRRlNZmXbUAiqE9:DehjJlUVxa0NHy/2VSCJoaioD
                  MD5:4C1702F83A8A0C15CD2FF757BC2864EA
                  SHA1:63AA735291E8FA5DFE5363E23F015F70766D3469
                  SHA-256:D45EE8F5080DB54486D28A932EF955C0F4FA2AFAE496A0D8FB0E631C647C3632
                  SHA-512:CB85620CB2DE7B1CFF415DE4DCE3D9FBCC5E22CA1E6A448C1DCFB1B814C5396A6769CF41399B9067B8C3D8BC6D4B4AC748E527DFDA6A15F1FCE80847707F3BD9
                  Malicious:false
                  Preview:.PNG........IHDR...%..........&......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..WMl.E.~.?v.;...H)i.AS.(..P...r.q...Q#...8U..pl.#.J...8...T.....z.,.i.8N.8i.......z..&.a.5...H..{.;.|.......5..:;..x.y(PLve~n.(W.........ukY...A.~..Y.....d2..k..s..o4.0...~......Ba..y.h4z...g.Y..t.h.,.j....D..L.f....'}u.......Y.5.L&.3.8!.Kkk0v.$...Q....~n6.P..+...m{V9..l./L.0..H..|xjjZ,./..`......o...9......[[Po4 ..vo.P..So......E......'.....LF0%.q.............................*...b..@..5hX.... Z.......5..q...j..(U...J......[U.....)I.o..SD@<....+.QZ.D"...)..n2..L.&..T.V.}L.S..*.Y...&v...~.....iL....d....O.2..N.%`......T.;.T..Ni..m..d.....}4......}$6.D@.S$..{...]..........^...r&i.f.PJ.....8..3:..'&.lo*.".4...........Bk.OA.Q{.R@.g.D]X.3..{.........Oy.......U}.x.X\=.)..j.s.......-.....y...&$.s...)...D....Y..SW7J......|{{[,.u..........hs.W...\E..#.U.`...W?.....M3G....Hx.z].l....h/3^#.I.&..$T5...,.h...7.02...]..dG..}..wX=D...5..x..t..vPA.Q...|..;..cc/.......H&....H.i

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Gantry_BrakePad1.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 3 x 14, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):253
                  Entropy (8bit):6.786612930696657
                  Encrypted:false
                  SSDEEP:6:6v/lhP3jnDspBQnvxX/Dy1i0Q3apbeIFfOkHBypcl/eWljp:6v/7kOhpIkkh6Ut7
                  MD5:C7FB177A81D91E347E2CD0A1D936F2B3
                  SHA1:DD94174E6FEC7965D6098B29F02E1D9B1733F44F
                  SHA-256:E9DFF432CEA02A7481492819E1440FC8CE95F22DE267493B795FAA9F9740E051
                  SHA-512:18D1F0E97C424F8C74F658EC06790ECE8A0A1CDE6EA7FB8D84C0584191A276D3DDDFC85812AC32AC3ACA061B92CFD39430A0A2C0E29D7D0DB96B2E2347D76E8F
                  Malicious:false
                  Preview:.PNG........IHDR..............a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.L....`.E......7p.?.....%|..B.!.@...7.h....Y..._....K...5.QJ..).?.|..WQ eY..G.A.a..}.,CtU....(....u.k.*...9.{.0..Fi.e.i...D.A..$..1..5..@...8...'...@O!..I.....IEND.B`.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Gantry_BrakePad2.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 3 x 14, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):249
                  Entropy (8bit):6.71955137964203
                  Encrypted:false
                  SSDEEP:6:6v/lhP3jnDsp49s0D3jV571Et2eYT8enBWMjp:6v/7kl0Tj371E08eBWMN
                  MD5:74AFD7A9E8AAC5426869F009C7D6BB0B
                  SHA1:523AC410661BA13687E29A378D02F9CE314CC4BE
                  SHA-256:62B509DFDD7C43729C3D3794D9AB04F84601557782FB6ED0420B835794A683AE
                  SHA-512:21AEEF9A78ACDD40E820B41E39256F45E5A327698435F1AFDC65C763EC803B2FCE23CCED15CBBE2ADA76ECF31A4D510BA9C8846C09CD0F60EB6BCC6DFB66F55B
                  Malicious:false
                  Preview:.PNG........IHDR..............a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.L.K..`.EO.i{H.(...U...`.^.E..ee.=0.......:Q.........l.kn.......>...Gc.0.0Ld.\.y.H.d....s.#....6...e...|..9f.=...GQ4..g..x.K........|.... L.3.).....IEND.B`.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Gantry_BrakePad3.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 3 x 13, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):260
                  Entropy (8bit):6.791077410098934
                  Encrypted:false
                  SSDEEP:6:6v/lhPol/8GjnDspDqvWkbcyIgP8h+Se+tsOWhhdp:6v/7AlGtVZyIgP8h+Se+C7Xz
                  MD5:7C064A22FA6126DE852F6A3A0529544F
                  SHA1:2CC89FCEC3696CAF867A5E146BF6906EC3AF0AB4
                  SHA-256:75ABC982E70BB05F6B4B857CCBA99A8B62C90E3D828461BFFD0752A8A0B3C253
                  SHA-512:923827951D9E5FBCEBB9FDC7406B6015A97CA4564E1185061DBDB5E7D0F644D514522D40397529CFEF58BC1CBCD186DD6AD8B4A63C272B708BB98921EAB02FE7
                  Malicious:false
                  Preview:.PNG........IHDR.............l"......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.....`...z...K..-...>..).+.N@1.5pK...M......m....P>K.f..i.......,.FU..a.Kx.-...y..D..4.e......A.G..^....C...).,....@'..5...M%.sEA.t.c..q0.}..m...8.=/..0..i:.v.....IEND.B`.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Gantry_BrakePad4.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 3 x 14, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):249
                  Entropy (8bit):6.71955137964203
                  Encrypted:false
                  SSDEEP:6:6v/lhP3jnDsp49s0D3jV571Et2eYT8enBWMjp:6v/7kl0Tj371E08eBWMN
                  MD5:74AFD7A9E8AAC5426869F009C7D6BB0B
                  SHA1:523AC410661BA13687E29A378D02F9CE314CC4BE
                  SHA-256:62B509DFDD7C43729C3D3794D9AB04F84601557782FB6ED0420B835794A683AE
                  SHA-512:21AEEF9A78ACDD40E820B41E39256F45E5A327698435F1AFDC65C763EC803B2FCE23CCED15CBBE2ADA76ECF31A4D510BA9C8846C09CD0F60EB6BCC6DFB66F55B
                  Malicious:false
                  Preview:.PNG........IHDR..............a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.L.K..`.EO.i{H.(...U...`.^.E..ee.=0.......:Q.........l.kn.......>...Gc.0.0Ld.\.y.H.d....s.#....6...e...|..9f.=...GQ4..g..x.K........|.... L.3.).....IEND.B`.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Gantry_Coupling1_1.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 42 x 4, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):157
                  Entropy (8bit):5.9258921357461505
                  Encrypted:false
                  SSDEEP:3:yionv//thPlDH4RthwkBDsTBZtaAkxP4HbE2EmuVWCQpIFoUd6asN2pB03ll/jp:6v/lhPinDsph1Ho7ZVFQ6FaNzjp
                  MD5:88459DAD93C493A79EA2058A36A7BE11
                  SHA1:AD5311E2C4ECB58F0D7FCFCBA0B863C9C6C0B448
                  SHA-256:C1A6EA0320D97F3E9C4CA5884DECA4968257E763A79CB1A53E48006FA9563555
                  SHA-512:7866667FFF8A4F910BA13D9E04100390C6097A0D4C8FD7D59652D70C06825F17BD103ED52CA15BE39C7B02D67EBDE462FD5F4B7DA501F8C2398D22C7D1DC0040
                  Malicious:false
                  Preview:.PNG........IHDR...*..........e......tEXtSoftware.Adobe ImageReadyq.e<...?IDATx.bb.".122.>2*.a0;..#.X........A.....f`.|."..?..C.>}...`.Vd..M.......IEND.B`.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Gantry_Coupling1_2.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 42 x 4, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):150
                  Entropy (8bit):5.786011606657732
                  Encrypted:false
                  SSDEEP:3:yionv//thPlDH4RthwkBDsTBZtdAsKgyZM0mj2C4MTNchcB1p:6v/lhPinDspdALgyZM0mC/Mucp
                  MD5:BDABCCFC2C5663DE9FE6D9BDFE004CE9
                  SHA1:DEE808502F858163BB0E762F283C16194E2A2137
                  SHA-256:EA506F06DC2E0D7641FA96FC307A4D9F1F7E1046730BCF54F79869077311F91C
                  SHA-512:523292AB721F96AF5C81C29DAC588BFC269B637DFE156BCCA086EBDB00A73A4CC605955E5B6799A1643896FD4654553DADEAC70DA096D44D6042DA18BC41113E
                  Malicious:false
                  Preview:.PNG........IHDR...*..........e......tEXtSoftware.Adobe ImageReadyq.e<...8IDATx.bb."....;::..fG^.|........A....g.;......~.f..0..Q.7..Ps....IEND.B`.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Gantry_Coupling1_3.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 42 x 4, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):150
                  Entropy (8bit):5.77287040956886
                  Encrypted:false
                  SSDEEP:3:yionv//thPlDH4RthwkBDsTBZtdAsPqpq1Sqo3O/izrMB2Vp:6v/lhPinDspdAqSwSNO+MIVp
                  MD5:95FA9FB8844E7E86AE839BAC84AAE889
                  SHA1:BFA5710D99E430C349D6C047521DFFC4ADC6F5B2
                  SHA-256:4EDE5712684C560E032BA2E4CAA35022990C46478FED0CB88B91AF8E019DBB33
                  SHA-512:C7B4C890CD86DD7F8C91EB0AE162CA8CFF5DF14D82B34AF578C5B61D6412B1B368C52604F90F6514B67D64FC3790A647E5BBA29909CCD70D1BF966EB2C1F244E
                  Malicious:false
                  Preview:.PNG........IHDR...*..........e......tEXtSoftware.Adobe ImageReadyq.e<...8IDATx.bb."......t..fG~......QZ^1.C....`.n.eP;..G......'..-.1.....IEND.B`.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Hoist_Brake_Close.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 33 x 27, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):469
                  Entropy (8bit):7.383723848910423
                  Encrypted:false
                  SSDEEP:12:6v/7fXI+h3L4doaSx65URhu0LZojgHbECYQj0/1:Xap40ajaECRU1
                  MD5:1E685E32700E055315613AE83E722DD6
                  SHA1:B7C5744453D8940F494EAC241F3D8D995C9FBE10
                  SHA-256:5A7B1F5E2BC2B2A2F253EFE25CA421D347E697A5A1C3592C3424400DAD40F456
                  SHA-512:18570AC86986CC9429C3BC164F51CF8548CE305305953F65A30E3B60015C5E903A5426B35B8497FCDC49A2213BB4554AC4B72699E1D9ED78F12A4F667AECBEBC
                  Malicious:false
                  Preview:.PNG........IHDR...!................tEXtSoftware.Adobe ImageReadyq.e<...wIDATx..VOK.A....[P)(F......k.....t.nA...&.c.HP.c.fV..;.;.[5..(..0.~.....y.y3.>...RV.......>........HI..Dm.8........F`0...Hi...).!..:#.a.D.P$..EB......r..l..............M\s..).lV.I.V......v...dCw.K."....X+...nt./.....=.>.B.z.U..p.vM.l.&D:.v..&=b.H.TM(...|7......Z........aJ..T.>...N"..+............|t1.>..+.!.Q..u.q....'.XN......>q../=...z..Q@V.....$......!....5.......IEND.B`.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Hoist_Brake_Open.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 34 x 27, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):460
                  Entropy (8bit):7.345655450664902
                  Encrypted:false
                  SSDEEP:12:6v/7OtcUstzgyGj898hMtj3CyT2vXNC2kWJZKkQ:stAYChg3vKv6l
                  MD5:E5287111A0AEF546D9119486BC085AD7
                  SHA1:C2872B963F431217C41F34C98DFB9ECC3F76BC05
                  SHA-256:28A62080A03E5C16438F0FF8132EB5ECB961873D812A736CA258E3EE155FB0BC
                  SHA-512:0DDFEA4380909B51BF115540017B3D7D9416282650A7AC0AE3B56D7A8BBA033BCA9159626CD275DC8DCC94012A45C2BB355D9B14BC5E49B48270BA157A7430E6
                  Malicious:false
                  Preview:.PNG........IHDR..."..........2].....tEXtSoftware.Adobe ImageReadyq.e<...nIDATx..N.A.........%.F".../..`o|.;{c.K...P..JM,HD.....23..cb........=3.l..d2....$.FJa"..%...H....X.F.8..~.K....u..8C.[:...,$8G...8;.X....b@...Y..p.. .A>.....B/..G.r.T..F.......<..c...p....}=..j.t.....g.hC..5...~Kq..@:.. d..|...z.kw.%.Z,.f.....oA.1P.<....i.......l.s....R..Y..7s.}..........G'..v:F[....L.c..C.u...m...J.e.yQ2Po4.....X3{d..WG}.!.@.w...!=.........IEND.B`.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Report_Btn.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 12 x 15, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):3209
                  Entropy (8bit):7.878172158588349
                  Encrypted:false
                  SSDEEP:96:mSMllcHitlIxv9vk7C1+I4wWHLihk/xVoOAl:mSHIIHUCD4waW
                  MD5:F9B2434F08209A4C42E6F87469BB4DCF
                  SHA1:9531D182084042CDFEB557C3DE282C82923F9E56
                  SHA-256:CD2DF814C3B0B9DE4BB4B28BBCB00F7FB7590B1224C343F6AAD7975F663B7D23
                  SHA-512:35E2EBE8060D703DF1F23BAF99BC0D853BC86ACD4013FB6957D1C6A62E22945A700D0FEC5DE5BD1880F634F74EF0B70F25CBAFEB769D2925DF5F101944CA2D07
                  Malicious:false
                  Preview:.PNG........IHDR................I....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\Thumbs.db

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:Composite Document File V2 Document, Cannot read section info
                  Category:dropped
                  Size (bytes):215040
                  Entropy (8bit):6.991514992964061
                  Encrypted:false
                  SSDEEP:3072:4cYIQPJfGAbfYhGdhWK3DmQ1CpNLV1fXDFRu6m7/QHiDaGx:3BQPnjYdqCpfTs6q4HiD9x
                  MD5:15F85205211A2FDE74BB942B82D91092
                  SHA1:C7A0582AF46E55C5C87098A313CB7CE0C3FF2E9E
                  SHA-256:E8C1640791EEF1430B8A0E31B2EB6792B0A966F4FE32EA56055A5C506C59632B
                  SHA-512:651374A14C57045A9149CA4762C6FC97914AA837829434E55C6B099A42181C5E162B54A3933C27A36A38B499B3F8AB937121AD1D113FE609D28C74CFD7A163EA
                  Malicious:false
                  Preview:......................>...............................................................x...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!...'........................................... ..."...,...#...$...%...&...(...:...)...*...+...-...6......./...0...1...2...3...4...5...7...C...8...9...;...M...<...=...>...?...@...A...B...D...L...E...F...G...H...I...J...K...N...X..._...O...P...Q...R...S...T...U...V...W...Y...d...Z...[...\...]...^...`...q...a...b...c...e...k...f...g...h...i...j...l...t...m...n...o...p...r.......s...u...|...v...w...x...y...z...

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\active.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):3102
                  Entropy (8bit):7.876131982510514
                  Encrypted:false
                  SSDEEP:96:xSMllcHitlIxv9vk7C1+I4wWHLihk/xOez:xSHIIHUCD4waEM
                  MD5:0BD425D03876225C0ADA7AF714A04E3B
                  SHA1:B7EB9F0D6E065C481AE0199419371C8FE1D4D41A
                  SHA-256:D5476E4666694AA1FDA617660784B25006B55D0B638E21462469F3012A8BA7A8
                  SHA-512:0C713FDAA4ED7E2180B34131C7584AB8428CC33F1E5759C3F769FA65DFCC5F268097885D407F80C22686F192217A24278D4FBC7BB541A51ED51780A7D52111E8
                  Malicious:false
                  Preview:.PNG........IHDR.............Vu\.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\alarm list.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 30 x 34, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):4709
                  Entropy (8bit):7.928969127668979
                  Encrypted:false
                  SSDEEP:96:GSMllcHitlIxv9vk7C1+I4wWHLihk/xg8VqXLxv1ge5kT3:GSHIIHUCD4wa6yqbxue5y
                  MD5:1B244223A4C35204B48BC0D06DBF190D
                  SHA1:05D9F9DFC6EB0A1E849631ECC760505F07D25CB8
                  SHA-256:0417F31DE0E1F7F73F3F8615E59E14EE5482836D7FDF59C489A1282E78228EBA
                  SHA-512:28F4294CF462666C7EEA499068A0CD9ECE631B72CE75053D859EB5C454C308629B9786ED043C933C930E1FE23A9F6E1BBA61BD507A3C56F8D89ADD48A7B858BF
                  Malicious:false
                  Preview:.PNG........IHDR.......".....H.it....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\alarm.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 17 x 23, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):3859
                  Entropy (8bit):7.904851368253586
                  Encrypted:false
                  SSDEEP:96:nSMllcHitlIxv9vk7C1+I4wWHLihk/xyYuKNSO5O5uK0DB:nSHIIHUCD4wa40SObK2B
                  MD5:44B30718598244787C33BA34EFCC87DE
                  SHA1:8B77ECDD06924F05D01DC98715D6A55FA43D9CDA
                  SHA-256:01D3DE63E2FE3B3AB0A80C8DB5F9A5149535BC87D508568BB35D9E392465A2E5
                  SHA-512:5457939BF921A52D25B939CB38EB63306BB1C69AD1382114C7EA35ED773AFCF00D73634B7766B4684AAD93ACEE400198CD002E882E3AA1D52F65D0DA09A72A12
                  Malicious:false
                  Preview:.PNG........IHDR..............4......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\alarm_connent.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 10 x 10, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):3086
                  Entropy (8bit):7.872599677407468
                  Encrypted:false
                  SSDEEP:96:8SMllcHitlIxv9vk7C1+I4wWHLihk/xU5Pj:8SHIIHUCD4wa+p
                  MD5:EDE13EAFF5A0FD742F348CC4DAC05EA0
                  SHA1:3EF6D193644B4CC8571DAA77F75FC0247588803B
                  SHA-256:0998CF375A73BDA221435696DBCCBA01ED29FE411FC63170316F630846954E00
                  SHA-512:C2C33270BEBB37CDDC43D4A3E3FF7DF5FC15ADD8EFFE6616A754F893CA7047BD23B4A7F224BAA5DF730D2487A041635958E99F4FAB525CC1C4F6AF9E0A444968
                  Malicious:false
                  Preview:.PNG........IHDR..............2.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\back.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 28 x 28, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):3763
                  Entropy (8bit):7.902837265375153
                  Encrypted:false
                  SSDEEP:96:HSMllcHitlIxv9vk7C1+I4wWHLihk/xjj1VoZY:HSHIIHUCD4wa9bSY
                  MD5:2FF581BBD81217E25ADE94B810C168CE
                  SHA1:5F60C5AD6F54A13CB2B71F0B2D01021E9EFF5B04
                  SHA-256:B2F1457B74DE46945756B6F1AB94AF8D472FEC682CAECFCDB54D80987BFAAA6C
                  SHA-512:E925C49EBAC2196B77A09D709B2BE705E51476BBA37BEDCD1DEBE79DB0072D7FAE6176BC0C8413BC337C54229CFB6DAA21418FBDD7079A840A7A719D926CA647
                  Malicious:false
                  Preview:.PNG........IHDR.............r......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\boom.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 38 x 32, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):5700
                  Entropy (8bit):7.9290960356331155
                  Encrypted:false
                  SSDEEP:96:zESMllcHitlIxv9vk7C1+I4wWHLihk/xbIYXbFVD9TNoVs/XvmMM/4t+/iDmMIXI:gSHIIHUCD4waNvrjD9Tm+XeH/HhD8
                  MD5:5745D577A3C8A96FD686232195955908
                  SHA1:B3AA28B329077786424357FC9A32DBFA2FEE2A11
                  SHA-256:77BA3F8F4271D9998F5621B73D8B5F6EC4AF052FEE87781986446C23CB8AD0AF
                  SHA-512:B7BECDF75A49680C8A50B07444F808C178885BDB56105279E8DBF767D7EA63B28E9DDC4FCC953D3233CB0932D4F1CF5B0A0F3C01D70486C0AD09CD6F2161023D
                  Malicious:false
                  Preview:.PNG........IHDR...&... .....~d......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\cable table.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 32 x 33, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):5060
                  Entropy (8bit):7.927937461995094
                  Encrypted:false
                  SSDEEP:96:90SMllcHitlIxv9vk7C1+I4wWHLihk/xMcqnVtw7AoPx6knSF/Wr3foi7:90SHIIHUCD4waucqnTSUvAA6
                  MD5:8F0B4C9387E85E07F226AD72A6034957
                  SHA1:86DB2035491497A9732E89FC084D38981D9648E4
                  SHA-256:D283AC7830EDBF34675DF6A133A227E54A1FB6A223B2304F1615AFE16FEA096F
                  SHA-512:9549B33BCE3884B1DBB754F88A3678430FB97667469823E67198F4F42D290DA205D83FCAF033645E516200BF1C93DFF70D7CE04B9BBA94354E580C252FD25C0E
                  Malicious:false
                  Preview:.PNG........IHDR... ...!......&.Q....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\communication.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 32 x 33, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):5813
                  Entropy (8bit):7.9354670367126765
                  Encrypted:false
                  SSDEEP:96:90SMllcHitlIxv9vk7C1+I4wWHLihk/xtnMqfblbBs0dJrYmVl4V+9mCSZc5Ammg:90SHIIHUCD4wa7MeJbBsmtA+9mCSZc59
                  MD5:F75E17EE37978EBD9BBE61AF98A5274D
                  SHA1:32C935ECE14AFCF026B11CD10763962A897BC79E
                  SHA-256:1B23BBAE807D7E14C93900DDD689B6D0D1204910736425DA1E4BBC3B0BBC9D55
                  SHA-512:A08C920F55A826A01F1C68975EF4ACDD8A03511E8C0A0D6F32931AC1F03B26D727E9277B85889C6FF0EC9B4CAD00D92AF9A492749A6ED5FDD660D184C0B34A19
                  Malicious:false
                  Preview:.PNG........IHDR... ...!......&.Q....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\condition.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 29 x 30, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):4371
                  Entropy (8bit):7.920483177793108
                  Encrypted:false
                  SSDEEP:96:hSMllcHitlIxv9vk7C1+I4wWHLihk/xppojnoRO0w4vMjyHr7UCi:hSHIIHUCD4wavpErOv/8
                  MD5:38E2E7A55BDD6B13A86B4493E48DA784
                  SHA1:F99CB5AD15DA8E3688266DA3BCB7F5D88F5E4FEE
                  SHA-256:1B9E33A0ACE77F902EA5E9FF092E665D364E48987EDAE4C5FCC1E94B1B8AC8CA
                  SHA-512:CABD2E28ED45BD46CEE836B5635F0B05CF316FE41E13FAD128E0F5276A210196607D694F71C5745720BF78696FEC75DE0BEBC1C30DFAE521DD183A42BC33F480
                  Malicious:false
                  Preview:.PNG........IHDR.....................pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\control on.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 30 x 34, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):4477
                  Entropy (8bit):7.917550626538875
                  Encrypted:false
                  SSDEEP:96:GSMllcHitlIxv9vk7C1+I4wWHLihk/xU8RjDAgF1ovYv:GSHIIHUCD4waO8RjD1F1ovYv
                  MD5:90D07BA049621A1E1E39BC5016AD00F6
                  SHA1:5AFB8BA07D2353FFB256F74C288E9BD87FFD49DC
                  SHA-256:6F1B9678C74F0A829A3672C662F91AF90A8ED26028A2EC32CBE6925226688303
                  SHA-512:DF565FF99D3134BDB8C67DF1145AEFB5DDC3525EEF3073C3D454A1EE21919D350A011821FC657ECBFB9A98F15AAF2440979861996CAFD6409307C686714AF06E
                  Malicious:false
                  Preview:.PNG........IHDR.......".....H.it....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\crane parameter.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 33 x 32, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):5301
                  Entropy (8bit):7.936456815154925
                  Encrypted:false
                  SSDEEP:96:TSMllcHitlIxv9vk7C1+I4wWHLihk/xaZMNaWoDDYSVSXuVYtAJv4BvIK:TSHIIHUCD4wa4ZMNnURVYtQ4pN
                  MD5:25AF8CAB8A8FCA96945298AF946C5E2B
                  SHA1:03AD44BA90FFEE8F65A7313033722059DBC19CD4
                  SHA-256:68DA1E9DDC87F6D8D69A1E2319C7E5DEF1CBDD8481D3215A1694851F15BFE4C0
                  SHA-512:C9E8EFE7C6C859DE3A4679EAC5A9ABFCD73697EC27B0CE118B68C6BDFD1D1B26DF59AFB74BA6939DE3EDC95400C7E1C5F0C40CCE6C5C71E8CCC21598AA39EE44
                  Malicious:false
                  Preview:.PNG........IHDR...!... .............pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\crane.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 30 x 35, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):5302
                  Entropy (8bit):7.9368688669676715
                  Encrypted:false
                  SSDEEP:96:wSMllcHitlIxv9vk7C1+I4wWHLihk/xlCcRdAjVT9YFkdcPgdAyapA1fSudKl8P+:wSHIIHUCD4wavYTCFZPg1aS1fjKl8PoB
                  MD5:A54FB86E30C10EAD0F27A1E491DFDC63
                  SHA1:B248EB24DF66FBE743DD6E3B356577CE56158000
                  SHA-256:6ED1F907D13F87C24501BBBA40AF3FD1E30B1026B88A663D4AECE91F8ADD76E3
                  SHA-512:1305AA292E13355E0DF870C514B15BC93DE235E6281A53B17791FC2D160BF306BF333C8FAE3D8C4CABBDD1BC4980373C6C5209B53B155FDCF5FCE7393BBF8614
                  Malicious:false
                  Preview:.PNG........IHDR.......#............pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\document.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 23 x 23, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):4213
                  Entropy (8bit):7.908638904107287
                  Encrypted:false
                  SSDEEP:96:bSMllcHitlIxv9vk7C1+I4wWHLihk/xaXdLSagZbGNKDx0zq:bSHIIHUCD4wa+gNGNO0e
                  MD5:AF999F269E12D3721270A29BB57837B4
                  SHA1:485EA78FF4DAB098209FB8951A7A907AC4B67C8F
                  SHA-256:17D742AF2AF4FC8C24F785B542939ECF3192B1AB87FC96B9D0FC92414CECE464
                  SHA-512:516D9777DA796676097880B49B99A3F465DC8F513E4C67F7E53C53401C97B52CF2BC41C12ED20163FF9935A97E0CC85233374463DB45B9B84BBD568591048805
                  Malicious:false
                  Preview:.PNG........IHDR..............*.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\electric drawing.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 32 x 33, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):5087
                  Entropy (8bit):7.924341612633569
                  Encrypted:false
                  SSDEEP:96:90SMllcHitlIxv9vk7C1+I4wWHLihk/xSZIBwyKhsenzjzGW35wk:90SHIIHUCD4waVrMz736k
                  MD5:60D8AE6D9F332D024EE5EFA36A1F5EF4
                  SHA1:E1D1ACE9F460886FD914250B1DFBAA52CA14D1C3
                  SHA-256:0993C0B5EC0B799D32838DA511C98ABE80A2C3DDD203AE2EF400E27AA73946C5
                  SHA-512:F4638A8C216F7A70DD6D14901BA092F03F8AEEA60CCFE9D5CFCECB21ED12AF3F6133B508DAD8983E614031EC235414878C10BB799833755461C673E81A845680
                  Malicious:false
                  Preview:.PNG........IHDR... ...!......&.Q....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\exit.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):5575
                  Entropy (8bit):7.932809915953804
                  Encrypted:false
                  SSDEEP:96:27SMllcHitlIxv9vk7C1+I4wWHLihk/xL9H/j2dIlhz7SrpjjCS+Mf9uwz+5YwRb:oSHIIHUCD4wa3fwIlharp10wURld
                  MD5:89264FE295FF20BD0CCA6C822C9B4A73
                  SHA1:83035F93722841D53230202469F8FD1ABF0BE37D
                  SHA-256:8DF66080E5D943985B13AD5E64160B868CB60A2EDFE59C507543A2A3228F0680
                  SHA-512:CFFD0DB6BE469F7A56303986584DF41040F9669BB15CCC0A3B2139AA676E5844CCFEDABA56341A65B6DDD451142C8C5E921BF6161186639E0C32C6E7EFB22452
                  Malicious:false
                  Preview:.PNG........IHDR... ... .....szz.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\fault.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):3124
                  Entropy (8bit):7.880971983254171
                  Encrypted:false
                  SSDEEP:96:xSMllcHitlIxv9vk7C1+I4wWHLihk/x3Cx1R:xSHIIHUCD4wa0l
                  MD5:47FC35B13DB640045610A31168F1F799
                  SHA1:3D71776CC30EADBC6350E615FA4AA9F24D9A3DC4
                  SHA-256:09F630F5318AEED4967EB20CC728E46E6723BACEBAE6C76E984322C4FCE1ADCB
                  SHA-512:554A430751F9283819C20E3CC67BDCCE928EF1144BB5590DD7C72DE2C64B7B1E41B65D62B954F4E70D9CE9912881D1B03FF96D2DB24BFABF7F5FB10BDF3A8405
                  Malicious:false
                  Preview:.PNG........IHDR.............Vu\.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\gantry.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 36 x 27, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):5395
                  Entropy (8bit):7.937698163112576
                  Encrypted:false
                  SSDEEP:96:zSMllcHitlIxv9vk7C1+I4wWHLihk/xTdQwApen4Ah9y9JyyjS6kJPaj8Lr:zSHIIHUCD4waRdQwanArCOJPm2r
                  MD5:3245D63E9BB4DBFB152F8D96B5DDE997
                  SHA1:96D0F971ADB8B6821E2885729E5FF9B2598A173B
                  SHA-256:38715BDC642F320A19F51CDA63E7FF044F69A21BAE736127204B9C39D1C62D4C
                  SHA-512:8EA5D0D8EA3D400BA9547C7DED4CCF38DD983B5E7B1BE0B373FDFA0D991D0A0AEB0833EF20E2FEAEF3388A7C6310F06CECF038C9F541321EBDB6E23694FF9B78
                  Malicious:false
                  Preview:.PNG........IHDR...$..........,-.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\home.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 27 x 31, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):4258
                  Entropy (8bit):7.919799885021769
                  Encrypted:false
                  SSDEEP:96:LSMllcHitlIxv9vk7C1+I4wWHLihk/xtbg7i2ZYPnV:LSHIIHUCD4waTnlV
                  MD5:45574E4654DBAD3C057AF7580468BD42
                  SHA1:F7C1B18E4ED5CAE7C769AB6304DE3483692ED249
                  SHA-256:9A33B084A863DB02AEAB839F0A53AD1BDDF1B70FD06951D18F8DC920B7F11FE4
                  SHA-512:451E9F8B848A96969C248A6215C547C8B07CC0B0F53EE8984218F6C90591DCCD11ADA60FF0EF167692A0E121ABDF3FF3FF02E93FB3DFD89CA0B4D183A076FE77
                  Malicious:false
                  Preview:.PNG........IHDR..............E.C....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\invertor parameter.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 38 x 24, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):5067
                  Entropy (8bit):7.933472903797394
                  Encrypted:false
                  SSDEEP:96:2SMllcHitlIxv9vk7C1+I4wWHLihk/xXdKK0bLg8//ROeEpZJeUo:2SHIIHUCD4wa3K1g8Xj6UUo
                  MD5:70A4E1FE4AB6B7A1A9ACF8D41A5AD62D
                  SHA1:8B079D46F931A67FBB501D333424C658AFC2DCBA
                  SHA-256:F40F5C94348C62E63439B6337D6B35F4EDDC252FF11F7D2FE2CD4AA43AA57183
                  SHA-512:2C465F9926AAC1CECC17BCE1128E53E8FBBB72D8535616819DD3D44409D77E3B7696724AEBE729CB5526E59A0DB0D7C8CB5A2FC09A28F9C4844EDADB499C5E85
                  Malicious:false
                  Preview:.PNG........IHDR...&..........M.s....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\invertor.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 27 x 32, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):4902
                  Entropy (8bit):7.928134667341305
                  Encrypted:false
                  SSDEEP:96:WSMllcHitlIxv9vk7C1+I4wWHLihk/xkD0DwroDoE+EU102v0u1:WSHIIHUCD4waecc0o0s
                  MD5:F1AA4F1C25620F546EB0544CD534D9E9
                  SHA1:F6740D2F247D0A37DA2765806C6DF83111D8E1CB
                  SHA-256:22BC5E993F46BEEB8D8B94BE425067BABC2A706E2CE0076B9C3A190A6A745BFF
                  SHA-512:903E4133C2452B6503D028DB42B452926FDCF0A95BA893E3A6344A0A5D9623391769B9D1828C8FB87483B069155CA062FDA6C66761CEBD4370936DAD3A06C922
                  Malicious:false
                  Preview:.PNG........IHDR....... ......i.;....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\login in.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):5674
                  Entropy (8bit):7.939936329273826
                  Encrypted:false
                  SSDEEP:96:27SMllcHitlIxv9vk7C1+I4wWHLihk/xa9bAiuCQRhBErj1rWrpLikKqvQ47SW2r:oSHIIHUCD4waAlAiuCQRhMj1r0p5Kqgn
                  MD5:F68285528C5E3D8192FBB7605D90F38A
                  SHA1:2932D3F365A5C029D5D7DDB9A40D374E7A40768E
                  SHA-256:6D78B5FDE59DADCE6FC64F662D7123CC22AF8BD32F3ABD0D845F63310B6B4DDB
                  SHA-512:280FEDFDF09F36EE4713C2324644B9CFF4CB756D530AD803D365525C2DAFFB770B7E94D6DE6C0C4B32751185265694871C59AE9AE78DD4888EF9AE8DA3E00FF6
                  Malicious:false
                  Preview:.PNG........IHDR... ... .....szz.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\login out.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):5827
                  Entropy (8bit):7.9408978973105855
                  Encrypted:false
                  SSDEEP:96:27SMllcHitlIxv9vk7C1+I4wWHLihk/xIlVso703akgS/704VPFBuVVant9h:oSHIIHUCD4waxo7xaRVTAMzh
                  MD5:CCF0B2E55EE7618B4167686845432102
                  SHA1:48C2719C8ADB761E496F343DA16F9B1D3D19470D
                  SHA-256:3E68A2722B6C6F0FC275A881EB988E202249A49CEBB2D529B2C5A3EF5480605D
                  SHA-512:EE74B21B850CF9B06C462BB1D1806817F5EE9E58116EDA615B7FCE84CC315548C89736C7BE12A8DA99AFB1BF22CFCF654932352799A8187936466A9423C8B031
                  Malicious:false
                  Preview:.PNG........IHDR... ... .....szz.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\logo.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 1205 x 352, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):27847
                  Entropy (8bit):7.92668725728377
                  Encrypted:false
                  SSDEEP:768:SQMRW8OpGtXe25X8/TWLi6lRtLZBadJ67vmDOpz:rMRjtPuyDLfaK7eSZ
                  MD5:0250D6EC064C8C7AB24C29308532B055
                  SHA1:146269C4B8A28C1DD0A7F2AFB59ECF3D0A589BDF
                  SHA-256:7BC8A6226051347A847114DCC6377851D294C4114DE882634D5B2876B438FAD4
                  SHA-512:35CC47D64182D4848E143837D6929FDCC3A2DB1F9CC3738CED14973A7A58F8A108665CCE660255766085124B5A6923FE5D76051CBE04A8921A912D91908CAB53
                  Malicious:false
                  Preview:.PNG........IHDR.......`.....M.K... .IDATx...}pT....O..y..d[.V.......a..-.E&.&3.......c6....R\dR!U...T<.Cm.My38...w....8k..".lc....d....!c./A.......84z.s.....T..Z.j..........g.}&...... .............P.......y.P.......y.P.......y.P.......y.P.......y.P.......y.P.......y.P.......y.P.......y.P.......y.P.......y.P.......y..n/.....8.x..8...\A.....b....\.x9t.......^....~.a.c.._J.{..p.x.0...3o.2..{CQ......P..........>...5.....e>.2..x....F.............|..-..\".lemx..9..M.t..7y.u2eE..].C5K.e....B-...e..0.ttvG._...e...\..w....kM.>.^.T-!.."!U......SB....W}m.."R.Z...,.....U.Z....(.`....j....._H..:..j;v..o"..r'..l.v.i.bM.8n..&^.pia:..%B1...E.....F..S..}pf.C..S..\....o...W..7^..{f.|..s....,......P...gFc....R......... ..[+...[)o..h.....il..%.0.@.!......1.T..*.Ny...).~....&..a).a......#.....h.A.U.T..S..yS....U%*.B...s....'....Ic..,......P...-F...F.T.m.ek...48C0{N..%..7........ ......0.9..*..[..C....`.,.K..............h..U...Q.....y.."....Q._......... X........w.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\maintennace manual.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 26 x 32, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):4710
                  Entropy (8bit):7.920182894599655
                  Encrypted:false
                  SSDEEP:96:xSMllcHitlIxv9vk7C1+I4wWHLihk/xwkJLva6+uFRDLtWPY4:xSHIIHUCD4waWgLva6vRH4Pd
                  MD5:34338FC2F0A160DE2E50D942698F5BE1
                  SHA1:E4F41B0FC3AC6B7B58A69CB68AB4BF7AD05A4EFD
                  SHA-256:546A7F79DE51EA8AA0F1185BDBCFD2D13C34DC9F83B9C03ECA4094F309C6E9A0
                  SHA-512:1959E36A4E324060545DF184CB671369AC2F6A8498E045C691331328C39D682EAFE5E01F06E67E117EACB2497FCD327AC0BE508414F9B5C50D7C2146DE92221E
                  Malicious:false
                  Preview:.PNG........IHDR....... .......h.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\maintennace.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 26 x 24, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):4683
                  Entropy (8bit):7.915579442465841
                  Encrypted:false
                  SSDEEP:96:bSMllcHitlIxv9vk7C1+I4wWHLihk/xmzlyRmHOWypmJXUFd/pjcjx:bSHIIHUCD4wagzQinypmOWd
                  MD5:8BF7B073121EEDA6612CE36128D92A67
                  SHA1:A290D1AFE13CE83E57C85173B20A4F7783C8E712
                  SHA-256:3665AF187107F47B3251FEDD501A4A15A9736CF9142B3D56F791929CABF19A35
                  SHA-512:391C135D2F396529BFC4BE37FB2AE4B1A899201B86A3A1AF9B3C067AB8601F4C67667F4573FF5F2F98040FEFF8472B637CB7656E88ABB5A6AD8B7BE91BFB764A
                  Malicious:false
                  Preview:.PNG........IHDR....................pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\motoe parameter.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 37 x 28, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):5404
                  Entropy (8bit):7.9344860679179146
                  Encrypted:false
                  SSDEEP:96:TSMllcHitlIxv9vk7C1+I4wWHLihk/x/t1TkUIcWYJZjTb2gztAUaGS:TSHIIHUCD4waltOSj6StAUC
                  MD5:4D122F10379F4F6DD844170229FD23B5
                  SHA1:D984D4B323FD58B832DD42B1E7B4637F785AC600
                  SHA-256:2A9209CD78CDA71EEA1A1B6BCC3C71C95D2A90B86878064FA9A48605D4800133
                  SHA-512:F1F522E6FCB1B1D362C7A0F6192D53CADF7B0A56B27D0F28DFB7836D93275046FA386422D8A9E4395C3CB2AE7802CA75DF1C6937FBC64E8872407D3FC84A048F
                  Malicious:false
                  Preview:.PNG........IHDR...%...........vf....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\no active.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):3121
                  Entropy (8bit):7.878422764918873
                  Encrypted:false
                  SSDEEP:96:xSMllcHitlIxv9vk7C1+I4wWHLihk/x92eO57:xSHIIHUCD4waSF7
                  MD5:716416F73B04E7074094F7C1E7381D41
                  SHA1:2DEB038A9A1378404239CBCC78185DBDD932917E
                  SHA-256:CDBF42D7D6D669C0BF79E22D97D39BBCF5A1F64FDE0959F649DDDCF88B09A1F2
                  SHA-512:576EF2A1919D52BF94CCBDDBEEDBB9EF0A06C3CD2AB10DA0413541EE97E139D05BA33A83E8BBD36911B6404399EB8570616DF9442AED527342FA23904B9B61E7
                  Malicious:false
                  Preview:.PNG........IHDR.............Vu\.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\nromal.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):3116
                  Entropy (8bit):7.877584563714106
                  Encrypted:false
                  SSDEEP:96:xSMllcHitlIxv9vk7C1+I4wWHLihk/xf491h:xSHIIHUCD4waW91h
                  MD5:468A0EE40A2C23E2FC194AF14C870C46
                  SHA1:2255993697749CFE4B0074DA49EA61EB9C47FA22
                  SHA-256:A2641BEA8CDE5697BE76AECFE558A5FFAC19B38B4A6052B3F35B51842AD9F29E
                  SHA-512:D67243D38A4B3385615FC67DBFC4A7E1ECE924FE0E5138A69798056157977AB614E19BEF60647983E529FB144F52AB1DF698BC82340A0F0B6E7CA8D87B687113
                  Malicious:false
                  Preview:.PNG........IHDR.............Vu\.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\parameter.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 21 x 24, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):4223
                  Entropy (8bit):7.920539651657174
                  Encrypted:false
                  SSDEEP:96:GSMllcHitlIxv9vk7C1+I4wWHLihk/xe8qA2S5rr:GSHIIHUCD4wazqo5rr
                  MD5:3ED6E7271F5BD5EF9FC087A1C01EA4E5
                  SHA1:44A5853A2A1A6B7D9C168D49C68BD7AEDF615129
                  SHA-256:8B058AFF16D6E9EC66989924BEC10963BFC428D029AACABDD36AEBC8EC69EA08
                  SHA-512:2AD22876D09316B214892CCD73D0F540F0E0FEDBC19EB91DBAF620712469EC04193453525BF1C1A7465A9BC684BBB90C516139C07C22A4FEA30CB095FEAA2DE2
                  Malicious:false
                  Preview:.PNG........IHDR................H....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\performance.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 31 x 33, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):4511
                  Entropy (8bit):7.923224721628666
                  Encrypted:false
                  SSDEEP:96:IxSMllcHitlIxv9vk7C1+I4wWHLihk/x1u/r5MyMfK8WHeYmoiFzUU:IxSHIIHUCD4wabKlq7WHeYkzT
                  MD5:97A46227EDBCE2A9E60DE0A53D3CF9C8
                  SHA1:FB503B7D323B9A2D61D9DFF1BF8F836A0118DBAF
                  SHA-256:E04A1E67B08CF2DC22B02BF64CCCD3EDFAA381F386FD4A2F098B5D769E8B386B
                  SHA-512:7546E70B88EFF5A5093BF150A2AACB16FAF2E3D9DCA45A1522AFF530274CF73857D7BDAB2C2666FBA40D220A1411FD0489E52BFF9876FBEE10713CADE2097E3C
                  Malicious:false
                  Preview:.PNG........IHDR.......!.....!.p.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\power.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):4736
                  Entropy (8bit):7.911853984541746
                  Encrypted:false
                  SSDEEP:96:27SMllcHitlIxv9vk7C1+I4wWHLihk/xBuPVLS9YOua4BtQ3:oSHIIHUCD4waiWma4w3
                  MD5:57BD543BB8C7855274E6B724511D231E
                  SHA1:A20D16FF05A10037C72BF77FE412B74D38F51DA0
                  SHA-256:6EB2F7B853B32F497EC9253069D931C9042FCFD69F95F27F79306D05A3E7E75C
                  SHA-512:2B644DD4D3D5D8F11F43111C72C3816B26B8DA1B99B2510DF7B08E00BCE86DBD4968C7541D8DE893C55C8F5B513B0C82EA45EBB74ACD76192E76DE78D115BC1E
                  Malicious:false
                  Preview:.PNG........IHDR... ... .....szz.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\print.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 16 x 15, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):3242
                  Entropy (8bit):7.881466028582053
                  Encrypted:false
                  SSDEEP:96:6SMllcHitlIxv9vk7C1+I4wWHLihk/xxCM:6SHIIHUCD4wa3
                  MD5:CFB50DBB98C9D918B1441F55C82A6CC6
                  SHA1:A2AA186AD560FCC1A9FFF724C421101220459F47
                  SHA-256:F0A2B6DE9FD663EF80A49A61BB77EEB110770A4A30C2AE87D1B7578250DA3314
                  SHA-512:97D31173E3A2D113BF81EC5F8E1CD86A7954182998E263409C600ED5A83F67F0D885C646D40B9A43E67341CD288AF61949BF73C81CA850F953658A32EF15E652
                  Malicious:false
                  Preview:.PNG........IHDR..............sO/....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\product list.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 32 x 33, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):4736
                  Entropy (8bit):7.919506893265308
                  Encrypted:false
                  SSDEEP:96:90SMllcHitlIxv9vk7C1+I4wWHLihk/xL9nZd08pzeOf7ND3fiwg5Ls4:90SHIIHUCD4wa1d08p6Of7Jfiwgn
                  MD5:DCBF376C9F08F422A8C5C0F138194210
                  SHA1:E6E1C2F18F1C89F1915939E51B63FC77EF2C25B6
                  SHA-256:122EB579D589F223DF1BF7F8CA61A04EB398019A14EF5E8505EF58ECE554792C
                  SHA-512:08C0B9B1A294B3A72E53088EC5212BC5424C6F75C356A3603EDD391865FB1A4A850DD19E4CB946DF4CCF659FFA7AC9564D91B07D689C94F8813E65E79F882F61
                  Malicious:false
                  Preview:.PNG........IHDR... ...!......&.Q....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\product.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 32 x 33, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):4699
                  Entropy (8bit):7.918790357337928
                  Encrypted:false
                  SSDEEP:96:90SMllcHitlIxv9vk7C1+I4wWHLihk/xTqLNrQC2qJ163LIpdS3U:90SHIIHUCD4wa0LNY3Iz7
                  MD5:5F6A249000CC6D48D44D26A84D68F835
                  SHA1:45F17D1A26FE6060E9C5CF32EA6BEDC77FF2AAF8
                  SHA-256:325D177039390375F991D5BE752417172274CD66FDE857098A88B2ED247184C4
                  SHA-512:2097D4EA6B47746827ADBE597AAB5A8D027F190900DB873B8BDE4232B7E93186C347BF4B3C062BA9441E71829F6662BC104DE2E6E2EF5534627A1906C680FC24
                  Malicious:false
                  Preview:.PNG........IHDR... ...!......&.Q....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\real alarm.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 28 x 35, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):4531
                  Entropy (8bit):7.920039220199377
                  Encrypted:false
                  SSDEEP:96:uSMllcHitlIxv9vk7C1+I4wWHLihk/xJ/pLe7AydhUf7smLTlkeL:uSHIIHUCD4waHp4VdhIAsBT
                  MD5:0458F6EEEA66AAFB054C83572FC28CED
                  SHA1:B4D13C3438DE93D55FF2C106405CC0608E6B51EC
                  SHA-256:D02210FD75EEF0FF8A6647D336570F90F2FAA506C60C79208E14BCD6A9A57A12
                  SHA-512:17E6D37B6BA1920612503A92649DFB57B4D793479213416FE154B84BE217CCEDEEF9E927351724995FADCC50FBBD7AC3ED12BAA7CABF5972B2C7F691378EC3DE
                  Malicious:false
                  Preview:.PNG........IHDR.......#......!j.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\real statu.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 23 x 23, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):3757
                  Entropy (8bit):7.9054660545985636
                  Encrypted:false
                  SSDEEP:96:bSMllcHitlIxv9vk7C1+I4wWHLihk/xHAi/1n3+R11eW:bSHIIHUCD4wa9dpceW
                  MD5:9C00BE80FCFAB4CB3310CA7D895A6BE7
                  SHA1:1AB01611500320A3B7F7EBE1FFB8121713522AE6
                  SHA-256:76D7EED72625B6AC9BF286A30AE6DFE8909B4429A43822FBFCCCE7FAB3E3AF26
                  SHA-512:995EB6DD76E2AC98D6A4F125AD2DA2B47F2B6A36EBB985609191C8C6D2334C4298FE95F5581781CD686224088582E436BFC12782736EE4913A3EAC4E3AF1C69E
                  Malicious:false
                  Preview:.PNG........IHDR..............*.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\runing hours.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 34 x 34, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):4866
                  Entropy (8bit):7.921297112200041
                  Encrypted:false
                  SSDEEP:96:7SMllcHitlIxv9vk7C1+I4wWHLihk/xTWbHFlFbU+ns2y9smNTAhD2h31:7SHIIHUCD4waxOZAMqDh31
                  MD5:5233F338AE740F18C1F6078F7C2B9006
                  SHA1:3B40038A17AFF93A269B86C383FE340F592F61F3
                  SHA-256:B10360FF62B9D7B5316896463C75BB9C054EA25297C086F24B7834313FFC0F62
                  SHA-512:B0C7894F64BCA1047CCEEB098BCF906BCF2483921788D2F75EEA4C948AC2C8521613E1E836C4F8F8C55725DC82335FE1BCAE8F4618ABFDD5D4EE6060D21BF5A7
                  Malicious:false
                  Preview:.PNG........IHDR..."...".....:G......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\save_btn.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):3125
                  Entropy (8bit):7.881141769913915
                  Encrypted:false
                  SSDEEP:96:2SMllcHitlIxv9vk7C1+I4wWHLihk/xEKxc:2SHIIHUCD4waW8c
                  MD5:282583648518C85AE271951258D1BA79
                  SHA1:44DFDE2982C3321EAE45B2B02ACCF6415FA96D1A
                  SHA-256:0C4E60EDF54B0FEA53CCCAA5688FB5EE53B5633BE81A1DE057A7A1EF163B946C
                  SHA-512:F979D685924C96344D9492F4EF6098E6448778F88195493DE6D58BFA05D1A2535368900370E0F8CF0CC48AA0FF09EBAF0B01889105279D115FCE17FEC4630851
                  Malicious:false
                  Preview:.PNG........IHDR..............H-.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\search_btn.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 13 x 14, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):3203
                  Entropy (8bit):7.879347326706771
                  Encrypted:false
                  SSDEEP:96:TSMllcHitlIxv9vk7C1+I4wWHLihk/xoPmVc5:TSHIIHUCD4wa+Oa5
                  MD5:D50FA69442813144DFE2356AEA65BA6F
                  SHA1:0C490829128DD35D2BD00AECA4686BD709B32D25
                  SHA-256:A6D5A9448EB6F89BF85AD9642A7B0DCCE7AED69D7C34EDE42BAD7B059A7DC48F
                  SHA-512:1FEF10301AC7529F7586227BC3D62E9337D98E9DA7816B27EF8AEA5158C2FBEB7025F3536D26A53B59FF214D9EDFF6B5CDD89ADE1029F0E943ACADB19D1D6B08
                  Malicious:false
                  Preview:.PNG........IHDR.....................pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\select date.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 28 x 30, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):4711
                  Entropy (8bit):7.9283806586555565
                  Encrypted:false
                  SSDEEP:96:ySMllcHitlIxv9vk7C1+I4wWHLihk/xBsKoNh1sm/o0H9lRfhS:ySHIIHUCD4waTsKXmw0H9lR8
                  MD5:D3E6C2919A825B12170CF6E0659A671B
                  SHA1:79973A3ADFC9E3AE4A88F0CBD33BF95A76F2ED2B
                  SHA-256:D3FFD6C225072D0F78448AF196A654A76F5B5F7E7BDF0C8A69D3F4B7956217AB
                  SHA-512:FB82050413F5748BCC1211B9FA60B53B599DA39149E28F94341F773FD4DE9CA95A45406E09B80E4FC51425A0B81E91443E10097EB1C0AF60E3A3BEA6FF7D44F9
                  Malicious:false
                  Preview:.PNG........IHDR.............?.~.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\spreader.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 36 x 23, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):4850
                  Entropy (8bit):7.92967635749823
                  Encrypted:false
                  SSDEEP:96:vSMllcHitlIxv9vk7C1+I4wWHLihk/xgnMAkyWdccBaeh95iJ4eHdh:vSHIIHUCD4waaMAidcc4895iJFHH
                  MD5:3AED6731F5031D5C73A9A721025F41A5
                  SHA1:E456FBEE679A83FED4EFB79D0BF8510E727E7FE7
                  SHA-256:E7EC0D5C31970A9B33349066CD58ACA35C6CF2490D32EDE17E3F08B4B69F90B3
                  SHA-512:AAE51BD1F0AE157452FF65200279E7AEBF8BF9C70B65F8304A46827EA40D5B430D552F6FCC09BA0228BE281A9C0E98AA53A01D67CB7CDD5AC86B05EBD2966C4C
                  Malicious:false
                  Preview:.PNG........IHDR...$.........c......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\statistic.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 25 x 21, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):4152
                  Entropy (8bit):7.909616459083002
                  Encrypted:false
                  SSDEEP:96:0SMllcHitlIxv9vk7C1+I4wWHLihk/xnrgqeLlNmzx1:0SHIIHUCD4wadMXLlozP
                  MD5:95E0F621910791A52CA6E5BAE65C2ED0
                  SHA1:E07EED3AE7CA50E043DEEC36AAC84B0BB7A50C5B
                  SHA-256:726D81A1364FE857DDFB3FBEE2550EA1880ED9B0D94FDD54D9808C185FCA4984
                  SHA-512:B4E12A215816294BD80CFB588D30F3CCBC13BB2B772BD774A0E9C39334D526DF9840FC5BD07842DB2FA5634A3B6CA3EED8C7E6E072DEBC86C41555BA548E11B6
                  Malicious:false
                  Preview:.PNG........IHDR..............+E.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\systerm admin.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):4500
                  Entropy (8bit):7.921162255729822
                  Encrypted:false
                  SSDEEP:96:xSMllcHitlIxv9vk7C1+I4wWHLihk/xul5z+q8t/OGFRr86Kf9Mj:xSHIIHUCD4waQC2GFVRKf+j
                  MD5:C3668340F34F26AAF9294EC5B716665E
                  SHA1:DCDE2585A528E9FE0DE80A7ED0CD40B3FC052009
                  SHA-256:E5B7431C38925B3F5D85705262EE738495FC558DC8B15CBA1CCF0154575FC737
                  SHA-512:22982D74B0143EF2860CCEF099A429445DCCE714B892F6A9DF69B21BDE1EC9E33CEC79F69F5CD6C4E162A24C5C57DB2CEB472F8BCD1505034B256332D4B64078
                  Malicious:false
                  Preview:.PNG........IHDR..............w=.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\trolley.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 35 x 32, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):5935
                  Entropy (8bit):7.94272172976044
                  Encrypted:false
                  SSDEEP:96:lSMllcHitlIxv9vk7C1+I4wWHLihk/xp9BvWFdDD90TI9uYhSXqAqANIH5U0f+Y7:lSHIIHUCD4waPYj0TB8SXlNIZU0fz3yq
                  MD5:6E3AEEB5E174A85D98389CA3DC2FE445
                  SHA1:579018A09D6343E1093C7213686BEAC9B1FAB179
                  SHA-256:7BEBC3F532A38FF5C412C98EB611CB28890A1F197CA17D60E1868EF805C4690E
                  SHA-512:F3ED03479E1995E509CD17AB3E51560BC29E8B9BE8AE04C7CC5A6A2B62E8239F8B7B2E1D8C7D6341165AB843A24215EF087CC311BB5FCBBC49A5F9FCF5E74742
                  Malicious:false
                  Preview:.PNG........IHDR...#... ......M......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\ImageList\Image_Symbol\user manual.png

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PNG image data, 26 x 32, 8-bit/color RGBA, non-interlaced
                  Category:dropped
                  Size (bytes):4767
                  Entropy (8bit):7.932100773513627
                  Encrypted:false
                  SSDEEP:96:xSMllcHitlIxv9vk7C1+I4wWHLihk/x985cyhJjrxsEhZTw1nWnFDD:xSHIIHUCD4wa76TtZ/81Qn
                  MD5:4C6ACAD6FEC4D2130F8DD64F1E5B901B
                  SHA1:5F84342F7A95B1AC211502C7959907FC9406FAFC
                  SHA-256:47A4E07E375363ED7AB89D648844E8F74DAB2AC0C2AB493AE86A2F37AB6982C5
                  SHA-512:A81B5C5C34CD6139C56AA7BB068BB5E49CAC11CC90F4CECCC94C3D45DF4C408C576B90E7A9EACA1F8B2584B3DCB86714EB62CDBFD8AD99CCAE8E1009215064B3
                  Malicious:false
                  Preview:.PNG........IHDR....... .......h.....pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol.xml

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):1490
                  Entropy (8bit):4.6492283277667115
                  Encrypted:false
                  SSDEEP:24:JdMDhOaI9UYeP3k2++jaYUYF+ehk+hO+9mn4bmvxT65Z0FizJy+Z5++T+2A:3MIhXE5A
                  MD5:237D839CFA026EE8FE84F6002700E181
                  SHA1:9CCC2EF4256AC076E6608EB0A464EACDDB268B64
                  SHA-256:2A31E4C12B0811524B3F40A6B0F5292816EB4ADE5031E5A2130EE0497878E97F
                  SHA-512:098F2DC0F5BFDC394765FA5EB0C66D4136A1E47FC89885313C467E272629786A16E383C26CA6FD8158E55582B4FA9243D1080C71E5325664ADAC245F8617A7BE
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<List>.. <FileType>SymbolLib</FileType>.. <Code>20110420135320703</Code>.. <SymbolLib>.. <Name>SymbolLib_1</Name>.. <Symbol>Symbol_2</Symbol>.. <Symbol>Symbol_1</Symbol>.. </SymbolLib>.. <SymbolLib>.. <Name>Symbol_Icon</Name>.. <Symbol>Back</Symbol>.. <Symbol>Home</Symbol>.. <Symbol>Normal</Symbol>.. <Symbol>Active</Symbol>.. <Symbol>Fault</Symbol>.. <Symbol>zpmc</Symbol>.. <Symbol>GantryMotor</Symbol>.. <Symbol>GantryReduce</Symbol>.. <Symbol>Hoist_Brake_Open</Symbol>.. <Symbol>Hoist_Brake_Close</Symbol>.. <Symbol>Gantry_Coupling_1</Symbol>.. <Symbol>Gantry_BrakePad</Symbol>.. <Symbol>Gantry_Brake_Close</Symbol>.. <Symbol>Flip1</Symbol>.. <Symbol>Flip2</Symbol>.. <Symbol>Flip3</Symbol>.. <Symbol>Flip4</Symbol>.. <Symbol>Boom_Reel_1</Symbol>.. <Symbol>Boom_Reel_2</Symbol>.. <Symbol>Boom_Reel_3</Symbol>.. <Symbol>Boom_Reel_4</Symbol>.. <Symbol>Boom_Reel_5</Symbol

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\SymbolLib_1\Symbol_1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4875
                  Entropy (8bit):4.923354428172071
                  Encrypted:false
                  SSDEEP:48:3fnarRxd8trxa5joL2kj6z2vgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6T:SrLdSr5L1S2v01GQucVzlzB4NQr0UR
                  MD5:264B1E0EBB68E4569E712EC424F727FB
                  SHA1:CB575F2E8526D88EBADCEF06F74B7CC473C6380D
                  SHA-256:EA54F266200C5C08DB86222A667AC911FDB41593E75527279759EFDEAB0590CA
                  SHA-512:46B1BE202D7EF2A932624BDFB899E8D08B06FECE2F48F7AA97C2677AB904B02EDC32277ACF65896C3E5AAFDC9F8C81B0BCCA8EEA14BA11D176C372DA990527D2
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Symbol_1" ShowMode="Overlap" X="0" Y="0" Width="1024" Height="768" ViewPortWidth="0" ViewPortHeight="0">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>3</Version>.. <Type>Color</Type>.. <Transparency>0</Transparency>.. <ColorType>SolidColor</ColorType>.. <IsPrivate>False</IsPrivate>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <ImageStretch>None</ImageStretch>.. <ImageAlignmentX>Left</ImageAlignmentX>.. <ImageAlignmentY>Top</ImageAlignmentY>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Animation>False</Animation>.. <TagNameList />.. <Context

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\SymbolLib_1\Symbol_2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4473
                  Entropy (8bit):4.923341497492429
                  Encrypted:false
                  SSDEEP:48:3fyirRxd8trxa5joL2kj6xvgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6Sr:rrLdSr5L1Gv01GQucVzlzB4N6Vk1
                  MD5:F2B75BF9A3A96BA718A41268D5BBC106
                  SHA1:DA2AC02BEB30AB69CF75D2770A99419906A668D6
                  SHA-256:59677A8DBCE9BC0A36C02B13B3A8E8E0467CD42B6C6F38EA5F28C942E1868B39
                  SHA-512:492F413BE86CD960097CB57CADACF91C33DAE304976BD131ED8F22AEB71FD357219EC501289AA5A0ABE6B570AF2DD57BE75D8FD7A8C865C53FE2D316C9ED5BF9
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Symbol_2" ShowMode="Overlap" X="0" Y="0" Width="1024" Height="768" ViewPortWidth="0" ViewPortHeight="0">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>3</Version>.. <Type>Color</Type>.. <Transparency>0</Transparency>.. <ColorType>SolidColor</ColorType>.. <IsPrivate>False</IsPrivate>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <ImageStretch>None</ImageStretch>.. <ImageAlignmentX>Left</ImageAlignmentX>.. <ImageAlignmentY>Top</ImageAlignmentY>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Animation>False</Animation>.. <TagNameList />.. <Context

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Active.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4750
                  Entropy (8bit):4.878128550172488
                  Encrypted:false
                  SSDEEP:96:4rLdhNklRxmlv01GQUcu1eHD+Hs4N5Wk1:0hNklR2D55Wk1
                  MD5:E76B78808AAA2C0FF7319B0A0CE50F7E
                  SHA1:1093ED04377082CFD8B5B2EEBD34A6E0FEF8E62E
                  SHA-256:5E2478DFBBB1C941B7E07D77CCF23B4D6FA2BEC5CE0B1C2CEDEE1C8B90779590
                  SHA-512:FD0C0B23538C5CC91DB217066A4B38A235034B58C22A2C3F0D1CEC75F8DBFEEDBC7EAD7689FE7DEEBB18F871CF9DFBCA38729EDF20BC7DE09B72A15E04784B68
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Active" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" St

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Back.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4483
                  Entropy (8bit):4.922673295095496
                  Encrypted:false
                  SSDEEP:48:3fgrHd86kyF99L2kj6ivgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6SEi8g:IrHdZkIL1lv01GQucVzlzB4NEi8k1
                  MD5:759628186A5D5E6F5F2043B4143160F5
                  SHA1:2C602F25EDC726CCB168B4A7887D0E10EA738D94
                  SHA-256:A221DEA459B9C3D4555C9A0D2E02D96E215FC0846339FFD88F3F31B8E1E50F31
                  SHA-512:B7B413E64BE5708D302956BA3BAF53616F905948230561220BF6B1426A4F051D68D04F459DC3C22F84BDAC51D3FFCAA23B0D0C83752D28D42C3A7672C728D136
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Back" ShowMode="Replace" X="0" Y="0" Width="1024" Height="768" ViewPortWidth="0" ViewPortHeight="0">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>3</Version>.. <Type>Color</Type>.. <Transparency>0</Transparency>.. <ColorType>SolidColor</ColorType>.. <IsPrivate>True</IsPrivate>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <ImageStretch>Fill</ImageStretch>.. <ImageAlignmentX>Center</ImageAlignmentX>.. <ImageAlignmentY>Center</ImageAlignmentY>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Animation>False</Animation>.. <TagNameList />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Boom_Brake_Pad.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4549
                  Entropy (8bit):4.8867208159655044
                  Encrypted:false
                  SSDEEP:48:3f7rrRxd80NklR/joL2kj6ivgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6e:3rLdhNklRML1lv01GQucVzlzB4NIAks
                  MD5:9CEA26B1377FCE70BC8EDE1BA0F10493
                  SHA1:086C57C98286ED996C058ED00110B85550E4E190
                  SHA-256:009A2F0293B235769CE69B16C0B04F437393F62E43F27C7554B72EBAA59B1A65
                  SHA-512:7A50B6EB9D954F274446C5EAFE7072B7235DD3A7650BE91B2E88F4EF0AD0CC83BD88C045536C8ADD3ABBC0820160463A7E9B89FC9EDBA7071ECF7DBA3E1809F0
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Boom_Brake_Pad" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1"

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Boom_Coupling_1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4551
                  Entropy (8bit):4.88656489330583
                  Encrypted:false
                  SSDEEP:48:3f7hrRxd80NklR/joL2kj6ivgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6E:9rLdhNklRML1lv01GQucVzlzB4Nxek1
                  MD5:C6451199DF0D130E8A82D500F578F276
                  SHA1:6602D2D4A2F3E1D99819662777BE0286171A953D
                  SHA-256:E1546862331542C57928DEA911F64A9CFDD5CB9B5ADDA7F0CEBB089F6CC5F3A8
                  SHA-512:ED4E1E1333B008FAC251A2DD5C62CD5914C82686A9D6C124988EA43F583079319656C042922D4C07F29A55B2FD2074D762AA3ED7D49DAA479AD3978E99CC0280
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Boom_Coupling_1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1"

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Boom_Hyd_Brake_Close.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4561
                  Entropy (8bit):4.891372338651308
                  Encrypted:false
                  SSDEEP:48:3f78rRxd80NklR/joL2kj6ivgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6Z:orLdhNklRML1lv01GQucVzlzB4NiGk1
                  MD5:26039912C8620BDAC7AB3F93DBADAA7A
                  SHA1:882B5CEA908CA3A17F36E7E50B671EF47D97ED07
                  SHA-256:F33B86191011805D3313F7548BAEDACEEF4FD330291C2E532979E0038FBFB34B
                  SHA-512:FC0E8A1B2EA14061D109EF64A1A79519A442CCCB53E8CD05A8C41AEA95C4A27E81CFFFDBD849510934741CC5098E36A9D3FAAA89364D70F668B3840495F3F8FF
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Boom_Hyd_Brake_Close" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSe

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Boom_Hyd_Brake_Open.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4559
                  Entropy (8bit):4.892027112991476
                  Encrypted:false
                  SSDEEP:48:3f7IrRxd80NklR/joL2kj6ivgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj69:srLdhNklRML1lv01GQucVzlzB4Niqk1
                  MD5:D848BDCAE986EBBBDDBEBA4520E5E134
                  SHA1:295CB8315B705407FA18AC3A8754CC2268431F22
                  SHA-256:528ADD812EB457EC279AEC9620F00A874912F19D04043EFE278514532874C05E
                  SHA-512:45D3923ABA183A6C142249719B7CCBE467F623D35A4B0B11C3B6A1D4C8150355E2E688E9DDF42CBB8BFEDAE53300859C07C0CCBA1D15B5A0111D576771FA1901
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Boom_Hyd_Brake_Open" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Boom_Motor.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4541
                  Entropy (8bit):4.882655563995118
                  Encrypted:false
                  SSDEEP:48:3f75lrRxd80NklR/joL2kj6ivgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekjV:rrLdhNklRML1lv01GQucVzlzB4N+Bk1
                  MD5:ABBEB0E455B3524883CB43482F5DE975
                  SHA1:DB27CDD147F3C55E770C426164ABB500DBAA71A3
                  SHA-256:EA6E2C8C1A1320DB97F9CBCAF59D366A9F02E8730470462A691C4343D4B7DBFC
                  SHA-512:7C0B50904F6318AA81C3976F5C71842972AB1A085A79E0EAC0ED749B025EA353C1309445A8E85EA3104D50B4D4DF6EDB01978E3C6633704446AEBC3EA84B2D0D
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Boom_Motor" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1" Styl

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Boom_Reduce.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4483
                  Entropy (8bit):4.923524516802352
                  Encrypted:false
                  SSDEEP:48:3f75rHd86kyjoL2kj6ivgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6SlXks:lrHdZktL1lv01GQucVzlzB4NlXks
                  MD5:34C648B27CE18967EE5ABDD45BE69160
                  SHA1:59696AF52C2B5A19C6DBE386293E7B860B11EA9F
                  SHA-256:3B8AA2CA5E9EA6CA33A5AC48956C07CA7CD535C5F4CAEA242BC5E5EF058B7537
                  SHA-512:5DB898A44FCD6E35F81EBAB00700A796FDBFD5BDAE0D8867D4E154B79286B83FA58849BB2D972FF268389CE624D737FD670B72C7BBBB5CC682F8EA9E3F2EA89F
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Boom_Reduce" ShowMode="Replace" X="0" Y="0" Width="1024" Height="768" ViewPortWidth="0" ViewPortHeight="0">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>3</Version>.. <Type>Color</Type>.. <Transparency>0</Transparency>.. <ColorType>SolidColor</ColorType>.. <IsPrivate>True</IsPrivate>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <ImageStretch>Fill</ImageStretch>.. <ImageAlignmentX>Center</ImageAlignmentX>.. <ImageAlignmentY>Center</ImageAlignmentY>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Animation>False</Animation>.. <TagNameList />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Boom_Reel_1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4546
                  Entropy (8bit):4.88736370913967
                  Encrypted:false
                  SSDEEP:48:3f7rrRxd80NklR/joL2kj6ivgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6s:3rLdhNklRML1lv01GQucVzlzB4NwXk1
                  MD5:88D478EB878CEAA2A27F71BE3C5D4149
                  SHA1:55544703F1A990E5F0C3E0CD4D3E02F8764C1C97
                  SHA-256:7E9C4253E6A06E97B9D8A440AB90BE542991706AC91B58E8EE6D560310BF82F9
                  SHA-512:B2D529CBC71FDA03DA68298BCDD5F823BAFC093E646A2B4DEA532D883E1A1020791F8939B4A530C66B5F925747816795CB1DC26484F0E40C582829B6FFB8DE99
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Boom_Brake_Pad" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1"

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Boom_Reel_10.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4549
                  Entropy (8bit):4.900163419442833
                  Encrypted:false
                  SSDEEP:48:3f7WrHd80NklR/joL2kj6tvgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6S/:6rHdhNklRML1sv01GQucVzlzB4NwNk1
                  MD5:786133DCD458FCFF360DA4AA3C9A556F
                  SHA1:62489BB40BF19D75A985B4157F776B02B0CD25E7
                  SHA-256:72F6933AA42ABFC63CE95DE4E9128ED916B0FC1F99F445A5A6EFDCD6EB34CCDB
                  SHA-512:D15896A141A7D88AE44E837C6CA3F8891C1A0C6CC6A08D7D5FFC68703537C05EDEA7584EA3447D54A8DED3F6BD174278C9C8770069DECA2D11918BF5E599E5C6
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Boom_Reel_10" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1"

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Boom_Reel_2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4547
                  Entropy (8bit):4.899782131741217
                  Encrypted:false
                  SSDEEP:48:3f72urHd80NklR/joL2kj6tvgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj61:iurHdhNklRML1sv01GQucVzlzB4Nw2k1
                  MD5:12B25BBB78347923DB3719FE096E3F35
                  SHA1:D7CC8DCD91D7102982C7E14C819AD09751C77E78
                  SHA-256:9A736C4EC4EF3C42ECE1200C6E3CF66DC5597BCB8BA736EC438A210BD695608A
                  SHA-512:CA13617F4EA83D3AC10237938CD225CA18BFE9DA1E012724F8772CC121DA2EB11961153B463AD4E0C2FC1C55440AA53974A616DDB697EB261DAC60DE057A5859
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Boom_Reel_2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1"

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Boom_Reel_3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4547
                  Entropy (8bit):4.900891738417623
                  Encrypted:false
                  SSDEEP:48:3f7QrHd80NklR/joL2kj6tvgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6S1:srHdhNklRML1sv01GQucVzlzB4Nw1k1
                  MD5:65DE1ABD334D9A4E60A88205B80C7CC2
                  SHA1:009CF658F1AF52DCDEF905BC653F2F6A5C74C80B
                  SHA-256:D2DF9C9E077CC1DBD490526A8304D578F756446C31755D5F2C6CAA28AB3C3F5A
                  SHA-512:B3624551E0DED2A3AB0F47953320403E98A2D3173B5782A7870D7A7C6964021D860707B4169BF9C69D8CC1DD58D28269A80DBB87F90C4F585BD13E2F235051DE
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Boom_Reel_3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1"

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Boom_Reel_4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4547
                  Entropy (8bit):4.900285869162694
                  Encrypted:false
                  SSDEEP:48:3f7NrHd80NklR/joL2kj6tvgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6So:BrHdhNklRML1sv01GQucVzlzB4Nw8k1
                  MD5:5C90A6930A0B39638AFB50B2FF6BDF97
                  SHA1:464E0E41D3A1AB44FF005FB7C75ED38FE5982EC9
                  SHA-256:597CD33C765FD7C57E45FAEC709756ADAB1D0EAB473D81A6F09BE596A1823461
                  SHA-512:3E92E3C1554D9EB03B1CFD5E102182122CA2A25F61317A77045D3C120A518EBAE7EBB64DACAFFEFBECFEA65299D1B77912DE67FF9D1A4CA4D1EF5B015D520CC9
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Boom_Reel_4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1"

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Boom_Reel_5.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4547
                  Entropy (8bit):4.900285869162694
                  Encrypted:false
                  SSDEEP:48:3f7+FrHd80NklR/joL2kj6tvgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6o:yFrHdhNklRML1sv01GQucVzlzB4Nwrk1
                  MD5:2C65691369699E72F488ADEEDCB88F6D
                  SHA1:42209FCDA71B216B802105B22BB83534DCC331E7
                  SHA-256:DC899CF0B78F4582F56A3DB69B0711B3E3DCB664DB403E9DC7E320963A786F83
                  SHA-512:551C3FA189AAC2B00C3731287D8E956FBB457D0A657E570873398E015AF932EC895AE20A475A98FA3FB2519D76153A08BF3E545EC4C35E2C2C15BEBE40FA6C8A
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Boom_Reel_5" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1"

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Boom_Reel_6.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4547
                  Entropy (8bit):4.900891738417623
                  Encrypted:false
                  SSDEEP:48:3f77rHd80NklR/joL2kj6tvgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6Si:vrHdhNklRML1sv01GQucVzlzB4Nw6k1
                  MD5:1A0E41B15B8AE2CCCD8A8CC06C36515F
                  SHA1:C23B056041E4FE5162BAC0F970B5BBC33C624589
                  SHA-256:9B826452907451CD670081CA10F3D62ABCDCD93E479FA3AA087DA48EC0DA357E
                  SHA-512:7581996C62AAB781510ACFDB90A6DE48A51F5D31355C14E7FD3DF8E9A16F99295C275252C48C81ECD0B784FB8C892C15929165736454E09FB4B86F04D76EA037
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Boom_Reel_6" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1"

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Boom_Reel_7.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4547
                  Entropy (8bit):4.900891738417623
                  Encrypted:false
                  SSDEEP:48:3f7ErHd80NklR/joL2kj6tvgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6SR:4rHdhNklRML1sv01GQucVzlzB4Nw7Nk1
                  MD5:AFE936B0261344FBE6BF5E5FE4C271E8
                  SHA1:39C5B0DBE8A56B81013F142DDB419914DAD15B08
                  SHA-256:BB54643FDEC3DA5A0BEBCB81C7FFEA39E1FB22F40A1328BCA06FF7C0566331F8
                  SHA-512:8C5F118BA79D11B1E40FEE12A58DFFA2F92AC2A742DF2FE51A5431222E4AAF4036910DE77C4BEA23950E24A9DB2E80A92E7B6BB8C4975EDA145A5F176C206E59
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Boom_Reel_7" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1"

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Boom_Reel_8.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4547
                  Entropy (8bit):4.900285869162694
                  Encrypted:false
                  SSDEEP:48:3f7FbrHd80NklR/joL2kj6tvgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj67:NrHdhNklRML1sv01GQucVzlzB4Nwwk1
                  MD5:9B7BF77D0AA718CD4741D5467D86C9EF
                  SHA1:9E2B75F72B6BEFB0E42F3073AC8FDEFD0082D7B4
                  SHA-256:AED978464461F574160B30DF246DD2A50B47FC3865E5EF184061511A88012569
                  SHA-512:41C371DEE18C523AC46BA0E7871976CB686B4753D6B627E1E5EA9C7BC1F9D88B3C77B2084D01753D58F65D80DDAF166702882D73C8D515D79DE53CF5BEF32FDA
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Boom_Reel_8" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1"

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Boom_Reel_9.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4547
                  Entropy (8bit):4.900617906770859
                  Encrypted:false
                  SSDEEP:48:3f76rHd80NklR/joL2kj6tvgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6S7:WrHdhNklRML1sv01GQucVzlzB4NwPk1
                  MD5:78246916603E66291B344A872C420AB0
                  SHA1:AF0AF1875F23490BA53F4A91600262BEF5DDF71E
                  SHA-256:DBAD1C9454AEE7C56CE77045669740D39A395FCD870960DC9E30F2548B209A65
                  SHA-512:930E5DCF06EFE5284B8F8255DBCC3097B797934015B70A094A826D43362869A5EA09135100B1C48190D2BF8B45114DAE7DE417A5171928BC8AF359EC566E2995
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Boom_Reel_9" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1"

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\EStop_Green.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4544
                  Entropy (8bit):4.882867708552913
                  Encrypted:false
                  SSDEEP:48:3f9rRxd80NklR/joL2kj6ivgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6SD:FrLdhNklRML1lv01GQucVzlzB4NRGk1
                  MD5:5E76F21EB5CF9FCE0A1CDC0CCF3B3FF2
                  SHA1:9FA3DC2AC07F6B03DB5D478C45231409EA23DD75
                  SHA-256:2B2D46F0581054D721F8B453039FDBD39683B5AAC0AB32E7E7D6300AEECB4281
                  SHA-512:99296831714CEF0ADC58D95F4E12F8BFC9F5A20858105D21286F959AE08353CD05093C67906A6FF7FB59E36A5C5349DABF272895EFFAA348ACA6004E5907A72F
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="EStop_Green" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1" Sty

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\EStop_Red.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4536
                  Entropy (8bit):4.882068002312513
                  Encrypted:false
                  SSDEEP:48:3flbrRxd80NklR/joL2kj6ivgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6W:9brLdhNklRML1lv01GQucVzlzB4NRyk1
                  MD5:A821081737721BF099F48098370A16CD
                  SHA1:F2C2463F5DB2B9080C530409F76697A078F317D5
                  SHA-256:D900AD207B93C297955E4C4AA2B042F5E2C91CE746D05DDBDF42BBF4EC3D254B
                  SHA-512:28BD3EFB73110A2E1E952BD9B2B4CE2017965F40C4E5A2EEFD7EA2DBADE61A40B5AE202253CE4AC8D8006C6084A8449F3FE8C905AFA34CE0D7B053B7BD1E9E14
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="EStop_Red" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1" Style

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Fault.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4748
                  Entropy (8bit):4.877810817281031
                  Encrypted:false
                  SSDEEP:96:mrLdhNklRxmlv01GQUcu1eHD+Hs4N5Ek1:GhNklR2D55Ek1
                  MD5:B678CDBE94108D1888B7B897DCCCC3E9
                  SHA1:7A0652D0D25FC35165FEC5C973217424BFE2584B
                  SHA-256:D7C55B59D4119D65496C3F53245D4196B1EFC60306351F725F81FDE3A8EC8698
                  SHA-512:D03FD13ECAD37105750AC8F6E0B69EA8CD9167236651FC4BAAFD15F9EAE46A18D762704AA1F44524F8E6FE0664BE9F5C311ED67A1CCCF467C988E193285B2B1F
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Fault" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Sty

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Flip1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):17739
                  Entropy (8bit):4.574009341775056
                  Encrypted:false
                  SSDEEP:192:AhNklRUfvUCjkFxBL5ONv5FtCjkFxBL61TD1d6quC8kFxBLe1qkF:4NklRUUCjkFxICjkFxfC8kFxU
                  MD5:3333C6370978E552042C02443C859A14
                  SHA1:71946F8A0BEEF27BBC7B7D6623EFBFCE74B44568
                  SHA-256:640025BBCA05847EE7DE26DD5BC700EDA4539BC1AC8FB53334694B22AB1C10B2
                  SHA-512:E32A60F507B47B4EE0A72C0CFCD00B7FEDD68FA07B2C522C0055CF9C065442B7A3A13489ACE9AEF01AC7EE47D23F4EA2274192A309DE1F8B8E51BF54BCC245A3
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Flip1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1" Style=""

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Flip2.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):17739
                  Entropy (8bit):4.573654252501704
                  Encrypted:false
                  SSDEEP:192:nhNklRUfvUCjkFxBLOrk6MktCjkFxBL9vi2nvJuC8kFxBLb1Nlm:hNklRUUCjkFxeCjkFxEC8kFxq
                  MD5:4F51C4B913540999C51AE388EDB84BAA
                  SHA1:1B203B8292A37AD7CEC82FCC15F782BE559D0129
                  SHA-256:7BADE6B524CBDABE939067535F9A9231EF1EFD2BE83B5DEDE348A1C779766334
                  SHA-512:E3954BADCA9B902316D379A0631FD8716231116CBD01EE7002E82979EFD16259B5702D5FA2AFFB6D28CBA728FC83C5721CF932DC2C88625BD20CFA0FADA33D35
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Flip2" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1" Style=""

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Flip3.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):17743
                  Entropy (8bit):4.570909260959995
                  Encrypted:false
                  SSDEEP:192:OhNklRUf9UCjkFxBLxOlV5ntCjkFxBLgqD/iyYuC8kFxBL+wsb:2NklRUmCjkFxgCjkFxDC8kFxG
                  MD5:27CD3BA3AB236D8CBC5B5F53D4338568
                  SHA1:BAE265B9E3C955B19712C507746F7DF7B2FFFFFA
                  SHA-256:FFB899DF18575FA81BE5463718A6DF2D9041717E8E363BBC8C2C46C16FD43BF1
                  SHA-512:0BA0D13E2FEDF9A065AA2EE6C77209F3EF0CF0DCC1F00CBC51458E6746A3E571B7EF5D3F143D7B4A66D6ADE0AD41716DB4A3C2D3E161F1602154F85F5638DDC0
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Flip3" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1" Style=""

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Flip4.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):17745
                  Entropy (8bit):4.571244946228545
                  Encrypted:false
                  SSDEEP:192:FhNklRUf9UCjkFxBLO5sgcstCjkFxBL/sOO0VXuC8kFxBL5vjm:fNklRUmCjkFxuCjkFxuC8kFx2
                  MD5:C3DF60990E37FF9F45085556D2979A75
                  SHA1:749A58878DB153B8F88BB0D37D4AEDD207B6F2EE
                  SHA-256:4E1068230E04B9BE0ABEAF3E176D1EFED717EACB76700A2F55724676175DF6BE
                  SHA-512:26B7F8BC84755EEE302209046F9F8BAC7B838A7717486F7144F6FFE9076A44B2CD71B9333CE6BE16614389AF07E25296196FDB3F423DC626FF4F27BAAB173359
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Flip4" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1" Style=""

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\GantryMotor.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4546
                  Entropy (8bit):4.892159202569837
                  Encrypted:false
                  SSDEEP:48:3fyrHd80NklR/joL2kj6ivgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6SU3:6rHdhNklRML1lv01GQucVzlzB4NUok1
                  MD5:E80D98E9EF428E86055DF482F8C4E945
                  SHA1:BC0D78578DF83311DCC3E469A53333B4B8844738
                  SHA-256:B173F90C13B48D5979C0EA6279A6A5D751745B75AAA4A9F010CB990832AD38E4
                  SHA-512:1B33BDFA30DDEE42406E1F1379A79B8B967FD2E79AFC31DC5D7C70E1003BD7A1A593E737570169D5799E32675A4F494C93A994C53CAB59403150DD4BFC5F8781
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="GantryMotor" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1"

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\GantryReduce.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4547
                  Entropy (8bit):4.906995265962278
                  Encrypted:false
                  SSDEEP:48:3fkrRxd80NklR/joL2kj6ivgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6SH:MrLdhNklRML1lv01GQucVzlzB4N3mnk1
                  MD5:310880E58847472E1DA981EBC4FD736D
                  SHA1:022952FB1B250A53B0B5D06051CB3A81180AC133
                  SHA-256:36178624ED50F3742D9328931A40FF2A746C1043C5BA273CBEB550FED2F1EFE6
                  SHA-512:66C380E1A11356F87F2F114D111720F304AE00674CBEB6C1D8F9F8B821BEE876BC7E9A449FEF8916D97BE34DDCF31AB65249996A2ABAD0DF0EF9A3FEFA5189B4
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="GantryBrake" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1" Sty

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Gantry_BrakePad.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4551
                  Entropy (8bit):4.885642201320653
                  Encrypted:false
                  SSDEEP:48:3f+rRxd80NklR/joL2kj6ivgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6SO:WrLdhNklRML1lv01GQucVzlzB4NJ/k1
                  MD5:4253C965FFF81C4901269DFE2B6C7736
                  SHA1:E931154526A433C03C7053CBBAA1412AE459D690
                  SHA-256:6E292288CD732FBA16267CCC856D845C5AEA0327FE049DD29B9523D87A1354C2
                  SHA-512:9B4DCF61E306BFA3983CDDBF2F7E84045178F49694EAB5E4B9B4E52794061353084511FD4DA020F7BE028E1D77C7BC30DD923EB3B6507866D82ABA2DD1F45904
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Gantry_BrakePad" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1"

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Gantry_Brake_Close.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4566
                  Entropy (8bit):4.92726558836079
                  Encrypted:false
                  SSDEEP:48:3fOrRxd80NklR/joL2kj6ivgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6Sv:GrLdhNklRML1lv01GQucVzlzB4NGrk1
                  MD5:7C25E2EAA0E9634CE06B317BF2B3C435
                  SHA1:09A7E144BA7F1E72285D8527A0008937951395CA
                  SHA-256:F3402AEDD0E20371079AFE7758DA44DFB04B9464050C8035CCFEC1E462A0BEC2
                  SHA-512:4C291E8380AC669FDB013E1A3645848D073951B647E6BA4DA88F12E0CC20202E9B1868FDFD0B5C6A242887A1C6705E56B07D9D9689740EF1679FFB3359C98F21
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Gantry_Brake_Close" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet=

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Gantry_Coupling_1.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4555
                  Entropy (8bit):4.887838643862835
                  Encrypted:false
                  SSDEEP:48:3fBrRxd80NklR/joL2kj6ivgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6Sp:5rLdhNklRML1lv01GQucVzlzB4NDSk1
                  MD5:5469091C7FF73F30E5649327559BC745
                  SHA1:ED29588E4B2C6293B9C1B727BEE43D9DDADBBC40
                  SHA-256:08757B383380AF211A6D8FC401A9449E956A0999B184D1593BA1220F500E876D
                  SHA-512:6AB7A299E9DD8AF2C3D33513929CB846F723E3801C0539E3C2E17D76E112878226EF5C6633C8C3457F0A0EF86CF0A01AFA7B52D74DD6AE8BB37A94DD4B851346
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Gantry_Coupling_1" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Hoist_Brake_Close.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4549
                  Entropy (8bit):4.8844272465962275
                  Encrypted:false
                  SSDEEP:48:3fSrRxd80NklR/joL2kj6ivgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6SY:KrLdhNklRML1lv01GQucVzlzB4NOgk1
                  MD5:5BC554E44A98F7867F10E2A9A2C731BC
                  SHA1:3268DA94A633A76F13ED7A20958E9E1767F7BAA9
                  SHA-256:6C07DB5201847028DF5B532587EBAE0BEF8B8899E69EACC2712A027E34323EA2
                  SHA-512:8B8E9B32A10D13CCFF2BD42D39EF3F870C1E1D39C3BCD9EA747EFC050E7FD9BA9563A8172B95AF9F1870463072454C69A0B92EA48861D6E1A2459B7B35286D37
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Brake_Close" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1" Sty

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Hoist_Brake_Open.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4547
                  Entropy (8bit):4.885075476384139
                  Encrypted:false
                  SSDEEP:48:3fWrRxd80NklR/joL2kj6ivgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6SG:+rLdhNklRML1lv01GQucVzlzB4NO0k1
                  MD5:D2DC7A6472083238440A2FACC3EFE740
                  SHA1:1C21FCFFD7C4DA01F6CFF2E6E1D26DCC0158513E
                  SHA-256:F0BE348DA86924A270E7CEC46BF057F7A683244C1887202621E21405B53ABD48
                  SHA-512:AD746E5C2555DF11692BF6EFDF630380A1EC11A5EC26151BC348A0EA3E6D5CFF2AEF25A325C865F6FAC4291837FA7281209F725E86F36B092033200F0C75B2BE
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Brake_Open" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1" Styl

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Home.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4746
                  Entropy (8bit):4.87919808686813
                  Encrypted:false
                  SSDEEP:96:hrLdhNklRxmlv01GQUcu1eHD+Hs4NgXk1:7hNklR2D5gXk1
                  MD5:26C26DE0E3A109139930169C7F8BD23D
                  SHA1:82F90149063241AEE192B69D16F3883D8DA20A14
                  SHA-256:76000F4CB855D65D1F06A00B1D5AB269257435912C9489A184EE80407791F25D
                  SHA-512:7E89686AC8D0A21EB6410E4A2030FA999BF5E1284C5D65037720CE291E34FC7D55D8D5105ABAD0F5425403A6F9E2893430052F8D783DDC50B69B66EF7ED63B4A
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Home" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" Styl

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\Normal.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4753
                  Entropy (8bit):4.876998274638503
                  Encrypted:false
                  SSDEEP:96:1rLdhNklRxmlv01GQUcu1eHD+Hs4N5/k1:nhNklR2D55/k1
                  MD5:C1F362B77DDE332ED3738CDA86E5524E
                  SHA1:8E5B1411F03635566BBA9442ABDF70870594704D
                  SHA-256:8119EACD7BD8E779AB24F170E419B81F33D193FE5735C3A025D31FD9A8426C8C
                  SHA-512:494D8A989EAB8D8B2FEBC8F5013B6178BCDBF6160E3A85A8049E49666AA8A4F8325390C03511F070509FC34A9EFF6035A4DC1C10DD47F82ACE3178926743F219
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Normal" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Tahoma" Size="8" Unit="Point" GdiCharSet="1" St

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Symbol\Symbol_Icon\zpmc.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4777
                  Entropy (8bit):4.881674422735325
                  Encrypted:false
                  SSDEEP:96:4rLdhNklRkL1Gv01GQUcu1eHD+Hs4NiHk1:0hNklR9D5iHk1
                  MD5:C3326B7CE8AC4D8A76C63766D8BAAD3C
                  SHA1:0D4E524D6DDA82400D0479C6FB31803EBEDD371C
                  SHA-256:A9C56E34804A56005A60EA2C13B80CF4DF5B80B84C799354A0C30033EA18B0B8
                  SHA-512:FFCA70650705F46BEE446929E24A521E580A5229D91207AC5D49E06B7A42ADA8C24825482A97210D35E67B77B881F2284FDA11064FED84C09BDF9F5EAE1E1DAD
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="zpmc" Width="1024" Height="768">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>2</Version>.. <Type>SOLIDCOLOR</Type>.. <Direction>HORIZANTOL</Direction>.. <Transparency>0</Transparency>.. <Image>.. <ImageInfo>.. <Version>2</Version>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <IsPrivate>True</IsPrivate>.. <ImageStretch>Fill</ImageStretch>.. </ImageInfo>.. <AlignmentX>Center</AlignmentX>.. <AlignmentY>Center</AlignmentY>.. <Stretch>Fill</Stretch>.. </Image>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1" Style

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Lib_Net\Template\Template_1.tpl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4469
                  Entropy (8bit):4.915575572585976
                  Encrypted:false
                  SSDEEP:48:3fF/arRxd8trxa5joL2kj6ivgqQ5B1GY6z+pmzm7T7KcS+n7zh7nj7zhP1gekj6G:dirLdSr5L1lv01GQucVzlzB4NfwHk1
                  MD5:C0413BA5FCB08FC56A3F9F64BD1AFF99
                  SHA1:48BFF0C988F75677F574515E2A9F7B7FF8C2D494
                  SHA-256:3DC162CFC0ECFD2D8A173FD87E5A68C43A93CF5AB39C6987E4D01C5C6D3E809F
                  SHA-512:0B656409CBFED87F5B69DE0E7D3866172960B74BC133C6C8ED0F8363D8CEDA16E135F65C94B07FFA61F34E787F0A950F76C6EA3DDD2D94385BF5C7C60A69C02D
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Template_1" ShowMode="Overlap" X="0" Y="0" Width="1024" Height="768" ViewPortWidth="0" ViewPortHeight="0">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="AliceBlue" Red="" Green="" Blue="" Alpha="" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>3</Version>.. <Type>Color</Type>.. <Transparency>0</Transparency>.. <ColorType>SolidColor</ColorType>.. <IsPrivate>False</IsPrivate>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <ImageStretch>None</ImageStretch>.. <ImageAlignmentX>Left</ImageAlignmentX>.. <ImageAlignmentY>Top</ImageAlignmentY>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Animation>False</Animation>.. <TagNameList />.. <Conte

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Program\CSAssemblyLoader.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                  Category:dropped
                  Size (bytes):65536
                  Entropy (8bit):5.343187227988686
                  Encrypted:false
                  SSDEEP:1536:2RstrxpP5er6Bc2yy/N4/Jft3d/6Uo7y4SyB6OWG72YDE:2RsV986DpqftN/Z+Sy4OWG72EE
                  MD5:8140486351ACAED15C0990CA1A6405D4
                  SHA1:868F86B79D714D0F73866514E5D7E053DF3B69CB
                  SHA-256:79B2EA0B7D068E2F4AB4031DB75DD04244CEBA52512251964701C8E0FFEC663D
                  SHA-512:A0A0A0B0C5B40225032FF587C3F0AFB2E8F7FBEB598DA6A14FD3124CC7B0CCC1F503CC1F66ABFAA277E8DEE2F8102B1FB2274D21322D032DE9A3B559673D1D47
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s.yy7..*7..*7..*...*5..*..J*1..*.(i*6..*.*j*6..*.*y*8..*.*z*9..*7..*...*.*l*0..*.*e*?..*.*m*6..*.*k*6..*.*o*6..*Rich7..*........PE..L...{x.M...........!.....0..........&;.......@...............................0..........................................[...L................................ ...... C..............................PD..@............@..8............C..H............text..._-.......0.................. ..`.rdata..[....@.......@..............@..@.data....7..........................@....rsrc...............................@..@.reloc..r.... ......................@..B........................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Program\CSProgram.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                  Category:dropped
                  Size (bytes):6144
                  Entropy (8bit):3.9582556670444755
                  Encrypted:false
                  SSDEEP:96:X3k1nzb2H5YK31454qnyKHk44vXt4q1HzHKKKIc4e4qlyHMHz4R64qdPLAuatFbQ:XzWLyqyvFv2q1Tlfzq45RfqtLvat3e
                  MD5:59DA07FF782C17C54A401A389626025A
                  SHA1:7B89DDD8F62F0C507441A4F1EAD107164F835B43
                  SHA-256:B76C1F27053957249585DAAF67184635E7F0900680040FEB459249875CDBFD04
                  SHA-512:FA3519B63E8ECFB6B7A86DBF705D2C2823CC946F0F20F1B0952FF36407ABDD25ACAB7AEC99BFA9FD2DA357022091A56364D88B1B3E32520744B114DCD396D9DA
                  Malicious:false
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......P...........!................./... ...@....@.. ....................................@.................................t/..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................./......H........)...............................................................*..(....*...0..........s............r...p.(....&r...p.(....&r5..p.(....&rI..p.(....&r_..p.(....&rq..p.(....&r...p.(....&r...p.(....&.......r...p.(....&r...p.(....&r...p.(....&..}......}....*..0..........s............r...p.(....&*...0..........s............r...p.(....&*r.{.... ..../...{.....Z}....*f.{......1...{.....[}....*....0..........s.....r...p..(....&..o....(....}.....{....-.*.{.....@....rI..p..(...

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Program\CSProgram.xml

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):493
                  Entropy (8bit):4.636041082640238
                  Encrypted:false
                  SSDEEP:12:MMHdVJFRqcdCZfJFROcdCZfJFRs2cdCZfJFRsk/2cdCZfJhxIcRZK:JdVLR/6fLRj6fLRsL6fLRR6f13K
                  MD5:D411660C40B3BB9B975347D26A4A56BD
                  SHA1:12C2266DF5B16D2EAA85CE17EA741D7085E2FECA
                  SHA-256:DE5D9880AC22B4B12EE2270FFA3849608208DD4C94EAF4941D411CDF66302601
                  SHA-512:F96CDC3E4ED87583258A396E65100D09469BE1673D9FF308FB207D6079BD1BF036387287CD4379EB142FA36C7C45AEC76044388787CB7632050900DC5A4B1DEA
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<ItemGroup>.. <Reference>.. <Name>System</Name>.. <Type>Gac</Type>.. </Reference>.. <Reference>.. <Name>System.Data</Name>.. <Type>Gac</Type>.. </Reference>.. <Reference>.. <Name>System.Xml</Name>.. <Type>Gac</Type>.. </Reference>.. <Reference>.. <Name>System.Windows.Forms</Name>.. <Type>Gac</Type>.. </Reference>.. <Reference>.. <Name>Rcw.ServerAPI</Name>.. <Type>Assembly</Type>.. </Reference>..</ItemGroup>

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Program\CraneFunc.vbs

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:ASCII text, with CR line terminators
                  Category:dropped
                  Size (bytes):3226
                  Entropy (8bit):4.993911948912877
                  Encrypted:false
                  SSDEEP:48:LvKpbvx55VWDorlN51jhy57tKe7aBK1FL55+STfNeIvB0o:uv3lVEtKLK1FLiIfNes3
                  MD5:3D5DDBCBD0966F19B3848EBB5299D8E6
                  SHA1:DD8B4DED9522F18EC2A0A4D914F92F90C3083FAB
                  SHA-256:6B428B3533BA210BAA7FDCC61606E6A60BAE94A21BF129BA981A46AB9BB6BF22
                  SHA-512:69B344E642F1DEAF889D6870A22C5441F4F2EF91C62F9BCA7096BB2B59B3C046356DD5368B0CA266BF5980B09874F86CA928B03917CFC561F901DB18F2759175
                  Malicious:false
                  Preview:Dim bpos As Variant.Dim tpos As Variant.Dim hpos As Variant.Dim bRun As Integer.Dim nStep As Integer..Public Sub WriteBoom()..Dim rval As Integer..TagWrite "Boom",2000..TagRead "Boom", rval..Print(rval).End Sub..Public Sub movecar()..Dim dval As Double..n = 1..dval = 4000..While n>0...TagWrite "Boom", dval...Idle(2000)..Wend.End Sub...Public Sub InitForm()..TagWrite "Boom", 8000 ..TagWrite "Trolley", 0 ..TagWrite "Hoist", -1770 ..TagWrite "IsLock", 0..TagWrite "onbroad", 0..TagWrite "IsDemoRun", 0..TagWrite "IsDemoEnd", 0..nStep = 1.End Sub..Public Sub StartDemo()..TagWrite "IsDemoRun", 1..TagWrite "IsDemoEnd", 0..End Sub..Public Sub PauseDemo()..TagWrite "IsDemoRun", 0.End Sub..Public Sub EndDemo()..TagWrite "IsDemoEnd", 1..End Sub..Public Sub RunDemo()..TagRead "IsDemoRun", bRun..If bRun = 0 Then Exit Sub..If nStep = 1 Then...TagRead "Boom", bpos...bpos = bpos - 300...If bpos < 0 Then....bpos = 0...End If...If bpos = 0 Then....nStep = 2...End If...TagWrite "Boom",bpos..End If..If nS

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Program\NewDoc1.cs

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:C++ source, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):354
                  Entropy (8bit):3.409408675653755
                  Encrypted:false
                  SSDEEP:6:QQFqfkRMsWqfkRG7WqfkRQEEy7WqfkRuWn+Ski3IqcutV0vDsQnrMVc7gSnrM+KX:QytDWtkWt0y7WtEUNcSmI2Y+7lnY++xT
                  MD5:AB7E89D4C89A49C1F2E61B88E464E6C6
                  SHA1:FC46A630E296F04A0B2D792B17B712957637EB77
                  SHA-256:BA9FA50E6D02E7984504285BBE5D42219C9EA9599A248C9C1A70E68E679BB413
                  SHA-512:59DBCF4AFC117E6F96EEA0DA7C665C5447EB7261072B06FF6550CBE36E3F915E75363E25DDE420F6195BCA7187AD768749CAD79DA5FA98F883A068F671EA664E
                  Malicious:false
                  Preview:..u.s.i.n.g. .S.y.s.t.e.m.;.....u.s.i.n.g. .S.y.s.t.e.m...X.m.l.;.....u.s.i.n.g. .S.y.s.t.e.m...D.a.t.a.;.....u.s.i.n.g. .S.y.s.t.e.m...W.i.n.d.o.w.s...F.o.r.m.s.;.................n.a.m.e.s.p.a.c.e. .S.c.r.e.e.n.....{.......p.u.b.l.i.c. .c.l.a.s.s. .N.e.w.D.o.c.1.......{.........p.u.b.l.i.c. .v.o.i.d. .F.u.n.c.(.).........{.........}.......}.....}.....

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Program\RTGDemoFunc.cs

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:C++ source, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):19918
                  Entropy (8bit):2.9779014539099515
                  Encrypted:false
                  SSDEEP:192:SHPr+xvJNeC9uPrLbZmA1d/ZX5BZGU8PZfKiRRt1epxAlCJepzT4pqdfOI:kPr+nNBS4Atc5K6gAJTh
                  MD5:C283373ECB7978B0F588785C2ABF8F5B
                  SHA1:CF43A6106808D4850A2DC5C50873B2E51EF3259A
                  SHA-256:EA4FB714E8FC583927762A7F3F13D5C9C0CAEFB916B9553E07EFFA02092121CC
                  SHA-512:008C0BE4CE682B5F21250D1D86FE4F36809E5F1578FCD96516B333F9CDE08C229F2F1F8AD433698A678393A791868D874139D2BF860A40E1BEB189C5D1AD8557
                  Malicious:false
                  Preview:..u.s.i.n.g. .S.y.s.t.e.m.;.....u.s.i.n.g. .S.y.s.t.e.m...X.m.l.;.....u.s.i.n.g. .S.y.s.t.e.m...D.a.t.a.;.....u.s.i.n.g. .S.y.s.t.e.m...W.i.n.d.o.w.s...F.o.r.m.s.;.....u.s.i.n.g. .Z.P.M.C...S.C.A.D.A...R.c.w...S.e.r.v.e.r.s.;.........n.a.m.e.s.p.a.c.e. .S.c.r.e.e.n.....{.......p.u.b.l.i.c. .c.l.a.s.s. .R.T.G.D.e.m.o.F.u.n.c.......{.........i.n.t. .m._.n.R.u.n. .=. .0.;..... . . . . . . . .i.n.t. .m._.n.S.t.e.p. .=. .0.;..... . . . . . . . .i.n.t. .m._.n.S.t.a.c.k.N.u.m. .=. .0.;..... . . . . . . . .i.n.t. .m._.n.S.p.e.e.d. .=. .1.0.0.;..... . . . . . . . .c.o.n.s.t. .i.n.t. .m._.n.D.i.s.t. .=. .8.0.0.;..... . . . . . . . .f.l.o.a.t. .m._.f.T.r.o.l.l.e.y. .=. .0.;..... . . . . . . . .f.l.o.a.t. .m._.f.H.o.i.s.t. .=. .0.;..... . . . . . . . .f.l.o.a.t. .m._.f.T.r.o.l.l.e.y.M.a.x. .=. .5.0.0.0.;..... . . . . . . . .f.l.o.a.t. .m._.f.H.o.i.s.t.M.a.x. .=. .5.0.0.0.;......... . . . . . . . .p.u.b.l.i.c. .v.o.i.d. .I.n.i.t.R.T.G.(.)..... . . . . . . . .{..... . . . . . . . . . . . .o.b.j.e.c.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Program\Rcw.ServerAPI.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                  Category:dropped
                  Size (bytes):24576
                  Entropy (8bit):2.802344295679032
                  Encrypted:false
                  SSDEEP:192:rzH/hbugWeDo4H8Qg8a8MkBhRPpHpxkmM5M5HUYc:/Uj4hPBhTzjM5MdUYc
                  MD5:8AAF9A0F0A9A0B759F8618E6717F66B7
                  SHA1:15350B63145F9B5297996BCB51C2EA16EBEDAADD
                  SHA-256:4BA4572576C62F6B488CF587FB93EDDCE73A251744CC8D54CDA3D1598270FF7A
                  SHA-512:2C70A6A0CEC998DE5E9BA28A524F44C651574061C7F81F07FD802B61D6932E2718746BABE69296F0080CD9C47BB6371D2079ECB7CB9B91BB1E2C72B98EB1B047
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...bQGO...........!.....0... ......~D... ...`....@.. ....................................@.................................0D..K....`..X............................C............................................... ............... ..H............text....$... ...0.................. ..`.rsrc...X....`.......@..............@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Program\test.vbs

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:ASCII text, with CR line terminators
                  Category:dropped
                  Size (bytes):41
                  Entropy (8bit):4.171474187957337
                  Encrypted:false
                  SSDEEP:3:CkXMXhhUIn:XMXUI
                  MD5:EDAF00CFE9EA54D7266530C94FB7E7F2
                  SHA1:C5C5FD3660AC6A7D796194A3E34FD1F83259CB3B
                  SHA-256:EF6FB325E62FFFC4A1F39E51A499EC6A3C49BE8D63F96538CE2F5AC60ECCD9B8
                  SHA-512:1023CB8078EF784BDF21A0F90CE01CF52BFAE9317285F1635F24EAD8C0C9B4078CC234625972578E5289287DB730FEE642CD5DBFD08A8CEF3133CF35B2539A5A
                  Malicious:false
                  Preview:Public Sub test()..Print("test").End Sub.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Program\window.vbs

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:ASCII text, with CR line terminators
                  Category:dropped
                  Size (bytes):63
                  Entropy (8bit):4.471028288744661
                  Encrypted:false
                  SSDEEP:3:Ypz9L8ciJQXK+pagP3In:yRATkK+FI
                  MD5:B79B546C869F0737B2BA2E2DDE8B3E63
                  SHA1:53E5A6ABCB05EB553C34165BB555A5DBA673A432
                  SHA-256:30BC7328A48321FF9A94B8D0C0E8B0FBB16FD1AB63E6FE6AAD17C0B3EA739F2C
                  SHA-512:38166230AA61929BCECD59F812E37221DDC000957517D5E14C153A129FB05780DDD5A20A04EC02292EAE07472005AC545A2B73D4BB10E87B2E61EF8CA194996E
                  Malicious:false
                  Preview:..Public Sub GoWindows()..Dim s As String..s=WinGoto().End Sub.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\RTG.scn

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):292895
                  Entropy (8bit):4.519566993311713
                  Encrypted:false
                  SSDEEP:6144:rh1bDRpCsAU789SVfR/CHNVdpIzDI0c0VqVw7j4+akdrDq0nDPgfNy1tMh+gwUbh:rh1bDRpCsAU789SVfR/CHNVdpIzDI0cz
                  MD5:1FC5760C44E7908C8C5CCCDC2ED8A1E6
                  SHA1:7A769F862AAC0967DDFCC28A01B2877FC440B626
                  SHA-256:DF49FE48B87FE2F2626F4E63816F49E189B9E13C6A193577152FA534171DB81F
                  SHA-512:48A89B97FB14DE7E9BF42927C06201D4FE02A8A1EA097E1CFB1D7DCF6C4593A7CD21CE64824ABD8174712770564EAA12DE335EE585341A3343072D173135B216
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="RTG" ShowMode="Overlap" X="0" Y="172" Width="798" Height="568" ViewPortWidth="0" ViewPortHeight="0">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event>.. <EventElement Event="Periodic" Action="Expression" Parameter="Screen.RTGDemoFunc.RunRTGDemo()" Level="-1" />.. </Event>.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>3</Version>.. <Type>Color</Type>.. <Transparency>0</Transparency>.. <ColorType>SolidColor</ColorType>.. <IsPrivate>False</IsPrivate>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <ImageStretch>None</ImageStretch>.. <ImageAlignmentX>Left</ImageAlignmentX>.. <ImageAlignmentY>Top</ImageAlignmentY>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFam

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Spreader.scn

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):438810
                  Entropy (8bit):4.494971077834916
                  Encrypted:false
                  SSDEEP:12288:GBp+2/aEHX2XPeTFopkupmd7UftZFaJsssRRYdSlsSa5QBkHlqdnaTXup851eq6o:GBp+2/aEHX2XPeTFopkupmd7UftZFaJV
                  MD5:700C5E39D57567713EF6318A09C465FC
                  SHA1:8F3272B6B8819F21085E4705255CC11E08FFBA49
                  SHA-256:24DADAB1394794E90A5DDD614FA16F8B22ED35AAD633D4C2749EF7701112C771
                  SHA-512:65015317656C85EB776FA193AC7A1466A013DEE2E6F8D684FBDB1482ADDC1CF20DE52724324E31D86BD4B8B2783CD381E4C88C5DCF5E22F83019C5E33873599E
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Spreader" ShowMode="Overlap" X="0" Y="131" Width="774" Height="608" ViewPortWidth="0" ViewPortHeight="0">.. <Template>.. <TemplateName>Template_Realtime</TemplateName>.. <IsPrivate>True</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event>.. <EventElement Event="Periodic" Action="Expression" Parameter="RunDemo()" Level="-1" />.. </Event>.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>3</Version>.. <Type>Color</Type>.. <Transparency>0</Transparency>.. <ColorType>SolidColor</ColorType>.. <IsPrivate>True</IsPrivate>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <ImageStretch>Fill</ImageStretch>.. <ImageAlignmentX>Center</ImageAlignmentX>.. <ImageAlignmentY>Center</ImageAlignmentY>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Statusbar.scn

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):13793
                  Entropy (8bit):4.884620708275702
                  Encrypted:false
                  SSDEEP:96:qurHdSr5L1lv01GQucVzlzB4NZXkiv01GQucVzlzB4NnlrrRRyXajbru0vov01Gx:qAgfZXkmfnjIfZp
                  MD5:D708D10056B6B5DB6A4040A6EDD9E8CE
                  SHA1:7AEEE389533BB6F9E0FEB3A1A24ACADB15BE3A2F
                  SHA-256:0985F68F450B2B1DBE9F739FAE93FF63706D973587E9B04762F0A5B33A7CBC74
                  SHA-512:2332927BD05B324123C0365CDBC9AB05D1B9FAA7AF9F27BFD34CE7C6985FF9F9D70DA130429D5CA072401DDF04449C8AD94B7C9D2B8AA1A9B225C6EBB95DBBF5
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Statusbar" ShowMode="Overlap" X="0" Y="738" Width="1024" Height="30" ViewPortWidth="0" ViewPortHeight="0">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>3</Version>.. <Type>Color</Type>.. <Transparency>0</Transparency>.. <ColorType>SolidColor</ColorType>.. <IsPrivate>False</IsPrivate>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <ImageStretch>None</ImageStretch>.. <ImageAlignmentX>Left</ImageAlignmentX>.. <ImageAlignmentY>Top</ImageAlignmentY>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Animation>False</Animation>.. <TagNameList />.. <Co

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\TitleBar.scn

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):22859
                  Entropy (8bit):4.86935321872532
                  Encrypted:false
                  SSDEEP:192:p75DkCQkCSkC1BNW9kC1kChkCNPmTDkakRm7kWka:lFkFkxkQLwkOkQkiKkPMkWka
                  MD5:B17094403D9C0A8892084DCA2005E193
                  SHA1:485FDEB4459AA9D6195147465A7BAAD47A29CDA1
                  SHA-256:F64643156081888C8007FFF8DB019ECB2748CA77A00183B85E10E6F54C1F6F31
                  SHA-512:B3A4031D3621B5AD2C8D0468B1C42EAA1B89D14586805F108DD4833118885F31B1A7BA99B8118B1A0DB02CAEDC57261C40173647C6EF3B353E8A10367D261239
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="TitleBar" ShowMode="Overlap" X="0" Y="0" Width="1024" Height="32" ViewPortWidth="0" ViewPortHeight="0">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>3</Version>.. <Type>Color</Type>.. <Transparency>0</Transparency>.. <ColorType>SolidColor</ColorType>.. <IsPrivate>False</IsPrivate>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <ImageStretch>None</ImageStretch>.. <ImageAlignmentX>Left</ImageAlignmentX>.. <ImageAlignmentY>Top</ImageAlignmentY>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Animation>False</Animation>.. <TagNameList />.. <Conte

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\Trolley.scn

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):279683
                  Entropy (8bit):4.839433012650944
                  Encrypted:false
                  SSDEEP:6144:tS1FuzsycrPpS59ofQqYtO/ouoTx53g/Xeto/suuqLOzhKUitZCzb0AyZ9uR3us+:tS1FuzsycrPpS59ofQqYtO/ouoTx53gr
                  MD5:69B3131DB5682335397F98A7C7D115A6
                  SHA1:3B9BF3302E48C2D27CE0B34D1456E1275FE697D1
                  SHA-256:C3548402C9C7BF43A5A7F5CCBF00CBE3CD3DC01E2C876A96DEE0A71483DCC0DD
                  SHA-512:496EA11F16E19F96EEBC83CFE3393DAED950F7F993CB54EB7192D8FACAE0B187073AD3946ADE8A710ABEA2460FF94A04895F9BAA96CB1DA9672C31D2FCEE3A66
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Trolley" ShowMode="Overlap" X="0" Y="131" Width="774" Height="608" ViewPortWidth="0" ViewPortHeight="0">.. <Template>.. <TemplateName />.. <IsPrivate>True</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event>.. <EventElement Event="Periodic" Action="Expression" Parameter="RunDemo()" Level="-1" />.. </Event>.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>3</Version>.. <Type>Color</Type>.. <Transparency>0</Transparency>.. <ColorType>SolidColor</ColorType>.. <Colors>.. <Color Name="Blue" Red="" Green="" Blue="" Alpha="" />.. </Colors>.. <IsPrivate>True</IsPrivate>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <ImageStretch>Fill</ImageStretch>.. <ImageAlignmentX>Center</ImageAlignmentX>.. <ImageAlignmentY>Center</ImageAlignmentY>.. </DefaultControlBackColor>.. <DefaultControlForeCo

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\View\Boom.scn

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):223203
                  Entropy (8bit):4.145017917500981
                  Encrypted:false
                  SSDEEP:6144:QiWehnh5BSWhhCyxcm7BZvzhE1dqCuL1wCp9uhn1cqFsMHjaZduU0D1KUZ:QiWehnh5BSWhhCyxcm7BZvzhE1dqCuLc
                  MD5:4861E46AF3D3D258F2B7765DDAF96C41
                  SHA1:D232F7CD00CA02170BC7C8E021FE82F205470721
                  SHA-256:588ED66D7DDA5DE980BA591821BEB47DF52E9524A24E74734A3095C0F57C0EB6
                  SHA-512:DF781F59847D29CF125CA90D10A8870B9F2886FE7CCC285509E88C2FE0132232E1B97B3577066C0BBA077CED68384EEFDFB402F96313FE6269E1251518C3D5A5
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Boom" ShowMode="Overlap" X="775" Y="130" Width="249" Height="152" ViewPortWidth="0" ViewPortHeight="0">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event>.. <EventElement Event="Click" Action="OpenWindow" Parameter="Boom.scn" Level="-1" />.. </Event>.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>3</Version>.. <Type>Color</Type>.. <Transparency>0</Transparency>.. <ColorType>SolidColor</ColorType>.. <IsPrivate>True</IsPrivate>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <ImageStretch>Fill</ImageStretch>.. <ImageAlignmentX>Center</ImageAlignmentX>.. <ImageAlignmentY>Center</ImageAlignmentY>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\View\Hoist.scn

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):43461
                  Entropy (8bit):4.673782365941543
                  Encrypted:false
                  SSDEEP:384:IYkdjkTJkaXVk+XkCXXk0LwklkTukpkF4kOkb:EwJXLh/LaQ9
                  MD5:2D2FBD342E888A006956E60FD436F5BD
                  SHA1:EC87FE5FEF2E739CA05A0D2DC35535DE03FE2B06
                  SHA-256:AF39E6E27F1C7665676ED24DC87F4EB5AB58E64A9A58D00AACF4D76B3CDEC66C
                  SHA-512:C1075600AC45F246F78E6C83204959CAC5758731C6618DE8529770038C8F13860A46387A5F4CE0B6FAD03D5CEDDC9462402F507C4110C8DA20B7F7D37D0CBF13
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Hoist" ShowMode="Overlap" X="775" Y="283" Width="249" Height="152" ViewPortWidth="0" ViewPortHeight="0">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event>.. <EventElement Event="Click" Action="OpenWindow" Parameter="Hoist.scn" Level="-1" />.. </Event>.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>3</Version>.. <Type>Color</Type>.. <Transparency>0</Transparency>.. <ColorType>SolidColor</ColorType>.. <IsPrivate>True</IsPrivate>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <ImageStretch>Fill</ImageStretch>.. <ImageAlignmentX>Center</ImageAlignmentX>.. <ImageAlignmentY>Center</ImageAlignmentY>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial"

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\View\Spreader.scn

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):337074
                  Entropy (8bit):4.076730636019823
                  Encrypted:false
                  SSDEEP:6144:XP1SP/AZrFCa1uoh9FOMalAePUaRd/NQGThAcUA/cxIufXJMSjPI/Lj+Z1dsRvrN:XP1SP/AZrFCa1uoh9FOMalAePUaRd/NV
                  MD5:ABBBEB719C600C9475B6565A81CF0D55
                  SHA1:C81C1680569A1AB54B351C6FC5889CFA4697C8F0
                  SHA-256:54076D891FA5DAF234156B2D4D85337B56AB847FBDF99C444E4E8449CE82B3D6
                  SHA-512:A4533DEBE708FC5E9690AC08DC82284AF046E2CA164094A6934B06E8AFDBE26B9445DA9ACD21B0EE2E0E0396B111FD10B024FC28021B9B45D9CC515987B283C0
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Spreader" ShowMode="Overlap" X="775" Y="587" Width="249" Height="152" ViewPortWidth="0" ViewPortHeight="0">.. <Template>.. <TemplateName>Template_Realtime</TemplateName>.. <IsPrivate>True</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event>.. <EventElement Event="Click" Action="OpenWindow" Parameter="Spreader.scn" Level="-1" />.. </Event>.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>3</Version>.. <Type>Color</Type>.. <Transparency>0</Transparency>.. <ColorType>SolidColor</ColorType>.. <IsPrivate>True</IsPrivate>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <ImageStretch>Fill</ImageStretch>.. <ImageAlignmentX>Center</ImageAlignmentX>.. <ImageAlignmentY>Center</ImageAlignmentY>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="WindowText" Red="" Green="" Blue="" Alpha="" />.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\View\Trolley.scn

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):24690
                  Entropy (8bit):4.698496250322838
                  Encrypted:false
                  SSDEEP:192:87ky6fkWfpkI2f6kIn8D7PHkgYNXkKLEcVGXkKLOGV:ok1kWxkRikq8n/kBXkbXki
                  MD5:4426D366B22EA1EE334FCAAB0D267EE5
                  SHA1:2C647F0CAB1AF0EF197DD21E9E5E9C22D84D39D1
                  SHA-256:3F78047CDF4EC144908EE0FEAC6FF7270CA3E27D9F41B9B11D1A7ACA84FBB288
                  SHA-512:60714D6F1244C96B91370CBDE5849A22DE38D89D2CF76A0EDB745A841A5442D3CAF14793849142DBB4D27492BA3530D568930E1AF281C4B80F9310CF02F79FDB
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="Trolley" ShowMode="Overlap" X="775" Y="435" Width="249" Height="152" ViewPortWidth="0" ViewPortHeight="0">.. <Template>.. <TemplateName />.. <IsPrivate>True</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="240" Green="248" Blue="255" Alpha="255" />.. <Event>.. <EventElement Event="Click" Action="OpenWindow" Parameter="Trolley.scn" Level="-1" />.. </Event>.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>3</Version>.. <Type>Color</Type>.. <Transparency>0</Transparency>.. <ColorType>SolidColor</ColorType>.. <Colors>.. <Color Name="Blue" Red="" Green="" Blue="" Alpha="" />.. </Colors>.. <IsPrivate>True</IsPrivate>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <ImageStretch>Fill</ImageStretch>.. <ImageAlignmentX>Center</ImageAlignmentX>.. <ImageAlignmentY>Center</ImageAlignmentY>.. </DefaultControlBackColor>.. <DefaultControlForeC

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\lastAlarm.scn

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):10471
                  Entropy (8bit):4.876302057302675
                  Encrypted:false
                  SSDEEP:96:gr7dSr5L1Vv01GQuxZVzlzB4N/Gr/Vh0QHQp8/QLQ0YI6Yaaadbt3N:2AXm+h0K2mimaadZ3N
                  MD5:29FD74E2C5AB4FA1D6E5441035D3951D
                  SHA1:58E3CB5D5114694D82B46303C21CB45D80ECD051
                  SHA-256:CF3DE0698D186BEC91801A795AF688CE27EBDF20AB05CE9465447C7DD77A96E4
                  SHA-512:E0D10B93781104CF71DA750A3E23E77801F95A71660C1E589A27A02C98DA866CC019ECE9892426C55BA5E249AC4A03107BF2D61C52E4C1E0318C4C1BA1DDD0C0
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<Canvas Name="lastAlarm" ShowMode="Overlap" X="0" Y="32" Width="1024" Height="100" ViewPortWidth="0" ViewPortHeight="0">.. <Template>.. <TemplateName />.. <IsPrivate>False</IsPrivate>.. </Template>.. <BackgroundColor Name="" Red="255" Green="255" Blue="255" Alpha="255" />.. <Event />.. <PeriodTime>200</PeriodTime>.. <DefaultControlBackColor>.. <Version>3</Version>.. <Type>Color</Type>.. <Transparency>0</Transparency>.. <ColorType>SolidColor</ColorType>.. <IsPrivate>False</IsPrivate>.. <ImageListName></ImageListName>.. <ImageName></ImageName>.. <ImageStretch>None</ImageStretch>.. <ImageAlignmentX>Left</ImageAlignmentX>.. <ImageAlignmentY>Top</ImageAlignmentY>.. </DefaultControlBackColor>.. <DefaultControlForeColor Name="Black" Red="" Green="" Blue="" Alpha="" />.. <DefaultFont FontFamily="Arial" Size="8" Unit="Point" GdiCharSet="1" Style="" />.. <Animation>False</Animation>.. <TagNameList />.. <Co

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Screen\mysymbol.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):346106
                  Entropy (8bit):3.5715848246816524
                  Encrypted:false
                  SSDEEP:3072:hhththththththththththththththththththththththththththth5bbbbbbe:g
                  MD5:1F64DF03BFB3EE3DAA7ADEDB2BFB1DF9
                  SHA1:F1FC5921AE79500337EED55BD68784F4748365F8
                  SHA-256:A44157E45A7871608682F3D37F1374B913673C2EC95304A845F4F74188B2F331
                  SHA-512:E1A40BF9553A7441A614449DF32C6EAD72882712780A66EA2ED2CDB01DC877C8A2C97692C0065F4C3DD524A82CE88033C7CCDB973FAC7DDD083F66F8EE712EA6
                  Malicious:false
                  Preview:........CDrawSymbol...............................................................................?...?..........CPositionObj.........................CDisplayObj..................................CSliderObj.....................................CDrawImage...............................................................................?...?......................................................................+C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\bmp1.tmp........99............BM........6...(...................v....................99.99.99.99.99.99.99.99.99.99.99.99.99.99.99.99.99..99.99.99.99.HH.xn..]Cu-.f.Am).uX.rj.HH.99.99.99.99..99.99.99.gd..Z..#..0..&.............xO.fb.99.99.99..99.99.hem.J..F..E..;..1=.S............bw;.fb.99.99..99.HH..a$.T%.Y".R..Fp........'..........zO.HH.99..99.{r..8/.l-.g&.[w...........2../..".......rh.99..99..m)._/.l/.l}...........H..D..9..1..+.....Z.99..99`.F/.l/.l}......................5..0E.2.99..991../.lI...............................E..;.. .99..99`.F

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Server\AlarmServer\AlarmServerAlarmServerSetting.ini

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:ASCII text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):47
                  Entropy (8bit):4.13344018105059
                  Encrypted:false
                  SSDEEP:3:6grlyzysSPXvWv:vJjv+v
                  MD5:1D0BD6A46571C2503E0F888E0CD3DCDA
                  SHA1:49028B10E59BF32480FC67E143C3C3AFDFD21465
                  SHA-256:6A4422B59B180C1374A58660DB888D043BEB59DD7042EA77AE91B60AF8D79BD0
                  SHA-512:0789FB39609F8D50F5F2066EF5228746EA997D69AD0C554E944AED41714146FAE16177386534B6C0DE77617175BC0351FB27D41AA5A0DF4D80ED7F90F9CB0EF1
                  Malicious:false
                  Preview:[APPSERVER]..SERVERIP=LocalHost..ISIOSERVER=0..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Server\AlarmServer\AlarmServerSetting.ini

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:ASCII text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):47
                  Entropy (8bit):4.13344018105059
                  Encrypted:false
                  SSDEEP:3:6grlyzysSP3Wwvn:vJjPWan
                  MD5:4631CBCE53662B46E1F916C67878AD3D
                  SHA1:F303BA388BE3D54421153542F1B736BAFEDB5B86
                  SHA-256:F4B85BC29695B09CD50E240B10A315D9E8993B2BCDE1254822D3F04C6356B6B6
                  SHA-512:6760938D30F786E005DF5F74EDAFE51336C3A7566497D364C98F716BBB1651EFFC6CCCE4B170CEDD0798952FB0377C68A7D08FB78EAFD1737FF60386AA9C76A2
                  Malicious:false
                  Preview:[APPSERVER]..SERVERIP=Localhost..ISIOSERVER=1..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\Server\EventServer\Program\NewDoc1.vbs

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:ASCII text, with CR line terminators
                  Category:dropped
                  Size (bytes):42
                  Entropy (8bit):4.2344795541337445
                  Encrypted:false
                  SSDEEP:3:CjXhhUIn:+XUI
                  MD5:496A04FC619B874F255A9C8BC284FA21
                  SHA1:45B3965A8D642C47FEB9FE916AB26AEB915D96E9
                  SHA-256:D2AECD9802BC2CA05A346C2E808AA409D0A7530C96EF935BBD21FB4EF0B11987
                  SHA-512:A8380FC62A5FD71499B768D47EF9C30215033598B3CA6B5ED0906E942BB1F37F48F2A894C2ACCA3055924F618AD466B3EC7A3BF4F562C659E3B1168D695F3C9C
                  Malicious:false
                  Preview:Public Sub test2()..Print("test").End Sub.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\DemoDotNet\VBAErrorLog\20131204.txt

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:ASCII text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):176
                  Entropy (8bit):4.515862210469783
                  Encrypted:false
                  SSDEEP:3:QuCMQLtwLQFFF3KNMozzCMQLtw5JNMozzCMQLtaNZKNMozzCMQLtbdLWYNMov:QCStwM/GMozbStwdMozbSta+MozbStVt
                  MD5:66A9F7CE0C35684A4444A69235DD670C
                  SHA1:4D3267E2D27D371E4DF52421AA0B93ABB7698253
                  SHA-256:8B7023754D451EE817881F630DF155614328DE62CFC861FAA104D3C9F4654E24
                  SHA-512:A0AEB9263427B61D10C57B55CBA5CFED02B4DCE80DF8BA62377127AAFB9D46B7C1F158ECBDF6A21BED433AC6CBDDD3B7BEF0F487686F4A2AC5239794EEBA26D8
                  Malicious:false
                  Preview:VBA Function Error: 14:14:38.085 Main()..VBA Function Error: 14:14:38.823 Main()..VBA Function Error: 14:14:40.027 Main()..VBA Function Error: 14:15:58.021 Main()..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\Config.dat

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):195
                  Entropy (8bit):2.770764821020561
                  Encrypted:false
                  SSDEEP:3:kllGl/Tfkl/ZlTyllUslZlBAA8EAXM0XXluna7/cA7ve/n:sly/Tfs//ylzFmAwMiw0cA7Gn
                  MD5:9AFD46A074E332C4A81447843EE52851
                  SHA1:6BA1BC73A72B647A117FD141B6F730F35384EB9B
                  SHA-256:6455A37817A1D373352A847699F8CFC7C91C6F0BE5E11A46773F7A3C38719093
                  SHA-512:072156D8584C476D8030EBD0862DAC04F78347B29B00BF889C9A042396FE7A0B83B3D972F7A2EFBBCADEFB4BBFFF5F052887C464F23B34A655F9FBB82D74E476
                  Malicious:false
                  Preview:...................................i................g..............CServerItem...AlarmServer.....j....l........m...Chinesen..........................."Arial.......................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\Data\GridLines.lot

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):12
                  Entropy (8bit):0.8166890883150209
                  Encrypted:false
                  SSDEEP:3:Ql/:w/
                  MD5:8E77C71162CE21B2CCAB3E8C45B06FF1
                  SHA1:B9D3440CF448B3EBD77056DCD55C5E348DC831BA
                  SHA-256:7C8F137D8272479DA49EF298B7170C52EC06AAD7725F554FE8B7C4E28A00BCBD
                  SHA-512:1FA2AA7826B75C2FCA35DE2F72A839FDBD65D36A8BA7B46B1BF3F62CC4F37971FA14BE7C3F64C444E5D2251F72DBAB2F579B703C50E27B63877F7178FE52C2A9
                  Malicious:false
                  Preview:........d...

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\Opd\DemoOpd.opd

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):9090
                  Entropy (8bit):0.4414934067011832
                  Encrypted:false
                  SSDEEP:12:vwhmqlSdnNPSxow+Ea6Rrp8izOqlSd1V1CWK4+aaZTVGPOn:vwFaSxvLrp8i3XWK4+hRVUOn
                  MD5:98B5DA151D71C22A3B14C88AA91E99D7
                  SHA1:DA5D705AE2757D5F4F322CD161C0883FB09282FC
                  SHA-256:9F5E5FD10F829927ED5FDB22E20D49AF219C54455A788E6BA44E003BBD45BE74
                  SHA-512:204D3A0A0CBCEDD8E99E51726C6826898790B627E2B9556903C4EF3388EE16C806BB0455D5422108A7309361453111A76B57D5E86AD64B1567DA8B845987E699
                  Malicious:false
                  Preview:........D.e.m.o.D.r.i.v.e.r.A.l.a.r.m.....M.e.m.o.r.y.................D.e.m.o.D.e.v.i.c.e.A.l.a.r.m.....D.e.m.o.D.e.v.i.c.e.A.l.a.r.m...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\Screen\Demo_Alarm.csw

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:Composite Document File V2 Document, Cannot read section info
                  Category:dropped
                  Size (bytes):408576
                  Entropy (8bit):4.963509225963255
                  Encrypted:false
                  SSDEEP:1536:pvgCpxRUyvj99UjsJvJrTPKpxRUyujp9UjsJvJrTPihH4NhH4omkimk:yOx2yvZ9csNlTOx2yu19csNlTSGRdid
                  MD5:C88FA38450CE1C455211FC2986BBE9CC
                  SHA1:28DB7B0FD1801CA8DED836EA4D395D9285AF37A1
                  SHA-256:D48DB29C7D0A3E98F6872258E0EC01D8A111921B129663206620A14EAECC6CE2
                  SHA-512:C20541F405B65AA98427730A4EAE155BFF66B6701908734201143A4D52415771A51A10487CE296BCA6B5E7C5A88430795F820A471E92F762B90E1050CEFA2992
                  Malicious:false
                  Preview:......................>...........................................................................$... ...!...".......#.......................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................`{..................C.o.n.t.e.n.t.s.....................................................................................................%...................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\Screen\Demo_QC.csw

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:Composite Document File V2 Document, Cannot read section info
                  Category:dropped
                  Size (bytes):1677824
                  Entropy (8bit):4.255157739486983
                  Encrypted:false
                  SSDEEP:49152:mV55wqiZqIqiZqIqiZqIqiZqIqiZqIqiZqIqiZqIqiZqIqiZqIqiZqIqiZqIqiZZ:m/
                  MD5:E9C34A24A4A75E0B6C52B6744C8C9BA6
                  SHA1:FB919D541F644EDEA9CF0B5118510FAB5397E58C
                  SHA-256:BDC9C71E6D6A6AD5FC1C843E87FC2A1DC0976EEF2E6E821CD81DDDD7B19D419E
                  SHA-512:7524E00748BFF2F43834D22D38572CCA06CDBDEAC84B97863D0244B883896D126B284E656EE2FD3F8798A5B7C0BC8B0191A254DF78FA4AADA89AA574117C4071
                  Malicious:false
                  Preview:......................>...................R.......................................................................................................................................!..."...#...G...H...I...J...K...L...N...O...P...Q...R...S...T...U...V...W...X...Y...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...............................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................`'..........@.......C.o.n.t.e.n.t.s..................................................................................................... ...+Z..............................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\Screen\Demo_RCMS.csw

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:Composite Document File V2 Document, Cannot read section info
                  Category:dropped
                  Size (bytes):4354560
                  Entropy (8bit):5.455809096255735
                  Encrypted:false
                  SSDEEP:12288:PYIicVLwrN8t6bBn1O9XkBYMEMOLKrN8t6ZPHX1O9Hk:AiV0rTbl19uHmrTZPX1t
                  MD5:09294430887DB3DA25CF0B3E2185FB47
                  SHA1:1A23832B7374AC45628E4A9786AE8B625B7A92FD
                  SHA-256:CDD9E52DFD3936FEBEF6F87F19CC0808091AB06F0B9907BDA0F6FA5829F8CD36
                  SHA-512:7DBF185D4E5D8A8E3E236D38145EFC7AEA7FAE42811FCC9816607FF991B431C357E76161D104CC63D8F279448353058E416B58CEBFAE55B0C7046FAC0B120FEC
                  Malicious:false
                  Preview:......................>.................................................................................................................................................................................................................................................................................................................... ... .................................................................................. ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...{...|...}...~...............................................................................................................................D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\Screen\Demo_RMG.csw

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:Composite Document File V2 Document, Cannot read section info
                  Category:dropped
                  Size (bytes):1697280
                  Entropy (8bit):2.536497185185532
                  Encrypted:false
                  SSDEEP:6144:dbdJtbv/0i1yKBtE8Jtb1/0SfyOpzkQae:dbdJtbUiAKPTJtbaSKOl
                  MD5:DC3CF26C8C86A44CA02080BF16AC8570
                  SHA1:4444C8451AE05CB7B472B337E6EEB583E3C2C10E
                  SHA-256:366C405B888C323117A38BFDDB7810C4925183F4C99B980CDCEE87249732EFD1
                  SHA-512:8DF927BB85979F52BE1BBF6B9BB47474B680A1E47764D886BA39C0AD30CC0ED5DCC405A20119010A9580197EC4CA833943DAB8A1FC4CB4BA323BBBE4395872E6
                  Malicious:false
                  Preview:......................>...................G....................................................................................................................... ..."...........+...........)...*...$...%...&...'...,...-......./...............................................................................................................................1...........................................................................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................P.8.................C.o.n.t.e.n.t.s.....................................................................................................0..................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\Screen\Demo_SideBar.csw

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:Composite Document File V2 Document, Cannot read section info
                  Category:dropped
                  Size (bytes):13824
                  Entropy (8bit):2.9461193310194944
                  Encrypted:false
                  SSDEEP:96:pByxG8h0K8uCsAvHQLWLR6cgmVfyt7pHs00CsAvHQLWLR4P41484A494/pYo:W06fWqnpM4vpN
                  MD5:DB4E59688A5A437412D4382FE3FAFAD4
                  SHA1:EEAEA40BE11802B6DDA17D4777FBF4BF41F423F1
                  SHA-256:9302AA4FCA43B0365BC5586498D1F0F5A8EDDC21A52D48D1B68CA648EF867E39
                  SHA-512:944C6AB9A5856C2FBC763D20D66E1C6F21840E657D648868B573592343BEE835A610F9B519410EC9F79850ED00A85838944BE5FABF373948D5C624B68853FE9C
                  Malicious:false
                  Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y..........................................................................................G*................C.o.n.t.e.n.t.s.........................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\Screen\Demo_StatusBar.csw

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:Composite Document File V2 Document, Cannot read section info
                  Category:dropped
                  Size (bytes):30208
                  Entropy (8bit):3.0777200275895122
                  Encrypted:false
                  SSDEEP:192:2ATYcgvaKFJ916y721jvaKFV6y721KBZBIg+2LM2LWR:PTMvZ7Ys21jvZ4s21KBZBIg+2LM2L
                  MD5:A9F1EC068A827FC97E9C5F4C8C7EBA21
                  SHA1:86468281D2D6073AB5C67290C0F6D56FEC594F6D
                  SHA-256:293837679C7D3A4C869113E67EABC74FC320E6340BF61C5469BA256459D3F726
                  SHA-512:545AAA26565F233368059D0A520F2694753C67F121A9A72B21635B89CF3CCEDF6A8EAA4D09E03D7AE3DB70225258504D5D90B4F0A1D43251CF245DE192F7445B
                  Malicious:false
                  Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................0q..h...............C.o.n.t.e.n.t.s..........................................................................................................-..............................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\Screen\Demo_Symbol.sbl

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:StarOffice Gallery theme \011\001\013, 3689279963 objects, 1st \333\361\345\333\361\345\333\361\345\333\361\345\333\361\345\333\361\345\333\361\345\333\361\345\333\361\345\333\361\345\333\361\345\333\361\345\333\361\345\333\361\345\333\361\345\333\361\345\333\361\345\333\361\345\333\361\345\333\361\345\333\361\345\333\361\345\333\361\345\333\361\345\333\361\345\333\361\345\333\361\345\333\361\345\333\361\345\333
                  Category:dropped
                  Size (bytes):153064
                  Entropy (8bit):5.050595266405158
                  Encrypted:false
                  SSDEEP:768:VxuDTQYgJNERbVM7mCU6v9jNClH0raf1mst82Y9U4hs4+6yGZC6GQOuSy+TP/Knk:VxRUyvjp9UusJvJrTPSomkR
                  MD5:383A6E8061C50402B46F0A5326418C35
                  SHA1:00391869D5525765272D38F208B5DFF678D38674
                  SHA-256:8AFECE7A017BE07ED9E8B38EECBA8FC62C90FB53DACC10CAE26A5C87FFBC479B
                  SHA-512:DB8BBA7D6F898091FC673F9F1F71C4154580D2CB3233726E666D7089FA3C003C18B5B13BDE0B0C30AF00DD9B184DC471DAF4848B844E4E363BDA18EFC3A876EC
                  Malicious:false
                  Preview:........CDrawSymbol1...%...............................................................1...%......?...?..........CPositionObj..1...%..................CDisplayObj..................................CSliderObj.................1...%...................CDrawImage1...%..........................................................................?...?........1...%.............................................................;D:\Hua\........_huatianyi\Symbol\Btn\Bmp...\DarkRedbtn.bmp......................BM........6...(.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\Screen\Demo_TopBar.csw

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:Composite Document File V2 Document, Cannot read section info
                  Category:dropped
                  Size (bytes):1440256
                  Entropy (8bit):3.7514403820938504
                  Encrypted:false
                  SSDEEP:6144:fUjKYUj+U8dm8dxcFnCntzntFtjqmZbsvPboA/N:fyKYy+U8I8bc+trtFtjqmZbsvToA/N
                  MD5:F37990B0635566D14F3136F79C188CD2
                  SHA1:0725D4AA8891260A35AF96506C5652821CF0C363
                  SHA-256:80F991511DC71F49BD778519E559069E21DF8CA13F73E746D8E07DC406BA7F4A
                  SHA-512:CC74C6E795963D2CD01F1BAF8EB4A16423B48813F2072D7DBF1EEC6D69BDD42AED086CB521E589F09D687838BF1F99CED1C0985E25EB0A994AAC5ECA4210B77E
                  Malicious:false
                  Preview:......................>...................,................................................... ...$...%...)...*...,...1...-.......0.../...........................................................................................................!...".......................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y...........................................................................................p....&...........C.o.n.t.e.n.t.s.....................................................................................................2..................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\Screen\Demo_Trend.csw

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:Composite Document File V2 Document, Cannot read section info
                  Category:dropped
                  Size (bytes):11776
                  Entropy (8bit):3.316555738345269
                  Encrypted:false
                  SSDEEP:96:Rct8rIM8rIO6TXE6TXargvrjrWgvrjrP7r1G27r1GCQVcQVM+CC2:QoroIRCgDPWgDPflj
                  MD5:47628182159F18AE25355AD9FF8E9305
                  SHA1:04A7D68B6D21D50DF778C19D1D199E357B140026
                  SHA-256:C7E3181B0CDA24F30A31A726CA5106D030B611F83D0557B738BAD2D3ED333288
                  SHA-512:65A876DC881AADA2364D37FA57A5ABC17F0C550EC677D9A8521E58D85840C4BD34AC33C2CE971E86507394E93ECC275E2E29D60904D2D701B2BFC619ACBE179F
                  Malicious:false
                  Preview:......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................@.................C.o.n.t.e.n.t.s.........................................................................................................r...............................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\Screen\Demo_UC.csc

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:Generic INItialization configuration [Rect]
                  Category:dropped
                  Size (bytes):153
                  Entropy (8bit):4.889942138629849
                  Encrypted:false
                  SSDEEP:3:+Qz3WaJVUrXE9ViM+ARYNBAl9ovY91wG68YP6y0zRbtsRBn:+i3PDqXEyM+0zl9oKwOYx0zRyRB
                  MD5:2175EEEDCC244F34822E59CAC76FB985
                  SHA1:846DD426FDC0A28363A60CC427EFDE28655428E0
                  SHA-256:ECC8445BC53DB1DB95249D72C5F22F14CCA8F606FBA884CD7D25B111BADFDCA2
                  SHA-512:46D1FDA8D93ED4D49101CE75AC82FFF67E10EE19930FE897621D664EF0122591CFA0DC7F11D7CD65C64BC1A80196BE8662560B9174D84E7A849CBA599B0BAE88
                  Malicious:false
                  Preview:[NetCustom]..Assemble=UCDemo.UserControl1,UCDemo..ShowTitle=0..TitleContent=..ShowMode=0..[Rect]..Rect_X=0..Rect_Y=100..Rect_Width=964..Rect_Height=624..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\Screen\Program\AlarmFunc.cs

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:C++ source, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):4064
                  Entropy (8bit):3.4939073317040337
                  Encrypted:false
                  SSDEEP:48:HyALDQtUFFUC4PKT/Oyj8OZL9zORCyt9zORgPk1aZY:mtUFFUzu/kOZL9zACyt9zAwk1Z
                  MD5:0FF58EF60B2BF436DE4E9641DCA8D200
                  SHA1:98D82F495A255EBFEDD72C8F0870A65726FD9B23
                  SHA-256:5948D8D9438B69FED6058C988C8937C8F256133A72E31AB39700C76DEFA357EB
                  SHA-512:73B9808621BD9AD65A246271FEB4A39FE07733E448B5DC7E1D38F68A3D2B6128135DA6C297D236091AFCFE3E6C0608D7B4A61FE55EE70B5EE1DA99AF2114AEFD
                  Malicious:false
                  Preview:..u.s.i.n.g. .S.y.s.t.e.m.;.....u.s.i.n.g. .S.y.s.t.e.m...X.m.l.;.....u.s.i.n.g. .S.y.s.t.e.m...D.a.t.a.;.....u.s.i.n.g. .S.y.s.t.e.m...W.i.n.d.o.w.s...F.o.r.m.s.;.....u.s.i.n.g. .Z.P.M.C...S.C.A.D.A...R.c.w...S.c.r.e.e.n.s.;.....u.s.i.n.g. .Z.P.M.C...S.C.A.D.A...R.c.w...S.e.r.v.e.r.s.;.....u.s.i.n.g. .Z.P.M.C...S.C.A.D.A...R.c.w...S.y.s.t.e.m.s.;.....u.s.i.n.g. .Z.P.M.C...S.C.A.D.A...S.e.r.v.e.r.;.............n.a.m.e.s.p.a.c.e. .S.c.r.e.e.n.....{.......p.u.b.l.i.c. .c.l.a.s.s. .A.l.a.r.m.F.u.n.c.......{.........i.n.t. .m._.n.T.e.m.p. .=. .0.;.........i.n.t. .m._.n.T.e.m.p.S.p.e.e.d. .=. .5.;.........b.o.o.l. .m._.b.I.s.T.e.m.p.U.p. .=. .f.a.l.s.e.;.........b.o.o.l. .m._.b.I.s.T.e.m.p.D.o.w.n. .=. .f.a.l.s.e.;.............../././././././././././././././././././././././././././././././././././././././././././././..... . . . . . . . .C.z.i.A.l.m.S.v.r.A.c.s.C.L.R. .m._.A.l.a.r.m.S.v.r. .=. .n.u.l.l.;..... . . . . . . . .p.r.o.t.e.c.t.e.d. .C.z.i.A.l.m.S.v.r.A.c.s.C.L.R. .g.e.t.A.l.a.r.m.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\Screen\Program\CSProgram.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                  Category:dropped
                  Size (bytes):12800
                  Entropy (8bit):4.848717264504695
                  Encrypted:false
                  SSDEEP:96:Kkyb973P0UP3Sp6sanPbfwoxx39FCF63//uUgiDRLQoLQZ380oL+MsSGVVRkDsc3:KVlHKyfZVZgiedCR+9NW4cbYDp69
                  MD5:8C419CB38A51658BF457EA306D7E010D
                  SHA1:8CF8F962E1D1DAB6C770C941AF22A495FE77855C
                  SHA-256:8F1099906D4AE9751D47EDED74D051CF437CDBD755D3C7DDE1789198380BEAC6
                  SHA-512:65FBF41541A32362ECA6AA3BF45E9D19DFEAA4590046C0A6516CC4A1675764FC483E2AD560778FE9FE48C4A1E52E659C562006560A64851DD5B9269294366F92
                  Malicious:false
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....%.U...........!.....*...........I... ...`....@.. ....................................@..................................I..O....`............................................................................... ............... ..H............text....)... ...*.................. ..`.rsrc........`.......,..............@..@.reloc...............0..............@..B.................I......H.......l3.. ...........................................................j.{....-..s....}.....{....*..0..Q..........}......}......}....r...p.{.........(....&r...p......(....&.(....r;..p..o....&*....0...........{....,F.{.....d/+.%{.....{....X}....r...p.{.........(....&+..{.....d3...}.....{....,B.{.....1*.%{.....{....Y}....r...p.{.........(....&*.{....-...}....*>..}......}....*>..}......}....*>..}......}....*2.(....o....*2.(....o....*:..}.....(....*...}......}....rO..p......(...

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\Screen\Program\CSProgram.xml

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):569
                  Entropy (8bit):4.617329826210359
                  Encrypted:false
                  SSDEEP:12:MMHdVJFRqcdCZfJFROcdCZfJFRs2cdCZfJFRsk/2cdCZfJ4rEIcubZfJ2DKxIcu4:JdVLR/6fLRj6fLRsL6fLRR6fWrE4fuWr
                  MD5:389DE8C33F6E741D1772B9334FFA2BF6
                  SHA1:AF5526CFE1A92A3FCE4ADA8B3B1601F291347B7F
                  SHA-256:5D750AF0C2ECEB887AC121A18FE0F2D2D7F8F129875447F7459CFE4BB5AF5A36
                  SHA-512:92955AFD78316A3A8DF309D17C3ED98CCB497FFFE2B72F7C2ED06D1E3C827ACD3CB3F805053514E1802A8921EF3DD93A5F087A7DF5BEB6C816C07FC86BAAE10A
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<ItemGroup>.. <Reference>.. <Name>System</Name>.. <Type>Gac</Type>.. </Reference>.. <Reference>.. <Name>System.Data</Name>.. <Type>Gac</Type>.. </Reference>.. <Reference>.. <Name>System.Xml</Name>.. <Type>Gac</Type>.. </Reference>.. <Reference>.. <Name>System.Windows.Forms</Name>.. <Type>Gac</Type>.. </Reference>.. <Reference>.. <Name>Rcw.SdAPI</Name>.. <Type>Bin</Type>.. </Reference>.. <Reference>.. <Name>RCW.ServerAPI</Name>.. <Type>Bin</Type>.. </Reference>..</ItemGroup>

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\Screen\Program\DemoFunc.cs

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:C++ source, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):41794
                  Entropy (8bit):3.6222490820902786
                  Encrypted:false
                  SSDEEP:384:zS0WLMiNH2ftSdMeEay5ntCH8kw6IpSv7whlqk/h:w20y5nsH8kwOwh7/h
                  MD5:7F538EEAAF5C7B9EB95A8ED226CF4947
                  SHA1:0681C7281559FBB7B21172DA8A02C8852C4FD2F2
                  SHA-256:0BDC9D5EA7DF0E7905C078CDA12C37608344342D67D71591E47DFFB943D06FAB
                  SHA-512:E41ACEBE300A96D7D0F0001FF56B3184371FCCCE833FD9440921D2193052CCEE6A8D90BB50E421F036EE76B49DDF277E79BC4F169A20B2CF6D6207A025935EAF
                  Malicious:false
                  Preview:..u.s.i.n.g. .S.y.s.t.e.m.;.....u.s.i.n.g. .S.y.s.t.e.m...X.m.l.;.....u.s.i.n.g. .S.y.s.t.e.m...D.a.t.a.;.....u.s.i.n.g. .S.y.s.t.e.m...W.i.n.d.o.w.s...F.o.r.m.s.;.....u.s.i.n.g. .Z.P.M.C...S.C.A.D.A...R.c.w...S.e.r.v.e.r.s.;.....u.s.i.n.g. .Z.P.M.C...S.C.A.D.A...R.c.w...S.y.s.t.e.m.s.;.............n.a.m.e.s.p.a.c.e. .S.c.r.e.e.n.....{.......p.u.b.l.i.c. .c.l.a.s.s. .D.e.m.o.......{.............e.n.u.m. .T.a.s.k. ...:.i.n.t. .{. .N.o.n.e. .=. .0.,. .B.o.o.m.D.o.w.n.,. .D.i.s.c.h.a.r.g.e.,. .A.g.v.G.o.H.e.a.p.,. .R.e.c.i.e.v.e.,. .D.e.l.i.v.e.r.y.,. .A.g.v.G.o.Q.c.,. .L.o.a.d. .}.;.........e.n.u.m. .S.t.a.t.u.s. .:.i.n.t. .{. .O.n. .=. .0.,. .R.u.n.,. .E.r.r.,. .O.f.f. .}.;.............c.o.n.s.t. .i.n.t. .m._.n.S.p.e.e.d. .=. .1.0.;.................i.n.t. .m._.n.T.a.s.k. . ... . . .=. .(.i.n.t.).T.a.s.k...N.o.n.e.;.........i.n.t. .m._.n.T.m.p.T.a.s.k... . . .=. .(.i.n.t.).T.a.s.k...N.o.n.e.;.........b.o.o.l. .m._.b.I.s.D.e.m.o.R.u.n. . .=. .f.a.l.s.e.;.................p.u.b.l.i.c. .v.o.

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\Server\AlarmServer\AlarmServerSetting.dat

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):473
                  Entropy (8bit):5.073311223736612
                  Encrypted:false
                  SSDEEP:12:gO3M3rI7dTyzpaOxXtley6tleQ3le/k5levmSleE1XZA:tW4T04mc12+Z
                  MD5:DA64AA0450774873496E84C931DBEFD1
                  SHA1:F4AA25973C23ED46FD4DCA12610E65705FF869A1
                  SHA-256:C457AA477D079618411272EE173755FEAA2ACC5FBADB3FCBB4AEA88F95A4F238
                  SHA-512:00B297B20B58E3A13D3FD0FB8DF80EAB1C519BAAD157624D45895885F8B980484872C4492EA5441B6D3F7B245AF4BE41FA6A562ED3091946504181A8E05879B1
                  Malicious:false
                  Preview:.VER_AppServerSetting......CAlarmServerSetting.....ServerIP.TriggerProgramList.OnProgramInfoList.RemoteServer.Port.......CObList...CObList........COnProgramInfo..COnProgramInfo.....FuncName.FullFuncName...OnServerStart.....COnProgramInfo.....FuncName.FullFuncName...OnServerEnd.....COnProgramInfo.....FuncName.FullFuncName...OnAlarmOn.....COnProgramInfo.....FuncName.FullFuncName...OnAlarmOff.....COnProgramInfo.....FuncName.FullFuncName...OnAlarmAcked..CStringArray....8..

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\Server\AlarmServer\Program\CSProgram.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                  Category:dropped
                  Size (bytes):3584
                  Entropy (8bit):2.7760910565024655
                  Encrypted:false
                  SSDEEP:24:etGSGdatA2aSHvhNFe3XQmKA6L2lvCztkZfKgmPcD53AmI+ycuZhNHPFXtqPNnq:6PW7eJNFoxXZCSJK7c91ulvFXtGq
                  MD5:0B486B2DD3E65CC5951A52F4C15A7F43
                  SHA1:754697E5E9135EEA5DFCEE1859F1743F685355D4
                  SHA-256:144D91744951C05AC87FE84167836D61A1857BFFF13F05FB36D846252950C6FC
                  SHA-512:19E3E8FD23448FF77BE191B62F9EC67746B5861D0AE92187BF593A6B9171C530E2A7496ED51337E0AA02FF7D040DA018B1AAEDE9F5CEF9A62AA7AD6EED600456
                  Malicious:false
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...mo.U...........!................~$... ...@....@.. ....................................@.................................($..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`$......H........ ..x............................................................0.. .......r...p......(......-.r...p(....&*.0.. .......r...p......(......-.r...p(....&*..(....*BSJB............v2.0.50727......l...<...#~......L...#Strings........$...#US.........#GUID...(...P...#Blob...........G..........3....................................................D.=.....k.....k.....=...........k...-.....8.......................(.......P ......K.....| ......Y...... ......e.......e.....e...)...

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\Server\AlarmServer\Program\CSProgram.xml

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):484
                  Entropy (8bit):4.630034131864245
                  Encrypted:false
                  SSDEEP:12:MMHdVJFRqcdCZfJFROcdCZfJFRs2cdCZfJFRsk/2cdCZfJ4rEIcubZK:JdVLR/6fLRj6fLRsL6fLRR6fWrE4K
                  MD5:9ED1BC2E5DC01F9D81C1253AEFAD6FBB
                  SHA1:9CA8A4EBBC2D821B4C5A803039484309B683EF66
                  SHA-256:05B3F580F4B152584B831B9F5C7853DD2B7EA9F16BAD4D81D4A42420875F9446
                  SHA-512:0D4BA3FC3A8BA3143890FC08D2E1FB835654DC0EBE5041BCE847BFC6B2F281ACEF3A0CFC88A86B47988CE50CE66CCD811167027A4EA439C0BD1792377956528C
                  Malicious:false
                  Preview:.<?xml version="1.0" encoding="utf-8"?>..<ItemGroup>.. <Reference>.. <Name>System</Name>.. <Type>Gac</Type>.. </Reference>.. <Reference>.. <Name>System.Data</Name>.. <Type>Gac</Type>.. </Reference>.. <Reference>.. <Name>System.Xml</Name>.. <Type>Gac</Type>.. </Reference>.. <Reference>.. <Name>System.Windows.Forms</Name>.. <Type>Gac</Type>.. </Reference>.. <Reference>.. <Name>Rcw.SdAPI</Name>.. <Type>Bin</Type>.. </Reference>..</ItemGroup>

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\UC\UCDemo.dll

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                  Category:dropped
                  Size (bytes):31354880
                  Entropy (8bit):7.952579442543823
                  Encrypted:false
                  SSDEEP:786432:PEEuI7Cd3OENT2/Ejdip+xYyQv2h9/ifG2nVbSAkzkLkzJMtkThAPAikV4joifG0:+Iqog
                  MD5:90E8DB8C201B735C5DC30056C0BF3649
                  SHA1:350A46D29162A589174B19CCEEEB0D1A93E96A36
                  SHA-256:4DCDC9B008AA0C75B689410156BB9331CA1B9CFC0014548623EBE4208D24F768
                  SHA-512:5C614E4749EA358EDC3A1C3495C8E5131ADC7AF51705D4B8EF02070994B25BF7DA29918A8BCE990CA444CC8306A18D705968C45B16A77E11B6689B470D8571BA
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...._.U...........!.....@... .......X... ...`....@.. ....................................@.................................tX..W....`...............................X............................................... ............... ..H............text....8... ...@.................. ..`.rsrc........`.......P..............@..@.reloc...............`..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\ziScadaDemo.csp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):1121
                  Entropy (8bit):5.4841963548161
                  Encrypted:false
                  SSDEEP:24:rMmT+0lvkZwPA8jaLAP4m2mA+bZ4444444kZ9HLjKCMyp:rM4+6hPEvmX4444444kZBLr1p
                  MD5:6ADE9095228F76E07FF6663C1B856D88
                  SHA1:360FDEE506C390A4C2A8EA25397070047D7D2551
                  SHA-256:98C68897FFAF8924F28EBFA384757FB4A3DBD84E085E4DAE038404298B2EA54F
                  SHA-512:7A6331EBA4A5148CE487E0CE4277B1CEBFB36C75F564D70736F7CD63DA38E03F27C4829BE713359B60F819AA615D7249D89694B9698C5978006CF829C18AE21D
                  Malicious:false
                  Preview:....CProject.....Version.AlarmDispersedList.AlarmAnalogList.AlarmExtendFieldList.EventTimeList.EventTagList.AccelList.UserList.UserGroupList.SettingList.StartupPrj.MainWnd.Pwd.bUnknow.dwUnknow.strUnknow.MacroItemsList.TrendConfig........................CObList........CDispersedAlarm......CDispersedAlarm.....1.2.3.4.5.6.KEY_EXTFIELD2.10_1.10_2.10_3.11............TempTooLow.AlarmTag_Temp < 20...Temperature is too low!(<20)..CObList......................CDispersedAlarm.....1.2.3.4.5.6.KEY_EXTFIELD2.10_1.10_2.10_3.11............TempTooHigh.AlarmTag_Temp > 80...Temperature is too high!(>80)..CObList......................CDispersedAlarm.....1.2.3.4.5.6.KEY_EXTFIELD2.10_1.10_2.10_3.11............EStopPushed.AlarmTag_Estop == 1...EStop is pushed!..CObList...............CObList...CObList...CObList...CObList...CObList...CObList...CObList...CObList...fDemo_TopBar.csw,Demo_StatusBar.csw,Demo_SideBar.csw,Demo_QC.csw,Demo_RMG.csw,Demo_RCMS.csw,Demo_UC.csc.............................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\program files\ZPMC\SCADA\User\Demo\ziScadaDemo.da

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):6688
                  Entropy (8bit):5.193762657312215
                  Encrypted:false
                  SSDEEP:96:Unl6gA9C9x9139Y9+9Wa959b949P9ogH9Y9X9ozH9K9x9Q9T929a9SDH9gH9zH9I:MBaYghzyDiFtj/qtD0Dsbb
                  MD5:BB25B80CD28C0FF594CB7CC6EBDA8C7D
                  SHA1:5DFD58E13AEA60C9676473FF2EC5D69587F00CEB
                  SHA-256:0454E33F09022331E53A95811B103E7EA16D4566FB66226F5156870D3C780B1E
                  SHA-512:933514D7BABA7B440EA20F4D1E7AAE6D2F251D06121442077B712522B20C5F26A003217D137E18BFB80598DAFE302B62CE87D2414A27CD95CE47CA7FA1F10437
                  Malicious:false
                  Preview:..CTagDataManager.....nVer.listTagDataGroup.System_NetConfig.........CObList........CTagDataGroup..CTagDataGroup.....nVer.Name.bIsMemory.strCommunicationParam.nUpdateRate.Desc.HistorianServer.listTagData..............Mem...........CObList".......CTagData..CTagData.....nVer.Name.DataType.ArraySize.Address.TagGroup.Desc.HistorianAddress..............QCTrolleyPosX.Short.....Mem.QC trolley position.....CTagData.....nVer.Name.DataType.ArraySize.Address.TagGroup.Desc.HistorianAddress..............QCSpreaderPosY.Short.....Mem.QC spreader position.....CTagData.....nVer.Name.DataType.ArraySize.Address.TagGroup.Desc.HistorianAddress..............QCHoistScaleY.Short.....Mem.QC hoist position.....CTagData.....nVer.Name.DataType.ArraySize.Address.TagGroup.Desc.HistorianAddress..............RMGGantryPos.Short.....Mem.RMG gantry postition.....CTagData.....nVer.Name.DataType.ArraySize.Address.TagGroup.Desc.HistorianAddress..............RMGTrolleyPosX.Short.....Mem.RMG trolley position.....CTagData....

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exe

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):1070080
                  Entropy (8bit):6.27053414036148
                  Encrypted:false
                  SSDEEP:12288:HYguHdb3baVXt1S3nQf63mRxJwGxfILBFKTUZAhV2gqbPoAsSmNlK9:4gK3baVdI3WDMCgL6TUCVCbqJl
                  MD5:675A00CA73BAF388C0EBF90C0644E8E0
                  SHA1:53F78A7277FD61BC82FD7A30742D031E51FCD684
                  SHA-256:6CFA520F9F9F92C5616DDFB9E41B1432D83CF3E75A132AE2040BF156F059807C
                  SHA-512:9D89B12E8D8DA04E278517EF64BCB78DA15A7C4AC385EC1C012098B66C77B76F0CD02BC7B16287FEDFDF9FBA46CF9CEBF077D748B0AE4CC6AE48787D68C41176
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........N..N..N....w.E....j.O...i.V...j......M...k......]..N.......k.y....m.O..N.3.O....h.O..RichN..........PE..L....?]Z.................:...........I.......P....@.......................................@.................................P........p..............................pX..8............................f..@............P......4........................text...I9.......:.................. ..`.rdata...c...P...d...>..............@..@.data...p........$..................@....rsrc........p......................@..@.reloc..<............`..............@..B........................................................................................................................................................................................................................................................................................................

                  C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\splash.bmp

                  Download File
                  Process:C:\Program Files\7-Zip\7zG.exe
                  File Type:PC bitmap, Windows 3.x format, 600 x 323 x 24, image size 581402, resolution 11808 x 11808 px/m, cbSize 581456, bits offset 54
                  Category:dropped
                  Size (bytes):581456
                  Entropy (8bit):7.198765171041322
                  Encrypted:false
                  SSDEEP:6144:JBJ/jFDdAc3k4dCeCFaaQgpdjmn+yiGbRYKHcss12XYxQhyH1zpqqTNUuCmkhV/s:Jo14Cz+ni8Yzd1+YxZZ+mkjetogMN0f
                  MD5:A5EFFEB4A39C891F159F71E70F51F80F
                  SHA1:5E7C732B7B7FE00605B0841ED13C83A7FD152AEE
                  SHA-256:F6417EC59DE1B55220AF3A84F7C294194A2D48480759DB6AE24940C598EA2A13
                  SHA-512:9565BC3399E5B51D258A2DE1A31ABF63711A5825D1A2849BF22554B8D1FB1885DC8EE33E959C1CDBB6E903C4FB72B2E65070AFDBD344F8E963C3D656291AABC0
                  Malicious:false
                  Preview:BMP.......6...(...X...C............... ... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Windows\Installer\420a40.msi

                  Download File
                  Process:C:\Windows\System32\msiexec.exe
                  File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: Installation Database, Comments: Contact: Your local administrator, Keywords: Installer,MSI,Database, Subject: Blank Project Template, Author: Shanghai ZPMC Electric Co.Ltd, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2018 - Professional Edition 24, Last Saved Time/Date: Wed Jun 5 02:57:46 2019, Create Time/Date: Wed Jun 5 02:57:46 2019, Last Printed: Wed Jun 5 02:57:46 2019, Revision Number: {66DF9F58-4C89-4E3E-AF81-ABF197C1156B}, Code page: 1252, Template: Intel;1033
                  Category:dropped
                  Size (bytes):3905024
                  Entropy (8bit):6.133000677779072
                  Encrypted:false
                  SSDEEP:98304:x6a1SmKbjgRzVW8iy9zpplkVW8iy9zpGa4Yi:x2IzVW8iy9zppKVW8iy9zpGDYi
                  MD5:32F1FFD5853059FE0D14CA8897DA9BE5
                  SHA1:AD6B641D75F4596C2B7A1812CE78A315A65EA8AB
                  SHA-256:F39C1E9DA463FB7B7791B3DC9C0FBD0FD4528E51BA59212113C1B36994B74762
                  SHA-512:56457F8F049A46A8455A2636BF35746D046B2D38C398F7038F7A15027064456E9E65D142C3422710BB273F0FB346D5A07271E0C0BABEE4C250C61C2833D9535C
                  Malicious:false
                  Preview:......................>...................<...............8...................................Q.......................................................................................................................................................................................................................................................................................................................................................................................................................................;.......................?.......)................................................................................... ......."...#...$...%...&...'...(.......*...+...,...-......./...0...1...2...3...4...5...6...7...>...M...:...<.......=.......A...@...T...B...C...D...E...F...G...H...I...J...K...L...N...>...O...P...Q...R...S...V...U...d...W...X...Y...Z...[...\...]...^..._...`...a...b...c...f...e...t...g...h...i...j...k...l...m...n...o...p...q...r...s...v...u.......w...x...y...z...

                  C:\Windows\Installer\MSI1221.tmp

                  Download File
                  Process:C:\Windows\System32\msiexec.exe
                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):28672
                  Entropy (8bit):3.741623752383387
                  Encrypted:false
                  SSDEEP:192:XOdG/6G4nnykxsdYZ+mrv2ySzLUHypLGgjuXFw5acHKBNtHjhuHWrkA9uBP1WWzT:P6GuZBrvkzAHyxxHKBdaA2dWWzm0ZH
                  MD5:85221B3BCBA8DBE4B4A46581AA49F760
                  SHA1:746645C92594BFC739F77812D67CFD85F4B92474
                  SHA-256:F6E34A4550E499346F5AB1D245508F16BF765FF24C4988984B89E049CA55737F
                  SHA-512:060E35C4DE14A03A2CDA313F968E372291866CC4ACD59977D7A48AC3745494ABC54DF83FFF63CF30BE4E10FF69A3B3C8B6C38F43EBD2A8D23D6C86FBEE7BA87D
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........CnuS".&S".&S".&t.}&P".&S".&.".&t.{&X".&t.m&^".&t.z&R".&t.n&R".&t.x&R".&RichS".&........................PE..L...\..C...........!.....@... .......6.......P....@..........................p......I................................B.......=..x............................`......0...............................x...@............................................text....2.......@.................. ..`.data...h....P.......P..............@....reloc..<....`.......`..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Windows\Installer\MSI1520.tmp

                  Download File
                  Process:C:\Windows\System32\msiexec.exe
                  File Type:data
                  Category:modified
                  Size (bytes):1788547
                  Entropy (8bit):4.728034825983346
                  Encrypted:false
                  SSDEEP:24576:HmbY7ak3VW8iy9zpxaeRITcVW8iy9zpxJeRITj:N7t3VW8iy9zpxvSTcVW8iy9zpxoSTj
                  MD5:E659550F5C20382EEA35AAC8CFD548F1
                  SHA1:42D4B6460157398B50C0D290F435895B3D3D3444
                  SHA-256:B2CDF04C9FA038009F9591019047ED72C93B42A718A6DC409B44F316C102E28B
                  SHA-512:85AB26F146E48ADF845AAF2BD80C3EA7B845F7D21D22A48DD858A476A0B15E8A599AC8E8AE317F825A79ED08BB19255C9F0677A299D706EC11F983735CB5FF56
                  Malicious:false
                  Preview:...@IXOS.@.....@./]Y.@.....@.....@.....@.....@.....@......&.{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}..SCADA 4.0.12.737..SCADA 4.0.12.737.msi.@.....@.1...@.....@......ARPPRODUCTICON.exe..&.{66DF9F58-4C89-4E3E-AF81-ABF197C1156B}.....@.....@.....@.....@.......@.....@.....@.......@......SCADA 4.0.12.737......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@w....@.....@.]....&.{FF62FC56-01ED-4B24-B3FF-C74CB9062E49}..C:\Program Files (x86)\ZPMC\.@.......@.....@.....@......&.{6E9435F7-DF26-41BB-8E40-1E54EA2FFFD5}...@.......@.....@.....@......&.{291C43D0-A87A-461F-AF13-C35338DA64A5}...@.......@.....@.....@......&.{BB79C69B-E0D5-4CB0-8327-53D3E6F728F9}...@.......@.....@.....@......&.{B260400F-50D6-4184-8FDD-46EEE667BF5D}...@.......@.....@.....@......&.{B2CBDFFB-0F74-463B-B4CC-47E9344A8FB2}".C:\Program Files (x86)\ZPMC\SCADA\.@.......@.....@.....@......&.{BD5BB930-3586-4D26-87A4-93EDCE706

                  C:\Windows\Installer\MSIBD6.tmp

                  Download File
                  Process:C:\Windows\System32\msiexec.exe
                  File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):175304
                  Entropy (8bit):6.228940130762618
                  Encrypted:false
                  SSDEEP:3072:mpnAfE+giQ322hTQxecDHudFJhIA+iM7kD5zZPE5TbY/9:mRUQth08oa7JsOJsUl
                  MD5:CC283BCD66F3E37994C1549CE8319BF1
                  SHA1:F66F0BDAEA978DB52FEE7029CE86C20596D11FAF
                  SHA-256:DC546032B595CF94AC0567D5DAB019BAC83EA518BFBFADF8F3DF95D19CB3CCE1
                  SHA-512:E0018853EC305D25DBE7EC43E2FD4A613273C6E4D0CD3D5E607FD1CA7D83C4BAF7502785AB33DC8AC3CAC21804DF6BA617106D9D9D3A7528D630DE5BAFFC7661
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h`....S...S...S...S...SA..S...S...S...S...S...S.~.S...S...S...S.~.S...SA..S...SA..S...SA..S...S...S...SA..S...SRich...S........PE..L.....]Z...........!.....................................................................@..........................B..a...t5..........................................................................@............................................text............................... ..`.rdata..............................@..@.data...41...P......................@....rsrc................@..............@..@.reloc..pH.......J...F..............@..B........................................................................................................................................................................................................................................................................................................

                  C:\Windows\Installer\MSIC44.tmp

                  Download File
                  Process:C:\Windows\System32\msiexec.exe
                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):156880
                  Entropy (8bit):6.0277354830634895
                  Encrypted:false
                  SSDEEP:3072:D44gTeAYO7IXGNTCZuoeNw+aqj0FlWUEPK:E4rAYYIXGxoeKr9EC
                  MD5:1A42FF9FF5945CB3A3589A74EB683DE1
                  SHA1:A463B74E1919C3C60A9DAF5462DE9338B426DE9E
                  SHA-256:CDE61E213903F7BFB46EFE6DB64E5946D01CFB169A6859358DF20C3302DCD2ED
                  SHA-512:B485A878E43A39934C9715A271F7D5D1612257EF508817FEFFDF759DFC890BD31ED3C6051A84982F73D3D5915B4739FD3557635B7CE30AFDC7B9D29AEB9020BF
                  Malicious:false
                  Antivirus:
                  • Antivirus: ReversingLabs, Detection: 0%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{..7?..d?..d?..d..#d...d.. d9..d.. d>..d..!d...d.. dL..d6.md<..d6.}d ..d?..d-..d..!d)..d..$d>..d..'d>..d?.yd>..d.."d>..dRich?..d........................PE..L...R.]Z...........!.....J..........v........`.......................................H..................................E............@...............H.......P..H...................................P...@............`...............................text...II.......J.................. ..`.rdata......`.......N..............@..@.data....1..........................@....rsrc........@......................@..@.reloc...J...P...L..................@..B................................................................................................................................................................................................................................................................................

                  C:\Windows\Installer\SourceHash{DFC48024-1A7F-4AF4-A9BD-19E1C9DE7F55}

                  Download File
                  Process:C:\Windows\System32\msiexec.exe
                  File Type:Composite Document File V2 Document, Cannot read section info
                  Category:dropped
                  Size (bytes):229376
                  Entropy (8bit):5.37824154548598
                  Encrypted:false
                  SSDEEP:3072:Y27mv6iVz6SogQCpdqlewHdKZOAXTJ7KwZe:L+6iAST3qRHsZl8wZe
                  MD5:533D0FBF590CA4FA8D0A01CF82000E05
                  SHA1:0DC9CC4CA0B8F43D4C2332ED65BF6D85C24C0CAA
                  SHA-256:0A81FF22EDE33A0952AC7E47FDDF3F67A74BCDA84A4D2EA854B9C95AED30D091
                  SHA-512:C5EA22AB7A10A620411C8E8CA6A2D8350B487417FDA3448DB6110344272E6CFF6DAE0F85DBEBD5FF8FE29EAD4A90179EED62C606D987485F67F46C7839FF5583
                  Malicious:false
                  Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Windows\Installer\inprogressinstallinfo.ipi

                  Download File
                  Process:C:\Windows\System32\msiexec.exe
                  File Type:Composite Document File V2 Document, Cannot read section info
                  Category:dropped
                  Size (bytes):65536
                  Entropy (8bit):2.4224763150810498
                  Encrypted:false
                  SSDEEP:192:1hISk69R/wXhzN+d+gkAa0K7N7qp1BMtV2Jqg0hzN+d+gkAa0K7N7qp1BM:1hb8z5HJ7RE4rPz5HJ7RE4
                  MD5:CE73B2EDF113341767D6A7DC5A27CF50
                  SHA1:145DEF8EF9650CC5022EAFFDD5D6A8C48FB5AC05
                  SHA-256:B873B6E2BBF8347A06609ED590B8570E74FA8E2841316C53060219FFE2F17CE4
                  SHA-512:74E30D85B148F95F712677A4EAB60768966C3A3EFD956A8B3997DC7247D8481096F1F188666BEBD14E93426DE67B3B112F53BAC213C808E2513D8D6287194BCC
                  Malicious:false
                  Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

                  Download File
                  Process:C:\Windows\System32\msiexec.exe
                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                  Category:dropped
                  Size (bytes):454234
                  Entropy (8bit):5.356173766982466
                  Encrypted:false
                  SSDEEP:1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgauc:zTtbmkExhMJCIpEG90D5JG81IIgMV
                  MD5:8CC507B42011E78A6F0B1CA326121FAF
                  SHA1:1D41ECFB8B6E9C940A6F4B8D51FF373C2A97C795
                  SHA-256:5D4D123811332D14114BAFDB9334F4B2E690043F51C82796937E763D73BF6D17
                  SHA-512:3D4362BD91DDC21DD9ABD3CBA82561CE3E7E838FF5F7D145E9D02FB3546F5070EDD153E675379EA5EC8D03DD0A279612839D884B61592BCB5C723001C4706E7D
                  Malicious:false
                  Preview:.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

                  C:\Windows\Temp\~DF233E34A398E70CF8.TMP

                  Download File
                  Process:C:\Windows\System32\msiexec.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):98304
                  Entropy (8bit):1.3118061674858574
                  Encrypted:false
                  SSDEEP:192:zqg0hzN+d+gkAa0K7N7qp1BM1R/wXhzN+d+gkAa0K7N7qp1BMtV256:mPz5HJ7RE4+z5HJ7RE4
                  MD5:2C053E37BFB82EF77EE5B5FCE9076EF9
                  SHA1:33EE01F0C9E40DE5CAD6EA74A6AC005134916DA9
                  SHA-256:3395FB96BB10C7E32E687C6A4C9BB2EE859EAFAC60545F7B33BCFC4CD7561507
                  SHA-512:3C1EB3CDDD4CC2AD4C5639DD8990104FB1F886AC0517E6ADFF1435B50E7F63CE306CEFF1EE3A2F98EA1CB03B515DAED6CEA939817CD31B946E40FC7966CD2E6D
                  Malicious:false
                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Windows\Temp\~DF9305C9DACCEC7314.TMP

                  Download File
                  Process:C:\Windows\System32\msiexec.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):196608
                  Entropy (8bit):5.716785061903398
                  Encrypted:false
                  SSDEEP:3072:5R2Nmv6iVz6SogQCpdq8ewHdKZOAXgJ7KwZ:5kA6iAST3q0HsZlPwZ
                  MD5:D5FF38EAC91A212DD032DA9702B18761
                  SHA1:B9C0D3A8C49CC24E2DC7B955EC40C3349A74B1F2
                  SHA-256:EDC1BD685F9A423232B51E49ADFFFFAC101580C8F0209E63577F915D26C552F9
                  SHA-512:A27637940A1D2EA0C66AFDCB471A3D6AD7D95BA2FF9C24D65B2B5EC9D83EB3A08D609CC3D766F1A63352711BE39189052DE2CE2488598EBF258F67ED3DBAB13F
                  Malicious:false
                  Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  Static File Info

                  General

                  File type:Zip archive data, at least v2.0 to extract, compression method=store
                  Entropy (8bit):7.9995921704577455
                  TrID:
                  • ZIP compressed archive (8000/1) 99.91%
                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.09%
                  File name:ZPMC SCADA Setup v4.0.12737.zip
                  File size:75'435'301 bytes
                  MD5:8cec6cab7e45958bdda97ddc8bd32d9a
                  SHA1:dde365ea81f5dbde959633932a406bd57a3fd42d
                  SHA256:e4892a88830b8ff7b8ce8f702573ac331c814a1a7f7a9535f63ca83c53afb716
                  SHA512:b569a8ffb6132aad82de1b02bdc04e1ad55d74a6ff3d08390f55e226a63d928bb3a46855d4005128a7cdacbe739dcbfebc447404806a8cdcf17eca0838217cb2
                  SSDEEP:1572864:pskSG69VcbHl9IzmxI+SZJuBQaKjeyxNTyRgd9nrvnMxLo4xe:2EzymKYQ5j9xN2R+vnAs
                  TLSH:FCF73370DD5A5054F4CC06B426AF8A5AAE55B204F629A6039F7C07FBAD10BDDCBA03D3
                  File Content Preview:PK.........Z\Y................ZPMC SCADA Setup v4.0.12737/PK..?...... uH.5I......W..&...ZPMC SCADA Setup v4.0.12737/0x0409.ini....]..........s....z...x.`<.u.N`...K...(.;........!...'...O<.a!...Jg;....:......'qvZ...z...0.B)...MoSI.........<...gf~P..#...L,.

                  File Icon

                  Icon Hash:1c1c1e4e4ececedc

                  Network Behavior

                  Network Port Distribution

                  UDP Packets

                  TimestampSource PortDest PortSource IPDest IP
                  Oct 29, 2024 10:54:22.605248928 CET5365454162.159.36.2192.168.2.16
                  Oct 29, 2024 10:54:23.272658110 CET6351353192.168.2.161.1.1.1
                  Oct 29, 2024 10:54:23.280791998 CET53635131.1.1.1192.168.2.16

                  DNS Queries

                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                  Oct 29, 2024 10:54:23.272658110 CET192.168.2.161.1.1.10xd68Standard query (0)206.23.85.13.in-addr.arpaPTR (Pointer record)IN (0x0001)false

                  DNS Answers

                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                  Oct 29, 2024 10:54:23.280791998 CET1.1.1.1192.168.2.160xd68Name error (3)206.23.85.13.in-addr.arpanonenonePTR (Pointer record)IN (0x0001)false

                  Statistics

                  CPU Usage

                  Click to jump to process

                  Memory Usage

                  Click to jump to process

                  High Level Behavior Distribution

                  Click to dive into process behavior distribution

                  Behavior

                  Click to jump to process

                  System Behavior

                  General

                  Target ID:2
                  Start time:05:53:56
                  Start date:29/10/2024
                  Path:C:\Windows\System32\rundll32.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                  Imagebase:0x7ff742980000
                  File size:71'680 bytes
                  MD5 hash:EF3179D498793BF4234F708D3BE28633
                  Has elevated privileges:false
                  Has administrator privileges:false
                  Programmed in:C, C++ or other language
                  Reputation:high
                  Has exited:true

                  General

                  Target ID:10
                  Start time:05:54:51
                  Start date:29/10/2024
                  Path:C:\Program Files\7-Zip\7zG.exe
                  Wow64 process (32bit):false
                  Commandline:"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\" -spe -an -ai#7zMap15170:110:7zEvent13957
                  Imagebase:0x7a0000
                  File size:700'416 bytes
                  MD5 hash:50F289DF0C19484E970849AAC4E6F977
                  Has elevated privileges:false
                  Has administrator privileges:false
                  Programmed in:C, C++ or other language
                  Reputation:moderate
                  Has exited:true

                  General

                  Target ID:14
                  Start time:05:55:21
                  Start date:29/10/2024
                  Path:C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exe
                  Wow64 process (32bit):false
                  Commandline:"C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exe"
                  Imagebase:0x60000
                  File size:1'070'080 bytes
                  MD5 hash:675A00CA73BAF388C0EBF90C0644E8E0
                  Has elevated privileges:false
                  Has administrator privileges:false
                  Programmed in:C, C++ or other language
                  Antivirus matches:
                  • Detection: 0%, ReversingLabs
                  Reputation:low
                  Has exited:true

                  General

                  Target ID:17
                  Start time:05:55:21
                  Start date:29/10/2024
                  Path:C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exe
                  Wow64 process (32bit):true
                  Commandline:"C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exe"
                  Imagebase:0x60000
                  File size:1'070'080 bytes
                  MD5 hash:675A00CA73BAF388C0EBF90C0644E8E0
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:low
                  Has exited:true

                  General

                  Target ID:18
                  Start time:05:55:22
                  Start date:29/10/2024
                  Path:C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exe
                  Wow64 process (32bit):true
                  Commandline:C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exe /q"C:\Users\user\Desktop\ZPMC SCADA Setup v4.0.12737\setup.exe" /tempdisk1folder"C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}" /IS_temp
                  Imagebase:0x7ff6d4dc0000
                  File size:1'070'080 bytes
                  MD5 hash:675A00CA73BAF388C0EBF90C0644E8E0
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Antivirus matches:
                  • Detection: 0%, ReversingLabs
                  Reputation:low
                  Has exited:false

                  General

                  Target ID:19
                  Start time:05:55:24
                  Start date:29/10/2024
                  Path:C:\Windows\System32\msiexec.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Windows\system32\msiexec.exe /V
                  Imagebase:0x7ff7dbd90000
                  File size:69'632 bytes
                  MD5 hash:E5DA170027542E25EDE42FC54C929077
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:high
                  Has exited:false

                  General

                  Target ID:20
                  Start time:05:55:24
                  Start date:29/10/2024
                  Path:C:\Windows\SysWOW64\msiexec.exe
                  Wow64 process (32bit):true
                  Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding 77B4B6CB8D21758EFE216C05F17DCEE1 C
                  Imagebase:0x6a0000
                  File size:59'904 bytes
                  MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:high
                  Has exited:true

                  General

                  Target ID:21
                  Start time:05:55:24
                  Start date:29/10/2024
                  Path:C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3C556304-8D46-41A1-A183-C63C96FA76B7}
                  Imagebase:0x7ff79e160000
                  File size:181'960 bytes
                  MD5 hash:82E1A9D1E3D0107F7E1253FA92F86B10
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Antivirus matches:
                  • Detection: 0%, ReversingLabs
                  Reputation:low
                  Has exited:true

                  General

                  Target ID:22
                  Start time:05:55:24
                  Start date:29/10/2024
                  Path:C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C68E9931-1A54-4D29-9A11-E2C1A6140D74}
                  Imagebase:0x7ff79e160000
                  File size:181'960 bytes
                  MD5 hash:82E1A9D1E3D0107F7E1253FA92F86B10
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:low
                  Has exited:true

                  General

                  Target ID:23
                  Start time:05:55:24
                  Start date:29/10/2024
                  Path:C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3C967A50-E90B-4AD5-B526-62683195C54F}
                  Imagebase:0x7ff79e160000
                  File size:181'960 bytes
                  MD5 hash:82E1A9D1E3D0107F7E1253FA92F86B10
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:low
                  Has exited:true

                  General

                  Target ID:24
                  Start time:05:55:24
                  Start date:29/10/2024
                  Path:C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EB53D73A-7D41-467E-AF22-FA743D2E5BD2}
                  Imagebase:0x7ff79e160000
                  File size:181'960 bytes
                  MD5 hash:82E1A9D1E3D0107F7E1253FA92F86B10
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:low
                  Has exited:true

                  General

                  Target ID:25
                  Start time:05:55:24
                  Start date:29/10/2024
                  Path:C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0B631758-29DD-4B8E-9A12-949F140ACCEC}
                  Imagebase:0x7ff79e160000
                  File size:181'960 bytes
                  MD5 hash:82E1A9D1E3D0107F7E1253FA92F86B10
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:low
                  Has exited:true

                  General

                  Target ID:26
                  Start time:05:55:25
                  Start date:29/10/2024
                  Path:C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{58E35334-6736-4373-BC16-B19DB2B7F3E2}
                  Imagebase:0x7ff79e160000
                  File size:181'960 bytes
                  MD5 hash:82E1A9D1E3D0107F7E1253FA92F86B10
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:low
                  Has exited:false

                  General

                  Target ID:27
                  Start time:05:55:25
                  Start date:29/10/2024
                  Path:C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{66BF646F-C6CD-4823-BD3A-BBBE0CE92580}
                  Imagebase:0x7ff79e160000
                  File size:181'960 bytes
                  MD5 hash:82E1A9D1E3D0107F7E1253FA92F86B10
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:low
                  Has exited:true

                  General

                  Target ID:28
                  Start time:05:55:25
                  Start date:29/10/2024
                  Path:C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5DB750C9-5B1D-4912-9BBB-735073942453}
                  Imagebase:0x7ff79e160000
                  File size:181'960 bytes
                  MD5 hash:82E1A9D1E3D0107F7E1253FA92F86B10
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:low
                  Has exited:true

                  General

                  Target ID:29
                  Start time:05:55:25
                  Start date:29/10/2024
                  Path:C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{85F4BC9B-9F30-4363-AD6D-FD00E62E44B7}
                  Imagebase:0x7ff79e160000
                  File size:181'960 bytes
                  MD5 hash:82E1A9D1E3D0107F7E1253FA92F86B10
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:low
                  Has exited:true

                  General

                  Target ID:30
                  Start time:05:55:25
                  Start date:29/10/2024
                  Path:C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Users\user\AppData\Local\Temp\{E696D1CF-59A2-4CC2-896D-A4083751C8A0}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D823CFD3-3D7A-4194-AD31-CD5AD6A26B55}
                  Imagebase:0x7ff79e160000
                  File size:181'960 bytes
                  MD5 hash:82E1A9D1E3D0107F7E1253FA92F86B10
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:low
                  Has exited:true

                  General

                  Target ID:34
                  Start time:05:55:55
                  Start date:29/10/2024
                  Path:C:\Windows\System32\SrTasks.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:1
                  Imagebase:0x7ff7c4b10000
                  File size:59'392 bytes
                  MD5 hash:2694D2D28C368B921686FE567BD319EB
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:moderate
                  Has exited:false

                  General

                  Target ID:35
                  Start time:05:55:55
                  Start date:29/10/2024
                  Path:C:\Windows\System32\conhost.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Imagebase:0x7ff6684c0000
                  File size:862'208 bytes
                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:high
                  Has exited:false

                  General

                  Target ID:36
                  Start time:05:55:57
                  Start date:29/10/2024
                  Path:C:\Windows\SysWOW64\msiexec.exe
                  Wow64 process (32bit):true
                  Commandline:C:\Windows\syswow64\MsiExec.exe -Embedding F52714C42576362BF3928B61AE156682
                  Imagebase:0x6a0000
                  File size:59'904 bytes
                  MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:high
                  Has exited:false

                  Disassembly

                  Reset < >

                    Execution Graph

                    Execution Coverage:3.3%
                    Dynamic/Decrypted Code Coverage:8.6%
                    Signature Coverage:7%
                    Total number of Nodes:2000
                    Total number of Limit Nodes:54
                    execution_graph 57010 1004cec4 57011 1004cece 57010->57011 57013 1004ced3 57010->57013 57012 1004cef0 VariantClear 57012->57011 57013->57011 57013->57012 57014 1003afc3 57017 10031ea4 57014->57017 57022 1006007d 57017->57022 57020 10031ead 57028 10064701 GetModuleHandleW GetProcAddress 57022->57028 57024 10031ea9 57024->57020 57025 10031e69 57024->57025 57031 100b5170 57025->57031 57027 10031e6e 57027->57020 57029 10064722 GetSystemInfo 57028->57029 57030 1006472a GetNativeSystemInfo 57028->57030 57029->57024 57030->57024 57037 100b52a0 57031->57037 57034 100b517c 57034->57027 57036 100b5186 57036->57027 57041 100b51c0 57037->57041 57040 100b5340 6 API calls ___wstrgtold12_l 57040->57036 57042 100b520e 57041->57042 57045 1008a483 57042->57045 57044 100b5178 57044->57034 57044->57040 57046 1008a48b 57045->57046 57047 1008a48d IsProcessorFeaturePresent 57045->57047 57046->57044 57049 10090775 57047->57049 57052 10090724 5 API calls 2 library calls 57049->57052 57051 10090858 57051->57044 57052->57051 59506 10042fe4 59507 10042ff3 __EH_prolog3_GS 59506->59507 59508 10043133 59507->59508 59510 10040d44 106 API calls 59507->59510 59509 1008be79 Mailbox 6 API calls 59508->59509 59511 10043138 59509->59511 59512 10043016 59510->59512 59513 10003aa0 Mailbox 73 API calls 59512->59513 59514 10043037 59513->59514 59515 10004ec2 Mailbox 4 API calls 59514->59515 59516 10043046 59515->59516 59517 10003be6 73 API calls 59516->59517 59518 10043062 59517->59518 59519 1003bfb6 78 API calls 59518->59519 59520 10043072 59519->59520 59521 10004ec2 Mailbox 4 API calls 59520->59521 59522 1004307a LoadLibraryW GetProcAddress 59521->59522 59523 100430e4 GetDC 59522->59523 59524 100430aa 59522->59524 59526 100430f2 GetDeviceCaps ReleaseDC 59523->59526 59527 1004310a MulDiv 59523->59527 59524->59523 59525 100430ae MonitorFromPoint 59524->59525 59529 100430d4 59525->59529 59526->59527 59528 1004312b Mailbox 59527->59528 59530 10004ec2 Mailbox 4 API calls 59528->59530 59529->59527 59530->59508 59531 10028be6 59532 10028c10 RegOpenKeyExW 59531->59532 59533 10028c09 59531->59533 59535 10028c0e 59532->59535 59538 10029010 59533->59538 59536 10028c23 59535->59536 59545 1002866e RegCloseKey 59535->59545 59539 10029051 59538->59539 59540 1002901b GetModuleHandleW 59538->59540 59542 1002905f 59539->59542 59543 10029057 RegOpenKeyExW 59539->59543 59541 1002902a GetProcAddress 59540->59541 59540->59542 59541->59542 59544 1002903a 59541->59544 59542->59535 59543->59542 59544->59542 59545->59536 57053 1004aa82 57056 1004a1da 57053->57056 57055 1004aa99 57059 1004a874 57056->57059 57058 1004a1fa 57058->57055 57060 1004a886 57059->57060 57063 1004a49e lstrlenW 57060->57063 57064 1004a4b1 57063->57064 57066 1004a4c8 57063->57066 57067 1004a51b 57064->57067 57066->57058 57068 1004a56f _memset 57067->57068 57069 1004a5a5 57068->57069 57070 1004a583 lstrcpyW lstrcatW 57068->57070 57071 1004a5c7 GetDiskFreeSpaceExW GetDiskFreeSpaceW 57069->57071 57070->57071 57072 1004a635 57071->57072 57073 1008a483 ___wstrgtold12_l 6 API calls 57072->57073 57074 1004a65e 57073->57074 57074->57066 59546 10013e27 59547 10013e32 59546->59547 59548 10013e37 59546->59548 59548->59547 59549 10013e48 GetHandle 59548->59549 59550 10013e4f 59548->59550 59549->59550 59552 10012f45 161 API calls 3 library calls 59550->59552 59552->59547 57075 1000b548 57076 1000b557 __EH_prolog3_GS 57075->57076 57114 10003f0a 57076->57114 57079 10003f0a 73 API calls 57080 1000b59c 57079->57080 57118 100541fd 57080->57118 57115 10003f16 57114->57115 57212 10003be6 57115->57212 57117 10003f3b 57117->57079 57119 1005420c __EH_prolog3_catch_GS 57118->57119 57120 10054416 57119->57120 57256 10003b8b 57119->57256 57248 10004ec2 GetLastError 57120->57248 57123 10054242 57259 100549ea 119 API calls 57123->57259 57124 1005441e 57126 10004ec2 Mailbox 4 API calls 57124->57126 57128 10054426 57126->57128 57127 1005426c 57260 10003aa0 57127->57260 57253 1008be88 57128->57253 57131 10054283 57267 1005445f 136 API calls 3 library calls 57131->57267 57134 10054288 57268 1003b44a 71 API calls 57134->57268 57136 1005429f 57269 1000ea8b SysStringLen 57136->57269 57140 100542c1 57276 100126fa 96 API calls 2 library calls 57140->57276 57142 100542d3 57277 1003b873 74 API calls Mailbox 57142->57277 57144 100542e1 57145 10004ec2 Mailbox 4 API calls 57144->57145 57146 100542e9 57145->57146 57278 1003b873 74 API calls Mailbox 57146->57278 57148 100542f7 57149 10004ec2 Mailbox 4 API calls 57148->57149 57150 100542ff 57149->57150 57151 10003be6 73 API calls 57150->57151 57152 1005431a 57151->57152 57153 10003be6 73 API calls 57152->57153 57154 1005433f 57153->57154 57279 10055060 83 API calls 57154->57279 57156 10054356 57157 10004ec2 Mailbox 4 API calls 57156->57157 57158 10054361 57157->57158 57159 10004ec2 Mailbox 4 API calls 57158->57159 57160 1005436d 57159->57160 57161 10003be6 73 API calls 57160->57161 57162 1005438e 57161->57162 57163 10003be6 73 API calls 57162->57163 57164 100543ad 57163->57164 57280 10055060 83 API calls 57164->57280 57166 100543c4 57167 10004ec2 Mailbox 4 API calls 57166->57167 57168 100543cc 57167->57168 57169 10004ec2 Mailbox 4 API calls 57168->57169 57170 100543db __NMSG_WRITE 57169->57170 57281 1001487c 71 API calls Mailbox 57170->57281 57172 100543f1 57173 10003aa0 Mailbox 73 API calls 57172->57173 57174 10054406 57173->57174 57282 1005445f 136 API calls 3 library calls 57174->57282 57176 1005440b 57177 10004ec2 Mailbox 4 API calls 57176->57177 57177->57120 57213 10003bf2 __EH_prolog3 57212->57213 57214 10003c0a GetLastError 57213->57214 57218 100040d3 57214->57218 57217 10003c55 Mailbox 57217->57117 57221 1000d3a8 57218->57221 57222 1000d3b9 __NMSG_WRITE 57221->57222 57225 1000d3cf 57222->57225 57224 10003c35 SetLastError 57224->57217 57226 1000d3df 57225->57226 57227 1000d401 57226->57227 57228 1000d3e3 57226->57228 57244 1000c333 71 API calls Mailbox 57227->57244 57232 1000d315 57228->57232 57231 1000d3ff Mailbox 57231->57224 57233 1000d32a 57232->57233 57234 1000d39d 57232->57234 57235 1000d337 57233->57235 57236 1000d34e 57233->57236 57247 10051e9f 69 API calls 3 library calls 57234->57247 57245 1000e5a6 69 API calls Mailbox 57235->57245 57246 1000c333 71 API calls Mailbox 57236->57246 57240 1000d3a7 57243 1000d34c Mailbox 57243->57231 57244->57231 57246->57243 57247->57240 57249 1008ab74 57248->57249 57250 10004ee0 SysFreeString 57249->57250 57283 1000cc5b 57250->57283 57254 1008a483 ___wstrgtold12_l 6 API calls 57253->57254 57255 1008be92 57254->57255 57255->57255 57257 10003ba5 GetLastError SetLastError 57256->57257 57258 10003b98 57256->57258 57257->57123 57258->57257 57259->57127 57261 10003aac __EH_prolog3 57260->57261 57262 10003ac4 GetLastError 57261->57262 57263 10003ade 57262->57263 57287 1000406b 57263->57287 57266 10003b0e Mailbox 57266->57131 57267->57134 57268->57136 57270 1000eaa2 SysReAllocStringLen 57269->57270 57271 1000eaba 57269->57271 57274 1000ead1 57270->57274 57271->57274 57290 1000bb37 69 API calls Mailbox 57271->57290 57275 10091193 104 API calls __vsnwprintf_l 57274->57275 57275->57140 57276->57142 57277->57144 57278->57148 57279->57156 57280->57166 57281->57172 57282->57176 57284 10004ef6 SetLastError 57283->57284 57286 1000cc6c Mailbox 57283->57286 57284->57124 57285 1000cc83 SysFreeString 57285->57284 57286->57284 57286->57285 57288 1000d315 Mailbox 71 API calls 57287->57288 57289 10003aee SetLastError 57288->57289 57289->57266 57290->57274 57369 1004204e 57537 1008beca 57369->57537 57371 1004205d GetPropW 57372 100423a7 57371->57372 57373 1004208c 57371->57373 57376 10042742 SetPropW 57372->57376 57377 100423b2 57372->57377 57374 10042092 57373->57374 57375 100421ab 57373->57375 57379 10042157 57374->57379 57384 1004209a 57374->57384 57380 100422b7 57375->57380 57388 100421c0 57375->57388 57378 10042758 57376->57378 57391 10042764 57376->57391 57385 100423c2 57377->57385 57386 1004251b 57377->57386 57387 100426c0 57377->57387 57538 10045174 GetWindowLongW 57378->57538 57382 1004215b RemovePropW 57379->57382 57421 10042140 57379->57421 57380->57421 57666 1004321c 8 API calls ___wstrgtold12_l 57380->57666 57661 10044ffc 69 API calls 2 library calls 57382->57661 57394 100420cc 57384->57394 57395 100420a8 57384->57395 57384->57421 57398 100423e4 GetKeyState 57385->57398 57385->57421 57389 10003b8b 2 API calls 57386->57389 57407 100426dc 57387->57407 57387->57421 57688 10043149 11 API calls ___wstrgtold12_l 57387->57688 57388->57421 57662 1004321c 8 API calls ___wstrgtold12_l 57388->57662 57396 10042543 57389->57396 57554 1000148d GetDlgItem 57391->57554 57399 100420d9 GetDlgItem 57394->57399 57394->57421 57397 100420b1 EnumChildWindows 57395->57397 57395->57421 57685 1003b44a 71 API calls 57396->57685 57397->57421 57404 100423f8 GetKeyState 57398->57404 57398->57421 57405 100420f0 BeginPaint 57399->57405 57399->57421 57401 1008be79 Mailbox 6 API calls 57412 10042cce 57401->57412 57402 100422c9 57413 100422d1 GetDlgCtrlID 57402->57413 57402->57421 57403 1004277d LoadIconW GetDlgItem SendMessageW GetDlgItem 57408 100428ce _memset 57403->57408 57409 100427ca 57403->57409 57419 1004240c GetDlgItem 57404->57419 57404->57421 57420 1000380e 73 API calls 57405->57420 57407->57421 57689 10044ffc 69 API calls 2 library calls 57407->57689 57427 100428dd VariantInit 57408->57427 57557 1000395e 57409->57557 57422 10003f0a 73 API calls 57413->57422 57415 1004277c 57415->57403 57416 100421e2 57416->57421 57429 10003b8b 2 API calls 57416->57429 57418 10042562 57426 1000ea8b 71 API calls 57418->57426 57419->57421 57423 10042428 57419->57423 57424 1004211c 57420->57424 57421->57401 57428 100422f4 57422->57428 57423->57421 57432 10042430 GetDlgItem ShowWindow GetWindowRect ScreenToClient ScreenToClient 57423->57432 57660 10001284 38 API calls 2 library calls 57424->57660 57425 100427e8 57560 10013130 57425->57560 57431 10042571 GetClassNameW 57426->57431 57438 10042912 lstrcmpW 57427->57438 57439 1000d3a8 71 API calls 57428->57439 57443 1004231e 57428->57443 57435 10042225 57429->57435 57686 100126fa 96 API calls 2 library calls 57431->57686 57432->57421 57453 1004247a 57432->57453 57434 1004212d EndPaint 57434->57421 57663 1003b44a 71 API calls 57435->57663 57449 10042940 57438->57449 57450 10042948 GetDlgItem 57438->57450 57439->57443 57442 1004258a GetWindowLongW 57687 1000d6ca 81 API calls __NMSG_WRITE 57442->57687 57482 1004228a 57443->57482 57667 1004156e 70 API calls 5 library calls 57443->57667 57444 10042241 57451 1000ea8b 71 API calls 57444->57451 57691 10044254 140 API calls 57449->57691 57456 10042957 57450->57456 57458 10042250 GetClassNameW 57451->57458 57452 10001123 Mailbox 4 API calls 57459 10042815 57452->57459 57453->57421 57673 10003d09 57453->57673 57454 10042347 57668 100052b0 57454->57668 57468 10042a44 57456->57468 57475 10042986 MapDialogRect GetClientRect MulDiv MulDiv 57456->57475 57664 100126fa 96 API calls 2 library calls 57458->57664 57464 1004282d SendMessageW GetObjectW CreateFontIndirectW 57459->57464 57465 1004281a SetWindowTextW 57459->57465 57460 1004264b GetDlgCtrlID 57467 10042657 57460->57467 57462 1004239a 57469 10004ec2 Mailbox 4 API calls 57462->57469 57472 10042885 SendMessageW GetSysColor CreateSolidBrush 57464->57472 57473 10042873 Mailbox 57464->57473 57465->57464 57466 10042610 SetBkMode GetSysColor SetTextColor GetStockObject 57478 10042639 57466->57478 57467->57466 57467->57478 57480 100426b5 57467->57480 57487 10042a65 GetDlgItem 57468->57487 57488 10042cac EnumChildWindows VariantClear 57468->57488 57469->57421 57471 1004226a 57471->57482 57665 10040260 88 API calls 2 library calls 57471->57665 57477 100428b6 Mailbox 57472->57477 57473->57472 57474 100425a6 57474->57460 57476 10042601 57474->57476 57475->57468 57481 100429d3 57475->57481 57476->57466 57476->57478 57484 10001123 Mailbox 4 API calls 57477->57484 57485 10004ec2 Mailbox 4 API calls 57478->57485 57489 10004ec2 Mailbox 4 API calls 57480->57489 57481->57468 57692 1008abd5 57481->57692 57672 10044ffc 69 API calls 2 library calls 57482->57672 57484->57408 57485->57421 57486 10005261 71 API calls 57490 100424f5 57486->57490 57487->57488 57491 10042a79 57487->57491 57488->57421 57489->57387 57493 10001123 Mailbox 4 API calls 57490->57493 57567 10041397 57491->57567 57494 10042500 InvalidateRect 57493->57494 57494->57421 57497 1000395e 2 API calls 57498 10042aa2 57497->57498 57499 10042ac4 57498->57499 57500 10042ab9 57498->57500 57700 10022a6a 71 API calls 57499->57700 57503 10005261 71 API calls 57500->57503 57501 100429eb 57502 100155be 69 API calls 57501->57502 57505 10042a12 57502->57505 57506 10042ac2 57503->57506 57511 100155be 69 API calls 57505->57511 57572 100155be 57506->57572 57507 10042ad5 57508 1000ea30 71 API calls 57507->57508 57509 10042ae4 GetDlgItemTextW 57508->57509 57701 1001cd08 96 API calls 2 library calls 57509->57701 57514 10042a29 57511->57514 57517 10042a33 SetPropW 57514->57517 57517->57468 57518 10042c33 57519 100155be 69 API calls 57518->57519 57521 10042c5c 57519->57521 57523 10001123 Mailbox 4 API calls 57521->57523 57522 10042b9a 57524 100155be 69 API calls 57522->57524 57525 10042c96 57523->57525 57526 10042bc9 57524->57526 57527 10001123 Mailbox 4 API calls 57525->57527 57703 10090707 81 API calls __wcstoi64 57526->57703 57530 10042ca1 57527->57530 57529 10042bcf 57531 10042c18 57529->57531 57704 100403a1 69 API calls 2 library calls 57529->57704 57532 10001123 Mailbox 4 API calls 57530->57532 57706 10033cf5 FindResourceW FindResourceW 57531->57706 57532->57488 57535 10042c0e 57705 1008cb70 78 API calls 57535->57705 57537->57371 57539 1004519f 57538->57539 57540 100451bb GetWindowRect 57538->57540 57541 100451a7 GetParent 57539->57541 57542 100451b0 GetWindow 57539->57542 57543 100451ce 57540->57543 57544 10045218 GetParent GetClientRect GetClientRect MapWindowPoints 57540->57544 57545 100451b9 57541->57545 57542->57545 57546 100451d2 GetWindowLongW 57543->57546 57547 100451eb SystemParametersInfoW 57543->57547 57550 100451ff SetWindowPos 57544->57550 57545->57540 57548 100451e2 57546->57548 57549 1004520b GetWindowRect 57547->57549 57547->57550 57548->57547 57549->57550 57552 1008a483 ___wstrgtold12_l 6 API calls 57550->57552 57553 100452d1 57552->57553 57553->57391 57555 100014a5 GetWindowLongW SetWindowLongW GetWindowLongW SetWindowLongW SetWindowPos 57554->57555 57556 100014e6 57554->57556 57555->57556 57556->57403 57690 100014e9 13 API calls ___wstrgtold12_l 57556->57690 57558 10003978 GetLastError SetLastError 57557->57558 57559 1000396b 57557->57559 57558->57425 57559->57558 57561 1000380e 73 API calls 57560->57561 57562 10013159 57561->57562 57563 10005261 57562->57563 57564 1000526e 57563->57564 57565 10005286 57564->57565 57566 1000d1cf 71 API calls 57564->57566 57565->57452 57566->57565 57568 1000395e 2 API calls 57567->57568 57569 100413ba 57568->57569 57570 1000395e 2 API calls 57569->57570 57571 100413ce 57570->57571 57571->57497 57573 100155d1 57572->57573 57707 10014e9a 57573->57707 57576 1004345a 57577 10043469 __EH_prolog3_GS 57576->57577 57578 1000395e 2 API calls 57577->57578 57579 10043498 57578->57579 57580 1000395e 2 API calls 57579->57580 57581 100434c2 57580->57581 57582 1000395e 2 API calls 57581->57582 57583 100434e9 57582->57583 57584 1000395e 2 API calls 57583->57584 57585 10043510 57584->57585 57586 1000395e 2 API calls 57585->57586 57587 1004352e 57586->57587 57588 10003d09 94 API calls 57587->57588 57589 10043550 57588->57589 57590 10043576 57589->57590 57729 10019415 70 API calls 57589->57729 57592 100435a8 57590->57592 57593 1004358a 57590->57593 57732 10042e51 94 API calls 2 library calls 57592->57732 57730 10019415 70 API calls 57593->57730 57596 10043595 57731 100432fd 99 API calls 2 library calls 57596->57731 57597 100435ba 57599 1004359f 57597->57599 57601 1000395e 2 API calls 57597->57601 57600 10001123 Mailbox 4 API calls 57599->57600 57602 10043951 57600->57602 57603 100435f5 57601->57603 57604 10001123 Mailbox 4 API calls 57602->57604 57605 1000395e 2 API calls 57603->57605 57606 10043959 57604->57606 57607 10043618 57605->57607 57608 10001123 Mailbox 4 API calls 57606->57608 57733 1009170f 68 API calls _vscan_fn 57607->57733 57610 10043964 57608->57610 57612 10001123 Mailbox 4 API calls 57610->57612 57611 10043640 57613 100436ff 57611->57613 57618 1004364b __itow 57611->57618 57615 1004396f 57612->57615 57734 10042e51 94 API calls 2 library calls 57613->57734 57617 10001123 Mailbox 4 API calls 57615->57617 57616 1004370f 57735 10042e51 94 API calls 2 library calls 57616->57735 57621 1004397a 57617->57621 57619 10003d09 94 API calls 57618->57619 57622 10043686 57619->57622 57624 10001123 Mailbox 4 API calls 57621->57624 57625 10005261 71 API calls 57622->57625 57623 100436fd 57659 1004392f 57623->57659 57736 10042e51 94 API calls 2 library calls 57623->57736 57626 10043985 57624->57626 57627 10043698 57625->57627 57628 1008be79 Mailbox 6 API calls 57626->57628 57629 10001123 Mailbox 4 API calls 57627->57629 57631 10042b1b 57628->57631 57632 100436a7 __itow 57629->57632 57631->57518 57702 1008a0b0 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 57631->57702 57637 10003d09 94 API calls 57632->57637 57633 10043743 57633->57659 57737 10042e51 94 API calls 2 library calls 57633->57737 57634 10001123 Mailbox 4 API calls 57635 1004393e 57634->57635 57636 10001123 Mailbox 4 API calls 57635->57636 57636->57599 57639 100436db 57637->57639 57641 10005261 71 API calls 57639->57641 57640 10043780 57640->57659 57738 10042e51 94 API calls 2 library calls 57640->57738 57642 100436ee 57641->57642 57644 10001123 Mailbox 4 API calls 57642->57644 57644->57623 57645 100437bd 57646 100437ff 57645->57646 57739 1009170f 68 API calls _vscan_fn 57645->57739 57646->57659 57740 10042e51 94 API calls 2 library calls 57646->57740 57649 10043840 57650 10043882 57649->57650 57741 1009170f 68 API calls _vscan_fn 57649->57741 57652 1000395e 2 API calls 57650->57652 57650->57659 57653 100438d5 57652->57653 57742 10042e51 94 API calls 2 library calls 57653->57742 57655 100438ee 57656 1004390e 57655->57656 57743 10045112 69 API calls 2 library calls 57655->57743 57658 10001123 Mailbox 4 API calls 57656->57658 57658->57659 57659->57634 57660->57434 57661->57421 57662->57416 57663->57444 57664->57471 57665->57482 57666->57402 57667->57454 57670 100052bd 57668->57670 57669 100052d5 57669->57482 57670->57669 57671 1000d315 Mailbox 71 API calls 57670->57671 57671->57669 57672->57462 57674 10003d15 __EH_prolog3_GS 57673->57674 57675 1000395e 2 API calls 57674->57675 57676 10003d3f 57675->57676 57677 10003d4c 57676->57677 57744 1008b76f 79 API calls __mbstrlen_l 57676->57744 57745 10003d86 57677->57745 57680 10003d60 57681 10001123 Mailbox 4 API calls 57680->57681 57682 10003d7c 57681->57682 57683 1008be79 Mailbox 6 API calls 57682->57683 57684 10003d83 57683->57684 57684->57486 57685->57418 57686->57442 57687->57474 57688->57407 57689->57421 57690->57415 57691->57450 57693 1008abdd 57692->57693 57695 1008abf7 57693->57695 57697 1008abf9 std::exception::exception 57693->57697 57797 1009003b 57693->57797 57814 10094b2c RtlDecodePointer 57693->57814 57695->57501 57815 1008be0a RaiseException 57697->57815 57699 1008ac23 57700->57507 57701->57506 57702->57522 57703->57529 57704->57535 57705->57531 57706->57518 57708 10014eac 57707->57708 57712 10014ed8 57707->57712 57709 10014eb1 WideCharToMultiByte 57708->57709 57708->57712 57711 10014ee0 57709->57711 57711->57576 57712->57711 57716 1008c694 57712->57716 57721 1008c6a2 57716->57721 57717 1008c6a6 57719 10014f06 57717->57719 57726 100910bb 68 API calls __getptd_noexit 57717->57726 57719->57711 57725 1008b926 68 API calls __filbuf 57719->57725 57720 1008c6d6 57727 10095b4a 9 API calls __filbuf 57720->57727 57721->57717 57721->57719 57723 1008c6e5 57721->57723 57723->57719 57728 100910bb 68 API calls __getptd_noexit 57723->57728 57725->57711 57726->57720 57727->57719 57728->57720 57729->57590 57730->57596 57731->57599 57732->57597 57733->57611 57734->57616 57735->57623 57736->57633 57737->57640 57738->57645 57739->57646 57740->57649 57741->57650 57742->57655 57743->57656 57744->57677 57746 10003d92 __EH_prolog3_GS 57745->57746 57747 1000395e 2 API calls 57746->57747 57748 10003dbe 57747->57748 57755 1000d8bb 57748->57755 57750 10003dd9 57751 10001123 Mailbox 4 API calls 57750->57751 57752 10003df8 SetLastError 57751->57752 57753 1008be79 Mailbox 6 API calls 57752->57753 57754 10003e0d 57753->57754 57754->57680 57756 1000d8c7 __EH_prolog3_GS 57755->57756 57757 1000395e 2 API calls 57756->57757 57758 1000d8ee 57757->57758 57767 1000d92b 57758->57767 57761 1000380e 73 API calls 57762 1000d91b 57761->57762 57763 10001123 Mailbox 4 API calls 57762->57763 57764 1000d923 57763->57764 57765 1008be79 Mailbox 6 API calls 57764->57765 57766 1000d92a 57765->57766 57766->57750 57768 1000d937 __EH_prolog3_GS 57767->57768 57769 1000d9d3 __NMSG_WRITE 57768->57769 57770 1000d95c _strlen 57768->57770 57771 1000da3a 57769->57771 57772 1000d9eb 57769->57772 57773 1000d96d MultiByteToWideChar 57770->57773 57796 10003e48 73 API calls 57771->57796 57794 1008b926 68 API calls __filbuf 57772->57794 57793 100519b1 57773->57793 57777 1000da4e 57780 10005261 71 API calls 57777->57780 57783 1000da5e 57780->57783 57781 1000da05 57795 10003e48 73 API calls 57781->57795 57785 10001123 Mailbox 4 API calls 57783->57785 57792 1000d9c5 57785->57792 57786 1000da1c 57788 10005261 71 API calls 57786->57788 57787 1008be79 Mailbox 6 API calls 57789 1000d902 57787->57789 57790 1000da29 57788->57790 57789->57761 57791 10001123 Mailbox 4 API calls 57790->57791 57791->57792 57792->57787 57794->57781 57795->57786 57796->57777 57798 100900b6 57797->57798 57810 10090047 57797->57810 57822 10094b2c RtlDecodePointer 57798->57822 57800 100900bc 57823 100910bb 68 API calls __getptd_noexit 57800->57823 57803 1009007a RtlAllocateHeap 57804 100900ae 57803->57804 57803->57810 57804->57693 57806 100900a2 57820 100910bb 68 API calls __getptd_noexit 57806->57820 57810->57803 57810->57806 57811 100900a0 57810->57811 57812 10090052 57810->57812 57819 10094b2c RtlDecodePointer 57810->57819 57821 100910bb 68 API calls __getptd_noexit 57811->57821 57812->57810 57816 10094683 68 API calls __NMSG_WRITE 57812->57816 57817 100946e0 68 API calls 5 library calls 57812->57817 57818 1009a757 GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 57812->57818 57814->57693 57815->57699 57816->57812 57817->57812 57819->57810 57820->57811 57821->57804 57822->57800 57823->57804 57824 70a1180 57825 70a1191 57824->57825 57827 70a11e2 57825->57827 57831 70a119a 57825->57831 57832 70a1040 57825->57832 57828 70a121e 57827->57828 57830 70a1040 146 API calls 57827->57830 57827->57831 57829 70a1040 146 API calls 57828->57829 57828->57831 57829->57831 57830->57828 57833 70a104d GetVersion 57832->57833 57834 70a1107 57832->57834 57862 70a4990 HeapCreate 57833->57862 57835 70a110d 57834->57835 57836 70a1160 57834->57836 57842 70a1066 57835->57842 57847 70a1133 _findenv 57835->57847 57949 70a1340 81 API calls _findenv 57835->57949 57836->57842 57954 70a1640 83 API calls ___free_lc_time 57836->57954 57842->57827 57844 70a10cd GetCommandLineA 57886 70a44e0 57844->57886 57845 70a10c1 57948 70a4a20 6 API calls 57845->57948 57846 70a1149 57951 70a1aa0 82 API calls ___free_lc_time 57846->57951 57847->57846 57950 70a3d30 81 API calls _findenv 57847->57950 57853 70a114e 57952 70a1550 87 API calls 57853->57952 57856 70a10e7 57926 70a3fd0 57856->57926 57857 70a1153 57953 70a4a20 6 API calls 57857->57953 57860 70a10ec 57935 70a3e80 57860->57935 57863 70a105f 57862->57863 57864 70a49bc 57862->57864 57863->57842 57876 70a14c0 57863->57876 57955 70a4760 98 API calls 2 library calls 57864->57955 57866 70a49c1 57867 70a49cf 57866->57867 57868 70a49f3 57866->57868 57956 70a67e0 HeapAlloc 57867->57956 57869 70a49f1 57868->57869 57957 70a84b0 5 API calls _calloc 57868->57957 57869->57863 57872 70a49d9 57872->57869 57874 70a49e0 HeapDestroy 57872->57874 57873 70a4a01 57873->57869 57875 70a4a05 HeapDestroy 57873->57875 57874->57863 57875->57863 57958 70a4d70 InitializeCriticalSection InitializeCriticalSection InitializeCriticalSection InitializeCriticalSection 57876->57958 57878 70a14c9 TlsAlloc 57879 70a10bd 57878->57879 57880 70a14e1 57878->57880 57879->57844 57879->57845 57959 70a1fd0 81 API calls __malloc_dbg 57880->57959 57882 70a14f3 57882->57879 57883 70a14ff TlsSetValue 57882->57883 57883->57879 57884 70a1518 __wcstoul_l 57883->57884 57885 70a1521 GetCurrentThreadId 57884->57885 57885->57879 57887 70a450c 57886->57887 57888 70a44fd GetEnvironmentStringsW 57886->57888 57890 70a463e 57887->57890 57891 70a4547 57887->57891 57888->57887 57889 70a4518 GetEnvironmentStrings 57888->57889 57889->57887 57894 70a10dd 57889->57894 57893 70a4651 GetEnvironmentStrings 57890->57893 57890->57894 57897 70a4667 57890->57897 57892 70a454d GetEnvironmentStringsW 57891->57892 57896 70a4563 WideCharToMultiByte 57891->57896 57892->57894 57892->57896 57893->57894 57893->57897 57912 70a1770 57894->57912 57898 70a45c6 57896->57898 57899 70a45e4 FreeEnvironmentStringsW 57896->57899 57901 70a1b70 __malloc_dbg 81 API calls 57897->57901 57960 70a1b70 57898->57960 57899->57894 57903 70a46b6 57901->57903 57905 70a46c2 FreeEnvironmentStringsA 57903->57905 57906 70a46d0 _calloc 57903->57906 57904 70a45f5 WideCharToMultiByte 57907 70a462c FreeEnvironmentStringsW 57904->57907 57908 70a4617 57904->57908 57905->57894 57910 70a46e1 FreeEnvironmentStringsA 57906->57910 57907->57894 57963 70a2710 81 API calls 2 library calls 57908->57963 57910->57894 57911 70a4622 57911->57907 57913 70a1b70 __malloc_dbg 81 API calls 57912->57913 57914 70a178c 57913->57914 57915 70a179f GetStartupInfoA 57914->57915 58044 70a1280 81 API calls __aligned_recalloc_base 57914->58044 57918 70a1995 57915->57918 57924 70a180e 57915->57924 57919 70a1a84 SetHandleCount 57918->57919 57920 70a19f4 GetStdHandle 57918->57920 57919->57856 57920->57918 57921 70a1a07 GetFileType 57920->57921 57921->57918 57922 70a1b70 __malloc_dbg 81 API calls 57922->57924 57923 70a1893 57923->57918 57925 70a1950 GetFileType 57923->57925 57924->57918 57924->57922 57924->57923 57925->57923 57927 70a3fdf 57926->57927 57928 70a3fe4 GetModuleFileNameA 57926->57928 58045 70a9ea0 95 API calls 57927->58045 57930 70a400c 57928->57930 57931 70a1b70 __malloc_dbg 81 API calls 57930->57931 57932 70a4058 57931->57932 57933 70a406b 57932->57933 58046 70a1280 81 API calls __aligned_recalloc_base 57932->58046 57933->57860 57936 70a3e8f 57935->57936 57938 70a3e94 _findenv 57935->57938 58047 70a9ea0 95 API calls 57936->58047 57939 70a1b70 __malloc_dbg 81 API calls 57938->57939 57940 70a3ef2 57939->57940 57947 70a3f11 _findenv 57940->57947 58048 70a1280 81 API calls __aligned_recalloc_base 57940->58048 57942 70a3f97 58050 70a2710 81 API calls 2 library calls 57942->58050 57944 70a3fa5 57944->57842 57945 70a1b70 __malloc_dbg 81 API calls 57945->57947 57947->57942 57947->57945 58049 70a1280 81 API calls __aligned_recalloc_base 57947->58049 57948->57842 57949->57847 57950->57846 57951->57853 57952->57857 57953->57842 57954->57842 57955->57866 57956->57872 57957->57873 57958->57878 57959->57882 57964 70a1bc0 57960->57964 57963->57911 57965 70a1be3 __malloc_dbg 57964->57965 57969 70a1b8f 57965->57969 57970 70a4e50 57965->57970 57985 70a1c80 57965->57985 58006 70a1c1d 57965->58006 57969->57899 57969->57904 57971 70a4ed2 EnterCriticalSection 57970->57971 57972 70a4e61 57970->57972 57971->57965 57973 70a1b70 __malloc_dbg 79 API calls 57972->57973 57975 70a4e74 57973->57975 57974 70a4e87 57977 70a4e50 __aligned_recalloc_base 79 API calls 57974->57977 57975->57974 58009 70a1280 81 API calls __aligned_recalloc_base 57975->58009 57978 70a4e91 57977->57978 57979 70a4eba 57978->57979 57980 70a4ea1 InitializeCriticalSection 57978->57980 58010 70a2710 81 API calls 2 library calls 57979->58010 57981 70a4ec5 57980->57981 58011 70a4ef0 LeaveCriticalSection 57981->58011 57984 70a4ecf 57984->57971 57986 70a1ccc 57985->57986 57987 70a1c9c 57985->57987 57990 70a1d06 57986->57990 57991 70a1d64 57986->57991 57987->57986 57989 70a1ca5 57987->57989 58033 70a2ed0 81 API calls 4 library calls 57987->58033 57989->57987 58034 70a56e0 81 API calls _findenv 57989->58034 57993 70a1d0c 57990->57993 57994 70a1d37 57990->57994 57995 70a1d97 57991->57995 57998 70a1dc3 57991->57998 58002 70a1d35 57993->58002 58035 70a56e0 81 API calls _findenv 57993->58035 58005 70a1d5d _calloc 57994->58005 58036 70a56e0 81 API calls _findenv 57994->58036 57995->58002 58037 70a56e0 81 API calls _findenv 57995->58037 58000 70a1e10 57998->58000 58003 70a1dea 57998->58003 58012 70a5470 58000->58012 58002->58005 58003->58000 58038 70a56e0 81 API calls _findenv 58003->58038 58005->57965 58043 70a4ef0 LeaveCriticalSection 58006->58043 58008 70a1c24 58008->57965 58009->57974 58010->57981 58011->57984 58013 70a549c 58012->58013 58014 70a54f3 58012->58014 58016 70a54d3 58013->58016 58019 70a4e50 __aligned_recalloc_base 79 API calls 58013->58019 58015 70a5500 58014->58015 58014->58016 58021 70a556d HeapAlloc 58015->58021 58023 70a4e50 __aligned_recalloc_base 79 API calls 58015->58023 58017 70a558e RtlAllocateHeap 58016->58017 58030 70a54e6 58016->58030 58017->58030 58020 70a54ae 58019->58020 58039 70a6ef0 5 API calls _calloc 58020->58039 58021->58030 58025 70a552d 58023->58025 58024 70a54c1 58040 70a54d5 LeaveCriticalSection __aligned_recalloc_base 58024->58040 58041 70a8970 6 API calls _calloc 58025->58041 58028 70a5543 58042 70a5557 LeaveCriticalSection __aligned_recalloc_base 58028->58042 58030->58005 58031 70a5555 58031->58021 58032 70a5568 58031->58032 58032->58030 58033->57987 58034->57989 58035->57993 58036->57994 58037->57995 58038->58003 58039->58024 58040->58016 58041->58028 58042->58031 58043->58008 58044->57915 58045->57928 58046->57933 58047->57938 58048->57947 58049->57947 58050->57944 58051 1004cd0e 58052 1004cd1a __EH_prolog3_GS 58051->58052 58053 1004cd26 58052->58053 58054 10003e10 73 API calls 58052->58054 58056 1008be79 Mailbox 6 API calls 58053->58056 58055 1004cd3c 58054->58055 58058 1004cd5a 58055->58058 58062 1004cda2 58055->58062 58069 1004cd49 58055->58069 58057 1004ce7f 58056->58057 58060 1000ea30 71 API calls 58058->58060 58059 10001123 Mailbox 4 API calls 58059->58053 58061 1004cd65 58060->58061 58061->58069 58070 10013c15 58061->58070 58063 1000ea30 71 API calls 58062->58063 58062->58069 58067 1004cddc 58063->58067 58068 1000ea30 71 API calls 58067->58068 58067->58069 58068->58069 58069->58059 58077 1000528d 58070->58077 58073 1003e6a3 58074 1003e6ae 58073->58074 58075 1003e6bc 58074->58075 58076 1000ea30 71 API calls 58074->58076 58075->58069 58076->58075 58078 1000d262 71 API calls 58077->58078 58079 100052a9 58078->58079 58079->58073 59553 10033c69 LoadStringW 59554 10033c89 LoadStringW 59553->59554 59555 10033c9e 59553->59555 59554->59555 58080 1003fd08 58081 1003fd14 _memset __EH_prolog3 58080->58081 58082 1003fd21 VariantInit 58081->58082 58089 1003eff3 58082->58089 58085 1003fdbb VariantClear 58086 1003fdcc Mailbox 58085->58086 58087 1003fd64 SysStringLen 58088 1003fd60 __itow _memmove 58087->58088 58088->58085 58091 1003efff __EH_prolog3_GS 58089->58091 58090 1003f018 58092 1008be79 Mailbox 6 API calls 58090->58092 58091->58090 58093 10003e10 73 API calls 58091->58093 58094 1003f0c3 58092->58094 58095 1003f036 58093->58095 58094->58085 58094->58087 58094->58088 58096 1003f03e 58095->58096 58097 1003f05f 58095->58097 58107 10019415 70 API calls 58095->58107 58098 10001123 Mailbox 4 API calls 58096->58098 58100 10003e10 73 API calls 58097->58100 58098->58090 58101 1003f06e 58100->58101 58102 1000ea30 71 API calls 58101->58102 58103 1003f08b 58102->58103 58104 1000ea30 71 API calls 58103->58104 58105 1003f095 58104->58105 58106 10001123 Mailbox 4 API calls 58105->58106 58106->58096 58107->58097 59556 1001ac2d 59557 1001ac3c 59556->59557 59558 1001ac37 59556->59558 59560 1001a6b4 59557->59560 59564 1008be97 59560->59564 59562 1001a6c0 VariantClear 59563 1001a6da Mailbox 59562->59563 59563->59558 59564->59562 59565 1004dc69 59566 1004dc84 LangLoadString 59565->59566 59567 1004dc73 59565->59567 59566->59567 58108 1004ab94 58109 1004aba7 58108->58109 58110 1004aba2 58108->58110 58111 10064701 4 API calls 58109->58111 58111->58110 58112 100a181b 58127 100957f8 58112->58127 58116 100a1861 58124 100a1868 58116->58124 58136 10090f1b 80 API calls 2 library calls 58116->58136 58118 1008a483 ___wstrgtold12_l 6 API calls 58119 100a18bb 58118->58119 58120 100a187c __NMSG_WRITE 58121 1008c694 __NMSG_WRITE 68 API calls 58120->58121 58120->58124 58122 100a1899 58121->58122 58123 100a18bf 58122->58123 58122->58124 58137 10095b75 IsProcessorFeaturePresent 58123->58137 58124->58118 58143 10095810 GetLastError 58127->58143 58129 100957fe 58130 1009580b 58129->58130 58157 1009a87d 68 API calls 4 library calls 58129->58157 58132 100a280d 58130->58132 58133 100a2829 GetLocaleInfoEx 58132->58133 58134 100a282d __crtLCMapStringA_stat 58132->58134 58133->58116 58135 100a2832 GetLocaleInfoW 58134->58135 58135->58116 58136->58120 58138 10095b80 58137->58138 58180 100959e2 58138->58180 58142 10095b9b 58158 1009231d 58143->58158 58145 10095825 58146 10095873 SetLastError 58145->58146 58161 1009abb6 58145->58161 58146->58129 58150 1009584c 58151 1009586a 58150->58151 58152 10095852 58150->58152 58169 1008ffc6 68 API calls 2 library calls 58151->58169 58168 1009587f 68 API calls 4 library calls 58152->58168 58155 10095870 58155->58146 58156 1009585a GetCurrentThreadId 58156->58146 58157->58130 58159 10092330 58158->58159 58160 10092334 TlsGetValue 58158->58160 58159->58145 58160->58145 58164 1009abbd 58161->58164 58163 10095838 58163->58146 58167 1009233c TlsSetValue 58163->58167 58164->58163 58165 1009abdb Sleep 58164->58165 58170 100b07af 58164->58170 58166 1009abf2 58165->58166 58166->58163 58166->58164 58167->58150 58168->58156 58169->58155 58171 100b07ba 58170->58171 58175 100b07d5 58170->58175 58172 100b07c6 58171->58172 58171->58175 58178 100910bb 68 API calls __getptd_noexit 58172->58178 58173 100b07e5 RtlAllocateHeap 58173->58175 58176 100b07cb 58173->58176 58175->58173 58175->58176 58179 10094b2c RtlDecodePointer 58175->58179 58176->58164 58178->58176 58179->58175 58181 100959fc _memset __call_reportfault 58180->58181 58182 10095a1c IsDebuggerPresent 58181->58182 58188 10092707 SetUnhandledExceptionFilter UnhandledExceptionFilter 58182->58188 58184 1008a483 ___wstrgtold12_l 6 API calls 58185 10095b03 58184->58185 58187 100926f2 GetCurrentProcess TerminateProcess 58185->58187 58186 10095ae0 __call_reportfault 58186->58184 58187->58142 58188->58186 59569 1003e837 59572 1003e859 59569->59572 59593 1003e851 59569->59593 59570 1008a483 ___wstrgtold12_l 6 API calls 59571 1003e99d 59570->59571 59573 1003e934 59572->59573 59575 1003e896 59572->59575 59572->59593 59573->59593 59594 1003e0c6 59573->59594 59576 10003b8b 2 API calls 59575->59576 59575->59593 59577 1003e8c8 59576->59577 59579 1000ea8b 71 API calls 59577->59579 59578 1003e950 59582 10003e10 73 API calls 59578->59582 59578->59593 59580 1003e8e2 59579->59580 59581 10010a5a 3 API calls 59580->59581 59583 1003e8f1 SysFreeString 59581->59583 59584 1003e983 59582->59584 59587 1003e914 59583->59587 59588 1003e909 59583->59588 59632 100137ed 81 API calls 2 library calls 59584->59632 59589 1000ea8b 71 API calls 59587->59589 59631 100052dc 71 API calls 59588->59631 59591 1003e91e 59589->59591 59592 10004ec2 Mailbox 4 API calls 59591->59592 59592->59593 59593->59570 59598 1003e0d5 __EH_prolog3_GS 59594->59598 59595 1003e0ed 59596 1008be79 Mailbox 6 API calls 59595->59596 59597 1003e5b4 59596->59597 59597->59578 59598->59595 59599 1000395e 2 API calls 59598->59599 59600 1003e17e FindResourceW 59599->59600 59601 1003e1a2 59600->59601 59602 1003e1c5 59600->59602 59603 10010a5a 3 API calls 59601->59603 59604 10010a5a 3 API calls 59602->59604 59605 1003e1bd 59603->59605 59604->59605 59606 1000ea30 71 API calls 59605->59606 59607 1003e1f1 SysFreeString 59606->59607 59609 1003e213 59607->59609 59613 1003e221 59607->59613 59610 1000528d 71 API calls 59609->59610 59610->59613 59612 10001123 Mailbox 4 API calls 59612->59595 59614 1003e4df 59613->59614 59615 1003e31c 59613->59615 59619 1003e548 VariantClear 59613->59619 59616 1000ea30 71 API calls 59614->59616 59618 1000ea30 71 API calls 59615->59618 59617 1003e4b0 59616->59617 59620 1003e53b VariantClear 59617->59620 59622 1003e342 59618->59622 59619->59612 59620->59619 59621 1003e415 _memset 59623 1003e425 VariantInit 59621->59623 59622->59619 59622->59621 59625 1000395e 2 API calls 59622->59625 59624 1003e44b 59623->59624 59624->59617 59624->59620 59629 1000ea8b 71 API calls 59624->59629 59626 1003e3d2 59625->59626 59633 1001323e 281 API calls 59626->59633 59628 1003e40d 59630 10001123 Mailbox 4 API calls 59628->59630 59629->59617 59630->59621 59631->59587 59632->59593 59633->59628 58189 1001a354 58190 1001a360 __EH_prolog3_catch_GS 58189->58190 58191 10003be6 73 API calls 58190->58191 58192 1001a38e 58191->58192 58199 100154c3 58192->58199 58195 10004ec2 Mailbox 4 API calls 58196 1001a3a9 58195->58196 58197 1008be88 6 API calls 58196->58197 58198 1001a3d9 58197->58198 58200 10003aa0 Mailbox 73 API calls 58199->58200 58201 100154e9 58200->58201 58204 1005bb18 58201->58204 58205 1005bb27 __EH_prolog3_GS 58204->58205 58206 1005bb76 58205->58206 58261 100194f1 88 API calls 58205->58261 58207 10003aa0 Mailbox 73 API calls 58206->58207 58209 1005bb92 58207->58209 58250 1005d5d3 58209->58250 58210 1005bb3a 58210->58206 58212 1005bb3e 58210->58212 58214 10003aa0 Mailbox 73 API calls 58212->58214 58213 1005bb97 58215 1005bbb7 GetLastError 58213->58215 58217 1005bb62 58213->58217 58216 1005bb5d 58214->58216 58218 1005bbc8 58215->58218 58219 1005bceb 58215->58219 58262 1005bcfb 133 API calls 3 library calls 58216->58262 58225 10004ec2 Mailbox 4 API calls 58217->58225 58218->58219 58223 1005bc9f 58218->58223 58224 1005bbda 58218->58224 58221 10004ec2 Mailbox 4 API calls 58219->58221 58222 1005bb6f 58221->58222 58229 1008be79 Mailbox 6 API calls 58222->58229 58223->58217 58226 1005bca9 58223->58226 58263 1005869d GetLastError SetLastError 58224->58263 58225->58222 58230 10003aa0 Mailbox 73 API calls 58226->58230 58228 1005bbe5 58231 10003aa0 Mailbox 73 API calls 58228->58231 58232 100154ee 58229->58232 58233 1005bcc4 58230->58233 58234 1005bc13 58231->58234 58232->58195 58265 10011f2e 73 API calls 2 library calls 58233->58265 58264 1005d0d5 99 API calls 2 library calls 58234->58264 58237 1005bcda 58266 1008be0a RaiseException 58237->58266 58238 1005bc18 58240 1005bc76 GetLastError 58238->58240 58245 1005bc22 58238->58245 58241 1005bc89 58240->58241 58242 10004ec2 Mailbox 4 API calls 58241->58242 58243 1005bc94 58242->58243 58244 10004ec2 Mailbox 4 API calls 58243->58244 58244->58223 58246 10004ec2 Mailbox 4 API calls 58245->58246 58247 1005bc66 58246->58247 58248 10004ec2 Mailbox 4 API calls 58247->58248 58249 1005bc71 58248->58249 58249->58217 58267 1008be97 58250->58267 58252 1005d5df GetModuleHandleW GetProcAddress 58253 1005d611 GetModuleHandleW GetProcAddress 58252->58253 58254 1005d601 GetFileAttributesW 58252->58254 58255 1005d635 58253->58255 58256 1005d62a 58253->58256 58254->58255 58258 10004ec2 Mailbox 4 API calls 58255->58258 58268 100238f8 69 API calls 58256->58268 58260 1005d63f Mailbox 58258->58260 58259 1005d632 58259->58255 58260->58213 58261->58210 58262->58217 58263->58228 58264->58238 58265->58237 58266->58219 58267->58252 58268->58259 58269 1001b097 58270 1001b142 58269->58270 58271 1001b0a9 VariantInit 58269->58271 58273 1001b11d 58271->58273 58274 1001b0be 58271->58274 58272 1001b133 VariantClear 58272->58270 58273->58272 58274->58272 58274->58273 58278 1001a60f VariantInit VariantClear VariantChangeType __EH_prolog3 Mailbox 58274->58278 58276 1001b106 58276->58273 58277 1001b10c FindWindowW 58276->58277 58277->58273 58278->58276 58279 10044d93 58280 10044da2 58279->58280 58281 10044d9d 58279->58281 58285 100131b1 58280->58285 58286 10003e10 73 API calls 58285->58286 58287 100131d6 58286->58287 58375 10015534 58287->58375 58290 10001123 Mailbox 4 API calls 58291 100131ed 58290->58291 58292 1008a483 ___wstrgtold12_l 6 API calls 58291->58292 58293 10013206 58292->58293 58293->58281 58294 100442fd 58293->58294 58295 1004430c __EH_prolog3_GS 58294->58295 58296 10044321 58295->58296 58297 100444cf 58295->58297 58298 1000395e 2 API calls 58296->58298 58299 1004454e 58297->58299 58300 100444d8 58297->58300 58301 10044342 58298->58301 58303 10044564 GetPropW 58299->58303 58324 1004459e 58299->58324 58350 1004469b 58299->58350 58386 10041768 58300->58386 58305 1000395e 2 API calls 58301->58305 58307 1004457b 58303->58307 58303->58324 58304 100446d9 KiUserCallbackDispatcher 58344 100444c7 58304->58344 58304->58350 58308 10044365 58305->58308 58306 100444dd 58314 1000380e 73 API calls 58306->58314 58306->58344 58408 1001323e 281 API calls 58307->58408 58313 1000395e 2 API calls 58308->58313 58309 100445ae 58409 10043f31 158 API calls 3 library calls 58309->58409 58310 100445bb 58316 100445d3 58310->58316 58310->58350 58312 10044703 SetActiveWindow 58312->58350 58318 1004437f 58313->58318 58320 10044510 58314->58320 58410 100019d0 94 API calls 2 library calls 58316->58410 58317 10044587 RemovePropW 58317->58324 58401 10022a6a 71 API calls 58318->58401 58407 100137ed 81 API calls 2 library calls 58320->58407 58322 1008be79 Mailbox 6 API calls 58328 100448a5 58322->58328 58323 100446a3 ShowWindow 58323->58350 58324->58309 58324->58310 58327 100445e1 58332 1004462c 58327->58332 58333 100445ed GetDlgItem 58327->58333 58328->58281 58329 10044398 58335 1000ea30 71 API calls 58329->58335 58330 1004451b GetDlgItem 58336 1004452d GetWindowLongW 58330->58336 58330->58344 58331 10044763 GetFocus IsChild 58337 100447b2 IsDialogMessageW 58331->58337 58331->58350 58411 100019d0 94 API calls 2 library calls 58332->58411 58338 10044602 SendMessageW 58333->58338 58339 1004460c GetDlgItem 58333->58339 58343 100443a7 LangLoadString 58335->58343 58336->58344 58337->58350 58338->58339 58339->58332 58340 10044621 SendMessageW 58339->58340 58340->58332 58341 1004463a 58348 10044654 GetDlgItem 58341->58348 58412 100019d0 94 API calls 2 library calls 58341->58412 58342 100447d6 TranslateMessage DispatchMessageW 58342->58350 58402 1001cd08 96 API calls 2 library calls 58343->58402 58344->58322 58345 10044787 GetParent 58346 10044796 SendMessageW 58345->58346 58347 1004477e GetParent 58345->58347 58346->58337 58346->58350 58347->58345 58352 10044673 GetDlgItem 58348->58352 58353 10044669 SendMessageW 58348->58353 58350->58304 58350->58312 58350->58323 58350->58331 58350->58342 58350->58344 58350->58345 58413 10044e8f 70 API calls std::_Iterator_base12::_Adopt 58350->58413 58414 10043b10 117 API calls 2 library calls 58350->58414 58352->58344 58356 10044688 SendMessageW 58352->58356 58353->58352 58354 100443cf 58403 10022a6a 71 API calls 58354->58403 58355 1004464e 58355->58344 58355->58348 58356->58344 58358 100443e3 58360 1000ea30 71 API calls 58358->58360 58361 100443f2 LangLoadString 58360->58361 58404 1001cd08 96 API calls 2 library calls 58361->58404 58363 1004441b 58405 10022a6a 71 API calls 58363->58405 58365 1004442f 58366 1000ea30 71 API calls 58365->58366 58367 10044449 wsprintfW 58366->58367 58406 1001cd08 96 API calls 2 library calls 58367->58406 58369 10044469 GetHandle MessageBoxW 58370 10001123 Mailbox 4 API calls 58369->58370 58371 100444b4 58370->58371 58372 10001123 Mailbox 4 API calls 58371->58372 58373 100444bf 58372->58373 58374 10001123 Mailbox 4 API calls 58373->58374 58374->58344 58380 100142fb 58375->58380 58379 100131e5 58379->58290 58381 10014308 58380->58381 58382 1001432a 58381->58382 58385 10005c3d 69 API calls 58381->58385 58382->58379 58384 10005c3d 69 API calls 58382->58384 58384->58379 58385->58381 58387 10041774 __EH_prolog3 58386->58387 58388 100417bc 58387->58388 58389 10041799 58387->58389 58391 100417e7 58388->58391 58392 10041803 LoadLibraryExW 58388->58392 58395 100417b2 Mailbox 58388->58395 58427 10033ca3 FindResourceW FindResourceW 58389->58427 58393 1000ea30 71 API calls 58391->58393 58392->58395 58393->58395 58397 100418b1 Mailbox 58395->58397 58415 100452d3 58395->58415 58397->58306 58398 1004188b 58398->58397 58399 100418b5 IsIconic 58398->58399 58399->58397 58400 100418c5 ShowWindow 58399->58400 58400->58397 58401->58329 58402->58354 58403->58358 58404->58363 58405->58365 58406->58369 58407->58330 58408->58317 58409->58310 58410->58327 58411->58341 58412->58355 58413->58350 58414->58350 58428 1008be97 58415->58428 58417 100452df FindResourceW 58418 100452f5 LoadResource 58417->58418 58421 100452f1 Mailbox 58417->58421 58419 10045303 LockResource 58418->58419 58418->58421 58420 1004530e 58419->58420 58419->58421 58422 1004535e CreateDialogIndirectParamW 58420->58422 58423 10045318 58420->58423 58421->58398 58422->58421 58429 10016dad 88 API calls 5 library calls 58423->58429 58425 10045332 58425->58421 58426 10045337 CreateDialogIndirectParamW 58425->58426 58426->58421 58427->58395 58428->58417 58429->58425 58430 10081790 58452 10080840 90 API calls 2 library calls 58430->58452 58432 100817dd 58453 1008b5c4 80 API calls 2 library calls 58432->58453 58434 10081809 58435 10004ec2 Mailbox 4 API calls 58434->58435 58436 10081836 58435->58436 58437 1008183a 58436->58437 58438 1008188b 58436->58438 58461 10087c30 75 API calls 4 library calls 58437->58461 58454 10080840 90 API calls 2 library calls 58438->58454 58441 1008184d 58462 100882f0 58441->58462 58443 1008189d 58455 1008b5c4 80 API calls 2 library calls 58443->58455 58445 1008a483 ___wstrgtold12_l 6 API calls 58447 10081996 58445->58447 58446 100818ca 58448 10004ec2 Mailbox 4 API calls 58446->58448 58449 100818fa 58448->58449 58450 1008185d 58449->58450 58456 1008a0f0 58449->58456 58450->58445 58452->58432 58453->58434 58454->58443 58455->58446 58457 1008a11b 58456->58457 58458 1008a0fb 58456->58458 58457->58450 58458->58457 58459 100882f0 6 API calls 58458->58459 58460 1008a110 58459->58460 58460->58450 58461->58441 58463 1008831d 58462->58463 58464 100883fe 58462->58464 58463->58464 58465 1008836a GetDC 58463->58465 58464->58450 58466 100883bf 58465->58466 58467 10088387 58465->58467 58469 100883c5 CreateDIBitmap 58466->58469 58467->58466 58468 1008838e SelectPalette RealizePalette 58467->58468 58468->58469 58470 100883e9 ReleaseDC 58469->58470 58471 100883dd SelectPalette 58469->58471 58470->58450 58471->58470 58472 1000fa1b 58473 1000fa43 58472->58473 58481 1000fa3e 58472->58481 58474 10003e10 73 API calls 58473->58474 58475 1000fa52 58474->58475 58482 100057b6 58475->58482 58476 1008a483 ___wstrgtold12_l 6 API calls 58478 1000fa93 58476->58478 58479 1000fa61 58480 10001123 Mailbox 4 API calls 58479->58480 58480->58481 58481->58476 58483 100057c5 __EH_prolog3 58482->58483 58502 1000e6d6 58483->58502 58486 10005261 71 API calls 58487 100057de 58486->58487 58488 100039b9 73 API calls 58487->58488 58490 100057e5 Mailbox 58487->58490 58489 10005817 58488->58489 58491 100039b9 73 API calls 58489->58491 58490->58479 58492 10005832 58491->58492 58493 100039b9 73 API calls 58492->58493 58494 1000584e 58493->58494 58495 10005261 71 API calls 58494->58495 58496 10005860 58495->58496 58497 10001123 Mailbox 4 API calls 58496->58497 58498 10005872 58497->58498 58499 10001123 Mailbox 4 API calls 58498->58499 58500 1000587a 58499->58500 58501 10001123 Mailbox 4 API calls 58500->58501 58501->58490 58507 1000c54e 58502->58507 58506 100057d3 58506->58486 58508 1000c55b 58507->58508 58509 1000c57d 58508->58509 58512 10005c3d 69 API calls 58508->58512 58509->58506 58511 10005c3d 69 API calls 58509->58511 58511->58506 58512->58508 58513 10030158 58514 10030167 __EH_prolog3_GS 58513->58514 58515 1008abd5 _Allocate 69 API calls 58514->58515 58516 1003018b 58515->58516 58518 100301a1 58516->58518 58701 1002b74a 58516->58701 58519 10003b8b 2 API calls 58518->58519 58520 10030252 58519->58520 58521 10003b8b 2 API calls 58520->58521 58522 10030281 _memset 58521->58522 58523 100302b4 VariantInit 58522->58523 58524 10030466 58522->58524 58525 100302da 58523->58525 58528 100306e1 58524->58528 58558 100304fa 58524->58558 58729 10060d95 58524->58729 58526 1000d3a8 71 API calls 58525->58526 58529 100302fa 58526->58529 58527 10030753 58532 10010a5a 3 API calls 58527->58532 58535 1003078e 58527->58535 58528->58527 58530 10010a5a 3 API calls 58528->58530 58528->58535 58774 1000daac 92 API calls 2 library calls 58529->58774 58534 1003072b 58530->58534 58537 1003076a 58532->58537 58539 1000ea8b 71 API calls 58534->58539 58746 10010a5a 58535->58746 58536 10030306 58540 100052b0 71 API calls 58536->58540 58541 1000ea8b 71 API calls 58537->58541 58543 10030739 SysFreeString 58539->58543 58545 10030313 58540->58545 58548 10030778 SysFreeString 58541->58548 58542 10004ec2 Mailbox 4 API calls 58542->58558 58543->58527 58547 10004ec2 Mailbox 4 API calls 58545->58547 58546 100307c0 58550 100308b7 58546->58550 58552 10030814 58546->58552 58553 100307eb 58546->58553 58586 1003099b 58546->58586 58563 1003031f 58547->58563 58548->58535 58555 10030907 58550->58555 58556 100308cc 58550->58556 58550->58586 58557 10003be6 73 API calls 58552->58557 58554 10003aa0 Mailbox 73 API calls 58553->58554 58559 10030808 58554->58559 58562 10003be6 73 API calls 58555->58562 58560 10003aa0 Mailbox 73 API calls 58556->58560 58557->58559 58561 1000ea30 71 API calls 58558->58561 58567 1000ea8b 71 API calls 58559->58567 58565 100308f2 58560->58565 58566 1003058d 58561->58566 58562->58565 58564 100303a8 _memset 58563->58564 58572 1000d3a8 71 API calls 58563->58572 58574 100303d9 VariantInit 58564->58574 58569 1000ea8b 71 API calls 58565->58569 58570 100305b0 58566->58570 58573 1000528d 71 API calls 58566->58573 58568 10030862 58567->58568 58575 1003088f 58568->58575 58579 10004ec2 Mailbox 4 API calls 58568->58579 58571 10030952 58569->58571 58578 1000ea30 71 API calls 58570->58578 58576 10030976 58571->58576 58580 10004ec2 Mailbox 4 API calls 58571->58580 58572->58564 58573->58570 58577 10030401 _memset 58574->58577 58575->58550 58582 10004ec2 Mailbox 4 API calls 58575->58582 58584 10004ec2 Mailbox 4 API calls 58576->58584 58576->58586 58583 10030411 VariantInit VariantChangeType VariantClear VariantClear VariantClear 58577->58583 58581 100305d7 58578->58581 58579->58575 58580->58576 58587 100305f9 58581->58587 58588 1000528d 71 API calls 58581->58588 58582->58550 58583->58524 58584->58586 58585 10030b3b 58589 10003aa0 Mailbox 73 API calls 58585->58589 58586->58585 58593 1000ea8b 71 API calls 58586->58593 58590 10003d09 94 API calls 58587->58590 58588->58587 58591 10030b63 58589->58591 58592 1003060f 58590->58592 58594 1000395e 2 API calls 58591->58594 58775 1002ccd4 79 API calls 3 library calls 58592->58775 58596 10030ad0 58593->58596 58597 10030b8c 58594->58597 58602 10030af2 58596->58602 58779 100052dc 71 API calls 58596->58779 58599 1000395e 2 API calls 58597->58599 58598 1003062d 58600 10001123 Mailbox 4 API calls 58598->58600 58606 10030bb0 58599->58606 58601 10030639 58600->58601 58603 10003d09 94 API calls 58601->58603 58608 1000ea30 71 API calls 58602->58608 58604 1003064f 58603->58604 58776 1002cd6c 110 API calls 3 library calls 58604->58776 58609 10010a5a 3 API calls 58606->58609 58611 10030cad 58606->58611 58612 10030b19 58608->58612 58613 10030be9 58609->58613 58610 10030664 58614 10001123 Mailbox 4 API calls 58610->58614 58615 10030d0b LoadLibraryW 58611->58615 58616 10030cee 58611->58616 58631 10030cf9 58611->58631 58612->58585 58627 1000528d 71 API calls 58612->58627 58619 1000ea30 71 API calls 58613->58619 58625 10030670 58614->58625 58615->58631 58620 1000ea30 71 API calls 58616->58620 58617 10030d41 58621 1000ea30 71 API calls 58617->58621 58618 10030d5e LoadLibraryW 58632 10030d4c 58618->58632 58623 10030bfa SysFreeString 58619->58623 58620->58631 58621->58632 58622 10030e1a SysFreeString 58626 10030e35 58622->58626 58634 10030c22 58623->58634 58635 10030c30 58623->58635 58624 10030e57 58629 1008abd5 _Allocate 69 API calls 58624->58629 58625->58528 58636 1000ea8b 71 API calls 58625->58636 58626->58624 58780 100052dc 71 API calls 58626->58780 58627->58585 58637 10030e5e 58629->58637 58630 10010a5a 3 API calls 58638 10030dd2 58630->58638 58631->58617 58631->58618 58631->58632 58632->58630 58644 10030dfb 58632->58644 58639 1000528d 71 API calls 58634->58639 58645 10010a5a 3 API calls 58635->58645 58640 1003069a 58636->58640 58641 10003b8b 2 API calls 58637->58641 58642 1000ea8b 71 API calls 58638->58642 58639->58635 58648 100306bc 58640->58648 58777 100052dc 71 API calls 58640->58777 58643 10030e8d _memset 58641->58643 58642->58644 58646 10030f04 _memset 58643->58646 58654 10030ea7 VariantInit 58643->58654 58644->58622 58644->58626 58649 10030c66 58645->58649 58647 10030fbb 58646->58647 58658 10030f21 VariantInit 58646->58658 58752 100136f2 58647->58752 58778 1000daac 92 API calls 2 library calls 58648->58778 58653 1000ea30 71 API calls 58649->58653 58656 10030c77 SysFreeString 58653->58656 58660 10030ecd 58654->58660 58655 100306c8 58659 100052b0 71 API calls 58655->58659 58656->58611 58666 10030c9f 58656->58666 58664 10030f47 58658->58664 58661 100306d5 58659->58661 58663 1000d3a8 71 API calls 58660->58663 58665 10004ec2 Mailbox 4 API calls 58661->58665 58667 10030ef3 VariantClear 58663->58667 58669 10030f88 58664->58669 58781 1002c71f 76 API calls 2 library calls 58664->58781 58665->58528 58671 1000528d 71 API calls 58666->58671 58667->58646 58668 10003aa0 Mailbox 73 API calls 58672 10031001 58668->58672 58782 100132ea 506 API calls 4 library calls 58669->58782 58671->58611 58756 10016858 58672->58756 58673 10030faa VariantClear 58673->58647 58676 10030f69 58677 100052b0 71 API calls 58676->58677 58678 10030f7c 58677->58678 58679 10004ec2 Mailbox 4 API calls 58678->58679 58679->58669 58680 100310a3 58682 10004ec2 Mailbox 4 API calls 58680->58682 58681 10031010 _memset 58681->58680 58683 10031050 VariantInit 58681->58683 58684 100310bc 58682->58684 58686 10031079 VariantClear 58683->58686 58685 10001123 Mailbox 4 API calls 58684->58685 58687 100310db 58685->58687 58686->58680 58689 10001123 Mailbox 4 API calls 58687->58689 58690 100310e6 58689->58690 58691 10004ec2 Mailbox 4 API calls 58690->58691 58692 100310f1 SysFreeString 58691->58692 58694 1003112e 58692->58694 58695 10004ec2 Mailbox 4 API calls 58694->58695 58696 10031167 58695->58696 58697 10004ec2 Mailbox 4 API calls 58696->58697 58698 1003116f 58697->58698 58699 1008be79 Mailbox 6 API calls 58698->58699 58700 10031176 58699->58700 58702 1002b756 __EH_prolog3 58701->58702 58783 1002fdd1 58702->58783 58706 1002b7b9 58796 1002b445 58706->58796 58710 1002b7d3 58805 1002b6c0 58710->58805 58718 1002b80d 58719 10003b8b 2 API calls 58718->58719 58730 10060da1 __EH_prolog3_GS 58729->58730 58731 10060db4 58730->58731 58732 10060df0 58730->58732 59036 10060e10 58731->59036 59080 10093f99 131 API calls 11 library calls 58732->59080 58736 10060dfe 59081 10011c15 94 API calls 2 library calls 58736->59081 58739 10060dee 58741 1008be79 Mailbox 6 API calls 58739->58741 58740 10060ddc 58743 10003f0a 73 API calls 58740->58743 58742 100304ef 58741->58742 58742->58542 58744 10060de6 58743->58744 58745 10004ec2 Mailbox 4 API calls 58744->58745 58745->58739 58747 10010a70 SysAllocString 58746->58747 58748 10010a66 58746->58748 58747->58748 58749 10010a7f 58747->58749 58748->58546 59487 10006473 VariantClear RaiseException __CxxThrowException@8 58749->59487 58751 10010a89 58751->58546 58753 10013703 58752->58753 58754 100136fd 58752->58754 58753->58668 59488 10086db0 69 API calls _Allocate 58754->59488 58757 10016864 __EH_prolog3_GS 58756->58757 58758 10003be6 73 API calls 58757->58758 58759 1001689a 58758->58759 59489 10015f9c 58759->59489 58762 100052b0 71 API calls 58763 100168bb 58762->58763 58764 10004ec2 Mailbox 4 API calls 58763->58764 58765 100168c3 58764->58765 58766 10004ec2 Mailbox 4 API calls 58765->58766 58767 100168cf 58766->58767 59503 1006472e GetModuleHandleW GetProcAddress 58767->59503 58770 10004ec2 Mailbox 4 API calls 58771 100168f7 58770->58771 58772 1008be79 Mailbox 6 API calls 58771->58772 58773 1001690d 58772->58773 58773->58681 58774->58536 58775->58598 58776->58610 58777->58648 58778->58655 58779->58602 58780->58624 58781->58676 58782->58673 58784 1008abd5 _Allocate 69 API calls 58783->58784 58785 1002fddb 58784->58785 58786 1002b7a1 58785->58786 58856 10051dee 69 API calls 3 library calls 58785->58856 58789 1002fcfa 58786->58789 58788 1002fe04 58790 1008abd5 _Allocate 69 API calls 58789->58790 58793 1002fd01 std::exception::exception _Allocate 58790->58793 58791 1008be0a RaiseException __CxxThrowException@8 58791->58793 58793->58706 58793->58791 58794 1008abd5 _Allocate 69 API calls 58793->58794 58795 100671d1 58793->58795 58857 1008bc3c 68 API calls std::exception::_Copy_str 58793->58857 58794->58793 58795->58706 58858 1002fccf 58796->58858 58798 1002b454 58799 1002b65c 58798->58799 58800 1002b668 __EH_prolog3 58799->58800 58801 10003e10 73 API calls 58800->58801 58802 1002b67d 58801->58802 58866 1002fd25 58802->58866 58804 1002b698 Mailbox 58804->58710 58874 1002fd50 58805->58874 58807 1002b6d3 58808 1000395e 2 API calls 58807->58808 58809 1002b6f0 58808->58809 58810 10015e4c 58809->58810 58811 10003b8b 2 API calls 58810->58811 58812 10015e7a 58811->58812 58813 1002b24c 58812->58813 58814 1002b258 __EH_prolog3_GS 58813->58814 58882 1002fd7b 58814->58882 58816 1002b269 58889 1002b138 58816->58889 58819 1000395e 2 API calls 58820 1002b293 58819->58820 58821 1000395e 2 API calls 58820->58821 58822 1002b2a6 58821->58822 58823 1000395e 2 API calls 58822->58823 58824 1002b2b9 58823->58824 58825 1000395e 2 API calls 58824->58825 58826 1002b2cf 58825->58826 58827 1000395e 2 API calls 58826->58827 58828 1002b308 58827->58828 58829 10003b8b 2 API calls 58828->58829 58830 1002b32e 58829->58830 58831 10003be6 73 API calls 58830->58831 58832 1002b36c 58831->58832 58892 1005e075 58832->58892 58836 1002b397 Mailbox 58837 10004ec2 Mailbox 4 API calls 58836->58837 58838 1002b3ac 58837->58838 58839 10004ec2 Mailbox 4 API calls 58838->58839 58840 1002b3b8 58839->58840 58841 1002b3d8 58840->58841 58842 1002b3bc GetProcAddress 58840->58842 58844 10003be6 73 API calls 58841->58844 58842->58841 58843 1002b3cc 58842->58843 58843->58841 58845 1002b3f9 58844->58845 58846 1005e075 106 API calls 58845->58846 58847 1002b40a LoadLibraryW 58846->58847 58849 10004ec2 Mailbox 4 API calls 58847->58849 58850 1002b42b 58849->58850 58851 10004ec2 Mailbox 4 API calls 58850->58851 58852 1002b433 Mailbox 58851->58852 58853 1008be79 Mailbox 6 API calls 58852->58853 58854 1002b442 58853->58854 58855 1002b6f5 GetLastError SetLastError 58854->58855 58855->58718 58856->58788 58857->58793 58859 1008abd5 _Allocate 69 API calls 58858->58859 58862 1002fcd6 std::exception::exception _Allocate 58859->58862 58860 1008be0a RaiseException __CxxThrowException@8 58860->58862 58862->58798 58862->58860 58863 1008abd5 _Allocate 69 API calls 58862->58863 58864 100671d1 58862->58864 58865 1008bc3c 68 API calls std::exception::_Copy_str 58862->58865 58863->58862 58864->58798 58865->58862 58867 1008abd5 _Allocate 69 API calls 58866->58867 58870 1002fd2c std::exception::exception _Allocate 58867->58870 58868 1008be0a RaiseException __CxxThrowException@8 58868->58870 58870->58804 58870->58868 58871 1008abd5 _Allocate 69 API calls 58870->58871 58872 100671d1 58870->58872 58873 1008bc3c 68 API calls std::exception::_Copy_str 58870->58873 58871->58870 58872->58804 58873->58870 58875 1008abd5 _Allocate 69 API calls 58874->58875 58876 1002fd57 std::exception::exception _Allocate 58875->58876 58876->58807 58877 1008be0a RaiseException __CxxThrowException@8 58876->58877 58879 1008abd5 _Allocate 69 API calls 58876->58879 58880 100671d1 58876->58880 58881 1008bc3c 68 API calls std::exception::_Copy_str 58876->58881 58877->58876 58879->58876 58880->58807 58881->58876 58883 1008abd5 _Allocate 69 API calls 58882->58883 58886 1002fd82 std::exception::exception _Allocate 58883->58886 58884 1008be0a RaiseException __CxxThrowException@8 58884->58886 58886->58816 58886->58884 58887 1008abd5 _Allocate 69 API calls 58886->58887 58888 100671d1 58886->58888 58906 1008bc3c 68 API calls std::exception::_Copy_str 58886->58906 58887->58886 58888->58816 58907 1002fca1 58889->58907 58891 1002b150 58891->58819 58893 1005e081 __EH_prolog3_GS 58892->58893 58916 10040d44 58893->58916 58898 10003aa0 Mailbox 73 API calls 58899 1005e0c1 58898->58899 58900 10004ec2 Mailbox 4 API calls 58899->58900 58901 1005e0c9 58900->58901 58902 10004ec2 Mailbox 4 API calls 58901->58902 58903 1005e0d1 58902->58903 58904 1008be79 Mailbox 6 API calls 58903->58904 58905 1002b37d LoadLibraryW 58904->58905 58905->58836 58906->58886 58908 1008abd5 _Allocate 69 API calls 58907->58908 58910 1002fcab 58908->58910 58909 1002fcb0 58909->58891 58910->58909 58915 10051dee 69 API calls 3 library calls 58910->58915 58912 1002fcc4 58913 1002fdd1 69 API calls 58912->58913 58914 1002fcce 58913->58914 58914->58891 58915->58912 58917 10040d50 __EH_prolog3_GS 58916->58917 58918 10003b8b 2 API calls 58917->58918 58919 10040d76 58918->58919 58969 100155a3 58919->58969 58922 10040d91 58924 1000ea8b 71 API calls 58922->58924 58923 10040dfc 58925 10040e02 58923->58925 58926 10040e6f 58923->58926 58927 10040da0 GetWindowsDirectoryW 58924->58927 58929 1000ea8b 71 API calls 58925->58929 58928 1000ea8b 71 API calls 58926->58928 58981 100126fa 96 API calls 2 library calls 58927->58981 58931 10040e7e GetSystemDirectoryW 58928->58931 58932 10040e11 GetWindowsDirectoryW 58929->58932 58990 100126fa 96 API calls 2 library calls 58931->58990 58984 100126fa 96 API calls 2 library calls 58932->58984 58934 10040dbb 58937 10040dd5 58934->58937 58941 10040e6d 58934->58941 58982 100123ab 70 API calls 3 library calls 58934->58982 58936 10040e2c 58936->58934 58938 10040e30 58936->58938 58940 10003be6 73 API calls 58937->58940 58943 10003be6 73 API calls 58938->58943 58945 10040df6 58940->58945 58972 10012c5b 58941->58972 58943->58945 58944 10040dc7 58983 1008be0a RaiseException 58944->58983 58985 1003bfb6 58945->58985 58948 10003aa0 Mailbox 73 API calls 58950 10040ec5 58948->58950 58952 10004ec2 Mailbox 4 API calls 58950->58952 58954 10040ecd 58952->58954 58953 10004ec2 Mailbox 4 API calls 58953->58941 58955 1008be79 Mailbox 6 API calls 58954->58955 58956 10040ed4 58955->58956 58957 100568fc 58956->58957 58958 10056908 __EH_prolog3_GS 58957->58958 58959 10003aa0 Mailbox 73 API calls 58958->58959 58960 1005692f 58959->58960 59024 1002c7d1 58960->59024 58963 10003aa0 Mailbox 73 API calls 58964 1005694f 58963->58964 58965 10004ec2 Mailbox 4 API calls 58964->58965 58966 10056957 58965->58966 58967 1008be79 Mailbox 6 API calls 58966->58967 58968 1005695e 58967->58968 58968->58898 58991 10011dbf 58969->58991 58973 10012c66 58972->58973 58974 10012c87 58973->58974 58975 10012c6e 58973->58975 58976 10012ca1 58974->58976 58997 1000d131 71 API calls Mailbox 58974->58997 58996 10014855 71 API calls __NMSG_WRITE 58975->58996 58998 10014855 71 API calls __NMSG_WRITE 58976->58998 58979 10012c85 58979->58948 58981->58934 58982->58944 58983->58937 58984->58936 58986 10003aa0 Mailbox 73 API calls 58985->58986 58987 1003bfdb 58986->58987 58999 10016a4d 58987->58999 58990->58934 58992 10011de4 58991->58992 58993 10011dda 58991->58993 58992->58922 58992->58923 58995 10015ac2 71 API calls 58993->58995 58995->58992 58996->58979 58997->58976 58998->58979 59000 10016a59 __EH_prolog3_GS 58999->59000 59002 10016a6c 59000->59002 59005 10016a75 59000->59005 59006 10016a77 59000->59006 59001 10004ec2 Mailbox 4 API calls 59003 10016abc 59001->59003 59004 100052b0 71 API calls 59002->59004 59007 1008be79 Mailbox 6 API calls 59003->59007 59004->59005 59005->59001 59009 10016ac4 59006->59009 59010 10016a98 59006->59010 59008 10016ac1 59007->59008 59008->58953 59011 10016aa9 59009->59011 59012 10016ac8 59009->59012 59010->59011 59020 1000d131 71 API calls Mailbox 59010->59020 59021 10012c02 71 API calls 59011->59021 59022 1000f814 73 API calls 59012->59022 59016 10016ad8 59023 10012c02 71 API calls 59016->59023 59018 10016ae4 59019 10004ec2 Mailbox 4 API calls 59018->59019 59019->59005 59020->59011 59021->59005 59022->59016 59023->59018 59025 1002c7dd 59024->59025 59026 1002c7e5 59025->59026 59030 1002c808 59025->59030 59033 10031655 71 API calls 59026->59033 59028 1002c82d 59035 1003162d 71 API calls 59028->59035 59029 1002c806 59029->58963 59030->59028 59034 1000d131 71 API calls Mailbox 59030->59034 59033->59029 59034->59028 59035->59029 59037 10060e37 59036->59037 59038 1006110f 59036->59038 59037->59038 59040 10060e3e 59037->59040 59082 1005e1ff 111 API calls 2 library calls 59038->59082 59043 10003f0a 73 API calls 59040->59043 59041 1006111a 59042 10060dbe 59041->59042 59044 10093639 59042->59044 59043->59042 59045 10093645 __lseeki64 59044->59045 59046 10093650 59045->59046 59047 10093667 59045->59047 59133 100910bb 68 API calls __getptd_noexit 59046->59133 59049 100957f8 _rand 68 API calls 59047->59049 59051 1009366c 59049->59051 59050 10093655 59134 10095b4a 9 API calls __filbuf 59050->59134 59083 10094de4 59051->59083 59054 10093676 59055 1009abb6 __calloc_crt 68 API calls 59054->59055 59056 10093689 59055->59056 59057 10093660 __wsetlocale __lseeki64 59056->59057 59098 1009205a 59056->59098 59057->58740 59059 1009369f 59105 10093000 59059->59105 59066 10093789 59139 10094d49 8 API calls 59066->59139 59067 100936d7 _wcscmp 59070 1009205a __lock 68 API calls 59067->59070 59069 1009378f 59140 10094bef 68 API calls 4 library calls 59069->59140 59072 10093701 59070->59072 59135 10094e60 76 API calls 3 library calls 59072->59135 59074 10093713 59136 10094d49 8 API calls 59074->59136 59076 10093719 59077 10093738 59076->59077 59137 10094e60 76 API calls 3 library calls 59076->59137 59138 1009377e RtlLeaveCriticalSection _doexit 59077->59138 59080->58736 59081->58739 59082->59041 59084 10094df0 __lseeki64 59083->59084 59085 100957f8 _rand 68 API calls 59084->59085 59086 10094df5 59085->59086 59087 10094e24 59086->59087 59089 10094e08 59086->59089 59088 1009205a __lock 68 API calls 59087->59088 59090 10094e2b 59088->59090 59091 100957f8 _rand 68 API calls 59089->59091 59142 10094e60 76 API calls 3 library calls 59090->59142 59092 10094e0d 59091->59092 59097 10094e1b __lseeki64 59092->59097 59141 1009a87d 68 API calls 4 library calls 59092->59141 59094 10094e3f 59143 10094e57 RtlLeaveCriticalSection _doexit 59094->59143 59097->59054 59099 1009206b 59098->59099 59100 1009207e RtlEnterCriticalSection 59098->59100 59144 10092102 68 API calls 9 library calls 59099->59144 59100->59059 59102 10092071 59102->59100 59145 1009a87d 68 API calls 4 library calls 59102->59145 59104 1009207d 59104->59100 59106 1009300b 59105->59106 59108 10093027 59105->59108 59106->59108 59146 10094b5f 8 API calls 59106->59146 59109 1009376f 59108->59109 59147 100921de RtlLeaveCriticalSection 59109->59147 59111 100936bb 59112 1009392a 59111->59112 59113 10093953 59112->59113 59117 10093972 59112->59117 59125 1009395f 59113->59125 59260 10093bb1 120 API calls 11 library calls 59113->59260 59116 10093af6 59148 1009308c 59116->59148 59117->59116 59124 10093ae2 59117->59124 59127 100939ae _wcscspn _TestDefaultCountry _wcspbrk __NMSG_WRITE 59117->59127 59119 1008a483 ___wstrgtold12_l 6 API calls 59120 100936c7 59119->59120 59120->59066 59120->59067 59121 10093b12 _wcscmp 59121->59124 59121->59125 59262 10093bb1 120 API calls 11 library calls 59121->59262 59123 1008c694 __NMSG_WRITE 68 API calls 59123->59127 59124->59125 59210 100937b6 59124->59210 59125->59119 59126 10093ba4 59129 10095b75 __invoke_watson 8 API calls 59126->59129 59127->59123 59127->59124 59127->59125 59127->59126 59128 10093b9f 59127->59128 59261 10093bb1 120 API calls 11 library calls 59127->59261 59263 1009085a 6 API calls ___report_securityfailure 59128->59263 59132 10093bb0 59129->59132 59133->59050 59134->59057 59135->59074 59136->59076 59137->59077 59138->59057 59139->59069 59140->59057 59141->59097 59142->59094 59143->59092 59144->59102 59145->59104 59146->59108 59147->59111 59149 100957f8 _rand 68 API calls 59148->59149 59150 100930bf 59149->59150 59151 1008c694 __NMSG_WRITE 68 API calls 59150->59151 59161 100930ef 59150->59161 59152 10093117 59151->59152 59154 10093231 59152->59154 59157 1009312e 59152->59157 59168 10093157 _wcscmp __NMSG_WRITE 59152->59168 59153 1008a483 ___wstrgtold12_l 6 API calls 59155 100930fe 59153->59155 59156 10095b75 __invoke_watson 8 API calls 59154->59156 59155->59121 59163 10093380 __lseeki64 59156->59163 59368 10092783 68 API calls __filbuf 59157->59368 59159 10093142 59159->59154 59159->59161 59161->59153 59162 100931b9 59165 10093236 59162->59165 59169 100931d9 59162->59169 59170 100931d2 59162->59170 59164 1009341c __lseeki64 59163->59164 59166 1009205a __lock 68 API calls 59163->59166 59164->59121 59370 100a289c IsValidLocale __crtLCMapStringA_stat 59165->59370 59171 1009339f 59166->59171 59167 100932fa _memmove 59167->59154 59371 10092783 68 API calls __filbuf 59167->59371 59168->59167 59264 10092e7c 59168->59264 59320 100a1a52 59169->59320 59280 100a22ba 59170->59280 59175 100933c8 59171->59175 59176 100933aa InterlockedDecrement 59171->59176 59373 10093426 RtlLeaveCriticalSection _doexit 59175->59373 59176->59175 59180 100933b7 59176->59180 59178 100931d7 59178->59165 59183 100931e5 59178->59183 59179 10093242 59185 100a280d _TestDefaultCountry 2 API calls 59179->59185 59186 10093344 __NMSG_WRITE 59179->59186 59180->59175 59372 1008ffc6 68 API calls 2 library calls 59180->59372 59182 100933d5 59184 10093416 59182->59184 59189 1009205a __lock 68 API calls 59182->59189 59369 10092e0e 120 API calls 3 library calls 59183->59369 59377 1008ffc6 68 API calls 2 library calls 59184->59377 59190 1009325f 59185->59190 59186->59154 59194 1008c694 __NMSG_WRITE 68 API calls 59186->59194 59192 100933e1 59189->59192 59193 10093270 GetACP 59190->59193 59197 1009327c 59190->59197 59374 10094d49 8 API calls 59192->59374 59193->59197 59194->59154 59196 10093226 59196->59154 59196->59167 59203 1008c694 __NMSG_WRITE 68 API calls 59196->59203 59199 1008c694 __NMSG_WRITE 68 API calls 59197->59199 59198 100931fd __NMSG_WRITE 59198->59196 59201 1008c694 __NMSG_WRITE 68 API calls 59198->59201 59200 1009329a 59199->59200 59200->59154 59205 1008c694 __NMSG_WRITE 68 API calls 59200->59205 59201->59196 59202 10093409 59376 10093432 RtlLeaveCriticalSection _doexit 59202->59376 59203->59167 59207 100932b0 59205->59207 59206 100933f0 59206->59202 59375 10094bef 68 API calls 4 library calls 59206->59375 59207->59154 59209 1008c694 __NMSG_WRITE 68 API calls 59207->59209 59209->59196 59411 1009ac00 59210->59411 59215 1009391d 59216 10095b75 __invoke_watson 8 API calls 59215->59216 59217 10093929 59216->59217 59220 10093953 59217->59220 59229 10093972 59217->59229 59218 10093802 _wcscmp 59218->59215 59219 100935fa __wsetlocale_get_all 116 API calls 59218->59219 59222 1009387a 59218->59222 59458 100a1367 59218->59458 59219->59218 59221 1009395f 59220->59221 59472 10093bb1 120 API calls 11 library calls 59220->59472 59233 1008a483 ___wstrgtold12_l 6 API calls 59221->59233 59225 100938cd 59222->59225 59226 10093880 59222->59226 59223 10093ae2 59223->59221 59227 100937b6 __wsetlocale_get_all 116 API calls 59223->59227 59469 1008ffc6 68 API calls 2 library calls 59225->59469 59231 1009389b 59226->59231 59232 10093886 InterlockedDecrement 59226->59232 59227->59221 59228 10093af6 59230 1009308c __wsetlocale_nolock 116 API calls 59228->59230 59229->59223 59229->59228 59252 100939ae _wcscspn _TestDefaultCountry _wcspbrk __NMSG_WRITE 59229->59252 59249 10093b12 _wcscmp 59230->59249 59238 100938a2 InterlockedDecrement 59231->59238 59248 100938b7 59231->59248 59232->59231 59236 10093893 59232->59236 59237 10093b9d 59233->59237 59235 100938d3 59239 100938e0 InterlockedDecrement 59235->59239 59240 100938f1 59235->59240 59467 1008ffc6 68 API calls 2 library calls 59236->59467 59237->59125 59242 100938af 59238->59242 59238->59248 59239->59240 59243 100938e9 59239->59243 59244 100938f8 InterlockedDecrement 59240->59244 59240->59248 59468 1008ffc6 68 API calls 2 library calls 59242->59468 59470 1008ffc6 68 API calls 2 library calls 59243->59470 59247 10093901 59244->59247 59244->59248 59471 1008ffc6 68 API calls 2 library calls 59247->59471 59248->59125 59249->59221 59249->59223 59474 10093bb1 120 API calls 11 library calls 59249->59474 59252->59221 59252->59223 59253 1008c694 __NMSG_WRITE 68 API calls 59252->59253 59254 10093ba4 59252->59254 59255 10093b9f 59252->59255 59473 10093bb1 120 API calls 11 library calls 59252->59473 59253->59252 59256 10095b75 __invoke_watson 8 API calls 59254->59256 59475 1009085a 6 API calls ___report_securityfailure 59255->59475 59259 10093bb0 59256->59259 59260->59125 59261->59127 59262->59121 59263->59126 59266 10092e94 _memset 59264->59266 59265 10092ea2 59265->59162 59266->59265 59267 10092eb9 59266->59267 59270 10092ede _wcscspn 59266->59270 59268 1008c694 __NMSG_WRITE 68 API calls 59267->59268 59274 10092eca 59268->59274 59269 10095b75 __invoke_watson 8 API calls 59271 10092fa5 59269->59271 59270->59265 59273 1008c694 __NMSG_WRITE 68 API calls 59270->59273 59270->59274 59272 100957f8 _rand 68 API calls 59271->59272 59275 10092faf 59272->59275 59273->59270 59274->59265 59274->59269 59276 10092fe4 59275->59276 59378 100910bb 68 API calls __getptd_noexit 59275->59378 59276->59162 59278 10092fd9 59379 10095b4a 9 API calls __filbuf 59278->59379 59281 100957f8 _rand 68 API calls 59280->59281 59282 100a22e1 _memset 59281->59282 59283 100957f8 _rand 68 API calls 59282->59283 59288 100a22fd 59283->59288 59284 100a230a GetUserDefaultLCID 59290 100a23a8 59284->59290 59286 100a2340 59287 100a23b5 59286->59287 59289 100a2353 59286->59289 59287->59284 59293 100a23c0 59287->59293 59288->59284 59288->59286 59380 100a224e 80 API calls _LanguageEnumProcEx@12 59288->59380 59292 100a2369 59289->59292 59296 100a235e 59289->59296 59314 100a24bb 59290->59314 59387 100a2139 72 API calls 2 library calls 59290->59387 59382 100a1d9b 69 API calls 3 library calls 59292->59382 59386 100a1cc2 69 API calls 2 library calls 59293->59386 59295 1008a483 ___wstrgtold12_l 6 API calls 59300 100a24d2 59295->59300 59381 100a1d1e 69 API calls 3 library calls 59296->59381 59299 100a23ff 59303 100a2423 IsValidCodePage 59299->59303 59299->59314 59300->59178 59302 100a2367 59302->59290 59383 100a224e 80 API calls _LanguageEnumProcEx@12 59302->59383 59305 100a2435 IsValidLocale 59303->59305 59303->59314 59306 100a2444 59305->59306 59305->59314 59388 100a26cd 68 API calls 4 library calls 59306->59388 59307 100a23aa 59385 100a1d9b 69 API calls 3 library calls 59307->59385 59308 100a238b 59308->59290 59308->59307 59311 100a239f 59308->59311 59384 100a1d1e 69 API calls 3 library calls 59311->59384 59312 100a245e 59312->59314 59389 100a26cd 68 API calls 4 library calls 59312->59389 59314->59295 59316 100a2479 GetLocaleInfoW 59316->59314 59317 100a2493 GetLocaleInfoW 59316->59317 59317->59314 59318 100a24aa 59317->59318 59390 1008c89d 68 API calls _xtow_s@20 59318->59390 59321 100957f8 _rand 68 API calls 59320->59321 59322 100a1a5e 59321->59322 59323 100a1a97 59322->59323 59324 100a19e6 _TranslateName 80 API calls 59322->59324 59325 100a1aea 59323->59325 59326 100a1aa4 59323->59326 59324->59323 59403 100a1496 69 API calls 4 library calls 59325->59403 59327 100a1aab 59326->59327 59328 100a1ab2 59326->59328 59391 100a150d 59327->59391 59395 100a1581 59328->59395 59332 100a1ae1 59367 100a1bf8 59332->59367 59404 100a18cc 72 API calls 3 library calls 59332->59404 59333 100a1ab0 59333->59332 59399 100a19e6 59333->59399 59336 100a1b08 59340 100a1b2c IsValidCodePage 59336->59340 59336->59367 59338 100a1adc 59341 100a150d _GetLocaleNameFromLangCountry 2 API calls 59338->59341 59339 100a1ae3 59342 100a1581 _GetLocaleNameFromLanguage 2 API calls 59339->59342 59343 100a1b3e __NMSG_WRITE 59340->59343 59340->59367 59341->59332 59342->59332 59344 1008c694 __NMSG_WRITE 68 API calls 59343->59344 59343->59367 59345 100a1b72 59344->59345 59346 100a1b7d 59345->59346 59347 100a1c07 59345->59347 59348 100a280d _TestDefaultCountry 2 API calls 59346->59348 59349 10095b75 __invoke_watson 8 API calls 59347->59349 59350 100a1b8b 59348->59350 59351 100a1c13 59349->59351 59352 100a280d _TestDefaultCountry 2 API calls 59350->59352 59350->59367 59353 100957f8 _rand 68 API calls 59351->59353 59357 100a1bac _wcschr 59352->59357 59354 100a1c32 59353->59354 59355 100957f8 _rand 68 API calls 59354->59355 59356 100a1c39 ___get_qualified_locale 59355->59356 59358 100a1c45 GetLocaleInfoW 59356->59358 59359 100a280d _TestDefaultCountry 2 API calls 59357->59359 59362 100a1be0 59357->59362 59357->59367 59360 100a1c7b 59358->59360 59363 100a1c76 ___get_qualified_locale 59358->59363 59359->59362 59406 10090f1b 80 API calls 2 library calls 59360->59406 59362->59367 59405 1008c89d 68 API calls _xtow_s@20 59362->59405 59364 1008a483 ___wstrgtold12_l 6 API calls 59363->59364 59365 100a1cbe 59364->59365 59365->59178 59367->59178 59368->59159 59369->59198 59370->59179 59371->59186 59372->59175 59373->59182 59374->59206 59375->59202 59376->59184 59377->59164 59378->59278 59379->59276 59380->59286 59381->59302 59382->59302 59383->59308 59384->59290 59385->59290 59386->59290 59387->59299 59388->59312 59389->59316 59390->59314 59392 100a151b _GetLocaleNameFromLangCountry __NMSG_WRITE 59391->59392 59407 100a2787 59392->59407 59394 100a155f 59394->59333 59396 100a158f _GetLocaleNameFromLangCountry __NMSG_WRITE 59395->59396 59397 100a2787 _GetLocaleNameFromLangCountry 2 API calls 59396->59397 59398 100a15bb 59397->59398 59398->59333 59400 100a1a46 59399->59400 59402 100a19f7 59399->59402 59400->59332 59400->59338 59400->59339 59402->59400 59410 10090f1b 80 API calls 2 library calls 59402->59410 59403->59332 59404->59336 59405->59367 59406->59363 59408 100a27a6 EnumSystemLocalesW 59407->59408 59409 100a2797 EnumSystemLocalesEx 59407->59409 59408->59394 59409->59394 59410->59402 59412 1009ac0e 59411->59412 59413 1009003b _malloc 67 API calls 59412->59413 59414 100937ce 59412->59414 59415 1009ac21 Sleep 59412->59415 59413->59412 59414->59248 59417 100935fa 59414->59417 59416 1009ac3a 59415->59416 59416->59412 59416->59414 59418 10093629 59417->59418 59420 10093608 59417->59420 59418->59218 59419 100a1367 __NMSG_WRITE 68 API calls 59419->59420 59420->59418 59420->59419 59421 1009362e 59420->59421 59422 10095b75 __invoke_watson 8 API calls 59421->59422 59423 10093638 __lseeki64 59422->59423 59424 10093650 59423->59424 59425 10093667 59423->59425 59476 100910bb 68 API calls __getptd_noexit 59424->59476 59427 100957f8 _rand 68 API calls 59425->59427 59429 1009366c 59427->59429 59428 10093655 59477 10095b4a 9 API calls __filbuf 59428->59477 59431 10094de4 _localeconv 76 API calls 59429->59431 59432 10093676 59431->59432 59433 1009abb6 __calloc_crt 68 API calls 59432->59433 59434 10093689 59433->59434 59435 10093660 __wsetlocale __lseeki64 59434->59435 59436 1009205a __lock 68 API calls 59434->59436 59435->59218 59437 1009369f 59436->59437 59438 10093000 __copytlocinfo_nolock 8 API calls 59437->59438 59439 100936b0 59438->59439 59440 1009376f __wsetlocale RtlLeaveCriticalSection 59439->59440 59441 100936bb 59440->59441 59442 1009392a __wsetlocale_nolock 120 API calls 59441->59442 59443 100936c7 59442->59443 59444 10093789 59443->59444 59445 100936d7 _wcscmp 59443->59445 59482 10094d49 8 API calls 59444->59482 59448 1009205a __lock 68 API calls 59445->59448 59447 1009378f 59483 10094bef 68 API calls 4 library calls 59447->59483 59450 10093701 59448->59450 59478 10094e60 76 API calls 3 library calls 59450->59478 59452 10093713 59479 10094d49 8 API calls 59452->59479 59454 10093719 59455 10093738 59454->59455 59480 10094e60 76 API calls 3 library calls 59454->59480 59481 1009377e RtlLeaveCriticalSection _doexit 59455->59481 59459 100a1381 59458->59459 59461 100a1373 59458->59461 59484 100910bb 68 API calls __getptd_noexit 59459->59484 59461->59459 59464 100a13ad 59461->59464 59463 100a1395 59463->59218 59464->59463 59486 100910bb 68 API calls __getptd_noexit 59464->59486 59466 100a138b 59485 10095b4a 9 API calls __filbuf 59466->59485 59467->59231 59468->59248 59469->59235 59470->59240 59471->59248 59472->59221 59473->59252 59474->59249 59475->59254 59476->59428 59477->59435 59478->59452 59479->59454 59480->59455 59481->59435 59482->59447 59483->59435 59484->59466 59485->59463 59486->59466 59487->58751 59488->58753 59490 10015fa8 __EH_prolog3_GS 59489->59490 59491 10003aa0 Mailbox 73 API calls 59490->59491 59492 10015fcc 59491->59492 59493 10003aa0 Mailbox 73 API calls 59492->59493 59494 10015fe8 59493->59494 59495 10016a4d 76 API calls 59494->59495 59496 10015ff0 59495->59496 59497 10003aa0 Mailbox 73 API calls 59496->59497 59498 10016006 59497->59498 59499 10004ec2 Mailbox 4 API calls 59498->59499 59500 1001600e 59499->59500 59501 1008be79 Mailbox 6 API calls 59500->59501 59502 10016015 59501->59502 59502->58762 59504 10064754 GetCurrentProcess 59503->59504 59505 100168d4 59503->59505 59504->59505 59505->58770 59634 10044aff 59635 10044b0b __EH_prolog3_GS 59634->59635 59636 10044b15 59635->59636 59637 10003e10 73 API calls 59635->59637 59638 1008be79 Mailbox 6 API calls 59636->59638 59639 10044b32 59637->59639 59640 10044b82 59638->59640 59641 10044b55 59639->59641 59642 10044b47 59639->59642 59644 100131b1 76 API calls 59641->59644 59655 1003e041 83 API calls 59642->59655 59645 10044b61 59644->59645 59646 10044b53 59645->59646 59649 10042d41 59645->59649 59648 10001123 Mailbox 4 API calls 59646->59648 59648->59636 59650 10042d58 59649->59650 59656 100130e1 IsWindow 59650->59656 59654 10042d76 Mailbox 59654->59646 59655->59646 59657 10013100 59656->59657 59658 100130f4 DestroyWindow 59656->59658 59659 1001370e 83 API calls 2 library calls 59657->59659 59658->59657 59659->59654

                    Executed Functions

                    Function 100452D3 Relevance: 9.1, APIs: 6, Instructions: 56COMMON
                    Download Yara Rule

                    Control-flow Graph

                    APIs
                    • __EH_prolog3.LIBCMT ref: 100452DA
                    • FindResourceW.KERNEL32(?,?,00000005,0000000C,1004188B,?,?,?,?,?,1004204E), ref: 100452E7
                    • LoadResource.KERNEL32(?,00000000), ref: 100452F9
                    • LockResource.KERNEL32(00000000), ref: 10045304
                    • CreateDialogIndirectParamW.USER32(?,?,?,?,?), ref: 10045346
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Resource$CreateDialogFindH_prolog3IndirectLoadLockParam
                    • String ID:
                    • API String ID: 2653467461-0
                    • Opcode ID: b87a5b93f31ae12c15638518dbb06ada1560ac2928628654a4dcab2aae1c2ec7
                    • Instruction ID: 34d66d42744ed7e88efa758ddea03e21703cc8b36f7a8af1a12a486432c8c2a2
                    • Opcode Fuzzy Hash: b87a5b93f31ae12c15638518dbb06ada1560ac2928628654a4dcab2aae1c2ec7
                    • Instruction Fuzzy Hash: 0111193250011AEBDF119FA1CD859EF7F75FF08791F504064FA05A5061E7728A52EB94
                    Function 1004A51B Relevance: 7.6, APIs: 5, Instructions: 92stringCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 1207 1004a51b-1004a57b call 1008a4a0 1210 1004a5a5-1004a5c0 1207->1210 1211 1004a57d-1004a581 1207->1211 1213 1004a5c7-1004a633 GetDiskFreeSpaceExW GetDiskFreeSpaceW 1210->1213 1211->1210 1212 1004a583-1004a5a3 lstrcpyW lstrcatW 1211->1212 1212->1213 1214 1004a644-1004a646 1213->1214 1215 1004a635-1004a642 1213->1215 1216 1004a64f-1004a65f call 1008a483 1214->1216 1217 1004a648-1004a64a 1214->1217 1215->1214 1217->1216 1218 1004a64c-1004a64e 1217->1218 1218->1216
                    APIs
                    • _memset.LIBCMT ref: 1004A56A
                    • lstrcpyW.KERNEL32(?,?,?,00000000,?), ref: 1004A58B
                    • lstrcatW.KERNEL32(?,100C90D0), ref: 1004A59D
                    • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,?,00000000,?), ref: 1004A5F0
                    • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?), ref: 1004A62B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: DiskFreeSpace$_memsetlstrcatlstrcpy
                    • String ID:
                    • API String ID: 261897053-0
                    • Opcode ID: a2187abcc521b5dfc0ce31216f0754949fd07fd128c67067047efe99ae9c0e77
                    • Instruction ID: dfd75fc27fbfeaa088427759186996335576352d89a9b85f67762d09dbca7fa6
                    • Opcode Fuzzy Hash: a2187abcc521b5dfc0ce31216f0754949fd07fd128c67067047efe99ae9c0e77
                    • Instruction Fuzzy Hash: 09312CB5A0022D9BDB20DF65CD85ADAB7B8EF48210F5081EAE609E3141E6309FC5CF58
                    Function 10041768 Relevance: 6.1, APIs: 4, Instructions: 125librarywindowCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 1364 10041768-1004178f call 1008be97 1367 100417c0-100417e5 1364->1367 1368 10041791-10041797 1364->1368 1377 100417e7-10041801 call 1000ea30 1367->1377 1378 10041803-1004180d 1367->1378 1369 100417bc-100417be 1368->1369 1370 10041799-100417b7 call 10033ca3 1368->1370 1369->1367 1372 10041830-10041835 1369->1372 1379 1004183d-10041842 1370->1379 1375 10041844-1004184b 1372->1375 1376 10041837 1372->1376 1380 1004185d 1375->1380 1381 1004184d-10041857 1375->1381 1376->1379 1377->1372 1383 10041811-10041823 LoadLibraryExW 1378->1383 1384 1004180f 1378->1384 1379->1375 1386 100418b1-100418b3 1379->1386 1387 10041864-1004186b 1380->1387 1381->1387 1388 10041859-1004185b 1381->1388 1383->1376 1385 10041825-1004182d call 100169dd 1383->1385 1384->1383 1385->1372 1391 100418d3-100418dc 1386->1391 1392 1004186d 1387->1392 1393 1004186f-10041886 call 100452d3 1387->1393 1388->1387 1395 100418e4-100418f3 call 100169dd call 1008be65 1391->1395 1396 100418de-100418e0 1391->1396 1392->1393 1400 1004188b-10041899 1393->1400 1396->1395 1402 100418a8-100418af 1400->1402 1403 1004189b-100418a4 1400->1403 1402->1386 1404 100418b5-100418c3 IsIconic 1402->1404 1403->1402 1404->1391 1406 100418c5-100418cd ShowWindow 1404->1406 1406->1391
                    APIs
                    • __EH_prolog3.LIBCMT ref: 1004176F
                    • LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 10041816
                    • IsIconic.USER32(?), ref: 100418BB
                    • ShowWindow.USER32(?,00000009), ref: 100418CD
                      • Part of subcall function 10033CA3: FindResourceW.KERNEL32(?,?,?,00000000,?,100441AC,?,00000002,00000000), ref: 10033CBB
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: FindH_prolog3IconicLibraryLoadResourceShowWindow
                    • String ID:
                    • API String ID: 2904428477-0
                    • Opcode ID: e25f3cd266ddaffa2f84159feb2f281f5427867bb2d71a94ec786dfe1acd8c2f
                    • Instruction ID: 33c97f56f2782200247833d354de1d072ae405e47f5e9e0cee7516c2b04b29c0
                    • Opcode Fuzzy Hash: e25f3cd266ddaffa2f84159feb2f281f5427867bb2d71a94ec786dfe1acd8c2f
                    • Instruction Fuzzy Hash: 05515830B00646EFDB08CFA0C944BEAB7B5FF44345F20856DE919EB251DB70A955CBA4
                    Function 10064701 Relevance: 6.0, APIs: 4, Instructions: 16libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • GetModuleHandleW.KERNEL32(100D3E90,100D3E7C,?,1006008C,?), ref: 1006470E
                    • GetProcAddress.KERNEL32(00000000), ref: 10064715
                    • GetSystemInfo.KERNEL32(1006008C,?,1006008C,?), ref: 10064722
                    • GetNativeSystemInfo.KERNEL32(1006008C,?,1006008C,?), ref: 1006472A
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: InfoSystem$AddressHandleModuleNativeProc
                    • String ID:
                    • API String ID: 3433367815-0
                    • Opcode ID: a9275d462d6118fb01b50870fee0a82a129a93177f57c7e74ba549a7c4cf28d4
                    • Instruction ID: 79e681a4c1a16c63d651363bbe52e102e1e251856045899359a45d172bcd3d67
                    • Opcode Fuzzy Hash: a9275d462d6118fb01b50870fee0a82a129a93177f57c7e74ba549a7c4cf28d4
                    • Instruction Fuzzy Hash: CED01231004359BBEB006FF1DD4C95B3F5DEA449A63055085F70DC1190EB6687105B75
                    Function 070A1040 Relevance: 3.1, APIs: 2, Instructions: 78COMMON
                    Download Yara Rule
                    APIs
                    • GetVersion.KERNEL32(?,070A123B,?,00000000,?,?,00000001,?), ref: 070A104D
                      • Part of subcall function 070A4990: HeapCreate.KERNEL32(00000000,00001000,00000000,?,070A105F,00000001,?,070A123B,?,00000000,?,?,00000001,?), ref: 070A49A4
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: CreateHeapVersion
                    • String ID:
                    • API String ID: 1692583746-0
                    • Opcode ID: 62c2889ff9675080d1f185a4f3bacfc76257097c328c2b3ab8f547ec58aef652
                    • Instruction ID: 49cc2f609d5df6dee541ec7c4325bbe7e4d8ff1fcc9e840c3db25e79e5ad0ca9
                    • Opcode Fuzzy Hash: 62c2889ff9675080d1f185a4f3bacfc76257097c328c2b3ab8f547ec58aef652
                    • Instruction Fuzzy Hash: 0B213EF9A1130EEED750ABFCE5027A972F0AB01295F024725D81586780EA7C99808F53
                    Function 100A2787 Relevance: 3.0, APIs: 2, Instructions: 20COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • EnumSystemLocalesEx.KERNEL32(00000000,00000000,00000000,00000000,?,100A155F,100A15FD,00000003,00000000,?,?,00000000,00000000,00000000,00000000,00000000), ref: 100A27A2
                    • EnumSystemLocalesW.KERNEL32(100A2773,00000001,?,100A155F,100A15FD,00000003,00000000,?,?,00000000,00000000,00000000,00000000,00000000), ref: 100A27B5
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: EnumLocalesSystem
                    • String ID:
                    • API String ID: 2099609381-0
                    • Opcode ID: 382839884f8478fa67d6aa78c493992863ce6e304dcfabc23a568f68d4176c6e
                    • Instruction ID: edd52936e47c4173f8894f7c05484f70545a9152f7b0d0d6ce54ef841fc64d1a
                    • Opcode Fuzzy Hash: 382839884f8478fa67d6aa78c493992863ce6e304dcfabc23a568f68d4176c6e
                    • Instruction Fuzzy Hash: 0BE08C32048228EFFF51CFE4CCD6F983BA4FB44B50F004010F6084A060C3B1AA60EB68
                    Function 100A280D Relevance: 3.0, APIs: 2, Instructions: 18COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • GetLocaleInfoEx.KERNEL32(?,20001004,?,1009325F,?,1009325F,?,20001004,?,00000002,?,00000004,?,00000000), ref: 100A2829
                    • GetLocaleInfoW.KERNEL32(00000000,20001004,?,1009325F,?,1009325F,?,20001004,?,00000002,?,00000004,?,00000000), ref: 100A2834
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: InfoLocale
                    • String ID:
                    • API String ID: 2299586839-0
                    • Opcode ID: d2860bbbef92ca6ccb15878e75c7cb072065792c95843294cb7ae69f0a801fd5
                    • Instruction ID: 45b7406f9202690bc5b593a15b2edb99ad15846648d2971a5f239b142f8a5106
                    • Opcode Fuzzy Hash: d2860bbbef92ca6ccb15878e75c7cb072065792c95843294cb7ae69f0a801fd5
                    • Instruction Fuzzy Hash: DDD0677600812DEFDF01AFE5ED99CAA3BA9EB48360B008455F91885120DA36A560EB65
                    Function 1004204E Relevance: 91.9, APIs: 50, Strings: 2, Instructions: 853windowkeyboardstringCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 10042058
                    • GetPropW.USER32(?,100CCE1C), ref: 10042078
                    • EnumChildWindows.USER32(?,10042DA0,?), ref: 100420C1
                      • Part of subcall function 10043149: GetClassNameW.USER32(?,?,00000100), ref: 1004316D
                      • Part of subcall function 10043149: lstrcmpiW.KERNEL32(?,100CCDA4), ref: 10043185
                    • GetDlgItem.USER32(?,00000007), ref: 100420DC
                    • BeginPaint.USER32(?,?), ref: 100420F5
                    • EndPaint.USER32(?,?), ref: 10042135
                    • RemovePropW.USER32(?,100CCE1C), ref: 10042161
                    • GetClassNameW.USER32(?,00000000,00000104), ref: 10042255
                    • GetDlgCtrlID.USER32(?), ref: 100422D3
                    • GetKeyState.USER32(000000A0), ref: 100423E9
                    • GetKeyState.USER32(000000A1), ref: 100423FD
                    • GetDlgItem.USER32(?,00000007), ref: 1004240F
                    • GetDlgItem.USER32(?,00000514), ref: 10042438
                    • ShowWindow.USER32(00000000), ref: 1004243F
                    • GetWindowRect.USER32(?,?), ref: 1004244F
                    • ScreenToClient.USER32(?,?), ref: 10042460
                    • ScreenToClient.USER32(?,?), ref: 1004246C
                    • InvalidateRect.USER32(?,?,00000001,?,?,00000001), ref: 10042510
                    • GetClassNameW.USER32(?,00000000,00000104), ref: 10042575
                    • GetWindowLongW.USER32(?,000000F0), ref: 1004258D
                    • SetBkMode.GDI32(?,00000001), ref: 10042619
                    • GetSysColor.USER32(00000008), ref: 10042621
                    • SetTextColor.GDI32(?,00000000), ref: 10042629
                    • GetStockObject.GDI32(00000005), ref: 10042631
                    • GetDlgCtrlID.USER32(?), ref: 1004264C
                    • SetPropW.USER32(?,100CCE1C,?), ref: 10042749
                    • LoadIconW.USER32(00000000,00007F03), ref: 1004278B
                    • GetDlgItem.USER32(?,00004590), ref: 100427A6
                    • SendMessageW.USER32(00000000), ref: 100427AD
                    • GetDlgItem.USER32(?,00000032), ref: 100427B6
                    • SetWindowTextW.USER32(?,?), ref: 10042827
                    • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 10042837
                    • GetObjectW.GDI32(00000000,0000005C,?), ref: 10042847
                    • CreateFontIndirectW.GDI32(?), ref: 1004285E
                    • SendMessageW.USER32(?,00000030,?,00000000), ref: 10042892
                    • GetSysColor.USER32(00000005), ref: 1004289A
                    • CreateSolidBrush.GDI32(00000000), ref: 100428A1
                      • Part of subcall function 10045174: GetWindowLongW.USER32(?,000000F0), ref: 10045193
                      • Part of subcall function 10045174: GetParent.USER32(?), ref: 100451A8
                      • Part of subcall function 10045174: GetWindowRect.USER32(?,?), ref: 100451C0
                      • Part of subcall function 10045174: GetWindowLongW.USER32(?,000000F0), ref: 100451D5
                      • Part of subcall function 10045174: SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 100451F5
                      • Part of subcall function 10045174: SetWindowPos.USER32(?,00000000,?,?,000000FF,000000FF,00000015), ref: 100452BE
                      • Part of subcall function 10001123: GetLastError.KERNEL32(00000000,100C90D4,10005872,100C90D8,100C90D4,?,00000000,100C90D4,?,00000000), ref: 10001131
                      • Part of subcall function 10001123: SysFreeString.OLEAUT32(?), ref: 10001145
                      • Part of subcall function 10001123: SetLastError.KERNEL32(?,00000001,00000000), ref: 1000115F
                    • _memset.LIBCMT ref: 100428D8
                    • VariantInit.OLEAUT32(?), ref: 100428E7
                    • lstrcmpW.KERNEL32(?,100CCE34), ref: 10042936
                    • GetDlgItem.USER32(?,00000034), ref: 1004294B
                    • MapDialogRect.USER32(?,?), ref: 1004299B
                    • GetClientRect.USER32(?,?), ref: 100429A6
                    • MulDiv.KERNEL32(?,00000004,00000004), ref: 100429BA
                    • MulDiv.KERNEL32(?,00000008,?), ref: 100429C6
                    • SetPropW.USER32(?,100CCD34,00000000), ref: 10042A3C
                    • GetDlgItem.USER32(?,000004B0), ref: 10042A6B
                      • Part of subcall function 1000EA30: SysStringLen.OLEAUT32(00000024), ref: 1000EA3D
                      • Part of subcall function 1000EA30: SysReAllocStringLen.OLEAUT32(00000024,00000004,?), ref: 1000EA57
                    • GetDlgItemTextW.USER32(?,000004B0,00000000,0000030C), ref: 10042AF1
                      • Part of subcall function 1001CD08: __EH_prolog3_GS.LIBCMT ref: 1001CD0F
                      • Part of subcall function 1001CD08: GetLastError.KERNEL32(00000038,1002271F), ref: 1001CD16
                      • Part of subcall function 1001CD08: SetLastError.KERNEL32(00000000), ref: 1001CD6A
                    • EnumChildWindows.USER32(?,10042DB9,?), ref: 10042CB3
                    • VariantClear.OLEAUT32(?), ref: 10042CC0
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ItemWindow$Rect$ErrorLastProp$ClassClientColorLongMessageNameSendStringText$ChildCreateCtrlEnumH_prolog3_ObjectPaintScreenStateVariantWindows$AllocBeginBrushClearDialogFontFreeIconIndirectInfoInitInvalidateLoadModeParametersParentRemoveShowSolidStockSystem_memsetlstrcmplstrcmpi
                    • String ID: N$d
                    • API String ID: 1601229946-1047674175
                    • Opcode ID: ab42c8b31c22eaa0225cd4a83e5444bc5211736585bb0806e680dc69aa4ecb10
                    • Instruction ID: ce53977938eee577c0e2b7a5bff0fa7871a8d0d9a1f9ec6333ee683e1f54de24
                    • Opcode Fuzzy Hash: ab42c8b31c22eaa0225cd4a83e5444bc5211736585bb0806e680dc69aa4ecb10
                    • Instruction Fuzzy Hash: 97726D71A00219DFEB15CF60CD89BEE77B9EF05340F6040A9E909EB191DB74AA84CF65
                    Function 100442FD Relevance: 52.9, APIs: 29, Strings: 1, Instructions: 379windowCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 271 100442fd-1004431b call 1008beca 274 10044321-100444c7 call 1000395e * 3 call 10022a6a call 1000ea30 LangLoadString call 1001cd08 call 10022a6a call 1000ea30 LangLoadString call 1001cd08 call 10022a6a call 1000ea30 wsprintfW call 1001cd08 GetHandle MessageBoxW call 10001123 * 3 271->274 275 100444cf-100444d6 271->275 302 100444c9-100444ca 274->302 277 1004454e-10044556 275->277 278 100444d8 call 10041768 275->278 281 100446d1-100446d7 277->281 282 1004455c-10044562 277->282 288 100444dd-100444df 278->288 285 100446f1-100446f8 281->285 286 100446d9-100446eb KiUserCallbackDispatcher 281->286 283 10044564-10044579 GetPropW 282->283 284 100445a6-100445ac 282->284 289 1004459f 283->289 290 1004457b-1004459e call 1001323e RemovePropW call 1008a218 283->290 297 100445ae-100445b6 call 10043f31 284->297 298 100445bb-100445cd 284->298 292 10044716-1004471c 285->292 293 100446fa-10044701 285->293 286->285 291 10044887-10044889 286->291 295 100444e1-100444e9 288->295 296 100444eb-1004452b call 1000380e call 100137ed GetDlgItem 288->296 289->284 290->289 306 100448a0-100448a5 call 1008be79 291->306 304 100447f5-10044843 call 10044e8f call 100415d0 call 100414c7 call 10044fe6 call 10043b10 292->304 305 10044722-10044729 292->305 293->292 300 10044703-1004470f SetActiveWindow 293->300 295->302 342 10044541-10044549 296->342 343 1004452d-10044538 GetWindowLongW 296->343 297->298 308 100445d3-100445eb call 100019d0 298->308 309 1004469b-100446a1 298->309 300->292 302->306 377 10044845-1004484e 304->377 378 10044869-10044870 304->378 314 1004473b-10044745 305->314 315 1004472b-10044735 305->315 336 1004462c-1004463e call 100019d0 308->336 337 100445ed-10044600 GetDlgItem 308->337 309->285 318 100446a3-100446c2 ShowWindow 309->318 324 10044747-10044751 314->324 325 10044753-10044761 314->325 315->314 323 1004488b 315->323 328 100446c4-100446c6 318->328 329 100446ca 318->329 344 10044892-10044899 323->344 324->325 334 10044763-1004477a GetFocus IsChild 324->334 325->334 335 100447cc 325->335 328->329 329->281 345 100447b2-100447ca IsDialogMessageW 334->345 346 1004477c 334->346 339 100447ce-100447d0 335->339 358 10044654-10044667 GetDlgItem 336->358 359 10044640-10044652 call 100019d0 336->359 347 10044602-1004460a SendMessageW 337->347 348 1004460c-1004461f GetDlgItem 337->348 339->281 351 100447d6-100447f0 TranslateMessage DispatchMessageW 339->351 342->302 343->342 354 1004453a 343->354 344->306 345->339 355 10044787-10044794 GetParent 346->355 347->348 348->336 349 10044621-1004462a SendMessageW 348->349 349->336 351->281 354->342 356 10044796-100447ac SendMessageW 355->356 357 1004477e-10044785 GetParent 355->357 356->281 356->345 357->355 363 10044673-10044686 GetDlgItem 358->363 364 10044669-10044671 SendMessageW 358->364 359->358 368 10044693-10044696 359->368 363->368 369 10044688-10044691 SendMessageW 363->369 364->363 368->306 369->368 380 10044850-10044856 377->380 381 1004489b 377->381 378->281 382 10044876-1004487c 378->382 380->344 384 10044858-1004485b 380->384 381->306 382->318 385 10044882 382->385 384->281 387 10044861-10044867 384->387 385->281 387->306
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 10044307
                      • Part of subcall function 1000395E: GetLastError.KERNEL32(?,?,?,10007B00,?,?,?,?,00000000,00000040,1000A532,?,?,?,?,?), ref: 1000397D
                      • Part of subcall function 1000395E: SetLastError.KERNEL32(?,?,?,?,10007B00,?,?,?,?,00000000,00000040,1000A532,?,?,?,?), ref: 100039AB
                      • Part of subcall function 1000EA30: SysStringLen.OLEAUT32(00000024), ref: 1000EA3D
                      • Part of subcall function 1000EA30: SysReAllocStringLen.OLEAUT32(00000024,00000004,?), ref: 1000EA57
                    • LangLoadString.ISRT(?,00002B69,00000000,000000C8,?,000000C8,?,00000000,?,00000000,?,00000000), ref: 100443BB
                      • Part of subcall function 10033C69: LoadStringW.USER32(?,?,?,?), ref: 10033C7F
                      • Part of subcall function 10033C69: LoadStringW.USER32(?,?,?,?), ref: 10033C98
                      • Part of subcall function 1001CD08: __EH_prolog3_GS.LIBCMT ref: 1001CD0F
                      • Part of subcall function 1001CD08: GetLastError.KERNEL32(00000038,1002271F), ref: 1001CD16
                      • Part of subcall function 1001CD08: SetLastError.KERNEL32(00000000), ref: 1001CD6A
                    • LangLoadString.ISRT(?,00002B6B,00000000,00000064,?,00000064,?,000000C8,?,00000000,?,00000000,?,00000000), ref: 10044407
                    • wsprintfW.USER32 ref: 10044451
                    • GetHandle.ISRT(?,000000FE,?,?,00000010), ref: 1004449A
                      • Part of subcall function 1001B097: VariantInit.OLEAUT32(?), ref: 1001B0B2
                      • Part of subcall function 1001B097: FindWindowW.USER32(100CA06C,00000000), ref: 1001B113
                      • Part of subcall function 1001B097: VariantClear.OLEAUT32(?), ref: 1001B137
                    • MessageBoxW.USER32(00000000,?,000000FE,?), ref: 100444A0
                      • Part of subcall function 10001123: GetLastError.KERNEL32(00000000,100C90D4,10005872,100C90D8,100C90D4,?,00000000,100C90D4,?,00000000), ref: 10001131
                      • Part of subcall function 10001123: SysFreeString.OLEAUT32(?), ref: 10001145
                      • Part of subcall function 10001123: SetLastError.KERNEL32(?,00000001,00000000), ref: 1000115F
                      • Part of subcall function 1000380E: __EH_prolog3.LIBCMT ref: 10003815
                      • Part of subcall function 1000380E: GetLastError.KERNEL32(00000004,10002E96,?,00000000,00000004,10002ADC,00000000,?,00000008,10002A85,?,?,00000000,?,00000000,00000000), ref: 10003837
                      • Part of subcall function 1000380E: SetLastError.KERNEL32(100C90E0,00000000,?,?,1000C93A,?,0000000E,00000000,00000010,1000CA32,00000000,0000000E,?,?,?), ref: 1000386F
                      • Part of subcall function 100137ED: __EH_prolog3_GS.LIBCMT ref: 100137F4
                      • Part of subcall function 100137ED: IsWindow.USER32(?), ref: 1001384A
                      • Part of subcall function 100137ED: EnableWindow.USER32(?,00000000), ref: 1001388B
                    • GetDlgItem.USER32(?,00000065), ref: 10044523
                    • GetWindowLongW.USER32(00000000,000000F0), ref: 10044530
                    • GetPropW.USER32(?,100CCD34), ref: 1004456F
                    • RemovePropW.USER32(?,100CCD34), ref: 10044592
                    • GetDlgItem.USER32(?,0000012D), ref: 100445F8
                    • SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 1004460A
                    • GetDlgItem.USER32(?,0000012E), ref: 10044617
                    • SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 1004462A
                    • GetDlgItem.USER32(?,000001F6), ref: 1004465F
                    • SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 10044671
                    • GetDlgItem.USER32(?,000001F7), ref: 1004467E
                    • SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 10044691
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$String$ItemMessage$LoadSendWindow$H_prolog3_$LangPropVariant$AllocClearEnableFindFreeH_prolog3HandleInitLongRemovewsprintf
                    • String ID: p
                    • API String ID: 1048186331-2181537457
                    • Opcode ID: 0354c3fd07ac993926b961bef72f88eef3c3a85aae689acefe9386524de56fbf
                    • Instruction ID: 07ee403959879e869ac03607708afbfcde3e44a3ae1438605aaafe61ace616ce
                    • Opcode Fuzzy Hash: 0354c3fd07ac993926b961bef72f88eef3c3a85aae689acefe9386524de56fbf
                    • Instruction Fuzzy Hash: B3E1B070A00656EFEB14CB70CC85BDDBBA8FF05390F2641A9F509A7192CFB06A94CB55
                    Function 10030158 Relevance: 51.9, APIs: 28, Strings: 1, Instructions: 1125libraryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 399 10030158-10030198 call 1008beca call 1008abd5 404 100301ab-100301ad 399->404 405 1003019a-1003019c call 1002b74a 399->405 407 100301b3-100301d4 call 1002c339 call 1002c30b 404->407 409 100301a1-100301a9 405->409 413 100301e0-1003029e call 1002c339 call 10003b8b * 2 407->413 414 100301d6-100301dc 407->414 409->407 425 10030466-10030484 413->425 426 100302a4-10030365 call 1008a4a0 VariantInit call 1000d3a8 call 1000daac call 100052b0 call 10004ec2 413->426 414->413 427 1003048a-100304b1 425->427 504 10030367-10030383 426->504 505 100303a8-10030464 call 1008a4a0 VariantInit call 1008a4a0 VariantInit VariantChangeType VariantClear * 3 426->505 431 100304b7-100304e2 427->431 432 1003070b-10030712 427->432 443 100304e4-100304ea call 10060d95 431->443 444 100304fa-10030540 431->444 434 10030714-10030719 432->434 435 1003078e-100307d1 call 1002ad04 * 2 call 10010a5a 432->435 438 10030753-10030758 434->438 439 1003071b-1003074d call 10010a5a call 1000ea8b SysFreeString 434->439 469 100309c1-100309fb call 1002acdb 435->469 470 100307d7-100307da 435->470 438->435 442 1003075a-10030788 call 10010a5a call 1000ea8b SysFreeString 438->442 439->438 442->435 455 100304ef-100304f5 call 10004ec2 443->455 472 10030542-1003054c 444->472 473 1003054e-1003055e 444->473 455->444 501 10030a06-10030a1f 469->501 502 100309fd-10030a02 469->502 474 100307e0-100307e9 470->474 475 100308b7-100308bb 470->475 476 10030564-100305a0 call 10005c21 call 1000ea30 472->476 473->476 478 10030814-1003084e call 10003be6 474->478 479 100307eb-10030812 call 10003aa0 474->479 481 100308c1-100308ca 475->481 482 1003099b-100309a3 475->482 520 100305a2-100305ab call 1000528d 476->520 521 100305b0-100305e9 call 10005c21 call 1000ea30 476->521 503 1003084f-10030873 call 1000ea8b 478->503 479->503 487 10030907-1003093c call 10003be6 481->487 488 100308cc-10030905 call 10003aa0 481->488 490 100309a5-100309aa 482->490 491 100309ae-100309b6 482->491 509 1003093e-10030963 call 1000ea8b 487->509 488->509 490->491 491->469 500 100309b8-100309bd 491->500 500->469 517 10030a21-10030a2f 501->517 518 10030a55-10030aa3 501->518 502->501 533 10030895-1003089e 503->533 534 10030875-1003088f call 10004ec2 503->534 504->505 519 10030385-100303a3 call 1000d3a8 504->519 505->427 535 10030965-10030976 call 10004ec2 509->535 536 1003097c-10030985 509->536 517->518 540 10030a31-10030a3e 517->540 556 10030b3b-10030bbb call 10003aa0 call 1000395e * 2 518->556 557 10030aa9-10030ae2 call 1002c7b5 call 1000ea8b 518->557 519->505 520->521 558 100305eb-100305f4 call 1000528d 521->558 559 100305f9-10030674 call 10003d09 call 1002ccd4 call 10001123 call 10003d09 call 1002cd6c call 10001123 521->559 533->475 539 100308a0-100308b2 call 10004ec2 533->539 534->533 535->536 536->482 548 10030987-10030996 call 10004ec2 536->548 539->475 552 10030a41-10030a43 540->552 548->482 552->518 555 10030a45-10030a52 552->555 555->518 580 10030cb3-10030ce2 556->580 581 10030bc1-10030c20 call 10031d9b call 10010a5a call 1000ea30 SysFreeString 556->581 578 10030af2-10030b2b call 10005c21 call 1000ea30 557->578 579 10030ae4-10030aed call 100052dc 557->579 558->559 615 100306e1-10030703 559->615 616 10030676-100306ac call 1002c7b5 call 1000ea8b 559->616 578->556 622 10030b2d-10030b36 call 1000528d 578->622 579->578 594 10030ce4-10030cec 580->594 595 10030d2e-10030d35 580->595 636 10030c22-10030c2b call 1000528d 581->636 637 10030c30-10030c9d call 10031d9b call 10010a5a call 1000ea30 SysFreeString 581->637 601 10030d0b-10030d28 LoadLibraryW 594->601 602 10030cee-10030d05 call 1000ea30 594->602 596 10030d81-10030d93 595->596 597 10030d37-10030d3f 595->597 607 10030e10-10030e18 596->607 608 10030d95-10030e0a call 1002c7b5 call 10010a5a call 1000ea8b 596->608 603 10030d41-10030d58 call 1000ea30 597->603 604 10030d5e-10030d7b LoadLibraryW 597->604 601->595 632 10030d09 602->632 633 10030d5c 603->633 604->596 611 10030e35-10030e3e 607->611 612 10030e1a-10030e2f SysFreeString 607->612 608->607 620 10030e40-10030e47 611->620 621 10030e57-10030e95 call 1008abd5 call 10003b8b 611->621 612->611 615->432 635 10030705-10030707 615->635 656 100306ae-100306b7 call 100052dc 616->656 657 100306bc-100306dc call 1000daac call 100052b0 call 10004ec2 616->657 620->621 625 10030e49-10030e52 call 100052dc 620->625 651 10030e97-10030efe call 1008a4a0 VariantInit call 1000d3a8 VariantClear 621->651 652 10030f04-10030f0b 621->652 622->556 625->621 632->595 633->596 635->432 636->637 678 10030c9f-10030ca8 call 1000528d 637->678 679 10030cad 637->679 651->652 654 10030f11-10030f49 call 1008a4a0 VariantInit 652->654 655 10030fbb-1003100b call 100136f2 call 10003aa0 call 10016858 652->655 682 10030f4b-10030f53 654->682 683 10030f88-10030fb5 call 100132ea VariantClear 654->683 691 10031010-1003103a 655->691 656->657 657->615 678->679 679->580 682->683 687 10030f55-10030f83 call 1002c71f call 100052b0 call 10004ec2 682->687 683->655 687->683 697 100310a3-100310a9 691->697 698 1003103c-1003103e 691->698 700 100310b1-100310c8 call 10004ec2 697->700 701 100310ab-100310ad 697->701 698->697 699 10031040-1003107b call 1008a4a0 VariantInit 698->699 711 10031090-1003109d VariantClear 699->711 712 1003107d-1003108a 699->712 706 100310d0-100310fd call 10001123 * 2 call 10004ec2 700->706 707 100310ca-100310cc 700->707 701->700 717 10031105-10031111 706->717 718 100310ff-10031101 706->718 707->706 711->697 712->711 719 10031113-10031115 717->719 720 10031119-1003112c SysFreeString 717->720 718->717 719->720 721 10031134-10031140 720->721 722 1003112e-10031130 720->722 723 10031142-10031144 721->723 724 10031148-10031154 721->724 722->721 723->724 725 10031156-10031158 724->725 726 1003115c-10031176 call 10004ec2 * 2 call 1008be79 724->726 725->726
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 10030162
                      • Part of subcall function 1008ABD5: _malloc.LIBCMT ref: 1008ABED
                    • _memset.LIBCMT ref: 100302AF
                    • VariantInit.OLEAUT32(?), ref: 100302BE
                      • Part of subcall function 1002B74A: __EH_prolog3.LIBCMT ref: 1002B751
                      • Part of subcall function 1000DAAC: __EH_prolog3_GS.LIBCMT ref: 1000DAB3
                      • Part of subcall function 10004EC2: GetLastError.KERNEL32(00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10004ED0
                      • Part of subcall function 10004EC2: SysFreeString.OLEAUT32(?), ref: 10004EE4
                      • Part of subcall function 10004EC2: SetLastError.KERNEL32(?,00000001,00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000), ref: 10004EFE
                    • _memset.LIBCMT ref: 100303D4
                    • VariantInit.OLEAUT32(?), ref: 100303E9
                    • _memset.LIBCMT ref: 1003040C
                    • VariantInit.OLEAUT32(?), ref: 1003041B
                    • VariantChangeType.OLEAUT32(?,?,00000000,00000003), ref: 1003042F
                    • VariantClear.OLEAUT32(?), ref: 10030450
                    • VariantClear.OLEAUT32(?), ref: 10030459
                    • VariantClear.OLEAUT32(?), ref: 10030462
                    • SysFreeString.OLEAUT32(?), ref: 1003074D
                    • SysFreeString.OLEAUT32(?), ref: 10030788
                      • Part of subcall function 10003BE6: __EH_prolog3.LIBCMT ref: 10003BED
                      • Part of subcall function 10003BE6: GetLastError.KERNEL32(00000004,10003F3B,00000000,?,00000000,?), ref: 10003C0F
                      • Part of subcall function 10003BE6: SetLastError.KERNEL32(00000000,00000000,?), ref: 10003C48
                    • SysFreeString.OLEAUT32(?), ref: 10030C0F
                    • SysFreeString.OLEAUT32(?), ref: 10030C8C
                    • LoadLibraryW.KERNEL32(?), ref: 10030D22
                    • LoadLibraryW.KERNEL32(?), ref: 10030D75
                      • Part of subcall function 1000EA8B: SysStringLen.OLEAUT32(?), ref: 1000EA98
                      • Part of subcall function 1000EA8B: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 1000EAB2
                    • SysFreeString.OLEAUT32(?), ref: 10030E29
                    • _memset.LIBCMT ref: 10030EA2
                    • VariantInit.OLEAUT32(?), ref: 10030EB1
                    • VariantClear.OLEAUT32(?), ref: 10030EFE
                    • _memset.LIBCMT ref: 10030F1C
                    • VariantInit.OLEAUT32(?), ref: 10030F2B
                    • VariantClear.OLEAUT32(?), ref: 10030FB5
                      • Part of subcall function 10003AA0: __EH_prolog3.LIBCMT ref: 10003AA7
                      • Part of subcall function 10003AA0: GetLastError.KERNEL32(00000004,100049CB,0000005C,00000000,00000000,00000000,?,1000DB12,00000000,00000001,00000000,?,000000FF,00000001,00000048,1000E682), ref: 10003AC9
                      • Part of subcall function 10003AA0: SetLastError.KERNEL32(?,00000000,?,1000DB12,00000000,00000001,00000000,?,000000FF,00000001,00000048,1000E682,?), ref: 10003B01
                      • Part of subcall function 10016858: __EH_prolog3_GS.LIBCMT ref: 1001685F
                    • _memset.LIBCMT ref: 1003104B
                    • VariantInit.OLEAUT32(?), ref: 1003105A
                    • VariantClear.OLEAUT32(?), ref: 10031097
                    • SysFreeString.OLEAUT32(?), ref: 1003111A
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Variant$String$Free$ClearErrorInitLast_memset$H_prolog3H_prolog3_$LibraryLoad$AllocChangeType_malloc
                    • String ID: %
                    • API String ID: 1615947039-2567322570
                    • Opcode ID: 7b3fdef807bf5c432b2e0ca593d3ced1b922c638fea8204bbeb133e7f1f00d37
                    • Instruction ID: 4532afd057c094acffd6b77d428fc7c8ff41807b87471b0eaa9eddd0eb9bc65a
                    • Opcode Fuzzy Hash: 7b3fdef807bf5c432b2e0ca593d3ced1b922c638fea8204bbeb133e7f1f00d37
                    • Instruction Fuzzy Hash: 00B23974901258DFEB11CB60CD98BDDBBB8EF49304F1440D9E949AB282DB71AE85CF61
                    Function 1009308C Relevance: 21.3, APIs: 14, Instructions: 293COMMONLIBRARYCODE
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 733 1009308c-100930ed call 100957f8 736 100930ef 733->736 737 10093100-1009311c call 1008c694 733->737 738 100930f1-100930ff call 1008a483 736->738 742 10093122-10093126 737->742 743 10093374-10093376 737->743 746 10093128-1009312c 742->746 747 10093157-10093169 call 1008b561 742->747 745 1009337b-10093392 call 10095b75 call 10091a00 743->745 763 10093398-100933a8 call 1009205a 745->763 764 1009341d-10093422 call 10091a45 745->764 746->747 749 1009312e-10093147 call 10092783 746->749 756 1009316b-1009317b call 100a13d3 747->756 757 10093197-100931bd call 10092e7c 747->757 749->743 760 1009314d-1009314f 749->760 772 10093319-1009331b 756->772 773 10093181-10093191 call 100a13d3 756->773 769 100931bf-100931d0 757->769 770 10093236 757->770 765 10093151 760->765 766 10093153-10093155 760->766 787 100933c9-100933d8 call 10093426 763->787 788 100933aa-100933b5 InterlockedDecrement 763->788 765->766 766->738 778 100931d9 call 100a1a52 769->778 779 100931d2-100931d7 call 100a22ba 769->779 780 1009323c-10093245 call 100a289c 770->780 775 1009331d-1009332b call 1008a530 772->775 776 1009332e-10093349 call 10092783 772->776 773->757 773->772 775->776 776->743 798 1009334b 776->798 795 100931de-100931e3 778->795 779->795 799 1009324b-10093264 call 100a280d 780->799 800 10093352-1009336d call 1008b561 call 1008c694 780->800 803 100933da-100933f5 call 1009205a call 10094d49 787->803 804 10093416-1009341c call 1008ffc6 787->804 788->787 794 100933b7-100933be 788->794 794->787 801 100933c0-100933c8 call 1008ffc6 794->801 795->780 802 100931e5-10093202 call 10092e0e 795->802 798->800 816 10093270-10093276 GetACP 799->816 817 10093266-1009326e 799->817 800->743 831 1009336f 800->831 801->787 820 10093208-1009322b call 1008b561 call 1008c694 802->820 821 100932da-100932df 802->821 836 1009340a-10093411 call 10093432 803->836 837 100933f7-100933fa 803->837 804->764 826 1009327c-1009329f call 1008c694 816->826 817->816 817->826 820->821 845 10093231 820->845 824 10093308-10093310 821->824 825 100932e1-100932e9 821->825 832 10093313 824->832 825->824 830 100932eb-100932ff call 1008c694 825->830 826->743 839 100932a5-100932b5 call 1008c694 826->839 830->832 847 10093301-10093306 830->847 831->743 832->772 836->804 837->836 841 100933fc-10093401 837->841 839->743 850 100932bb-100932cf call 1008c694 839->850 841->836 846 10093403-10093409 call 10094bef 841->846 845->743 846->836 847->745 850->743 854 100932d5 850->854 854->821
                    APIs
                      • Part of subcall function 100957F8: __getptd_noexit.LIBCMT ref: 100957F9
                    • _wcscmp.LIBCMT ref: 10093172
                    • _wcscmp.LIBCMT ref: 10093188
                    • ___lc_wcstolc.LIBCMT ref: 100931B4
                    • ___get_qualified_locale.LIBCMT ref: 100931D9
                      • Part of subcall function 100A1A52: _TranslateName.LIBCMT ref: 100A1A92
                      • Part of subcall function 100A1A52: _GetLocaleNameFromLangCountry.LIBCMT ref: 100A1AAB
                      • Part of subcall function 100A1A52: _TranslateName.LIBCMT ref: 100A1AC6
                      • Part of subcall function 100A1A52: _GetLocaleNameFromLangCountry.LIBCMT ref: 100A1ADC
                      • Part of subcall function 100A1A52: IsValidCodePage.KERNEL32(00000000,?,?,00000055,?,?,100931DE,?,?,?,?,00000004,?,00000000), ref: 100A1B30
                    • GetACP.KERNEL32(?,?,?,?,?,00000004,?,00000000), ref: 10093270
                    • _memmove.LIBCMT ref: 10093326
                    • __invoke_watson.LIBCMT ref: 1009337B
                    • __lock.LIBCMT ref: 1009339A
                    • InterlockedDecrement.KERNEL32(00000000), ref: 100933AD
                    • _free.LIBCMT ref: 100933C3
                    • __lock.LIBCMT ref: 100933DC
                    • ___removelocaleref.LIBCMT ref: 100933EB
                    • ___freetlocinfo.LIBCMT ref: 10093404
                    • _free.LIBCMT ref: 10093417
                      • Part of subcall function 100A280D: GetLocaleInfoEx.KERNEL32(?,20001004,?,1009325F,?,1009325F,?,20001004,?,00000002,?,00000004,?,00000000), ref: 100A2829
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Name$Locale$CountryFromLangTranslate__lock_free_wcscmp$CodeDecrementInfoInterlockedPageValid___freetlocinfo___get_qualified_locale___lc_wcstolc___removelocaleref__getptd_noexit__invoke_watson_memmove
                    • String ID:
                    • API String ID: 1127632904-0
                    • Opcode ID: bfe32082a61342565ef6a249b810dfd752d9fdce16b057076d3f33059c41c6f0
                    • Instruction ID: fa3779118764ea0e48ca92775e1d5380b5607c38aee46c17ba760bb122b125c2
                    • Opcode Fuzzy Hash: bfe32082a61342565ef6a249b810dfd752d9fdce16b057076d3f33059c41c6f0
                    • Instruction Fuzzy Hash: 2591B2759002559BDB21CB65CC46BEF77A8EF45390F0190AAFD0DA6191EB30AE80EF91
                    Function 10042FE4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 96libraryloaderCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 10042FEE
                      • Part of subcall function 10040D44: __EH_prolog3_GS.LIBCMT ref: 10040D4B
                      • Part of subcall function 10040D44: GetWindowsDirectoryW.KERNEL32(00000000,00000104,00000000,00000104,?,00000000,00000078,1005E096,00000000,00000000,00000068,10077762,00000000,100C90E8,100CB3E4,?), ref: 10040DA3
                      • Part of subcall function 10040D44: __CxxThrowException@8.LIBCMT ref: 10040DD0
                      • Part of subcall function 10003AA0: __EH_prolog3.LIBCMT ref: 10003AA7
                      • Part of subcall function 10003AA0: GetLastError.KERNEL32(00000004,100049CB,0000005C,00000000,00000000,00000000,?,1000DB12,00000000,00000001,00000000,?,000000FF,00000001,00000048,1000E682), ref: 10003AC9
                      • Part of subcall function 10003AA0: SetLastError.KERNEL32(?,00000000,?,1000DB12,00000000,00000001,00000000,?,000000FF,00000001,00000048,1000E682,?), ref: 10003B01
                      • Part of subcall function 10004EC2: GetLastError.KERNEL32(00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10004ED0
                      • Part of subcall function 10004EC2: SysFreeString.OLEAUT32(?), ref: 10004EE4
                      • Part of subcall function 10004EC2: SetLastError.KERNEL32(?,00000001,00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000), ref: 10004EFE
                      • Part of subcall function 10003BE6: __EH_prolog3.LIBCMT ref: 10003BED
                      • Part of subcall function 10003BE6: GetLastError.KERNEL32(00000004,10003F3B,00000000,?,00000000,?), ref: 10003C0F
                      • Part of subcall function 10003BE6: SetLastError.KERNEL32(00000000,00000000,?), ref: 10003C48
                    • LoadLibraryW.KERNEL32(?,?,100CCCAC,?,00000000,00000000,00000000), ref: 10043086
                    • GetProcAddress.KERNEL32(00000000,100CCCC4), ref: 1004309E
                    • MonitorFromPoint.USER32(00000001,00000001,00000002), ref: 100430B4
                    • GetDC.USER32(00000000), ref: 100430E6
                    • GetDeviceCaps.GDI32(00000000,00000058), ref: 100430F5
                    • ReleaseDC.USER32(00000000,00000000), ref: 10043104
                    • MulDiv.KERNEL32(?,00000064,00000060), ref: 10043114
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$H_prolog3H_prolog3_$AddressCapsDeviceDirectoryException@8FreeFromLibraryLoadMonitorPointProcReleaseStringThrowWindows
                    • String ID: `
                    • API String ID: 4093503460-2679148245
                    • Opcode ID: 538f52de2090c8b86c7b714501d627355197aa6f3c7f1ebc95f848936f3935df
                    • Instruction ID: ef43f4a5657bd8d55eb31cef8f921650e8d69e665ab05e0b2effd43c2b9f3b18
                    • Opcode Fuzzy Hash: 538f52de2090c8b86c7b714501d627355197aa6f3c7f1ebc95f848936f3935df
                    • Instruction Fuzzy Hash: 5B419E75E00368EFEB20CBA0CD89BDEBBB4FF05710F544099F604A6181DBB05A45CB55
                    Function 1003E0C6 Relevance: 10.9, APIs: 7, Instructions: 368COMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 884 1003e0c6-1003e0eb call 1008beca 887 1003e0f5-1003e0fc call 1003e5b7 884->887 888 1003e0ed-1003e0f0 884->888 889 1003e5af-1003e5b4 call 1008be79 887->889 893 1003e102-1003e114 887->893 888->889 893->889 896 1003e11a-1003e120 893->896 897 1003e122-1003e123 896->897 898 1003e154 896->898 900 1003e125-1003e126 897->900 901 1003e14d-1003e152 897->901 899 1003e159-1003e1a0 call 1000395e FindResourceW 898->899 908 1003e1a2-1003e1c3 call 10005c21 call 10010a5a 899->908 909 1003e1c5-1003e1e2 call 10005c21 call 10010a5a 899->909 903 1003e146-1003e14b 900->903 904 1003e128-1003e12b 900->904 901->899 903->899 906 1003e13f-1003e144 904->906 907 1003e12d-1003e12e 904->907 906->899 910 1003e130-1003e135 907->910 911 1003e137-1003e13d 907->911 920 1003e1e6-1003e211 call 1000ea30 SysFreeString 908->920 909->920 910->899 911->899 924 1003e213-1003e21c call 1000528d 920->924 925 1003e221-1003e263 920->925 924->925 928 1003e584-1003e590 925->928 929 1003e269-1003e271 925->929 930 1003e592-1003e594 928->930 931 1003e598-1003e5ad VariantClear call 10001123 928->931 932 1003e273-1003e27e 929->932 933 1003e282-1003e2a7 929->933 930->931 931->889 932->933 937 1003e570-1003e57c 933->937 938 1003e2ad-1003e2de 933->938 937->928 939 1003e57e-1003e580 937->939 941 1003e2f0-1003e316 938->941 942 1003e2e0-1003e2e9 938->942 939->928 944 1003e4df-1003e4fe call 1000ea30 941->944 945 1003e31c-1003e333 941->945 942->941 954 1003e503-1003e50b 944->954 947 1003e335-1003e338 945->947 948 1003e33a-1003e35f call 1000ea30 945->948 947->948 955 1003e365-1003e37a 948->955 956 1003e548-1003e554 948->956 959 1003e52b 954->959 960 1003e50d-1003e525 954->960 955->956 964 1003e380-1003e38e 955->964 957 1003e556-1003e558 956->957 958 1003e55c-1003e568 956->958 957->958 958->937 962 1003e56a-1003e56c 958->962 961 1003e52d-1003e533 959->961 960->959 965 1003e535-1003e537 961->965 966 1003e53b-1003e542 VariantClear 961->966 962->937 968 1003e415-1003e44d call 1008a4a0 VariantInit 964->968 969 1003e394-1003e39a 964->969 965->966 966->956 978 1003e461-1003e46f 968->978 979 1003e44f-1003e457 968->979 969->968 971 1003e39c-1003e410 call 1003dee1 call 1000395e call 1008cb90 * 2 call 1001323e call 10001123 969->971 971->968 978->966 985 1003e475-1003e497 978->985 979->978 981 1003e459 979->981 981->978 985->960 990 1003e499-1003e4bb call 1000ea8b 985->990 995 1003e4bf-1003e4c1 990->995 995->954 996 1003e4c3-1003e4d5 995->996 996->954 998 1003e4d7-1003e4dd 996->998 998->961
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1003E0D0
                    • FindResourceW.KERNEL32(?,0000283D,00000005,?,00000000), ref: 1003E18B
                    • SysFreeString.OLEAUT32(?), ref: 1003E200
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: FindFreeH_prolog3_ResourceString
                    • String ID:
                    • API String ID: 3506213144-0
                    • Opcode ID: 36de3cb1cca1754d6759a33bc2422b59246f05b4a36b3ca5c3f9ac9479ec95a0
                    • Instruction ID: 8374c74675d0aaee2f28d72bafaeb1ce02fd82c0b47547ce43b314c0bc71d1dc
                    • Opcode Fuzzy Hash: 36de3cb1cca1754d6759a33bc2422b59246f05b4a36b3ca5c3f9ac9479ec95a0
                    • Instruction Fuzzy Hash: 1AE15B359002A9DFDB62CB64C888BDEB7B4FF49305F1445D8E909AB291DB31AE85CF50
                    Function 1003FD08 Relevance: 10.6, APIs: 7, Instructions: 68COMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 999 1003fd08-1003fd46 call 1008be97 call 1008a4a0 VariantInit call 1003eff3 1005 1003fd4b-1003fd52 999->1005 1006 1003fd54-1003fd59 1005->1006 1007 1003fdbb-1003fdcc VariantClear call 1008be65 1005->1007 1009 1003fd94-1003fd99 1006->1009 1010 1003fd5b-1003fd5e 1006->1010 1014 1003fd9b-1003fdab call 10091360 1009->1014 1015 1003fdb8 1009->1015 1012 1003fd60-1003fd62 1010->1012 1013 1003fd64-1003fd75 SysStringLen 1010->1013 1017 1003fd7b-1003fd7c 1012->1017 1018 1003fd77-1003fd79 1013->1018 1019 1003fd7e-1003fd92 call 1008a530 1013->1019 1022 1003fdb1-1003fdb6 1014->1022 1015->1007 1017->1007 1018->1017 1019->1022 1022->1007
                    APIs
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Variant$ClearH_prolog3H_prolog3_InitString__itow_memmove_memset
                    • String ID:
                    • API String ID: 811572108-0
                    • Opcode ID: 70c5aef445630a32585e6d00673777a504b7fd0c7a1c8b5ffca46273f5f79d6b
                    • Instruction ID: ddc7622ba8bfde445ee63468dd8ab662e2ad9e8920588db0dd984d1dbbe2d4ba
                    • Opcode Fuzzy Hash: 70c5aef445630a32585e6d00673777a504b7fd0c7a1c8b5ffca46273f5f79d6b
                    • Instruction Fuzzy Hash: 14215C36C0021AAFCF12DF90CC49AEEBBB5FB04361F114115F990AB1A0D379AA65DB91
                    Function 100882F0 Relevance: 9.1, APIs: 6, Instructions: 93windowCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 1024 100882f0-10088317 1025 1008831d-10088324 1024->1025 1026 100883fe-10088405 1024->1026 1025->1026 1027 10088339-10088345 1025->1027 1028 1008832b-10088337 1025->1028 1029 10088361-10088363 1025->1029 1030 10088347-10088353 1025->1030 1031 1008836a-10088385 GetDC 1027->1031 1028->1031 1029->1031 1032 1008835a-1008835f 1030->1032 1033 10088355-10088358 1030->1033 1034 100883bf-100883c2 1031->1034 1035 10088387-1008838c 1031->1035 1032->1031 1033->1031 1037 100883c5-100883db CreateDIBitmap 1034->1037 1035->1034 1036 1008838e-100883bd SelectPalette RealizePalette 1035->1036 1036->1037 1038 100883e9-100883fd ReleaseDC 1037->1038 1039 100883dd-100883e3 SelectPalette 1037->1039 1039->1038
                    APIs
                    • GetDC.USER32(00000000), ref: 10088376
                    • SelectPalette.GDI32(00000000,?,00000000), ref: 10088399
                    • RealizePalette.GDI32(00000000), ref: 100883AD
                    • CreateDIBitmap.GDI32(00000000,1008190E,00000004,?,1008190E,00000000), ref: 100883CF
                    • SelectPalette.GDI32(00000000,1008190E,00000000), ref: 100883E3
                    • ReleaseDC.USER32(00000000,00000000), ref: 100883EC
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Palette$Select$BitmapCreateRealizeRelease
                    • String ID:
                    • API String ID: 1213237138-0
                    • Opcode ID: 296e7b35025743c46d46a9b726edac8869f0e7d8b7cbc4fed613abdf15cd168c
                    • Instruction ID: 81047a3a971fb56fa489c0e778f18fbd3f87659db1ad6c5ccef0ab48f86effa8
                    • Opcode Fuzzy Hash: 296e7b35025743c46d46a9b726edac8869f0e7d8b7cbc4fed613abdf15cd168c
                    • Instruction Fuzzy Hash: C8316BB0600314EFE750CF59DD88B9ABBE8FB08B20F10455AF949CB690D7B4EA50DB94
                    Function 1005D5D3 Relevance: 9.0, APIs: 6, Instructions: 37libraryloaderCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    APIs
                    • __EH_prolog3.LIBCMT ref: 1005D5DA
                    • GetModuleHandleW.KERNEL32(100D2F68,100D40FC,00000000,1005BB97,?,?,?,?,?,?,?,?,?,?,?,100154EE), ref: 1005D5F4
                    • GetProcAddress.KERNEL32(00000000), ref: 1005D5F7
                    • GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,100154EE), ref: 1005D60D
                    • GetModuleHandleW.KERNEL32(100D2F68,100D4110,?,?,?,?,?,?,?,?,?,?,?,100154EE), ref: 1005D61B
                    • GetProcAddress.KERNEL32(00000000), ref: 1005D61E
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: AddressHandleModuleProc$AttributesFileH_prolog3
                    • String ID:
                    • API String ID: 3512441749-0
                    • Opcode ID: 32deffc9188ea845b1b9214ad6c4e1f105ceb516832698b49c747283dac28d92
                    • Instruction ID: 22def3669920b69ddf9b9f4a3ea795093e98b55f1d6c2b307fa5adb1bc8ea8ba
                    • Opcode Fuzzy Hash: 32deffc9188ea845b1b9214ad6c4e1f105ceb516832698b49c747283dac28d92
                    • Instruction Fuzzy Hash: FBF0BB35500354ABCB20EF74CC559CD3B64FF90651B52496AF60597250DF34D70BCB65
                    Function 1005BB18 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 1074 1005bb18-1005bb30 call 1008beca 1077 1005bb76-1005bb92 call 10003aa0 call 1005d5d3 1074->1077 1078 1005bb32-1005bb3c call 100194f1 1074->1078 1085 1005bb97-1005bb9d 1077->1085 1078->1077 1084 1005bb3e-1005bb65 call 10003aa0 call 1005bcfb 1078->1084 1097 1005bb67-1005bb71 call 10004ec2 1084->1097 1087 1005bbb7-1005bbc2 GetLastError 1085->1087 1088 1005bb9f-1005bba3 1085->1088 1092 1005bbc8-1005bbcb 1087->1092 1093 1005bceb-1005bcf3 call 10004ec2 1087->1093 1090 1005bba5-1005bba7 1088->1090 1091 1005bba9-1005bbad 1088->1091 1090->1091 1096 1005bbb3-1005bbb5 1090->1096 1091->1097 1098 1005bbaf-1005bbb1 1091->1098 1092->1093 1099 1005bbd1-1005bbd4 1092->1099 1106 1005bcf5-1005bcfa call 1008be79 1093->1106 1096->1097 1097->1106 1098->1096 1098->1097 1102 1005bc9f-1005bca3 1099->1102 1103 1005bbda-1005bc20 call 1005869d call 10003aa0 call 1005d0d5 1099->1103 1102->1097 1107 1005bca9-1005bce6 call 10003aa0 call 10011f2e call 1008be0a 1102->1107 1121 1005bc76-1005bc9a GetLastError call 1003c338 call 10004ec2 * 2 1103->1121 1122 1005bc22-1005bc37 call 1003c338 1103->1122 1107->1093 1121->1102 1128 1005bc42-1005bc46 1122->1128 1129 1005bc39-1005bc40 1122->1129 1132 1005bc53-1005bc71 call 1003c338 call 10004ec2 * 2 1128->1132 1133 1005bc48-1005bc4f 1128->1133 1129->1128 1131 1005bc51 1129->1131 1131->1132 1132->1097 1133->1131 1133->1132
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1005BB22
                    • GetLastError.KERNEL32 ref: 1005BBB7
                    • GetLastError.KERNEL32 ref: 1005BC76
                    • __CxxThrowException@8.LIBCMT ref: 1005BCE6
                      • Part of subcall function 10003AA0: __EH_prolog3.LIBCMT ref: 10003AA7
                      • Part of subcall function 10003AA0: GetLastError.KERNEL32(00000004,100049CB,0000005C,00000000,00000000,00000000,?,1000DB12,00000000,00000001,00000000,?,000000FF,00000001,00000048,1000E682), ref: 10003AC9
                      • Part of subcall function 10003AA0: SetLastError.KERNEL32(?,00000000,?,1000DB12,00000000,00000001,00000000,?,000000FF,00000001,00000048,1000E682,?), ref: 10003B01
                      • Part of subcall function 1005BCFB: __EH_prolog3_catch_GS.LIBCMT ref: 1005BD05
                      • Part of subcall function 1005BCFB: __CxxThrowException@8.LIBCMT ref: 1005BDC4
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$Exception@8Throw$H_prolog3H_prolog3_H_prolog3_catch_
                    • String ID:
                    • API String ID: 3135901474-3916222277
                    • Opcode ID: 18f308e00b8d3620b58a6e6daa1f22d63c4e338c1fb4cb2402b308cb2200f574
                    • Instruction ID: 2fd0aef5f5f4374038d273ebb582c1452dfd92475203e511c2f9be6f41fe63c9
                    • Opcode Fuzzy Hash: 18f308e00b8d3620b58a6e6daa1f22d63c4e338c1fb4cb2402b308cb2200f574
                    • Instruction Fuzzy Hash: 1051D075C006989EEB51DF60C881BED7BA4FF01294F5001C9ED8A67191DBB07A8ECF95
                    Function 100A15FD Relevance: 6.2, APIs: 4, Instructions: 226COMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 1221 100a15fd-100a164e call 100957f8 call 100a280d 1226 100a1659-100a1672 call 10090f1b 1221->1226 1227 100a1650-100a1654 1221->1227 1233 100a1678-100a169b call 100a280d 1226->1233 1234 100a1720-100a172c 1226->1234 1228 100a17c0-100a17cd call 1008a483 1227->1228 1242 100a175b-100a1762 1233->1242 1243 100a16a1-100a16b3 call 10090f1b 1233->1243 1235 100a1732-100a1759 call 100a280d 1234->1235 1236 100a17b4-100a17bc 1234->1236 1235->1242 1245 100a1764-100a1776 call 10090f1b 1235->1245 1238 100a17bf 1236->1238 1238->1228 1242->1238 1248 100a16df-100a16e3 1243->1248 1249 100a16b5 1243->1249 1245->1236 1253 100a1778-100a1784 1245->1253 1248->1234 1252 100a16e5-100a16e9 1248->1252 1251 100a16bc-100a16d8 call 1008b561 call 1008c694 1249->1251 1251->1234 1276 100a16da-100a180e 1251->1276 1255 100a16eb-100a1701 call 1008b5c4 1252->1255 1256 100a1709-100a170d 1252->1256 1257 100a17d0-100a17d3 1253->1257 1258 100a1786-100a1794 1253->1258 1255->1256 1273 100a1703-100a1707 1255->1273 1256->1234 1259 100a170f-100a1718 call 100a1961 1256->1259 1257->1258 1261 100a17d5-100a17e0 call 1008b561 1257->1261 1258->1236 1263 100a1796-100a17b2 call 1008b561 call 1008c694 1258->1263 1259->1234 1275 100a171a-100a171e 1259->1275 1261->1258 1277 100a17e2-100a17eb call 100a1961 1261->1277 1263->1236 1281 100a1810-100a1833 call 10095b75 call 100957f8 1263->1281 1273->1251 1275->1251 1276->1281 1277->1258 1284 100a17ed-100a1801 call 100a15cb call 1008b561 1277->1284 1292 100a1838-100a185c call 100a280d 1281->1292 1284->1236 1293 100a1803-100a1809 1284->1293 1295 100a1861-100a1866 1292->1295 1293->1258 1296 100a1868-100a186c 1295->1296 1297 100a186e-100a1880 call 10090f1b 1295->1297 1299 100a18af-100a18bc call 1008a483 1296->1299 1303 100a1882-100a189e call 1008b561 call 1008c694 1297->1303 1304 100a18a4-100a18ac 1297->1304 1309 100a18bf-100a18cb call 10095b75 1303->1309 1310 100a18a0 1303->1310 1304->1299 1310->1304
                    APIs
                      • Part of subcall function 100957F8: __getptd_noexit.LIBCMT ref: 100957F9
                      • Part of subcall function 100A280D: GetLocaleInfoEx.KERNEL32(?,20001004,?,1009325F,?,1009325F,?,20001004,?,00000002,?,00000004,?,00000000), ref: 100A2829
                    • __invoke_watson.LIBCMT ref: 100A1815
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: InfoLocale__getptd_noexit__invoke_watson
                    • String ID:
                    • API String ID: 4206719065-0
                    • Opcode ID: c23591df3ad57b994ff391e212ca46780b61522ade971fd7d53e823a120c12c0
                    • Instruction ID: a576bd8650586abb9e277722035629e1f4e589b6b248a90f927a878d6bbe008c
                    • Opcode Fuzzy Hash: c23591df3ad57b994ff391e212ca46780b61522ade971fd7d53e823a120c12c0
                    • Instruction Fuzzy Hash: 1361C176908615DAEB14CAA4CC86BEE73E8EF013D0F1540A9FD06DA186EB74EE45C760
                    Function 1002B24C Relevance: 6.2, APIs: 4, Instructions: 150libraryloaderCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1002B253
                      • Part of subcall function 1000395E: GetLastError.KERNEL32(?,?,?,10007B00,?,?,?,?,00000000,00000040,1000A532,?,?,?,?,?), ref: 1000397D
                      • Part of subcall function 1000395E: SetLastError.KERNEL32(?,?,?,?,10007B00,?,?,?,?,00000000,00000040,1000A532,?,?,?,?), ref: 100039AB
                      • Part of subcall function 10003B8B: GetLastError.KERNEL32(00000000,?,?,10004A1A,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10003BAA
                      • Part of subcall function 10003B8B: SetLastError.KERNEL32(?,?,?,10004A1A,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10003BD8
                      • Part of subcall function 10003BE6: __EH_prolog3.LIBCMT ref: 10003BED
                      • Part of subcall function 10003BE6: GetLastError.KERNEL32(00000004,10003F3B,00000000,?,00000000,?), ref: 10003C0F
                      • Part of subcall function 10003BE6: SetLastError.KERNEL32(00000000,00000000,?), ref: 10003C48
                      • Part of subcall function 1005E075: __EH_prolog3_GS.LIBCMT ref: 1005E07C
                    • LoadLibraryW.KERNEL32(-00000004,100CB3E4,?,00000000), ref: 1002B38B
                    • GetProcAddress.KERNEL32(00000000,100CB3FC), ref: 1002B3C2
                    • LoadLibraryW.KERNEL32(-00000004,100CB414,?,00000000), ref: 1002B418
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$H_prolog3_LibraryLoad$AddressH_prolog3Proc
                    • String ID:
                    • API String ID: 1413326155-0
                    • Opcode ID: 4376c87fcecde69ad336758e88f9521aa32f28e7e197a7f41f6581f713c63a39
                    • Instruction ID: 68bf939bfe11f4d6fa3e5f4ac0c70a2d743c72e1ee22d7158a8c85a015e508aa
                    • Opcode Fuzzy Hash: 4376c87fcecde69ad336758e88f9521aa32f28e7e197a7f41f6581f713c63a39
                    • Instruction Fuzzy Hash: AF515FB5904A5AEFD705CFB4C885BDDB7B8FF18300F6041AEE10997242DB71A64ACB91
                    Function 070A4990 Relevance: 6.0, APIs: 4, Instructions: 42memoryCOMMON
                    Download Yara Rule
                    APIs
                    • HeapCreate.KERNEL32(00000000,00001000,00000000,?,070A105F,00000001,?,070A123B,?,00000000,?,?,00000001,?), ref: 070A49A4
                    • ___sbh_heap_init.LIBCMTD ref: 070A49D4
                    • HeapDestroy.KERNEL32(073A0000), ref: 070A49E7
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: Heap$CreateDestroy___sbh_heap_init
                    • String ID:
                    • API String ID: 3481495115-0
                    • Opcode ID: 136fbd554c8649e09a01a4bf206749b08e2757e3e67f765eb359934eb5702a00
                    • Instruction ID: 0eb2e16b34b482fc5d94f3693191bcf6125c6b0cf5f2b6ece485778fb433eddf
                    • Opcode Fuzzy Hash: 136fbd554c8649e09a01a4bf206749b08e2757e3e67f765eb359934eb5702a00
                    • Instruction Fuzzy Hash: 06017CB9512381EBCB119ABCED0EB79B2D89709242F014734FD06C6241E6FC98408656
                    Function 070A3E80 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: __malloc_dbg
                    • String ID: stdenvp.c
                    • API String ID: 95588982-3286689081
                    • Opcode ID: a179311bdc74d6ac09d1c71db68f92de64ec5d643e4044abd738c51d1c461c91
                    • Instruction ID: abd383214f4cb505d4d6e38aabb2627be85984442df64405fe7f4dcd836fec01
                    • Opcode Fuzzy Hash: a179311bdc74d6ac09d1c71db68f92de64ec5d643e4044abd738c51d1c461c91
                    • Instruction Fuzzy Hash: F14160F5E00209FFDB04DFE4E841BADB7B1AB45308F158699D8156B381E779AB00CB41
                    Function 1001B097 Relevance: 4.6, APIs: 3, Instructions: 67COMMON
                    Download Yara Rule
                    APIs
                    • VariantInit.OLEAUT32(?), ref: 1001B0B2
                    • FindWindowW.USER32(100CA06C,00000000), ref: 1001B113
                    • VariantClear.OLEAUT32(?), ref: 1001B137
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Variant$ClearFindInitWindow
                    • String ID:
                    • API String ID: 1661748534-0
                    • Opcode ID: 774b093c337ab2f46b0c696f4b35261cff8c6862734b758a4873eb2d35ade9fd
                    • Instruction ID: 6f8079d6328c4085ff94949155ac7bb256617312435a026c83fd7c8c8b293c6e
                    • Opcode Fuzzy Hash: 774b093c337ab2f46b0c696f4b35261cff8c6862734b758a4873eb2d35ade9fd
                    • Instruction Fuzzy Hash: 2C215E7190062ABBCB14DF64CC54AAE77B4FF447A4F968259ED159F290D730E981CBC0
                    Function 10060D95 Relevance: 4.5, APIs: 3, Instructions: 48COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: H_prolog3___wsetlocale_setlocale
                    • String ID:
                    • API String ID: 3835439539-0
                    • Opcode ID: 3c4beb6ab597bb91ad09cec62609dd4bf0ffcab77b5c1b9ee2cbeeaa80ae119c
                    • Instruction ID: 4a64e4bf5562a11e8f2f57b1e988df3fd13ccfbc95e0de9b96d327863519c316
                    • Opcode Fuzzy Hash: 3c4beb6ab597bb91ad09cec62609dd4bf0ffcab77b5c1b9ee2cbeeaa80ae119c
                    • Instruction Fuzzy Hash: CB018F76A84214AFEB08DB90D856BBE33B9EF00710F10400AF501AB1C1DF74BA428799
                    Function 070A5470 Relevance: 3.1, APIs: 2, Instructions: 92memoryCOMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • RtlAllocateHeap.NTDLL(073A0000,00000000,00000000), ref: 070A55A6
                      • Part of subcall function 070A4E50: __malloc_dbg.LIBCMTD ref: 070A4E6F
                      • Part of subcall function 070A4E50: InitializeCriticalSection.KERNEL32(00000000,?,00000009), ref: 070A4EA5
                      • Part of subcall function 070A4E50: EnterCriticalSection.KERNEL32(00000000,00000000,?,070A273A,00000009), ref: 070A4EDD
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: CriticalSection$AllocateEnterHeapInitialize__malloc_dbg
                    • String ID:
                    • API String ID: 1328405978-0
                    • Opcode ID: fe3db2da95e4bd5aa2d4e6767609d70bbb23bced6f25df895b6bff247786cf6c
                    • Instruction ID: d02b04f74ab7a3d3bb1716613afabfa0d1062adc5adf0964406f7af73a78c2c6
                    • Opcode Fuzzy Hash: fe3db2da95e4bd5aa2d4e6767609d70bbb23bced6f25df895b6bff247786cf6c
                    • Instruction Fuzzy Hash: 1F313EF1900245FFDF10CFA8DC55BAD77B5BB41768F148318F9254A281D3B99950CB82
                    Function 1001A6B4 Relevance: 3.0, APIs: 2, Instructions: 47COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ClearH_prolog3Variant
                    • String ID:
                    • API String ID: 3629354427-0
                    • Opcode ID: 6f2aee934f53af77c6b2496fd192b0987bcb4af5965f41d289087bc9140af4c6
                    • Instruction ID: 03c02965fd95d6da0d6da90c667e1ac3c5d3d4e348083f2b04d95882e1518fed
                    • Opcode Fuzzy Hash: 6f2aee934f53af77c6b2496fd192b0987bcb4af5965f41d289087bc9140af4c6
                    • Instruction Fuzzy Hash: 69015B759016269FCB15CB60C845B6EB7B0FF49720F118655E950EB290D771DE41CB90
                    Function 10033C69 Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                    Download Yara Rule
                    APIs
                    • LoadStringW.USER32(?,?,?,?), ref: 10033C7F
                    • LoadStringW.USER32(?,?,?,?), ref: 10033C98
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: LoadString
                    • String ID:
                    • API String ID: 2948472770-0
                    • Opcode ID: 609ecfae1a9f390dba1270c8bc40e3442b2f50dbd3bf3578bb5a533777c8e8e2
                    • Instruction ID: 2b393df98a2ce52d7f24c953ec189db1a4b103028826e688a933ca893fbc997a
                    • Opcode Fuzzy Hash: 609ecfae1a9f390dba1270c8bc40e3442b2f50dbd3bf3578bb5a533777c8e8e2
                    • Instruction Fuzzy Hash: 5CE07E36000629EBCF029FA1DD449CA7F66EB08361F048414FA5955121C7729970AB90
                    Function 100130E1 Relevance: 3.0, APIs: 2, Instructions: 11COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Window$Destroy
                    • String ID:
                    • API String ID: 3707531092-0
                    • Opcode ID: ba0b161149c6725d5a2f957ffd3b629b650c728e6a048603706a18ca3627b20f
                    • Instruction ID: ffefc503d18c55d4cf5dc23f345e1539b250779addc09c15676b73469a2469e0
                    • Opcode Fuzzy Hash: ba0b161149c6725d5a2f957ffd3b629b650c728e6a048603706a18ca3627b20f
                    • Instruction Fuzzy Hash: 02D01231010A609FE7615B20DD0879A7BE4FF003A1F058959F057A5020D7F06CD08B48
                    Function 1000B548 Relevance: 1.7, APIs: 1, Instructions: 222COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1000B552
                      • Part of subcall function 100541FD: __EH_prolog3_catch_GS.LIBCMT ref: 10054207
                      • Part of subcall function 100541FD: vswprintf.LIBCMT ref: 100542BC
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: H_prolog3_H_prolog3_catch_vswprintf
                    • String ID:
                    • API String ID: 4183785953-0
                    • Opcode ID: 510ede3bc6f9391f627a8348faf5d5fc4b4ca66cd856923449fa9baa9ac885f6
                    • Instruction ID: 1e26b0568ea65d7784701a13921b9e433680a45a8917d83560574967191bdf81
                    • Opcode Fuzzy Hash: 510ede3bc6f9391f627a8348faf5d5fc4b4ca66cd856923449fa9baa9ac885f6
                    • Instruction Fuzzy Hash: 5C81A575D00219EFEB10DBB4CD49FEEBB78EF45354F108198E905A7286DB315A09CBA1
                    Function 1004CD0E Relevance: 1.6, APIs: 1, Instructions: 134COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: H_prolog3_
                    • String ID:
                    • API String ID: 2427045233-0
                    • Opcode ID: f415163f9a902d7691bfae72ab3eaade6c132b1f0bc6e034dd04266fe7068785
                    • Instruction ID: 7ee970c92989aaaa6ec733a1c2c2280b74472e0f57de6f1b36975babda45de3d
                    • Opcode Fuzzy Hash: f415163f9a902d7691bfae72ab3eaade6c132b1f0bc6e034dd04266fe7068785
                    • Instruction Fuzzy Hash: 8C414D35901A25AFCB55CFA4C894F9977A5FF09750F2102A4E802EF290DB31ED51CBD5
                    Function 1002B74A Relevance: 1.6, APIs: 1, Instructions: 118COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 1002B751
                      • Part of subcall function 1002B65C: __EH_prolog3.LIBCMT ref: 1002B663
                      • Part of subcall function 1002B24C: __EH_prolog3_GS.LIBCMT ref: 1002B253
                      • Part of subcall function 1002B24C: LoadLibraryW.KERNEL32(-00000004,100CB3E4,?,00000000), ref: 1002B38B
                      • Part of subcall function 10003B8B: GetLastError.KERNEL32(00000000,?,?,10004A1A,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10003BAA
                      • Part of subcall function 10003B8B: SetLastError.KERNEL32(?,?,?,10004A1A,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10003BD8
                      • Part of subcall function 1000395E: GetLastError.KERNEL32(?,?,?,10007B00,?,?,?,?,00000000,00000040,1000A532,?,?,?,?,?), ref: 1000397D
                      • Part of subcall function 1000395E: SetLastError.KERNEL32(?,?,?,?,10007B00,?,?,?,?,00000000,00000040,1000A532,?,?,?,?), ref: 100039AB
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$H_prolog3$H_prolog3_LibraryLoad
                    • String ID:
                    • API String ID: 4151444707-0
                    • Opcode ID: 9ad39d10eb68370d1955794334cf6bd1d6fcf8c029348899ce99450ae8da5951
                    • Instruction ID: f30570787244dc667faa50789d0e892573fb3d0f39bbca8d52927abf9331a41e
                    • Opcode Fuzzy Hash: 9ad39d10eb68370d1955794334cf6bd1d6fcf8c029348899ce99450ae8da5951
                    • Instruction Fuzzy Hash: 125123B4901A4AEFD309CF69C580BD9FBA8FF18304F9042AED15C93641CB757665CB91
                    Function 1003E837 Relevance: 1.6, APIs: 1, Instructions: 116COMMON
                    Download Yara Rule
                    APIs
                    • SysFreeString.OLEAUT32(?), ref: 1003E8FD
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: FreeString
                    • String ID:
                    • API String ID: 3341692771-0
                    • Opcode ID: 587ea5936e53470859edd76c21ae9e4b2eb4b024ba9b1f77d6f56b7e2ee4f41a
                    • Instruction ID: f98dd8f11e02364301545a018fe5fc7541cc73e23256f15a954609a35bc253b3
                    • Opcode Fuzzy Hash: 587ea5936e53470859edd76c21ae9e4b2eb4b024ba9b1f77d6f56b7e2ee4f41a
                    • Instruction Fuzzy Hash: 8741EC34A00288AFDB56DBA0C895BEEBBA9EF06341F10065DF4129B2E1CB71AD45CB51
                    Function 1003EFF3 Relevance: 1.6, APIs: 1, Instructions: 73COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: H_prolog3_
                    • String ID:
                    • API String ID: 2427045233-0
                    • Opcode ID: f3c93f49f3ec0c3ac75310a48cb8269724c32fc259a58b65dbff8a6cf6ba66d6
                    • Instruction ID: 2b7ff181339e1058c583d37bbd567be6317655aecb532160a58374e55a46cb19
                    • Opcode Fuzzy Hash: f3c93f49f3ec0c3ac75310a48cb8269724c32fc259a58b65dbff8a6cf6ba66d6
                    • Instruction Fuzzy Hash: 68210579900119EFDB29CFA4C890AEDB774FF08350F20411DE9616B292DB71A955CB90
                    Function 10016858 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1001685F
                      • Part of subcall function 10003BE6: __EH_prolog3.LIBCMT ref: 10003BED
                      • Part of subcall function 10003BE6: GetLastError.KERNEL32(00000004,10003F3B,00000000,?,00000000,?), ref: 10003C0F
                      • Part of subcall function 10003BE6: SetLastError.KERNEL32(00000000,00000000,?), ref: 10003C48
                      • Part of subcall function 10015F9C: __EH_prolog3_GS.LIBCMT ref: 10015FA3
                      • Part of subcall function 10004EC2: GetLastError.KERNEL32(00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10004ED0
                      • Part of subcall function 10004EC2: SysFreeString.OLEAUT32(?), ref: 10004EE4
                      • Part of subcall function 10004EC2: SetLastError.KERNEL32(?,00000001,00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000), ref: 10004EFE
                      • Part of subcall function 1006472E: GetModuleHandleW.KERNEL32(100D3E90,100D3EA4,?,?,?,100161C2,00000048,10016958,?,?,?,?), ref: 10064741
                      • Part of subcall function 1006472E: GetProcAddress.KERNEL32(00000000), ref: 10064748
                      • Part of subcall function 1006472E: GetCurrentProcess.KERNEL32(00000000,?,?,?,100161C2,00000048,10016958,?,?,?,?), ref: 10064758
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$H_prolog3_$AddressCurrentFreeH_prolog3HandleModuleProcProcessString
                    • String ID:
                    • API String ID: 4263085905-0
                    • Opcode ID: 06d8da404634fd547879e741f6c57fd69e2f4585b14bab54c64fbbbc30179c65
                    • Instruction ID: 2eb3c8a1becfe35d95e0d70d156c905dc1c16d84339df84aacf7e8df99031be6
                    • Opcode Fuzzy Hash: 06d8da404634fd547879e741f6c57fd69e2f4585b14bab54c64fbbbc30179c65
                    • Instruction Fuzzy Hash: 87117274900648EFDB10DBA0C995BDEB778FF14340F50419DF5469B182DF71AA4ACB60
                    Function 1004CEC4 Relevance: 1.5, APIs: 1, Instructions: 38COMMON
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 723748e78597eaa31ef6f2954ec64f5af473e7a6e4b5b628469e5be730df228d
                    • Instruction ID: 365f08528b51f2918b26fef8c4e9360571f1fe726619587995ea96f2ccd41a99
                    • Opcode Fuzzy Hash: 723748e78597eaa31ef6f2954ec64f5af473e7a6e4b5b628469e5be730df228d
                    • Instruction Fuzzy Hash: 3FF0963264016AAB83A1CE29D800F4A77E9EF44AB0726416AED54FB251D720EC0487D9
                    Function 10028BE6 Relevance: 1.5, APIs: 1, Instructions: 36registryCOMMON
                    Download Yara Rule
                    APIs
                    • RegOpenKeyExW.KERNEL32(?,?,00000000,?,?), ref: 10028C10
                      • Part of subcall function 10029010: GetModuleHandleW.KERNEL32(100CAF68,?,?,10028C0E,?,?,00000000,?,?), ref: 10029020
                      • Part of subcall function 10029010: GetProcAddress.KERNEL32(00000000,100CAF84), ref: 10029030
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: AddressHandleModuleOpenProc
                    • String ID:
                    • API String ID: 1337834000-0
                    • Opcode ID: 8c6607b1bc9a95dd8ace39d7019ea724ff521e9b70ddef93acb6219246ba3b50
                    • Instruction ID: 05405a678934769156a1263ef0e0786a34d75087ba98dd094630d5e588d5e27d
                    • Opcode Fuzzy Hash: 8c6607b1bc9a95dd8ace39d7019ea724ff521e9b70ddef93acb6219246ba3b50
                    • Instruction Fuzzy Hash: 8AF0307A602215AF9F08CF59D855EAEB7E9EF84250B54802EF805D3240EB70AE1097A0
                    Function 10013E27 Relevance: 1.5, APIs: 1, Instructions: 33COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Handle
                    • String ID:
                    • API String ID: 2519475695-0
                    • Opcode ID: 7f4bdcf38d6c5e67b4dec57d6815f2db3bca5d2d2a5ba22ce43e672312c40f30
                    • Instruction ID: a36ef7485113e192783c94ae014d12d7a6873368bbc5fa9369476b40644359d1
                    • Opcode Fuzzy Hash: 7f4bdcf38d6c5e67b4dec57d6815f2db3bca5d2d2a5ba22ce43e672312c40f30
                    • Instruction Fuzzy Hash: C8F0363240064AABCF12DE64CC01DDF3BE9FF09674F054215F964960A0C732D9A19B90
                    Function 1001A354 Relevance: 1.5, APIs: 1, Instructions: 32COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_catch_GS.LIBCMT ref: 1001A35B
                      • Part of subcall function 10003BE6: __EH_prolog3.LIBCMT ref: 10003BED
                      • Part of subcall function 10003BE6: GetLastError.KERNEL32(00000004,10003F3B,00000000,?,00000000,?), ref: 10003C0F
                      • Part of subcall function 10003BE6: SetLastError.KERNEL32(00000000,00000000,?), ref: 10003C48
                      • Part of subcall function 10004EC2: GetLastError.KERNEL32(00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10004ED0
                      • Part of subcall function 10004EC2: SysFreeString.OLEAUT32(?), ref: 10004EE4
                      • Part of subcall function 10004EC2: SetLastError.KERNEL32(?,00000001,00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000), ref: 10004EFE
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$FreeH_prolog3H_prolog3_catch_String
                    • String ID:
                    • API String ID: 3758836666-0
                    • Opcode ID: ea1917588e2d3ac1bb81ca60494a29dd08e02f3b8691f3b20d20eeebf7acb87b
                    • Instruction ID: ad24354d67c7624c4820125534a51a2f25b1434c29b2de5550886f1cd41c0ae8
                    • Opcode Fuzzy Hash: ea1917588e2d3ac1bb81ca60494a29dd08e02f3b8691f3b20d20eeebf7acb87b
                    • Instruction Fuzzy Hash: F9F0B475A0524AEFDB04CB94C917BDD73E4EF04200F500059A701AB182DFB9BB459B14
                    Function 1004DC69 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                    Download Yara Rule
                    APIs
                    • LangLoadString.ISRT(?,00002CF8,100FB980,00000004), ref: 1004DCA6
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: LangLoadString
                    • String ID:
                    • API String ID: 2636797913-0
                    • Opcode ID: 270d7e5bdccaff23159951d0e9a5e067c26b41bdd13dedf1e68727ab6e28e8c1
                    • Instruction ID: f515b87ecf4784a8784e53546175b51b2e910eabfaef0ec5b295329eb4924947
                    • Opcode Fuzzy Hash: 270d7e5bdccaff23159951d0e9a5e067c26b41bdd13dedf1e68727ab6e28e8c1
                    • Instruction Fuzzy Hash: F1E0ED70258A0FABEB40FF648DC5A697795E715681F604432FE15CA290D7F0D810FA68
                    Function 1004A49E Relevance: 1.3, APIs: 1, Instructions: 52stringCOMMON
                    Download Yara Rule
                    APIs
                    • lstrlenW.KERNEL32(00000000), ref: 1004A4A7
                      • Part of subcall function 1004A51B: _memset.LIBCMT ref: 1004A56A
                      • Part of subcall function 1004A51B: lstrcpyW.KERNEL32(?,?,?,00000000,?), ref: 1004A58B
                      • Part of subcall function 1004A51B: lstrcatW.KERNEL32(?,100C90D0), ref: 1004A59D
                      • Part of subcall function 1004A51B: GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,?,00000000,?), ref: 1004A5F0
                      • Part of subcall function 1004A51B: GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?), ref: 1004A62B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: DiskFreeSpace$_memsetlstrcatlstrcpylstrlen
                    • String ID:
                    • API String ID: 47180863-0
                    • Opcode ID: 3239f6847dd90395171548ae58405424291af0297ac109e9c25597e99942f6e5
                    • Instruction ID: 30077036e5d70e8c088d954a8c1caaaccf9a761809cd109daeb77839f6ac6d0a
                    • Opcode Fuzzy Hash: 3239f6847dd90395171548ae58405424291af0297ac109e9c25597e99942f6e5
                    • Instruction Fuzzy Hash: 64110C75A0060AEFCF01DFA8C940A9E7BF9FF45254F2081A5EC11D7291E771DA81CB94

                    Non-executed Functions

                    Function 100819A0 Relevance: 121.5, APIs: 80, Instructions: 1483stringCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 100039B9: __EH_prolog3.LIBCMT ref: 100039C0
                      • Part of subcall function 100039B9: GetLastError.KERNEL32(00000004,10003E41,00000000,?,00000000,?,?,1000A50D,?,?,00000001,00000040), ref: 100039E2
                      • Part of subcall function 100039B9: SetLastError.KERNEL32(?,00000000,?,?,1000A50D,?,?,00000001,00000040), ref: 10003A1B
                      • Part of subcall function 10081700: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000027,?,?,1007B801,?,00000000,00000103), ref: 10081726
                      • Part of subcall function 10081700: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,?), ref: 1008176E
                    • GetPrivateProfileIntA.KERNEL32(?,100D4A30,00000000,00000000), ref: 10081A9A
                    • _memset.LIBCMT ref: 10081ACA
                    • _memset.LIBCMT ref: 10081ADB
                    • _memset.LIBCMT ref: 10081AF5
                    • _memset.LIBCMT ref: 10081B0F
                    • _memset.LIBCMT ref: 10081B29
                    • GetSysColor.USER32(00000008), ref: 10081B39
                    • GetSysColor.USER32(00000011), ref: 10081B3D
                    • GetLastError.KERNEL32(?,?,00000001), ref: 10081B75
                    • SetLastError.KERNEL32(100C90B8), ref: 10081BC2
                    • GetLastError.KERNEL32 ref: 10081BD8
                    • SetLastError.KERNEL32(100C90B8), ref: 10081C1F
                      • Part of subcall function 10001123: GetLastError.KERNEL32(00000000,100C90D4,10005872,100C90D8,100C90D4,?,00000000,100C90D4,?,00000000), ref: 10001131
                      • Part of subcall function 10001123: SysFreeString.OLEAUT32(?), ref: 10001145
                      • Part of subcall function 10001123: SetLastError.KERNEL32(?,00000001,00000000), ref: 1000115F
                    • lstrcpy.KERNEL32(00000000,00000000), ref: 10081E43
                    • lstrcpy.KERNEL32(00000000,00000000), ref: 10081E73
                      • Part of subcall function 1008ABD5: _malloc.LIBCMT ref: 1008ABED
                    • lstrcpy.KERNEL32(00000000,100D4A38), ref: 10081F5B
                    • __itow.LIBCMT ref: 10081F6C
                    • lstrcat.KERNEL32(00000000,00000000), ref: 10081F7C
                    • GetLastError.KERNEL32 ref: 10081F96
                    • SetLastError.KERNEL32(100C90E0,100C90D4,100C90D2), ref: 1008202A
                    • GetPrivateProfileIntA.KERNEL32(00000000,00000000,00000000,00000000), ref: 100820A9
                    • GetLastError.KERNEL32 ref: 100820C6
                    • SysFreeString.OLEAUT32(00000000), ref: 100820E8
                    • SysFreeString.OLEAUT32(?), ref: 100820F9
                      • Part of subcall function 10077560: GetLastError.KERNEL32(00000000,10083A67,?,?,?,?,?,?,?,?,?,AD4A72FF,?,000001A4,00000000), ref: 10077571
                      • Part of subcall function 10077560: SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,AD4A72FF,?,000001A4,00000000), ref: 100775A1
                      • Part of subcall function 10077560: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,AD4A72FF,?,000001A4,00000000), ref: 100775B5
                      • Part of subcall function 10077560: SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,AD4A72FF,?,000001A4,00000000), ref: 100775E5
                    • SetLastError.KERNEL32(100C90D8), ref: 10082128
                    • lstrcpy.KERNEL32(00000000,00000000), ref: 10082139
                    • lstrcat.KERNEL32(00000000,100D4A40), ref: 10082148
                    • GetLastError.KERNEL32(?,00000104), ref: 1008217E
                    • SetLastError.KERNEL32(100C90E0,100C90D4,100C90D2), ref: 1008221A
                    • GetPrivateProfileStringA.KERNEL32(00000000,00000000,100C909C,00000000,00000104,?), ref: 100822BA
                    • GetLastError.KERNEL32 ref: 100822D1
                    • SysFreeString.OLEAUT32(00000000), ref: 100822F3
                    • SysFreeString.OLEAUT32(?), ref: 10082304
                    • SetLastError.KERNEL32(100C90D8), ref: 10082333
                    • GetLastError.KERNEL32(00000000,?,00000000), ref: 100823B1
                    • SysFreeString.OLEAUT32(00000000), ref: 100823CD
                    • SysFreeString.OLEAUT32(?), ref: 100823DE
                    • SetLastError.KERNEL32(100C99E4), ref: 1008240D
                    • lstrcpy.KERNEL32(00000000,00000000), ref: 1008241E
                    • lstrcat.KERNEL32(00000000,100D4A44), ref: 1008242D
                    • GetLastError.KERNEL32(?,00000104), ref: 10082463
                    • SetLastError.KERNEL32(100C90E0,100C90D4,100C90D2), ref: 100824FA
                    • GetPrivateProfileStringA.KERNEL32(00000000,00000000,100C909C,00000000,00000104,?), ref: 1008259A
                    • GetLastError.KERNEL32 ref: 100825B1
                    • SysFreeString.OLEAUT32(00000000), ref: 100825D3
                    • SysFreeString.OLEAUT32(?), ref: 100825E4
                    • SetLastError.KERNEL32(100C90D8), ref: 10082613
                    • GetLastError.KERNEL32(00000000,?,00000000), ref: 1008268D
                    • SysFreeString.OLEAUT32(00000000), ref: 100826A9
                    • SysFreeString.OLEAUT32(?), ref: 100826BA
                    • SetLastError.KERNEL32(100C99E4), ref: 100826EF
                    • lstrcpy.KERNEL32(00000000,00000000), ref: 10082704
                    • lstrcat.KERNEL32(00000000,100D49A4), ref: 10082713
                    • GetLastError.KERNEL32 ref: 1008272D
                    • SetLastError.KERNEL32(100C90E0,100C90D4,100C90D2), ref: 100827CA
                    • GetPrivateProfileStringA.KERNEL32(00000000,00000000,100C909C,00000000,000003E8,00000000), ref: 10082851
                    • GetLastError.KERNEL32 ref: 1008286C
                    • SysFreeString.OLEAUT32(00000000), ref: 1008288E
                    • SysFreeString.OLEAUT32(?), ref: 1008289F
                    • SetLastError.KERNEL32(100C90D8), ref: 100828CE
                    • lstrcmp.KERNEL32(00000000,100C909C), ref: 100828F2
                    • lstrcpy.KERNEL32(00000000,00000000), ref: 10082935
                    • lstrcat.KERNEL32(00000000,100D49C0), ref: 10082944
                    • GetPrivateProfileStringA.KERNEL32(00000000,00000000,100C909C,00000000,000003E8,00000000), ref: 100829FD
                    • lstrcmp.KERNEL32(00000000,100C909C), ref: 10082A1E
                      • Part of subcall function 10024FF8: __EH_prolog3_GS.LIBCMT ref: 10024FFF
                      • Part of subcall function 10024FF8: GetLastError.KERNEL32(0000003C,10025275,?,?,00000001,?,00000400,?,00000000,100C9108,80000000,00000001,00000080,00000003,00000000,00000000), ref: 1002502A
                      • Part of subcall function 10024FF8: SetLastError.KERNEL32(?), ref: 1002505B
                      • Part of subcall function 10080CC0: GetLastError.KERNEL32(100D4A60,00000001,00000001,?,?,7563E860,00000000,?,?,?,?,?,?,00000000,100C6670,000000FF), ref: 10080E46
                      • Part of subcall function 10080CC0: SysFreeString.OLEAUT32(100C6670), ref: 10080E62
                      • Part of subcall function 10080CC0: SysFreeString.OLEAUT32(00000000), ref: 10080E6D
                      • Part of subcall function 10080CC0: SetLastError.KERNEL32(`cu,?,?,?,7563E860,00000000), ref: 10080E8D
                    • lstrcpy.KERNEL32(00000000,00000000), ref: 10082A6D
                    • lstrcat.KERNEL32(00000000,100D49C4), ref: 10082A7C
                    • GetPrivateProfileStringA.KERNEL32(00000000,00000000,100C909C,00000000,000003E8,00000000), ref: 10082B35
                    • lstrcmp.KERNEL32(00000000,100C909C), ref: 10082B56
                    • lstrcpy.KERNEL32(00000000,00000000), ref: 10082BA5
                    • lstrcat.KERNEL32(00000000,100D4A4C), ref: 10082BB4
                    • GetPrivateProfileStringA.KERNEL32(00000000,00000000,100C909C,00000000,000003E8,00000000), ref: 10082C6D
                    • lstrcmp.KERNEL32(00000000,100C909C), ref: 10082C8E
                    • GetSysColor.USER32(00000008), ref: 10082CA8
                    • lstrcpy.KERNEL32(00000000,00000000), ref: 10082CE1
                    • lstrcat.KERNEL32(00000000,100D4A54), ref: 10082CF0
                    • GetPrivateProfileStringA.KERNEL32(00000000,00000000,100C909C,00000000,000003E8,00000000), ref: 10082DA9
                    • lstrcmp.KERNEL32(00000000,100C909C), ref: 10082DCA
                    • GetSysColor.USER32(00000011), ref: 10082DE4
                    • wsprintfA.USER32 ref: 10082E24
                    • wsprintfA.USER32 ref: 10082F7A
                      • Part of subcall function 1008ABD5: std::exception::exception.LIBCMT ref: 1008AC09
                      • Part of subcall function 1008ABD5: __CxxThrowException@8.LIBCMT ref: 1008AC1E
                      • Part of subcall function 100772E0: _memset.LIBCMT ref: 100772F1
                      • Part of subcall function 100772E0: _memset.LIBCMT ref: 10077305
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$String$Free$lstrcpy$PrivateProfile$lstrcat$_memset$lstrcmp$Color$ByteCharMultiWidewsprintf$Exception@8H_prolog3H_prolog3_Throw__itow_mallocstd::exception::exception
                    • String ID:
                    • API String ID: 2457224758-0
                    • Opcode ID: 1a15ce9f1616a7419975903e36e942eeaeb30b69ea1399e5db59350d8e685ba1
                    • Instruction ID: 46f52bb08f136be2a0b457a6e4c1751f1ff0e266ade67cada1999daa295f0527
                    • Opcode Fuzzy Hash: 1a15ce9f1616a7419975903e36e942eeaeb30b69ea1399e5db59350d8e685ba1
                    • Instruction Fuzzy Hash: BEE24374D002699FEB60CB64CD88BDDB7B9FF44204F0141EAE549A3291DB76AE94CF90
                    Function 10084490 Relevance: 93.9, APIs: 62, Instructions: 923stringCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 100039B9: __EH_prolog3.LIBCMT ref: 100039C0
                      • Part of subcall function 100039B9: GetLastError.KERNEL32(00000004,10003E41,00000000,?,00000000,?,?,1000A50D,?,?,00000001,00000040), ref: 100039E2
                      • Part of subcall function 100039B9: SetLastError.KERNEL32(?,00000000,?,?,1000A50D,?,?,00000001,00000040), ref: 10003A1B
                      • Part of subcall function 10081700: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000027,?,?,1007B801,?,00000000,00000103), ref: 10081726
                      • Part of subcall function 10081700: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,?), ref: 1008176E
                    • GetPrivateProfileIntA.KERNEL32(?,100D49B0,00000000,00000000), ref: 10084582
                    • _memset.LIBCMT ref: 100845B4
                    • _memset.LIBCMT ref: 100845C5
                    • _memset.LIBCMT ref: 100845DF
                    • GetLastError.KERNEL32 ref: 1008462D
                    • SetLastError.KERNEL32(?), ref: 10084659
                    • lstrcpy.KERNEL32(00000000,100D49B8), ref: 10084675
                    • __itow.LIBCMT ref: 10084685
                    • lstrcat.KERNEL32(00000000,00000000), ref: 10084695
                    • GetLastError.KERNEL32(?,00000104), ref: 100846D1
                    • SetLastError.KERNEL32(100C90E0,100C90D4,100C90D2), ref: 10084770
                    • GetPrivateProfileStringA.KERNEL32(00000000,00000000,100C909C,00000000,00000104,?), ref: 10084810
                    • GetLastError.KERNEL32 ref: 1008482D
                    • SysFreeString.OLEAUT32(00000000), ref: 1008484B
                    • SysFreeString.OLEAUT32(?), ref: 1008485C
                    • SetLastError.KERNEL32(100C90D8), ref: 1008488B
                    • lstrcpy.KERNEL32(00000000,00000000), ref: 100848AE
                    • lstrcat.KERNEL32(00000000,100D49A4), ref: 100848BD
                    • GetLastError.KERNEL32 ref: 100848D7
                    • SetLastError.KERNEL32(100C90E0,100C90D4,100C90D2), ref: 1008496B
                    • GetPrivateProfileStringA.KERNEL32(00000000,00000000,100C909C,00000000,000003E8,00000000), ref: 100849FC
                    • GetLastError.KERNEL32 ref: 10084A20
                    • SysFreeString.OLEAUT32(00000000), ref: 10084A3E
                    • SysFreeString.OLEAUT32(?), ref: 10084A4F
                    • SetLastError.KERNEL32(100C90D8), ref: 10084A7E
                    • lstrcpy.KERNEL32(00000000,00000000), ref: 10084ACF
                    • lstrcat.KERNEL32(00000000,100D49C0), ref: 10084ADE
                    • GetLastError.KERNEL32 ref: 10084AF8
                    • SetLastError.KERNEL32(100C90E0,100C90D4,100C90D2), ref: 10084B8C
                    • GetPrivateProfileStringA.KERNEL32(00000000,00000000,100C909C,00000000,000003E8,00000000), ref: 10084C1D
                    • GetLastError.KERNEL32 ref: 10084C41
                    • SysFreeString.OLEAUT32(00000000), ref: 10084C5F
                    • SysFreeString.OLEAUT32(?), ref: 10084C70
                    • SetLastError.KERNEL32(100C90D8), ref: 10084C9F
                    • lstrcpy.KERNEL32(00000000,00000000), ref: 10084CDF
                    • lstrcat.KERNEL32(00000000,100D49C4), ref: 10084CEE
                    • GetLastError.KERNEL32 ref: 10084D08
                    • SetLastError.KERNEL32(100C90E0,100C90D4,100C90D2), ref: 10084D9C
                    • GetPrivateProfileStringA.KERNEL32(00000000,00000000,100C909C,00000000,000003E8,00000000), ref: 10084E2D
                    • GetLastError.KERNEL32 ref: 10084E4B
                    • SysFreeString.OLEAUT32(00000000), ref: 10084E6D
                    • SysFreeString.OLEAUT32(?), ref: 10084E7E
                    • SetLastError.KERNEL32(100C90D8), ref: 10084EAD
                    • wsprintfA.USER32 ref: 10084EF1
                    • GetLastError.KERNEL32 ref: 10084F1D
                    • SetLastError.KERNEL32(100C90B8,100C90D4,100C90D2), ref: 10084FAF
                    • GetLastError.KERNEL32(?,00000000,000000FF,00000000,?,00000001), ref: 10085006
                    • SysFreeString.OLEAUT32(?), ref: 10085028
                    • SysFreeString.OLEAUT32(?), ref: 10085039
                    • SetLastError.KERNEL32(?), ref: 10085068
                    • _memset.LIBCMT ref: 10085119
                    • _memset.LIBCMT ref: 1008512D
                    • GetLastError.KERNEL32(100C90B0), ref: 10085184
                    • SetLastError.KERNEL32(100C90C8,100C90D4,100C90D2), ref: 1008521A
                    • GetLastError.KERNEL32(100C90C0), ref: 10085250
                    • SysFreeString.OLEAUT32(00000000), ref: 10085272
                    • SysFreeString.OLEAUT32(?), ref: 10085283
                    • SetLastError.KERNEL32(100C90C0), ref: 100852B2
                    • GetLastError.KERNEL32(?,100C90B0), ref: 1008531F
                    • SysFreeString.OLEAUT32(00000000), ref: 1008533D
                    • SysFreeString.OLEAUT32(?), ref: 1008534E
                    • SetLastError.KERNEL32(100C90B0), ref: 1008537D
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$String$Free$PrivateProfile_memset$lstrcatlstrcpy$ByteCharMultiWide$H_prolog3__itowwsprintf
                    • String ID:
                    • API String ID: 3056211105-0
                    • Opcode ID: ca238f368b3fce39b63240e72617026069d6d9989f7c01ddc3452eadfa71db4c
                    • Instruction ID: 53d3ebce27d9d00634eaac4199657dec248d0f753a479802c07f356540778a41
                    • Opcode Fuzzy Hash: ca238f368b3fce39b63240e72617026069d6d9989f7c01ddc3452eadfa71db4c
                    • Instruction Fuzzy Hash: E79246B5D002298FDB60CF64CD84B9AB7B8FF44305F1141EAEA09A7291DB31AE85CF54
                    Function 1009C407 Relevance: 59.9, APIs: 39, Instructions: 1383COMMON
                    Download Yara Rule
                    APIs
                    • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 1009C493
                    • __whiteout.LIBCMT ref: 1009C4FE
                      • Part of subcall function 100910BB: __getptd_noexit.LIBCMT ref: 100910BB
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Locale$UpdateUpdate::___getptd_noexit__whiteout
                    • String ID:
                    • API String ID: 4052982633-0
                    • Opcode ID: 7e6bb879a11b3aaac9dbd8134feed946e47e220a5b241126a6147dac6ab314bf
                    • Instruction ID: 3e082583f38821571031e93be3298ab9c4ddd05b3bd15897bc453af87a1a0f4b
                    • Opcode Fuzzy Hash: 7e6bb879a11b3aaac9dbd8134feed946e47e220a5b241126a6147dac6ab314bf
                    • Instruction Fuzzy Hash: AEB2A975D4526A8BDB25DB14DC98BADB7F4EB48350F2040EBE84DA7281DA309EC1EF50
                    Function 1007C220 Relevance: 42.3, APIs: 28, Instructions: 270nativeCOMMON
                    Download Yara Rule
                    APIs
                    • GetPropW.USER32(?,100D4954), ref: 1007C24B
                    • NtdllDefWindowProc_W.NTDLL(?,?,?,?), ref: 1007C263
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: NtdllProc_PropWindow
                    • String ID:
                    • API String ID: 2172124074-0
                    • Opcode ID: 4fa370804847d37ec94e3704359f09b7a59c4e27bf364909eb092dafb06118bc
                    • Instruction ID: 8d2dd69fa53b2a4ef6697bc36be2c11f2c6ca934a22ad4b40596325a52bd0c22
                    • Opcode Fuzzy Hash: 4fa370804847d37ec94e3704359f09b7a59c4e27bf364909eb092dafb06118bc
                    • Instruction Fuzzy Hash: 5B916F71A0021DAFEB10DFA4DD85FAE77B9FB48310F00409AFA0AE6151DB35AA55CB64
                    Function 100A5E68 Relevance: 21.5, APIs: 14, Instructions: 537COMMONLIBRARYCODE
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: f2d777e9cf5024eb38d47a69bc4e8d66c51d8aca519f577205f77ccc45a84a4f
                    • Instruction ID: f39db442856eb296baae7000015bc1ea0e318d2f0dcef46246f6f1ca41cb03fc
                    • Opcode Fuzzy Hash: f2d777e9cf5024eb38d47a69bc4e8d66c51d8aca519f577205f77ccc45a84a4f
                    • Instruction Fuzzy Hash: 06323A75B02669CBDB24CFA4CD806D9B7F5FB8A354F0541D9E40AA7A81D730AE80CF52
                    Function 10045D87 Relevance: 16.6, APIs: 11, Instructions: 54libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • GetModuleHandleW.KERNEL32(100CCEE0,?,?,100453A5,?,100390CB,00000008,1003B0E0,?,000000D8), ref: 10045D90
                    • GetProcAddress.KERNEL32(00000000,100CCEFC), ref: 10045DA9
                    • GetProcAddress.KERNEL32(00000000,100CCF10), ref: 10045DB4
                    • GetProcAddress.KERNEL32(00000000,100CCF1C), ref: 10045DBF
                    • GetProcAddress.KERNEL32(00000000,100CCF34), ref: 10045DCA
                    • GetProcAddress.KERNEL32(00000000,100CCF4C), ref: 10045DD5
                    • GetProcAddress.KERNEL32(00000000,100CCF60), ref: 10045DE0
                    • GetProcAddress.KERNEL32(00000000,100CCF78), ref: 10045DEB
                    • GetProcAddress.KERNEL32(00000000,100CCF94), ref: 10045DF6
                    • GetProcAddress.KERNEL32(00000000,100CCFA8), ref: 10045E01
                    • GetProcAddress.KERNEL32(00000000,100CCFB0), ref: 10045E0C
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: AddressProc$HandleModule
                    • String ID:
                    • API String ID: 667068680-0
                    • Opcode ID: b82ad8d210f80b6b30983151edc905c83e0aa031959f11a063994ff5ef930972
                    • Instruction ID: b9d4a197a8e955f251592958e19598c771405d9a0ca1ca104d5728898c8ecd95
                    • Opcode Fuzzy Hash: b82ad8d210f80b6b30983151edc905c83e0aa031959f11a063994ff5ef930972
                    • Instruction Fuzzy Hash: F701CCB1C042186A8B10DF7ACE88E8FBEA9DD955A131444EFFA08E7116D7B4C512CEA4
                    Function 100A22BA Relevance: 15.2, APIs: 10, Instructions: 188COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                      • Part of subcall function 100957F8: __getptd_noexit.LIBCMT ref: 100957F9
                    • _memset.LIBCMT ref: 100A22F0
                    • _TranslateName.LIBCMT ref: 100A233B
                    • _TranslateName.LIBCMT ref: 100A2386
                    • GetUserDefaultLCID.KERNEL32(?,?,00000055), ref: 100A23D3
                      • Part of subcall function 100A26CD: _GetTableIndexFromLcid.LIBCMT ref: 100A26FA
                      • Part of subcall function 100A26CD: _wcsnlen.LIBCMT ref: 100A270E
                    • IsValidCodePage.KERNEL32(00000000), ref: 100A2427
                    • IsValidLocale.KERNEL32(?,00000001), ref: 100A243A
                    • GetLocaleInfoW.KERNEL32(?,00001001,?,00000040), ref: 100A248D
                    • GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 100A24A4
                    • __itow_s.LIBCMT ref: 100A24B6
                      • Part of subcall function 1008C89D: _xtow_s@20.LIBCMT ref: 1008C8BF
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Locale$InfoNameTranslateValid$CodeDefaultFromIndexLcidPageTableUser__getptd_noexit__itow_s_memset_wcsnlen_xtow_s@20
                    • String ID:
                    • API String ID: 3898403912-0
                    • Opcode ID: c7d55c3cd1c117e7b360b67a4d4663bad950ba01011a88a440381c1d4a78419c
                    • Instruction ID: 53788f2b2429a62c2a68ae6811f365b16d697db0511698a63363dccf873805a2
                    • Opcode Fuzzy Hash: c7d55c3cd1c117e7b360b67a4d4663bad950ba01011a88a440381c1d4a78419c
                    • Instruction Fuzzy Hash: 56514F72A01229EAEF50DFE8DC85ABE77F8EF09340F010476E915EB191E7749A44CB61
                    Function 070AA750 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 54libraryloaderCOMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • LoadLibraryA.KERNEL32(user32.dll,Microsoft Visual C++ Runtime Library), ref: 070AA76B
                    • GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 070AA783
                    • GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 070AA7A4
                    • GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 070AA7B8
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: AddressProc$LibraryLoad
                    • String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
                    • API String ID: 2238633743-4044615076
                    • Opcode ID: 8d2cb595967172e4bd291df5de569c4bc8664176ac201f7aa6d8f34394075ec8
                    • Instruction ID: 323ad3c1a5b00cdb0eab30a63d9cb30911f6da553b90900f656f67b7ab7d25a6
                    • Opcode Fuzzy Hash: 8d2cb595967172e4bd291df5de569c4bc8664176ac201f7aa6d8f34394075ec8
                    • Instruction Fuzzy Hash: 5111D8F4912308EFCB40DFA4E84AAAE7BF4AB49611F129759E90192290DB7C4A80CF10
                    Function 100B86D3 Relevance: 12.1, APIs: 8, Instructions: 125filestringCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 100B86DD
                      • Part of subcall function 100B79CF: __EH_prolog3_GS.LIBCMT ref: 100B79D9
                      • Part of subcall function 100B79CF: GetFileAttributesW.KERNEL32(00000027,00000084,100B86EF,?,000002E0,1007BFCC,?,00000001), ref: 100B79ED
                      • Part of subcall function 100B79CF: __CxxThrowException@8.LIBCMT ref: 100B7A32
                    • FindFirstFileW.KERNEL32(-00000004,?,1007BFCC,?,00000001), ref: 100B8723
                    • lstrcmpW.KERNEL32(?,100C9120), ref: 100B875A
                    • lstrcmpW.KERNEL32(?,100D35A8), ref: 100B8770
                    • FindNextFileW.KERNEL32(00000000,?), ref: 100B87D6
                    • RemoveDirectoryW.KERNEL32(?), ref: 100B87FE
                    • __CxxThrowException@8.LIBCMT ref: 100B8844
                    • DeleteFileW.KERNEL32(?,000002E0,1007BFCC,?,00000001), ref: 100B8855
                      • Part of subcall function 10012B90: __EH_prolog3_GS.LIBCMT ref: 10012B97
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: File$H_prolog3_$Exception@8FindThrowlstrcmp$AttributesDeleteDirectoryFirstNextRemove
                    • String ID:
                    • API String ID: 1087441661-0
                    • Opcode ID: 01de09bf29c989fcc3a2a444809843700a10202f5e73ca9ad35fcb5f770000fd
                    • Instruction ID: 8416a82ea6eb41312caa9d2c5253893d07329f9ba6775f589be5068e0375262a
                    • Opcode Fuzzy Hash: 01de09bf29c989fcc3a2a444809843700a10202f5e73ca9ad35fcb5f770000fd
                    • Instruction Fuzzy Hash: 37415A7A900259EFDB00DFA0CD8ABDE77BCFF04244F544199EA06A7151EB70AB45CBA1
                    Function 100521D0 Relevance: 12.1, APIs: 8, Instructions: 66memoryCOMMON
                    Download Yara Rule
                    APIs
                    • GetProcessHeap.KERNEL32(00000000,0000000D,?,?,00000001,1001FEF0,?,?,100220ED,00000000,?,?,10022125,?,?), ref: 100521F4
                    • RtlAllocateHeap.NTDLL(00000000,?,100220ED), ref: 100521FB
                      • Part of subcall function 100522A9: IsProcessorFeaturePresent.KERNEL32(0000000C,100521E3,?,?,00000001,1001FEF0,?,?,100220ED,00000000,?,?,10022125,?,?), ref: 100522AB
                    • RtlInterlockedPopEntrySList.NTDLL(00000000), ref: 1005220E
                    • VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,100220ED,00000000,?,?,10022125,?,?,?,1001E154,?), ref: 1005221E
                    • RaiseException.KERNEL32(C0000017,00000000,00000000,00000000,?,100220ED,00000000,?,?,10022125,?,?,?,1001E154,?), ref: 10052232
                    • RtlInterlockedPopEntrySList.NTDLL ref: 10052244
                    • VirtualFree.KERNEL32(00000000,00000000,00008000,?,100220ED,00000000,?,?,10022125,?,?,?,1001E154,?), ref: 10052253
                    • RtlInterlockedPushEntrySList.NTDLL(00000000), ref: 1005226A
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: EntryInterlockedList$HeapVirtual$AllocAllocateExceptionFeatureFreePresentProcessProcessorPushRaise
                    • String ID:
                    • API String ID: 3543143608-0
                    • Opcode ID: 218d32974bcd1b8d26ae6d0950f4c807fa7239e340fbce8c03af607568522c75
                    • Instruction ID: 0bb98d1358e108714178a93b32d870f452a675448bc19926fcc701dbb0182e1e
                    • Opcode Fuzzy Hash: 218d32974bcd1b8d26ae6d0950f4c807fa7239e340fbce8c03af607568522c75
                    • Instruction Fuzzy Hash: ED11A57A604222BBF71197B98DC8F5B379DEF467E1F120421F900E6150DA71DC099BB9
                    Function 070B3E50 Relevance: 10.6, APIs: 7, Instructions: 135COMMON
                    Download Yara Rule
                    APIs
                    • GetLocaleInfoW.KERNEL32(00000000,00000001,00000000,00000000), ref: 070B3E87
                    • GetLocaleInfoA.KERNEL32(00000000,00000001,00000000,00000000), ref: 070B3EA5
                    • GetLocaleInfoA.KERNEL32(00000080,00000000,00000001,00000000), ref: 070B3EDB
                    • GetLocaleInfoW.KERNEL32(00000080,00000000,00000000,00000000), ref: 070B3F0E
                    • GetLocaleInfoW.KERNEL32(00000080,00000000,00000000,00000000), ref: 070B3F80
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: InfoLocale
                    • String ID:
                    • API String ID: 2299586839-0
                    • Opcode ID: f989f96764dce0c6ddbab790b7ae574391955496385eff43826f90b0eda79b87
                    • Instruction ID: fc729e43fb8670f956ec486d23ee28d34575d8de9486af943fa767cf8e388e7f
                    • Opcode Fuzzy Hash: f989f96764dce0c6ddbab790b7ae574391955496385eff43826f90b0eda79b87
                    • Instruction Fuzzy Hash: 9F5130B064420AEBDF20CF95DC46FEEB7F4EB48710F214319F925A62C0D778AA408B61
                    Function 070B3CB0 Relevance: 10.6, APIs: 7, Instructions: 130COMMON
                    Download Yara Rule
                    APIs
                    • GetLocaleInfoW.KERNEL32(00000000,00000001,00000000,00000000), ref: 070B3CE7
                    • GetLocaleInfoA.KERNEL32(00000000,00000001,00000000,00000000), ref: 070B3D05
                    • GetLocaleInfoW.KERNEL32(00000004,070D1D28,00000001,00000000), ref: 070B3D3B
                    • GetLocaleInfoA.KERNEL32(00000004,070D1D28,00000000,00000000), ref: 070B3D6E
                    • GetLocaleInfoA.KERNEL32(00000004,070D1D28,00000000,00000000), ref: 070B3DDE
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: InfoLocale
                    • String ID:
                    • API String ID: 2299586839-0
                    • Opcode ID: 4cdde927d7077ffc861d5a99065a591c6c98401f09321a369a25caf751e824ff
                    • Instruction ID: 29b00717d58cf4fc42a844b02d55ef582cb45569a13b7f7ec4aeadda65c76d2a
                    • Opcode Fuzzy Hash: 4cdde927d7077ffc861d5a99065a591c6c98401f09321a369a25caf751e824ff
                    • Instruction Fuzzy Hash: 5D412EB1A11249EBDB60CF94DC46BEEB7F4EB08710F604719F925A72C0D7789A418B64
                    Function 100522A9 Relevance: 10.5, APIs: 7, Instructions: 42memoryCOMMON
                    Download Yara Rule
                    APIs
                    • IsProcessorFeaturePresent.KERNEL32(0000000C,100521E3,?,?,00000001,1001FEF0,?,?,100220ED,00000000,?,?,10022125,?,?), ref: 100522AB
                    • GetProcessHeap.KERNEL32(00000000,00000008,?,?,0000000C,100521E3,?,?,00000001,1001FEF0,?,?,100220ED,00000000,?), ref: 100522D0
                    • RtlAllocateHeap.NTDLL(00000000,?,100220ED), ref: 100522D7
                    • RtlInitializeSListHead.NTDLL(00000000), ref: 100522E4
                    • InterlockedCompareExchange.KERNEL32(-00000004,00000000,00000000), ref: 100522EE
                    • GetProcessHeap.KERNEL32(00000000,00000000,?,100220ED,00000000,?,?,10022125,?,?,?,1001E154,?), ref: 100522FB
                    • HeapFree.KERNEL32(00000000,?,100220ED,00000000,?,?,10022125,?,?,?,1001E154,?), ref: 10052302
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Heap$Process$AllocateCompareExchangeFeatureFreeHeadInitializeInterlockedListPresentProcessor
                    • String ID:
                    • API String ID: 4165282562-0
                    • Opcode ID: cf1b325caf4e6b40280ce2af035c8584e1309bead00922f38262a1962a5ec4d6
                    • Instruction ID: f423e087d0a460cda94463403e57bcd591b889bae11b0149829c2a46922ac3af
                    • Opcode Fuzzy Hash: cf1b325caf4e6b40280ce2af035c8584e1309bead00922f38262a1962a5ec4d6
                    • Instruction Fuzzy Hash: 31F06D76645222ABE350DB788E8CF0A37ECEF89A62F014465F942E3150DB74DA058B75
                    Function 070A6910 Relevance: 9.5, APIs: 3, Strings: 3, Instructions: 458COMMONLIBRARYCODE
                    Download Yara Rule
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID:
                    • String ID: $ $
                    • API String ID: 0-3665324030
                    • Opcode ID: 5f5be9c7eb8ceedfb8857e32f374ea6dc8f3a977965b4a6aef7fc93f6b6dbcdc
                    • Instruction ID: a201a1b06719d0e7aceaaa1838d12a0e1e655504b28c9cd66a3aca97a2162c48
                    • Opcode Fuzzy Hash: 5f5be9c7eb8ceedfb8857e32f374ea6dc8f3a977965b4a6aef7fc93f6b6dbcdc
                    • Instruction Fuzzy Hash: F822C474A01209EFCB08CF98D595AADFBF2BF88314F29C259E815AB355CA35AD41CF50
                    Function 1005E1FF Relevance: 9.2, APIs: 6, Instructions: 186libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1005E209
                    • GetModuleHandleW.KERNEL32(100D3910,100D3DC4,000000BC,1006111A,?,?,?,?,10060DBE,?,?,0000003C,100304EF,?,00000000,?), ref: 1005E222
                    • GetProcAddress.KERNEL32(00000000), ref: 1005E229
                    • LoadLibraryW.KERNEL32(-00000004,100D3DD8,?,00000000,?,?,10060DBE,?,?,0000003C,100304EF,?,00000000,?,?,100CEF10), ref: 1005E2F9
                    • GetProcAddress.KERNEL32(00000000,100D3DEC), ref: 1005E328
                      • Part of subcall function 10003B8B: GetLastError.KERNEL32(00000000,?,?,10004A1A,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10003BAA
                      • Part of subcall function 10003B8B: SetLastError.KERNEL32(?,?,?,10004A1A,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10003BD8
                      • Part of subcall function 1000EA8B: SysStringLen.OLEAUT32(?), ref: 1000EA98
                      • Part of subcall function 1000EA8B: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 1000EAB2
                      • Part of subcall function 100126FA: __EH_prolog3_GS.LIBCMT ref: 10012701
                      • Part of subcall function 100126FA: GetLastError.KERNEL32(00000038,10054A54,1000B0C9,100C95EC,?), ref: 10012708
                      • Part of subcall function 100126FA: SetLastError.KERNEL32(00000000), ref: 1001275C
                      • Part of subcall function 10003AA0: __EH_prolog3.LIBCMT ref: 10003AA7
                      • Part of subcall function 10003AA0: GetLastError.KERNEL32(00000004,100049CB,0000005C,00000000,00000000,00000000,?,1000DB12,00000000,00000001,00000000,?,000000FF,00000001,00000048,1000E682), ref: 10003AC9
                      • Part of subcall function 10003AA0: SetLastError.KERNEL32(?,00000000,?,1000DB12,00000000,00000001,00000000,?,000000FF,00000001,00000048,1000E682,?), ref: 10003B01
                      • Part of subcall function 10004EC2: GetLastError.KERNEL32(00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10004ED0
                      • Part of subcall function 10004EC2: SysFreeString.OLEAUT32(?), ref: 10004EE4
                      • Part of subcall function 10004EC2: SetLastError.KERNEL32(?,00000001,00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000), ref: 10004EFE
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$String$AddressH_prolog3_Proc$AllocFreeH_prolog3HandleLibraryLoadModule
                    • String ID:
                    • API String ID: 2427421149-0
                    • Opcode ID: 898d79c7416be22ba968a7888fd961740af3f33e296f26dce2f871cfb2343448
                    • Instruction ID: 4d86bc8fa8c915dd720cbf4ad1620eb2ac3b134b79ffa5f7aba087f802759a16
                    • Opcode Fuzzy Hash: 898d79c7416be22ba968a7888fd961740af3f33e296f26dce2f871cfb2343448
                    • Instruction Fuzzy Hash: 5C714D75900358EEEB11DBA0CC95BEDBBB8FF05300F508099E645A7281DB746E49CF62
                    Function 10045996 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 413memoryCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1004599D
                    • LocalAlloc.KERNEL32(00000000,00000044,100CD25C,100CD230,100CD218,100CD200,100CD1E4,100CD1D4,100CD1B4,100CD198,100CD17C,100CD15C,100CD150,100CD128,100CD114,00000060), ref: 10045B65
                    • GetLastError.KERNEL32(?,00000000,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,100CD25C,0000003F,00000000), ref: 10045D48
                    • LocalFree.KERNEL32(?), ref: 10045D77
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Local$AllocErrorFreeH_prolog3_Last
                    • String ID: D
                    • API String ID: 1550486811-2746444292
                    • Opcode ID: bae6d5d60e113a26b6096e4a0417f31a086cfced743c36701e64cfa62dac2a7c
                    • Instruction ID: 0f951a83a7c839fd2f0fa994896ad27cdba198e719d8e08cd4f9434462254372
                    • Opcode Fuzzy Hash: bae6d5d60e113a26b6096e4a0417f31a086cfced743c36701e64cfa62dac2a7c
                    • Instruction Fuzzy Hash: 9AB1F931900209AAE724D7D08D96FFEB3B8EF44741F31013AEE15D6987E763AD04D6A9
                    Function 10060283 Relevance: 9.1, APIs: 6, Instructions: 108processCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1006028D
                      • Part of subcall function 10032261: __EH_prolog3_GS.LIBCMT ref: 10032268
                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000003B,00000000,?,00000001,00000284,1003AFFD,?,?,?,00000001,00000038), ref: 100602F0
                    • GetLastError.KERNEL32(00000002,00000000,0000003B,00000000,?,00000001,00000284,1003AFFD,?,?,?,00000001,00000038), ref: 10060306
                    • Process32FirstW.KERNEL32 ref: 10060325
                    • Process32NextW.KERNEL32(00000000,?), ref: 100603A1
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: H_prolog3_Process32$CreateErrorFirstLastNextSnapshotToolhelp32
                    • String ID:
                    • API String ID: 3102987474-0
                    • Opcode ID: b3d3558b8edc95c16a4f10d38753291dc52c20ccd8a24d433ef3065317a78cc6
                    • Instruction ID: 87d2566dfe87f763ea39fad3d043b9529c13676888e5f80eb5a09ef0ef2e0a90
                    • Opcode Fuzzy Hash: b3d3558b8edc95c16a4f10d38753291dc52c20ccd8a24d433ef3065317a78cc6
                    • Instruction Fuzzy Hash: 34415779D462299FEF60DB64CC89BDEB7B8EF04250F5041CAE909A2291DB706F80CF50
                    Function 070B33D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 266timeCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 070A4E50: __malloc_dbg.LIBCMTD ref: 070A4E6F
                      • Part of subcall function 070A4E50: InitializeCriticalSection.KERNEL32(00000000,?,00000009), ref: 070A4EA5
                      • Part of subcall function 070A4E50: EnterCriticalSection.KERNEL32(00000000,00000000,?,070A273A,00000009), ref: 070A4EDD
                      • Part of subcall function 070A4EF0: LeaveCriticalSection.KERNEL32(?,?,070AE9AE,00000011,?,?,00000000), ref: 070A4EFE
                    • GetTimeZoneInformation.KERNEL32(070D1D40), ref: 070B342E
                    • WideCharToMultiByte.KERNEL32(00000000,00000220,070D1D44,000000FF,070D0DCC,0000003F,00000000,?), ref: 070B34E3
                    • WideCharToMultiByte.KERNEL32(00000000,00000220,070D1D98,000000FF,070D0E0C,0000003F,00000000,?), ref: 070B352A
                    • __malloc_dbg.LIBCMTD ref: 070B35B8
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: CriticalSection$ByteCharMultiWide__malloc_dbg$EnterInformationInitializeLeaveTimeZone
                    • String ID: tzset.c
                    • API String ID: 920344145-289169805
                    • Opcode ID: 8d21e7fba8169824e95a1237dba402e8cdff4f4b97c1f9bd32b0c633c951cea3
                    • Instruction ID: 5bca5a17143908082c09baaf998e8426bcc2a567ead6c249746dd3e57f53029c
                    • Opcode Fuzzy Hash: 8d21e7fba8169824e95a1237dba402e8cdff4f4b97c1f9bd32b0c633c951cea3
                    • Instruction Fuzzy Hash: E7B180F4E01244EBD714CF94E892BADBBF5EB45309F25835AD8199B381DB7CAA44CB01
                    Function 1004C3B7 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 284stringCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1004C3C1
                      • Part of subcall function 10011DEB: __EH_prolog3.LIBCMT ref: 10011DF2
                      • Part of subcall function 10003BE6: __EH_prolog3.LIBCMT ref: 10003BED
                      • Part of subcall function 10003BE6: GetLastError.KERNEL32(00000004,10003F3B,00000000,?,00000000,?), ref: 10003C0F
                      • Part of subcall function 10003BE6: SetLastError.KERNEL32(00000000,00000000,?), ref: 10003C48
                      • Part of subcall function 10015898: __EH_prolog3.LIBCMT ref: 1001589F
                      • Part of subcall function 10004EC2: GetLastError.KERNEL32(00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10004ED0
                      • Part of subcall function 10004EC2: SysFreeString.OLEAUT32(?), ref: 10004EE4
                      • Part of subcall function 10004EC2: SetLastError.KERNEL32(?,00000001,00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000), ref: 10004EFE
                      • Part of subcall function 1004BB3E: __EH_prolog3_GS.LIBCMT ref: 1004BB48
                      • Part of subcall function 1004BB3E: __CxxThrowException@8.LIBCMT ref: 1004BBBE
                      • Part of subcall function 1004BB3E: ReadFile.KERNEL32(?,?,?,?,00000000,0000010C,1004C45D,?,0000000C,100C9108,80000000,00000001,00000080,00000003,00000000,00000000), ref: 1004BBD0
                    • lstrlenW.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,0000000C,?,00000006,00000000,00000000,00000000,?,0000000C,100C9108), ref: 1004C770
                    • lstrcpyW.KERNEL32(?,00000000), ref: 1004C77F
                      • Part of subcall function 1004BC26: __EH_prolog3_GS.LIBCMT ref: 1004BC30
                      • Part of subcall function 1004BC26: __CxxThrowException@8.LIBCMT ref: 1004BCA6
                      • Part of subcall function 1004BC26: ReadFile.KERNEL32(?,?,?,?,00000000,0000010C,1004C4D9,?,00000010,?,0000000C,100C9108,80000000,00000001,00000080,00000003), ref: 1004BCB8
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$H_prolog3H_prolog3_$Exception@8FileReadThrow$FreeStringlstrcpylstrlen
                    • String ID: name
                    • API String ID: 1119492081-1579384326
                    • Opcode ID: 2bafde5522e35e0a4ac67e9377fd3d51bb0e28216c9e85ae53b5477701bf61ab
                    • Instruction ID: 1780de2bdbe1c8fc0232637dee979e232dd6b441b4abdd80f2051972e2be0528
                    • Opcode Fuzzy Hash: 2bafde5522e35e0a4ac67e9377fd3d51bb0e28216c9e85ae53b5477701bf61ab
                    • Instruction Fuzzy Hash: 17A1033490427D9EDB64DB68CC90BFEBBF0EF50241F5041AAE4C5E7281D6389E85DB64
                    Function 100A1E1E Relevance: 6.2, APIs: 4, Instructions: 173COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 100957F8: __getptd_noexit.LIBCMT ref: 100957F9
                    • GetLocaleInfoW.KERNEL32(00000000,?,?,000000F0), ref: 100A1E77
                    • GetLocaleInfoW.KERNEL32(00000000,?,?,000000F0), ref: 100A1EC4
                    • GetLocaleInfoW.KERNEL32(00000000,?,?,000000F0), ref: 100A1F74
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: InfoLocale$__getptd_noexit
                    • String ID:
                    • API String ID: 1862418609-0
                    • Opcode ID: de573a5c68f1718e3aa70d7222bf971cdc3fae3b88df4c33a3f85fbe65a21cba
                    • Instruction ID: 5788a2d30fb5f5745f27716e8c68a4b7e8b2abe62e6115050a5c8280f047424d
                    • Opcode Fuzzy Hash: de573a5c68f1718e3aa70d7222bf971cdc3fae3b88df4c33a3f85fbe65a21cba
                    • Instruction Fuzzy Hash: F551B275508657DFEB18CF64CC82BAA77E8EF017A0F1041B9F904CA191EB74EA91DB50
                    Function 100A2139 Relevance: 6.1, APIs: 4, Instructions: 56COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • _wcscmp.LIBCMT ref: 100A2150
                    • _wcscmp.LIBCMT ref: 100A2161
                    • GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,100A23FF,?,00000000), ref: 100A217D
                    • GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,100A23FF,?,00000000), ref: 100A21A7
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: InfoLocale_wcscmp
                    • String ID:
                    • API String ID: 1351282208-0
                    • Opcode ID: 0ceca3810111c318a2223b6d5790aa33ad2352bbec0f91c971295b9ccc15bd5a
                    • Instruction ID: 8b05680f1637fd608c0c135e49ed7f4b541830111b6a8cb97068d096bf4e98ee
                    • Opcode Fuzzy Hash: 0ceca3810111c318a2223b6d5790aa33ad2352bbec0f91c971295b9ccc15bd5a
                    • Instruction Fuzzy Hash: F7018032204636FBE714CF98DC84FCA37E8EF142E1B004065FA08DA150E730DA81D794
                    Function 1003C60E Relevance: 3.2, APIs: 2, Instructions: 178fileCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1003C618
                      • Part of subcall function 10003B8B: GetLastError.KERNEL32(00000000,?,?,10004A1A,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10003BAA
                      • Part of subcall function 10003B8B: SetLastError.KERNEL32(?,?,?,10004A1A,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10003BD8
                      • Part of subcall function 10003AA0: __EH_prolog3.LIBCMT ref: 10003AA7
                      • Part of subcall function 10003AA0: GetLastError.KERNEL32(00000004,100049CB,0000005C,00000000,00000000,00000000,?,1000DB12,00000000,00000001,00000000,?,000000FF,00000001,00000048,1000E682), ref: 10003AC9
                      • Part of subcall function 10003AA0: SetLastError.KERNEL32(?,00000000,?,1000DB12,00000000,00000001,00000000,?,000000FF,00000001,00000048,1000E682,?), ref: 10003B01
                      • Part of subcall function 1003B6E8: __EH_prolog3_GS.LIBCMT ref: 1003B6EF
                      • Part of subcall function 10003BE6: __EH_prolog3.LIBCMT ref: 10003BED
                      • Part of subcall function 10003BE6: GetLastError.KERNEL32(00000004,10003F3B,00000000,?,00000000,?), ref: 10003C0F
                      • Part of subcall function 10003BE6: SetLastError.KERNEL32(00000000,00000000,?), ref: 10003C48
                      • Part of subcall function 10015F9C: __EH_prolog3_GS.LIBCMT ref: 10015FA3
                    • FindFirstFileW.KERNEL32(-00000004,?,?,?,?,?,100CC20C,?,00000001,?,?,0000005C,?,00000000,?,100C90D4), ref: 1003C7B0
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$H_prolog3_$H_prolog3$FileFindFirst
                    • String ID:
                    • API String ID: 2516304814-0
                    • Opcode ID: e76e2263097790981c6279b36d1c217a37c63378f768e89ca29b5f52d7174154
                    • Instruction ID: 988c876591d905541b559f6d366f9327c215a5b34a9f89a5b8d16dd95afe9e1c
                    • Opcode Fuzzy Hash: e76e2263097790981c6279b36d1c217a37c63378f768e89ca29b5f52d7174154
                    • Instruction Fuzzy Hash: AC812775901268DEDB26CBA0CC95BEEB778FF15300F9041D9E50AA7281DB706B89CF61
                    Function 070B0380 Relevance: 3.1, APIs: 2, Instructions: 147COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 070B0E50: GetVersionExA.KERNEL32(00000094), ref: 070B0E6A
                    • IsValidCodePage.KERNEL32(00000000), ref: 070B04C2
                      • Part of subcall function 070B0A00: EnumSystemLocalesA.KERNEL32(070B0A80,00000001,?,070B046B), ref: 070B0A53
                    • IsValidLocale.KERNEL32(00000000,00000001), ref: 070B04DC
                      • Part of subcall function 070B0BA0: EnumSystemLocalesA.KERNEL32(070B0BF0,00000001,070B0487), ref: 070B0BC6
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: EnumLocalesSystemValid$CodeLocalePageVersion
                    • String ID:
                    • API String ID: 2445944043-0
                    • Opcode ID: cd512991f23562c93f698b1d7c92b78ea794dd706c11fb5dc76591c324a5beb1
                    • Instruction ID: 64409c61740aaa07eb818aaceac6bdae21cce3c5f76f7111c826408aa3d05e6e
                    • Opcode Fuzzy Hash: cd512991f23562c93f698b1d7c92b78ea794dd706c11fb5dc76591c324a5beb1
                    • Instruction Fuzzy Hash: AE518FF060130AEFD760DF60D996BEB37E4AB45745F268728DC119A241DB789B80CB51
                    Function 100A1D1E Relevance: 3.0, APIs: 2, Instructions: 47COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                      • Part of subcall function 100957F8: __getptd_noexit.LIBCMT ref: 100957F9
                    • _GetPrimaryLen.LIBCMT ref: 100A1D69
                    • EnumSystemLocalesW.KERNEL32(100A1E1E,00000001,000000A0,?,?,100A23A8,00000000,?,?,?,?,?,00000055), ref: 100A1D79
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: EnumLocalesPrimarySystem__getptd_noexit
                    • String ID:
                    • API String ID: 1605451767-0
                    • Opcode ID: f3302ba137678e7b11fd6f81bad1d7523329d3e2eb8368c4994b535f835595e5
                    • Instruction ID: 56800df6cf8c6aafe092a1b81c0e3c37f5a6a0a83e296664af62a70edb455531
                    • Opcode Fuzzy Hash: f3302ba137678e7b11fd6f81bad1d7523329d3e2eb8368c4994b535f835595e5
                    • Instruction Fuzzy Hash: A601D632950707DFE721CFB4D505BE5BBE0EF017A1F104929F49A96491D775A454CB40
                    Function 100A21E6 Relevance: 3.0, APIs: 2, Instructions: 40COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 100957F8: __getptd_noexit.LIBCMT ref: 100957F9
                    • GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,100A20BF,00000000,00000000,?), ref: 100A2210
                    • _GetPrimaryLen.LIBCMT ref: 100A222F
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: InfoLocalePrimary__getptd_noexit
                    • String ID:
                    • API String ID: 3580725100-0
                    • Opcode ID: 82531430ac4ec4fc23fb7330d5a0378a78f91713b8a2281539aad7ada8cbe381
                    • Instruction ID: 86287e0da1ca54c0073c1d172bc2f32783f81ab1d845db3d181369edfec00c8f
                    • Opcode Fuzzy Hash: 82531430ac4ec4fc23fb7330d5a0378a78f91713b8a2281539aad7ada8cbe381
                    • Instruction Fuzzy Hash: F8F02432A10021FBEB04E7B8CC05FEE77DCEB002A4F104135E916A3090EA70BE41C7A0
                    Function 100A1D9B Relevance: 3.0, APIs: 2, Instructions: 31COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                      • Part of subcall function 100957F8: __getptd_noexit.LIBCMT ref: 100957F9
                    • _GetPrimaryLen.LIBCMT ref: 100A1DCD
                    • EnumSystemLocalesW.KERNEL32(100A2011,00000001,?,?,100A2372,100931D7,?,?,00000055,?,?,100931D7,?,?,?), ref: 100A1DE0
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: EnumLocalesPrimarySystem__getptd_noexit
                    • String ID:
                    • API String ID: 1605451767-0
                    • Opcode ID: 0381a7bae6102842b96290c9dc7bf9aca24092980a6fce50f93eb8c671a5bd6a
                    • Instruction ID: a461ced78a8f0099c18806124d090ff8b9dd4741fcacc44dcdc7c3a08ef6af40
                    • Opcode Fuzzy Hash: 0381a7bae6102842b96290c9dc7bf9aca24092980a6fce50f93eb8c671a5bd6a
                    • Instruction Fuzzy Hash: C6F0E531950715EFE711DBB8EC05FE67BD5DB023A0F114816F98A8A192DB716940C764
                    Function 100234D7 Relevance: 3.0, APIs: 2, Instructions: 30nativeCOMMON
                    Download Yara Rule
                    APIs
                    • GetPropW.USER32(?,100CAB2C), ref: 10023506
                    • NtdllDefWindowProc_W.NTDLL(?,?,?,?), ref: 10023526
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: NtdllProc_PropWindow
                    • String ID:
                    • API String ID: 2172124074-0
                    • Opcode ID: 88105ee947fe3d9d66ff70c5c02ed667184bd6f500e42e65cfefc47e3f313e36
                    • Instruction ID: 28c7bf364cf322487196968984f729a16f342b37713278a028078b54154c3bb1
                    • Opcode Fuzzy Hash: 88105ee947fe3d9d66ff70c5c02ed667184bd6f500e42e65cfefc47e3f313e36
                    • Instruction Fuzzy Hash: CAF01DB090025A9FCF04DFA8E9449AF7BB5FF48300B408559F909A7211D735EA14DFA5
                    Function 100222F6 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                    Download Yara Rule
                    APIs
                    • GetWindowLongW.USER32(?,000000FC), ref: 10022305
                    • SetWindowLongW.USER32(?,000000FC,?), ref: 10022320
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: LongWindow
                    • String ID:
                    • API String ID: 1378638983-0
                    • Opcode ID: 6af44a328b039a7ac2ffaf6df4d1893f730cec96c21d79f3aa22232f5e1c5342
                    • Instruction ID: 3c5ac632532061133888bc16c4e42449aaa1bb754ec857debadf8d7c4adb2d31
                    • Opcode Fuzzy Hash: 6af44a328b039a7ac2ffaf6df4d1893f730cec96c21d79f3aa22232f5e1c5342
                    • Instruction Fuzzy Hash: 9DF08231200722EBD720DF65ED44907BBE5FB44671711866EE45AC35A0E730EA108B98
                    Function 1003DA79 Relevance: 3.0, APIs: 2, Instructions: 27windowCOMMON
                    Download Yara Rule
                    APIs
                    • GetLastError.KERNEL32(00000000,00000000,?,1003DCE6,100CC258,?,00000000,?), ref: 1003DA80
                    • FormatMessageW.KERNEL32(00001300,00000000,00000000,00000000,00000000,00000000,00000000,?,1003DCE6,100CC258,?,00000000,?), ref: 1003DA96
                      • Part of subcall function 1003D973: lstrcmpW.KERNEL32(00000418,100C90D4,00000000), ref: 1003D990
                      • Part of subcall function 1003D973: lstrcatW.KERNEL32(00000418,100CC660), ref: 1003D9A0
                      • Part of subcall function 1003D973: lstrcatW.KERNEL32(00000418,?), ref: 1003D9AA
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: lstrcat$ErrorFormatLastMessagelstrcmp
                    • String ID:
                    • API String ID: 947592109-0
                    • Opcode ID: e5d78f737ce6099b9028ee67024895b08585235cd335365158aa070fe28b0743
                    • Instruction ID: aba2a7c1289258852e427f3fca82c290860271b4429b03d671dfa325ffdfc963
                    • Opcode Fuzzy Hash: e5d78f737ce6099b9028ee67024895b08585235cd335365158aa070fe28b0743
                    • Instruction Fuzzy Hash: D3E04FB56101247EBB0AAB619E05DBF31ADCAC8E51B04408AF80259180DA609F0182A5
                    Function 10092707 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • SetUnhandledExceptionFilter.KERNEL32(00000000,?,10095AE0,?,?,?,00000001), ref: 1009270C
                    • UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 10092715
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ExceptionFilterUnhandled
                    • String ID:
                    • API String ID: 3192549508-0
                    • Opcode ID: 3b7402024be88041b9bbe753c8720e058b1c6272a8bacc2a30c25157e6819b63
                    • Instruction ID: 7058862cdce79d8c2f9a76bde935fa792a0e57c7de669144b1edef16c0e514fc
                    • Opcode Fuzzy Hash: 3b7402024be88041b9bbe753c8720e058b1c6272a8bacc2a30c25157e6819b63
                    • Instruction Fuzzy Hash: DDB09231044628ABFB402B91DE4DBAE3F28EB04673F004090F60D440B0CB7256508B99
                    Function 070A7730 Relevance: 3.0, Strings: 2, Instructions: 489COMMONLIBRARYCODE
                    Download Yara Rule
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID:
                    • String ID: $
                    • API String ID: 0-227171996
                    • Opcode ID: b98c9b7b019ad7f2de2bb5b43c50729e4ee20e1ac89c4c9f7e511d28801b1b90
                    • Instruction ID: 112872a5c10ca951fe98a3c972268ba3774c8475d313aa27cfebd225405a2884
                    • Opcode Fuzzy Hash: b98c9b7b019ad7f2de2bb5b43c50729e4ee20e1ac89c4c9f7e511d28801b1b90
                    • Instruction Fuzzy Hash: 7032A274A012199FDB04CF98D990AEDFBF2BF88304F24D259D809AB355D735A941CF94
                    Function 070B0EA0 Relevance: 1.6, APIs: 1, Instructions: 118COMMON
                    Download Yara Rule
                    APIs
                    • GetLocaleInfoA.KERNEL32(00000000,?,00000000,?), ref: 070B1018
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: InfoLocale
                    • String ID:
                    • API String ID: 2299586839-0
                    • Opcode ID: 4651b5fc0cc25ae4f59c4b8b86a1d8644316191315823260458c72977df7b10e
                    • Instruction ID: 441b62813402ead773644dcdffd89b0e3098375f808d185cdac2aa2a17fb444e
                    • Opcode Fuzzy Hash: 4651b5fc0cc25ae4f59c4b8b86a1d8644316191315823260458c72977df7b10e
                    • Instruction Fuzzy Hash: C4513DF1E1020AEFCB28CF94C5D46EEBBB5EB55300F148269E415AB684D371AB85CB51
                    Function 100A2011 Relevance: 1.6, APIs: 1, Instructions: 81COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 100957F8: __getptd_noexit.LIBCMT ref: 100957F9
                    • GetLocaleInfoW.KERNEL32(00000000,?,?,000000F0), ref: 100A206A
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: InfoLocale__getptd_noexit
                    • String ID:
                    • API String ID: 2161030339-0
                    • Opcode ID: 913af731310d8a7bcc8bed7b22f43136cd3c026ed054dd14f7c04d9ac32351af
                    • Instruction ID: 2f98e5bca0dfe91da3206eb92111e13b668df4deb18f82d4278f7e7fffb97fb5
                    • Opcode Fuzzy Hash: 913af731310d8a7bcc8bed7b22f43136cd3c026ed054dd14f7c04d9ac32351af
                    • Instruction Fuzzy Hash: 9221C27150422AEFEB24CF68DC46FAA73E8EF41354F10017AF905C7082E774AA84DB61
                    Function 070B0610 Relevance: 1.6, APIs: 1, Instructions: 50COMMON
                    Download Yara Rule
                    APIs
                    • EnumSystemLocalesA.KERNEL32(070B06D0,00000001,?,?,070B0464), ref: 070B068A
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: EnumLocalesSystem
                    • String ID:
                    • API String ID: 2099609381-0
                    • Opcode ID: 538e1ab6e6a90734759379342e8c897e2ddf3a32e6c51c41c72d457f7c184bd3
                    • Instruction ID: 03ee37bb8135c8d43e2221efe91d3d3d1c3ea47a52f4844c6f58b0be4e282c4f
                    • Opcode Fuzzy Hash: 538e1ab6e6a90734759379342e8c897e2ddf3a32e6c51c41c72d457f7c184bd3
                    • Instruction Fuzzy Hash: A01152F5612308ABDB54DB50F96779637F4E788304F264329EC0587240EB7C9E80CB42
                    Function 1001C207 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                    Download Yara Rule
                    APIs
                    • GetSysColor.USER32(00000008), ref: 1001C275
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Color
                    • String ID:
                    • API String ID: 2811717613-0
                    • Opcode ID: 7c8736b9befffca53fd61115a0da451ff8f8ad8b1d3251702c926684b8accaa2
                    • Instruction ID: ee03438197684c2a221c8c5789ff5d78285373b5cf2dfca50b8f81e82cfd55e8
                    • Opcode Fuzzy Hash: 7c8736b9befffca53fd61115a0da451ff8f8ad8b1d3251702c926684b8accaa2
                    • Instruction Fuzzy Hash: 80212DB1801B408FE361CF6AD945786FBE8BFA5714F108E0FD1AA976A0C7B4A1458F54
                    Function 100A1C14 Relevance: 1.5, APIs: 1, Instructions: 42COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 100957F8: __getptd_noexit.LIBCMT ref: 100957F9
                    • GetLocaleInfoW.KERNEL32(00000000,?,?,000000F0,100931DE,00000000,100932FE), ref: 100A1C6C
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: InfoLocale__getptd_noexit
                    • String ID:
                    • API String ID: 2161030339-0
                    • Opcode ID: 22fe4430e3e4f6482b1caa00d612d809d29c3f5568d402cbbb44fd6c4623296e
                    • Instruction ID: e0f2a63cd043dda1b14ec4389e0c230668665da467b5179da41cf297b8334386
                    • Opcode Fuzzy Hash: 22fe4430e3e4f6482b1caa00d612d809d29c3f5568d402cbbb44fd6c4623296e
                    • Instruction Fuzzy Hash: 17F0D135604215ABD714DBA8D84AEBE73ACEB05351F000179E90197181EA746901A764
                    Function 070B0A00 Relevance: 1.5, APIs: 1, Instructions: 33COMMON
                    Download Yara Rule
                    APIs
                    • EnumSystemLocalesA.KERNEL32(070B0A80,00000001,?,070B046B), ref: 070B0A53
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: EnumLocalesSystem
                    • String ID:
                    • API String ID: 2099609381-0
                    • Opcode ID: 1f368b6e4c0b16f21770547fb1e17d2384674fc8fb624535806524a695b511f1
                    • Instruction ID: c3dcba94dcac0dff3d7c2c8657f55add81484735c72e320196cc138b208208cc
                    • Opcode Fuzzy Hash: 1f368b6e4c0b16f21770547fb1e17d2384674fc8fb624535806524a695b511f1
                    • Instruction Fuzzy Hash: 25F036F5512308EBDB54DF90F9667AA37F4E704204F124759EC0597241EB7D9E40CB52
                    Function 070B0BA0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                    Download Yara Rule
                    APIs
                    • EnumSystemLocalesA.KERNEL32(070B0BF0,00000001,070B0487), ref: 070B0BC6
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: EnumLocalesSystem
                    • String ID:
                    • API String ID: 2099609381-0
                    • Opcode ID: f983d8dd9c96be9a5f73d4a1d4e8af5136825bdb8c783c2f6d1c45ca80b6a798
                    • Instruction ID: c440a4e55bf9c76b184d671e03f071d37c63846bf70b2a888eef999939aaebb4
                    • Opcode Fuzzy Hash: f983d8dd9c96be9a5f73d4a1d4e8af5136825bdb8c783c2f6d1c45ca80b6a798
                    • Instruction Fuzzy Hash: A7E0CDBAA113085BDB149B50F85BB5633E5E780604F334315EC0547240EF7CE9C0CB41
                    Function 100B5400 Relevance: 1.3, Strings: 1, Instructions: 17COMMON
                    Download Yara Rule
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID:
                    • String ID: @
                    • API String ID: 0-2766056989
                    • Opcode ID: 1d8ed2934e48e1cf41ea512bd44a1e0e08d8cad1ffa955dc287f681181a4114b
                    • Instruction ID: 7902fef21f701cd2efbfba338a11112a8d992d1b5f1fdc1d169993dafa824424
                    • Opcode Fuzzy Hash: 1d8ed2934e48e1cf41ea512bd44a1e0e08d8cad1ffa955dc287f681181a4114b
                    • Instruction Fuzzy Hash: B3D05E61C0929C7ADF00CEC0A50139CBBE8C74335AF0021C8ED0C12101D37B0F54A385
                    Function 10064A20 Relevance: .7, Instructions: 666COMMON
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: d70a78a24b70e8b50047d4d43358a2896d0a1e01cee125088401b42e74b93592
                    • Instruction ID: af59a42136ad2b18ee267074a558a58d32c5b18bb0df6a088e81953d3a4665db
                    • Opcode Fuzzy Hash: d70a78a24b70e8b50047d4d43358a2896d0a1e01cee125088401b42e74b93592
                    • Instruction Fuzzy Hash: B91277B7F9161447DB0CCA99CCA27EDB2E3AFD4214B0E913DA80AE3745EE7DD8054684
                    Function 070B37B0 Relevance: .2, Instructions: 246COMMON
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 803e322fbb34ddaf35bddbf219687bcc27ff0d5612d91d96d281db884bc79a0f
                    • Instruction ID: d4a0958d503914761624290ca7c1bbb4331e94c51db81d6f6e115e2cda968bef
                    • Opcode Fuzzy Hash: 803e322fbb34ddaf35bddbf219687bcc27ff0d5612d91d96d281db884bc79a0f
                    • Instruction Fuzzy Hash: A09142B5315205AFD758DF55E892FA673E6E748B00F32C218F9098B280EB79DD81CB54
                    Function 100B5450 Relevance: .0, Instructions: 16COMMON
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: fbf069ab025039dcfd0a4d6d2b6752be46817eecc986639a654dc30613719319
                    • Instruction ID: 7c6ae1543cfec8b523bdb3eb9b677102bf1053929015654987e2f4434f43029c
                    • Opcode Fuzzy Hash: fbf069ab025039dcfd0a4d6d2b6752be46817eecc986639a654dc30613719319
                    • Instruction Fuzzy Hash: 9FD092B550960AAF9304CF0BE480821FBA8FF98364320C22AE52C83B00C331B860CFE0
                    Function 1001C1DF Relevance: .0, Instructions: 15COMMON
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: _memset
                    • String ID:
                    • API String ID: 2102423945-0
                    • Opcode ID: 5abea1e376c9fce034adb39b66f85fd906dff791f49773b692a420e04842e8b4
                    • Instruction ID: ff3a4b9ba75d4fe3be903618322ebdf78edab03e996b272ce49c3990fec0e83a
                    • Opcode Fuzzy Hash: 5abea1e376c9fce034adb39b66f85fd906dff791f49773b692a420e04842e8b4
                    • Instruction Fuzzy Hash: 4FE02DB1909B208B8378CF1DE590542BBF0AB1C7103014A6EA08AC7B60D770A9498B88
                    Function 1001C2D0 Relevance: .0, Instructions: 15COMMON
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: _memset
                    • String ID:
                    • API String ID: 2102423945-0
                    • Opcode ID: 5abea1e376c9fce034adb39b66f85fd906dff791f49773b692a420e04842e8b4
                    • Instruction ID: ff3a4b9ba75d4fe3be903618322ebdf78edab03e996b272ce49c3990fec0e83a
                    • Opcode Fuzzy Hash: 5abea1e376c9fce034adb39b66f85fd906dff791f49773b692a420e04842e8b4
                    • Instruction Fuzzy Hash: 4FE02DB1909B208B8378CF1DE590542BBF0AB1C7103014A6EA08AC7B60D770A9498B88
                    Function 100B53D0 Relevance: .0, Instructions: 13COMMON
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 6aa408d7e8106fe6c43df85ecd71d951607ea69366554a407e90b5f4898af375
                    • Instruction ID: cda79499867215c18f5adfcd0d7c7f87c63cc37aeaf86977e91656b7eb72d40c
                    • Opcode Fuzzy Hash: 6aa408d7e8106fe6c43df85ecd71d951607ea69366554a407e90b5f4898af375
                    • Instruction Fuzzy Hash: 7BD0C92D90925EFBDB00EFA8988609CBFB6E746101F5581DACD5863301F2301B99DBA1
                    Function 100B53B0 Relevance: .0, Instructions: 11COMMON
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 39bde44087fe4cc3178a62ac09361430c9edf68b2fff908e07c95bb286dcec1c
                    • Instruction ID: e72fe0dd5d573c1a81c65bc771f30a9e891171d779174c8065e66299d6432358
                    • Opcode Fuzzy Hash: 39bde44087fe4cc3178a62ac09361430c9edf68b2fff908e07c95bb286dcec1c
                    • Instruction Fuzzy Hash: DAC08C2B90C60C17CB20AAB89C0238CB7688B01110F000180FC0882308D2209A24818E
                    Function 100507FC Relevance: 60.3, APIs: 40, Instructions: 268windowCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 10050A8F: CreateCompatibleDC.GDI32(1004DF85), ref: 10050A98
                      • Part of subcall function 10050A8F: CreateCompatibleBitmap.GDI32(1004DF85,?,?), ref: 10050AB6
                      • Part of subcall function 10050A8F: SelectObject.GDI32(00000000,00000000), ref: 10050AC1
                      • Part of subcall function 10050A8F: BitBlt.GDI32(00000000,00000000,00000000,?,?,1004DF85,00000000,?,00CC0020), ref: 10050AEB
                      • Part of subcall function 10050A8F: SelectObject.GDI32(00000000,00000000), ref: 10050AF3
                      • Part of subcall function 10050A8F: DeleteDC.GDI32(00000000), ref: 10050AFA
                    • SaveDC.GDI32(?), ref: 1005081B
                    • CreateCompatibleDC.GDI32(?), ref: 1005082D
                    • CreateCompatibleBitmap.GDI32(?,?,?), ref: 10050848
                    • SelectObject.GDI32(00000000,00000000), ref: 10050851
                    • CreateCompatibleDC.GDI32(?), ref: 1005085A
                    • CreateCompatibleBitmap.GDI32(?,?,?), ref: 10050872
                    • SelectObject.GDI32(1004DF85,00000000), ref: 1005087B
                    • CreateCompatibleDC.GDI32(?), ref: 10050887
                    • SelectObject.GDI32(00000000,00000000), ref: 1005088E
                    • CreateCompatibleDC.GDI32(?), ref: 1005089A
                    • CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 100508B7
                    • SelectObject.GDI32(00000000,00000000), ref: 100508C2
                    • CreateCompatibleDC.GDI32(?), ref: 100508CE
                    • SelectObject.GDI32(00000000,00000000), ref: 100508D9
                    • SetBkColor.GDI32(00000000,10050B80), ref: 100508E6
                    • CreateCompatibleDC.GDI32(?), ref: 100508EF
                    • CreateCompatibleBitmap.GDI32(?,?,?), ref: 10050909
                    • SelectObject.GDI32(00000000,00000000), ref: 10050910
                    • BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 1005093E
                    • BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 10050960
                    • BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 10050981
                    • BitBlt.GDI32(1004DF85,00000000,00000000,?,?,00000000,00000000,00000000,00330008), ref: 100509A2
                    • BitBlt.GDI32(1004DF85,00000000,00000000,?,?,00000000,00000000,00000000,008800C6), ref: 100509C5
                    • BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,008800C6), ref: 100509E8
                    • BitBlt.GDI32(00000000,00000000,00000000,?,?,1004DF85,00000000,00000000,00EE0086), ref: 10050A0B
                    • SelectObject.GDI32(00000000,?), ref: 10050A11
                    • DeleteObject.GDI32(1004DF85), ref: 10050A20
                    • DeleteDC.GDI32(00000000), ref: 10050A29
                    • SelectObject.GDI32(?,10050B80), ref: 10050A31
                    • DeleteDC.GDI32(?), ref: 10050A3A
                    • SelectObject.GDI32(00000000,00000000), ref: 10050A41
                    • DeleteObject.GDI32(10050B80), ref: 10050A4A
                    • DeleteDC.GDI32(00000000), ref: 10050A4D
                    • SelectObject.GDI32(1004DF85,?), ref: 10050A56
                    • DeleteObject.GDI32(?), ref: 10050A5F
                    • DeleteDC.GDI32(1004DF85), ref: 10050A62
                    • SelectObject.GDI32(00000000,?), ref: 10050A6B
                    • DeleteDC.GDI32(00000000), ref: 10050A72
                    • DeleteDC.GDI32(00000000), ref: 10050A77
                    • RestoreDC.GDI32(?,?), ref: 10050A7F
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Object$Select$Create$Compatible$Delete$Bitmap$ColorRestoreSave
                    • String ID:
                    • API String ID: 999709688-0
                    • Opcode ID: 1c88dde3ab484b73f43deb2ccc72b54fb3e7205eedd9202556bbeba6ee4b305c
                    • Instruction ID: c4a12f01dad33ae8a149a9502dca6b2e493d8440f5476becb6c84687d9206737
                    • Opcode Fuzzy Hash: 1c88dde3ab484b73f43deb2ccc72b54fb3e7205eedd9202556bbeba6ee4b305c
                    • Instruction Fuzzy Hash: FBA1D671900118BFDB04DFA8CD89CAEBFB9FF88710B158059F91997221CB329912DFA4
                    Function 10085510 Relevance: 59.8, APIs: 33, Strings: 1, Instructions: 329memoryCOMMON
                    Download Yara Rule
                    APIs
                    • GetTickCount.KERNEL32 ref: 1008554D
                      • Part of subcall function 10071F00: GetLastError.KERNEL32(AD4A72FF,7563E860), ref: 10071F4C
                      • Part of subcall function 10071F00: SetLastError.KERNEL32(100C90C8,00000000,00000000,000000FF), ref: 10071FAC
                      • Part of subcall function 10071F00: GetLastError.KERNEL32(00000000,00000000,000000FF), ref: 10071FDA
                      • Part of subcall function 10071F00: SetLastError.KERNEL32(?,?,00000000,000000FF), ref: 10072028
                    • GetLastError.KERNEL32(00000000,00000004,?), ref: 100855F4
                    • SysFreeString.OLEAUT32(?), ref: 10085609
                    • SysFreeString.OLEAUT32(?), ref: 1008561A
                    • SetLastError.KERNEL32(?), ref: 10085649
                    • GetLastError.KERNEL32 ref: 10085660
                    • SysFreeString.OLEAUT32(?), ref: 10085678
                    • SysFreeString.OLEAUT32(?), ref: 10085689
                    • SetLastError.KERNEL32(?), ref: 100856B8
                    • GetLastError.KERNEL32 ref: 100856C9
                    • SysFreeString.OLEAUT32(?), ref: 100856DB
                    • SysFreeString.OLEAUT32(?), ref: 100856E6
                    • SetLastError.KERNEL32(?), ref: 10085706
                    • GetLastError.KERNEL32 ref: 1008571D
                    • SysFreeString.OLEAUT32(?), ref: 10085735
                    • SysFreeString.OLEAUT32(?), ref: 10085746
                    • SetLastError.KERNEL32(?), ref: 1008577B
                    • GetLastError.KERNEL32 ref: 1008578B
                    • SetLastError.KERNEL32(100C99EC), ref: 100857B7
                    • SysStringLen.OLEAUT32(?), ref: 100857E0
                    • SysReAllocStringLen.OLEAUT32(7572E034,7572E014,?), ref: 100857FD
                    • _wmemcpy_s.LIBCMT ref: 10085839
                    • wsprintfW.USER32 ref: 10085861
                    • GetFileAttributesW.KERNEL32(00000000,?,00000000,000000FF), ref: 10085897
                    • GetLastError.KERNEL32 ref: 100858C5
                    • SysFreeString.OLEAUT32(?), ref: 100858D7
                    • SysFreeString.OLEAUT32(?), ref: 100858E2
                    • SetLastError.KERNEL32(100C99E4), ref: 10085902
                    • __CxxThrowException@8.LIBCMT ref: 10085996
                    • GetLastError.KERNEL32(100C9930,100E6030), ref: 1008599D
                    • SysFreeString.OLEAUT32(?), ref: 100859B3
                    • SysFreeString.OLEAUT32(?), ref: 100859BE
                    • SetLastError.KERNEL32(100C99E4), ref: 100859DE
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$String$Free$AllocAttributesCountException@8FileThrowTick_wmemcpy_swsprintf
                    • String ID: P
                    • API String ID: 2442431672-3110715001
                    • Opcode ID: c953d2b6c5b4d208fe5b1c0ad160abea452f2a8e5c6686b3c33db3278dd704f5
                    • Instruction ID: 9917bb493485ef96c8bc5c928ed0dde5becf7f5435922d7a6e385d49faf60fad
                    • Opcode Fuzzy Hash: c953d2b6c5b4d208fe5b1c0ad160abea452f2a8e5c6686b3c33db3278dd704f5
                    • Instruction Fuzzy Hash: 11E11374D00218DFEB10DFA8CD84B9DBBB1FF08315F1181A9E949A72A1DB35AA84CF54
                    Function 1004649E Relevance: 56.3, APIs: 31, Strings: 1, Instructions: 316windowstringCOMMON
                    Download Yara Rule
                    APIs
                    • GetWindow.USER32(?,00000005), ref: 100464C1
                    • GetWindow.USER32(00000000,00000000), ref: 100464D4
                    • MapDialogRect.USER32(?,00000000), ref: 10046506
                      • Part of subcall function 10042FE4: __EH_prolog3_GS.LIBCMT ref: 10042FEE
                      • Part of subcall function 10042FE4: LoadLibraryW.KERNEL32(?,?,100CCCAC,?,00000000,00000000,00000000), ref: 10043086
                      • Part of subcall function 10042FE4: GetProcAddress.KERNEL32(00000000,100CCCC4), ref: 1004309E
                      • Part of subcall function 10042FE4: MonitorFromPoint.USER32(00000001,00000001,00000002), ref: 100430B4
                      • Part of subcall function 10042FE4: MulDiv.KERNEL32(?,00000064,00000060), ref: 10043114
                    • MulDiv.KERNEL32(00000003,00000064,00000064), ref: 10046555
                    • MulDiv.KERNEL32(00000001,00000064,00000064), ref: 1004657B
                    • GetClassNameW.USER32(00000000,?,000000FF), ref: 100465C4
                    • lstrcmpW.KERNEL32(?,100CCDC0), ref: 100465D6
                    • GetWindowTextW.USER32(00000000,?,0000000A), ref: 100465EB
                    • lstrcmpW.KERNEL32(?,100C90D4), ref: 100465FA
                    • GetWindowRect.USER32(00000000,?), ref: 1004660C
                    • ScreenToClient.USER32(?,?), ref: 10046626
                    • MoveWindow.USER32(00000000,?,?,?,?,00000000), ref: 10046642
                    • GetWindowRect.USER32(00000000,?), ref: 10046650
                    • ScreenToClient.USER32(?,?), ref: 1004665E
                    • lstrcmpW.KERNEL32(?,100CCE50), ref: 10046670
                    • GetWindow.USER32(00000000,00000002), ref: 1004667D
                    • GetWindowRect.USER32(00000000,?), ref: 1004669D
                      • Part of subcall function 10042FE4: GetDC.USER32(00000000), ref: 100430E6
                      • Part of subcall function 10042FE4: GetDeviceCaps.GDI32(00000000,00000058), ref: 100430F5
                      • Part of subcall function 10042FE4: ReleaseDC.USER32(00000000,00000000), ref: 10043104
                    • ScreenToClient.USER32(?,?), ref: 100466E2
                    • MoveWindow.USER32(00000000,?,?,?,-00000009,00000000), ref: 10046715
                    • GetWindowRect.USER32(00000000,?), ref: 10046723
                    • ScreenToClient.USER32(?,?), ref: 10046731
                    • CreateWindowExW.USER32(00000000,100CCDC0,?,50020000,?,?,?,?,?,00000000,00000000,00000000), ref: 1004676D
                    • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 10046786
                    • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 100467C2
                    • CreateWindowExW.USER32(00000204,100CCDA4,100CCDA4,50030080,?,?,?,00000000,?,00000004,00000000,00000000), ref: 100467FE
                    • SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 10046818
                    • SetWindowTextW.USER32(?,?), ref: 1004682A
                    • SendMessageW.USER32(?,000000C5,00000104,00000000), ref: 10046842
                    • CreateWindowExW.USER32(00000000,100CCDC0,?,50020000,?,00000000,?,?,?,00000000,00000000,00000000), ref: 10046887
                    • SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 1004689B
                    • SendMessageW.USER32(?,00000467,00000001,?), ref: 100468DB
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Window$MessageSend$Rect$ClientScreen$Createlstrcmp$MoveText$AddressCapsClassDeviceDialogFromH_prolog3_LibraryLoadMonitorNamePointProcRelease
                    • String ID: d
                    • API String ID: 1129425424-2564639436
                    • Opcode ID: a4b84cd35efc3c34cbcdedc7d8cbd47d8390764a6a36297f42239eed049a8a9b
                    • Instruction ID: 2f6e6b3936e6c344073657cb8f45f0edb58e24fa730079dc1b48a600b8ddc991
                    • Opcode Fuzzy Hash: a4b84cd35efc3c34cbcdedc7d8cbd47d8390764a6a36297f42239eed049a8a9b
                    • Instruction Fuzzy Hash: ABC14EB6901229AFEF60DB64CD8DFAAB7B8EF48750F0141E5F509E2150DB70AE848F54
                    Function 10083180 Relevance: 51.5, APIs: 34, Instructions: 494stringCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 100039B9: __EH_prolog3.LIBCMT ref: 100039C0
                      • Part of subcall function 100039B9: GetLastError.KERNEL32(00000004,10003E41,00000000,?,00000000,?,?,1000A50D,?,?,00000001,00000040), ref: 100039E2
                      • Part of subcall function 100039B9: SetLastError.KERNEL32(?,00000000,?,?,1000A50D,?,?,00000001,00000040), ref: 10003A1B
                      • Part of subcall function 10081700: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000027,?,?,1007B801,?,00000000,00000103), ref: 10081726
                      • Part of subcall function 10081700: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,?), ref: 1008176E
                    • GetPrivateProfileIntA.KERNEL32(?,100D4994,00000000,?), ref: 10083277
                    • _memset.LIBCMT ref: 100832A7
                    • _memset.LIBCMT ref: 100832B8
                    • _memset.LIBCMT ref: 100832D2
                    • lstrcpy.KERNEL32(00000000,100D499C), ref: 10083312
                    • __itow.LIBCMT ref: 10083322
                    • lstrcat.KERNEL32(00000000,00000000), ref: 10083332
                    • GetLastError.KERNEL32 ref: 1008334C
                    • SetLastError.KERNEL32(100C90E0,100C90D4,100C90D2), ref: 100833DA
                    • GetPrivateProfileStringA.KERNEL32(00000000,00000000,100C909C,00000000,000003E8,00000000), ref: 1008346E
                    • GetLastError.KERNEL32 ref: 1008348C
                    • SysFreeString.OLEAUT32(00000000), ref: 100834AE
                    • SysFreeString.OLEAUT32(?), ref: 100834BF
                    • SetLastError.KERNEL32(100C90D8), ref: 100834F4
                    • GetSysColor.USER32(0000000F), ref: 100834F8
                    • CreateSolidBrush.GDI32(?), ref: 1008352E
                    • lstrcpy.KERNEL32(00000000,00000000), ref: 10083542
                    • lstrcat.KERNEL32(00000000,100D49A4), ref: 10083551
                    • GetLastError.KERNEL32 ref: 1008356B
                    • SetLastError.KERNEL32(100C90E0,100C90D4,100C90D2), ref: 100835FA
                    • GetPrivateProfileStringA.KERNEL32(00000000,00000000,100C909C,00000000,000003E8,00000000), ref: 10083687
                    • GetLastError.KERNEL32 ref: 100836A5
                    • SysFreeString.OLEAUT32(00000000), ref: 100836C7
                    • SysFreeString.OLEAUT32(?), ref: 100836D8
                    • SetLastError.KERNEL32(100C90D8), ref: 1008370D
                    • lstrcpy.KERNEL32(00000000,00000000), ref: 1008375B
                    • lstrcat.KERNEL32(00000000,100D49A8), ref: 1008376A
                    • GetLastError.KERNEL32 ref: 10083784
                    • SetLastError.KERNEL32(100C90E0,100C90D4,00000000), ref: 1008380A
                    • GetPrivateProfileStringA.KERNEL32(00000000,00000000,100C909C,00000000,000003E8,00000000), ref: 10083891
                    • GetLastError.KERNEL32 ref: 100838AF
                    • SysFreeString.OLEAUT32(00000000), ref: 100838D1
                    • SysFreeString.OLEAUT32(?), ref: 100838E2
                    • SetLastError.KERNEL32(100C90D8), ref: 10083917
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$String$Free$PrivateProfile$_memsetlstrcatlstrcpy$ByteCharMultiWide$BrushColorCreateH_prolog3Solid__itow
                    • String ID:
                    • API String ID: 2353542737-0
                    • Opcode ID: d2eb438b152d666f500cad481e219b63159a95eef3f612c1c147320520099b07
                    • Instruction ID: c0fbdb3e4b9edcf8854e0f42829148013592a086d15b4f1cf83eb06cedb2066a
                    • Opcode Fuzzy Hash: d2eb438b152d666f500cad481e219b63159a95eef3f612c1c147320520099b07
                    • Instruction Fuzzy Hash: 9C2226B5D012699FEB60CF54CD84B9DB7B8FB44304F1141EAEA09A7291DB70AE84CF58
                    Function 1007A6B0 Relevance: 51.1, APIs: 28, Strings: 1, Instructions: 395stringwindowCOMMON
                    Download Yara Rule
                    APIs
                    • _memset.LIBCMT ref: 1007A6DF
                    • GetClassNameW.USER32(?,?,00000032), ref: 1007A6EE
                    • lstrcmpiW.KERNEL32(100CCD80,?), ref: 1007A703
                    • GetWindowLongW.USER32(?,000000F0), ref: 1007A710
                    • SetWindowLongW.USER32(?,000000F0,?), ref: 1007A7A6
                    • GetWindowLongW.USER32(?,000000F4), ref: 1007A7AF
                    • GetWindowRect.USER32(?,?), ref: 1007A8DB
                    • MulDiv.KERNEL32(?,000186A0,000186A0), ref: 1007A922
                    • MulDiv.KERNEL32(?,?,000186A0), ref: 1007A93F
                    • MulDiv.KERNEL32(?,000186A0,?), ref: 1007A969
                    • MulDiv.KERNEL32(?,000186A0,?), ref: 1007A9A8
                    • ScreenToClient.USER32(?,?), ref: 1007A9D4
                    • MulDiv.KERNEL32(?,?,00000004), ref: 1007A9F6
                    • MulDiv.KERNEL32(?,?,00000008), ref: 1007AA10
                    • MoveWindow.USER32(?,?,00000000,?,?,00000000), ref: 1007AA2F
                    • lstrcmpiW.KERNEL32(100CCDC0,?), ref: 1007AA43
                    • GetWindowLongW.USER32(?,000000F0), ref: 1007AA56
                    • GetWindowLongW.USER32(?,000000F0), ref: 1007AA67
                    • GetWindowRect.USER32(?,?), ref: 1007AA79
                    • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 1007AA8A
                    • SendMessageW.USER32(?,00000171,00000000,00000000), ref: 1007AAA6
                    • GetWindowLongW.USER32(?,000000F4), ref: 1007AAC9
                    • ShowWindow.USER32(?,00000000,?), ref: 1007AAFE
                    • GetWindowTextW.USER32(?,?,0000000A), ref: 1007AB41
                    • SetWindowLongW.USER32(?,000000FC,1007C590), ref: 1007AB56
                    • SetPropW.USER32(?,100D4B08,?), ref: 1007AB73
                    • SetPropW.USER32(?,100D4B28,00000000), ref: 1007AB7C
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Window$Long$PropRectlstrcmpi$ClassClientMessageMoveNamePointsScreenSendShowText_memset
                    • String ID: @
                    • API String ID: 2481118448-2766056989
                    • Opcode ID: 73f3f4d427baf22541ff0ffb3b13b00f5d462675c67b37976956eb2fbe87a6a7
                    • Instruction ID: 0043572727c2ae94045aaff761ac1edb27ef41ad12dbef2f374f0da24e013a94
                    • Opcode Fuzzy Hash: 73f3f4d427baf22541ff0ffb3b13b00f5d462675c67b37976956eb2fbe87a6a7
                    • Instruction Fuzzy Hash: E4F17874A00605AFD710CFA4CD84EAABBF5FB49310F108599E99ADB352DB34ED81CB54
                    Function 1007ABD0 Relevance: 50.0, APIs: 33, Instructions: 476stringwindowCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 10024FF8: __EH_prolog3_GS.LIBCMT ref: 10024FFF
                      • Part of subcall function 10024FF8: GetLastError.KERNEL32(0000003C,10025275,?,?,00000001,?,00000400,?,00000000,100C9108,80000000,00000001,00000080,00000003,00000000,00000000), ref: 1002502A
                      • Part of subcall function 10024FF8: SetLastError.KERNEL32(?), ref: 1002505B
                    • wsprintfA.USER32 ref: 1007AC5A
                      • Part of subcall function 10001123: GetLastError.KERNEL32(00000000,100C90D4,10005872,100C90D8,100C90D4,?,00000000,100C90D4,?,00000000), ref: 10001131
                      • Part of subcall function 10001123: SysFreeString.OLEAUT32(?), ref: 10001145
                      • Part of subcall function 10001123: SetLastError.KERNEL32(?,00000001,00000000), ref: 1000115F
                    • GetLastError.KERNEL32 ref: 1007ACB2
                    • SetLastError.KERNEL32(?,?,00000000,000000FF), ref: 1007AD00
                    • lstrcpy.KERNEL32(000000D0,?), ref: 1007AD49
                    • lstrcpy.KERNEL32(00000004,0000000A), ref: 1007AD50
                    • lstrcpy.KERNEL32(00000068,1003E40D), ref: 1007AD60
                    • MapDialogRect.USER32(?,?), ref: 1007AD9E
                    • MulDiv.KERNEL32(?,000186A0,00000006), ref: 1007ADC9
                    • MulDiv.KERNEL32(?,000186A0,0000000D), ref: 1007ADDE
                    • MulDiv.KERNEL32(?,?,00000004), ref: 1007AE46
                    • MulDiv.KERNEL32(?,?,00000008), ref: 1007AE72
                    • GetClientRect.USER32(?,?), ref: 1007AF05
                    • CreateDCW.GDI32(100CE57C,00000000,00000000,00000000), ref: 1007AF16
                    • CreateCompatibleDC.GDI32(00000000), ref: 1007AF22
                    • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 1007AF3B
                    • SelectObject.GDI32(?,00000000), ref: 1007AF4E
                    • MulDiv.KERNEL32(?,?,00000004), ref: 1007AF7E
                    • MulDiv.KERNEL32(?,?,00000008), ref: 1007AF91
                    • MulDiv.KERNEL32(?,?,00000004), ref: 1007AFA4
                    • MulDiv.KERNEL32(?,?,00000008), ref: 1007AFB7
                    • FillRect.USER32(?,?,?), ref: 1007AFCC
                    • GetDlgItem.USER32(?,?), ref: 1007B0EF
                    • DrawIcon.USER32(?,?,?,00000000), ref: 1007B106
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$CreateRectlstrcpy$Compatible$BitmapClientDialogDrawFillFreeH_prolog3_IconItemObjectSelectStringwsprintf
                    • String ID:
                    • API String ID: 3678071035-0
                    • Opcode ID: 712bfb1618c6c807d539a1c749b2e2908b9d4d06c2864ce5728f6327cefed304
                    • Instruction ID: aa957c51abd2e216f63014b305cd2f2d3d05cf80594158f81161c46eac93c142
                    • Opcode Fuzzy Hash: 712bfb1618c6c807d539a1c749b2e2908b9d4d06c2864ce5728f6327cefed304
                    • Instruction Fuzzy Hash: 5222CF71A00654EFDB21CF64C888F99BBF1FF49310F098199E589AB2A1C735AD84CF94
                    Function 1004E57C Relevance: 40.7, APIs: 27, Instructions: 177COMMON
                    Download Yara Rule
                    APIs
                    • GetClientRect.USER32(?,?), ref: 1004E5A5
                    • CreateSolidBrush.GDI32(?), ref: 1004E5BE
                    • FillRect.USER32(?,?,00000000), ref: 1004E5CC
                    • DeleteObject.GDI32(00000000), ref: 1004E5D3
                    • CreatePen.GDI32(00000000,00000001,00FFFFFF), ref: 1004E5E9
                    • CreatePen.GDI32(00000000,00000001,00000000), ref: 1004E5F4
                    • GetSysColor.USER32(00000010), ref: 1004E5FB
                    • CreatePen.GDI32(00000000,00000001,00000000), ref: 1004E605
                    • SelectObject.GDI32(?,00000000), ref: 1004E60F
                    • MoveToEx.GDI32(?,?,?,00000000), ref: 1004E625
                    • LineTo.GDI32(?,?,?), ref: 1004E63C
                    • LineTo.GDI32(?,?,?), ref: 1004E64A
                    • SelectObject.GDI32(?,?), ref: 1004E656
                    • MoveToEx.GDI32(?,?,?,00000000), ref: 1004E66D
                    • LineTo.GDI32(?,?,?), ref: 1004E67B
                    • LineTo.GDI32(?,?,?), ref: 1004E689
                    • SelectObject.GDI32(?,?), ref: 1004E695
                    • MoveToEx.GDI32(?,?,?,00000000), ref: 1004E6A4
                    • LineTo.GDI32(?,?,?), ref: 1004E6B1
                    • LineTo.GDI32(?,?,?), ref: 1004E6C1
                    • SelectObject.GDI32(?,?), ref: 1004E6CD
                    • MoveToEx.GDI32(?,?,?,00000000), ref: 1004E6DA
                    • LineTo.GDI32(?,?,?), ref: 1004E6EF
                    • LineTo.GDI32(?,?,?), ref: 1004E6F6
                    • DeleteObject.GDI32(?), ref: 1004E701
                    • DeleteObject.GDI32(?), ref: 1004E706
                    • DeleteObject.GDI32(?), ref: 1004E751
                      • Part of subcall function 1004E150: SaveDC.GDI32(1004FC44), ref: 1004E1B6
                      • Part of subcall function 1004E150: SelectObject.GDI32(1004FC44,?), ref: 1004E1CE
                      • Part of subcall function 1004E150: GetSysColor.USER32(00000005), ref: 1004E1DE
                      • Part of subcall function 1004E150: CreateSolidBrush.GDI32(00000000), ref: 1004E1EB
                      • Part of subcall function 1004E150: FillRect.USER32(1004FC44,?,00000000), ref: 1004E1FC
                      • Part of subcall function 1004E150: DeleteObject.GDI32(00000000), ref: 1004E203
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Object$Line$CreateDeleteSelect$Move$Rect$BrushColorFillSolid$ClientSave
                    • String ID:
                    • API String ID: 1100827085-0
                    • Opcode ID: 4f08355c13fb1466da1f75015f19cc17b2648e47b809f28b96b12a1edbb31041
                    • Instruction ID: 296225f009809e7258972d39c4c7cb6a70b9f4e0f9555b9c3a4059955404f676
                    • Opcode Fuzzy Hash: 4f08355c13fb1466da1f75015f19cc17b2648e47b809f28b96b12a1edbb31041
                    • Instruction Fuzzy Hash: B261F67190021AEFEF519FA4CD89DEFBFB9FF48320F140165FA15A2260C6316A02DB64
                    Function 10001284 Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 173COMMON
                    Download Yara Rule
                    APIs
                    • SaveDC.GDI32(?), ref: 100012B3
                    • SetBkMode.GDI32(?,00000001), ref: 100012C5
                    • SelectObject.GDI32(?,00000000), ref: 100012FD
                    • GetSysColor.USER32(0000000F), ref: 10001305
                    • CreateSolidBrush.GDI32(00000000), ref: 1000130C
                    • SelectObject.GDI32(?,00000000), ref: 1000132A
                    • FillRect.USER32(?,?,00000000), ref: 10001337
                    • GetWindowRect.USER32(00000000,?), ref: 10001344
                    • ScreenToClient.USER32(000000A0,?), ref: 1000134F
                    • GetSysColor.USER32(00000014), ref: 10001357
                    • SetTextColor.GDI32(?,00000000), ref: 10001366
                    • TextOutW.GDI32(?,?,?,00000000,?), ref: 10001385
                    • SetBkMode.GDI32(?,00000001), ref: 1000138B
                    • GetSysColor.USER32(00000010), ref: 10001393
                    • SetTextColor.GDI32(?,00000000), ref: 1000139C
                    • SelectObject.GDI32(?,00000000), ref: 100013EB
                    • CopyRect.USER32(?,?), ref: 100013F8
                    • SetTextColor.GDI32(?,00808080), ref: 1000140B
                    • TextOutW.GDI32(?,?,?,00000000,?), ref: 1000142A
                    • SetTextColor.GDI32(?,00FFFFFF), ref: 10001433
                    • TextOutW.GDI32(?,?,?,00000000,?), ref: 10001450
                    • RestoreDC.GDI32(?,100C90E0), ref: 10001457
                      • Part of subcall function 10001204: GetDC.USER32(?), ref: 1000121E
                      • Part of subcall function 10001204: GetDeviceCaps.GDI32(00000000,0000005A), ref: 1000122B
                      • Part of subcall function 10001204: MulDiv.KERNEL32(100013D0,00000000), ref: 10001235
                      • Part of subcall function 10001204: ReleaseDC.USER32(00000000,00000000), ref: 10001244
                      • Part of subcall function 10001204: lstrcpyW.KERNEL32(?,000000A0), ref: 10001265
                      • Part of subcall function 10001204: CreateFontIndirectW.GDI32(?), ref: 1000126F
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ColorText$ObjectRectSelect$CreateMode$BrushCapsClientCopyDeviceFillFontIndirectReleaseRestoreSaveScreenSolidWindowlstrcpy
                    • String ID: Tahoma
                    • API String ID: 1111251737-3580928618
                    • Opcode ID: f38e933382d460209ed86b4347e7945d838cb633e4536ead0ec4dcbd774c71e7
                    • Instruction ID: ba5d787208e343aeaea4a9d2ff08cf920eaec6d37bf9a8447b8731fb694b6f0e
                    • Opcode Fuzzy Hash: f38e933382d460209ed86b4347e7945d838cb633e4536ead0ec4dcbd774c71e7
                    • Instruction Fuzzy Hash: 0B61253190012AEFEF01DFA4CD89AEE7BB9FF08355F140064FA10A6164C735AA56DF65
                    Function 1004E150 Relevance: 34.8, APIs: 23, Instructions: 293stringwindowCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 1004E923: GetClientRect.USER32(?,00000000), ref: 1004E949
                    • SaveDC.GDI32(1004FC44), ref: 1004E1B6
                    • SelectObject.GDI32(1004FC44,?), ref: 1004E1CE
                    • GetSysColor.USER32(00000005), ref: 1004E1DE
                    • CreateSolidBrush.GDI32(00000000), ref: 1004E1EB
                    • FillRect.USER32(1004FC44,?,00000000), ref: 1004E1FC
                    • DeleteObject.GDI32(00000000), ref: 1004E203
                    • GetSysColor.USER32(00000008), ref: 1004E2D1
                    • SetTextColor.GDI32(1004FC44,00000000), ref: 1004E2D9
                    • SetBkMode.GDI32(1004FC44,00000001), ref: 1004E2E2
                    • wsprintfW.USER32 ref: 1004E34C
                    • lstrlenW.KERNEL32(?), ref: 1004E356
                    • lstrlenW.KERNEL32(?,1004FC44,?,00000000), ref: 1004E371
                    • lstrcpyW.KERNEL32(?,100CE7EC,1004FC44,?,00000000), ref: 1004E3DF
                    • wsprintfW.USER32 ref: 1004E3FC
                    • lstrlenW.KERNEL32(?), ref: 1004E409
                    • lstrlenW.KERNEL32(00000284,1004FC44,100CDC5C,00000001), ref: 1004E469
                    • TextOutW.GDI32(1004FC44,?,?,00000284,?,1004FC44,00000284,00000000), ref: 1004E4E2
                    • lstrlenW.KERNEL32(?), ref: 1004E4FA
                    • TextOutW.GDI32(1004FC44,?,?,?,00000000), ref: 1004E50F
                    • lstrlenW.KERNEL32(?), ref: 1004E524
                    • TextOutW.GDI32(1004FC44,?,?,?,00000000), ref: 1004E539
                    • RestoreDC.GDI32(1004FC44,?), ref: 1004E54C
                    • DrawFocusRect.USER32(1004FC44,?), ref: 1004E564
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: lstrlen$Text$ColorRect$Objectwsprintf$BrushClientCreateDeleteDrawFillFocusModeRestoreSaveSelectSolidlstrcpy
                    • String ID:
                    • API String ID: 456787190-0
                    • Opcode ID: db6290df2a13838ff293b1b6ef1e1c0db66bd4dff76177beebea1c99731159fd
                    • Instruction ID: a64d0b9e90267d04fe24b039b3bb752ae025122b719338d04804b13fe735912b
                    • Opcode Fuzzy Hash: db6290df2a13838ff293b1b6ef1e1c0db66bd4dff76177beebea1c99731159fd
                    • Instruction Fuzzy Hash: 29C13D71904128AFEB21CF64CD89FAEBBB8FB05310F1440E9EA49E2241DB745E85DF65
                    Function 1004DEE7 Relevance: 31.6, APIs: 21, Instructions: 130windowCOMMON
                    Download Yara Rule
                    APIs
                    • SetRect.USER32(?,00000000,00000000,?,?), ref: 1004DF23
                    • CreateCompatibleDC.GDI32(?), ref: 1004DF2A
                    • CreateCompatibleBitmap.GDI32(?,?,?), ref: 1004DF3B
                    • SelectObject.GDI32(00000000,00000000), ref: 1004DF46
                    • CreateSolidBrush.GDI32(?), ref: 1004DF4D
                    • FillRect.USER32(00000000,?,00000000), ref: 1004DF61
                    • DeleteObject.GDI32(00000000), ref: 1004DF64
                      • Part of subcall function 10050B09: LoadBitmapW.USER32(?,00000000), ref: 10050B36
                      • Part of subcall function 10050B09: GetObjectW.GDI32(00000000,00000018,?), ref: 10050B48
                      • Part of subcall function 10050B09: SetRect.USER32(?,?,?,?,?), ref: 10050B65
                      • Part of subcall function 10050B09: CreateCompatibleDC.GDI32(1004DF85), ref: 10050B83
                      • Part of subcall function 10050B09: SelectObject.GDI32(00000000,00000000), ref: 10050B8D
                      • Part of subcall function 10050B09: BitBlt.GDI32(1004DF85,00000000,?,?,?,00000000,00000000,00000000,00CC0020), ref: 10050BAC
                      • Part of subcall function 10050B09: DeleteObject.GDI32(00000000), ref: 10050BBB
                      • Part of subcall function 10050B09: DeleteObject.GDI32(?), ref: 10050BC0
                      • Part of subcall function 10050B09: DeleteDC.GDI32(00000000), ref: 10050BC3
                      • Part of subcall function 10050B09: DeleteObject.GDI32(00000000), ref: 10050BCA
                    • DeleteDC.GDI32(00000000), ref: 1004DF86
                    • CreateCompatibleDC.GDI32(?), ref: 1004DF90
                    • CreateCompatibleBitmap.GDI32(?,?,?), ref: 1004DFA5
                    • SelectObject.GDI32(00000000,00000000), ref: 1004DFAF
                    • CreateSolidBrush.GDI32(?), ref: 1004DFB8
                    • FillRect.USER32(?,?,00000000), ref: 1004DFC8
                    • DeleteObject.GDI32(00000000), ref: 1004DFCB
                      • Part of subcall function 100507FC: SaveDC.GDI32(?), ref: 1005081B
                      • Part of subcall function 100507FC: CreateCompatibleDC.GDI32(?), ref: 1005082D
                      • Part of subcall function 100507FC: CreateCompatibleBitmap.GDI32(?,?,?), ref: 10050848
                      • Part of subcall function 100507FC: SelectObject.GDI32(00000000,00000000), ref: 10050851
                      • Part of subcall function 100507FC: CreateCompatibleDC.GDI32(?), ref: 1005085A
                      • Part of subcall function 100507FC: CreateCompatibleBitmap.GDI32(?,?,?), ref: 10050872
                      • Part of subcall function 100507FC: SelectObject.GDI32(1004DF85,00000000), ref: 1005087B
                      • Part of subcall function 100507FC: CreateCompatibleDC.GDI32(?), ref: 10050887
                      • Part of subcall function 100507FC: SelectObject.GDI32(00000000,00000000), ref: 1005088E
                      • Part of subcall function 100507FC: CreateCompatibleDC.GDI32(?), ref: 1005089A
                      • Part of subcall function 100507FC: CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 100508B7
                      • Part of subcall function 100507FC: SelectObject.GDI32(00000000,00000000), ref: 100508C2
                      • Part of subcall function 100507FC: CreateCompatibleDC.GDI32(?), ref: 100508CE
                      • Part of subcall function 100507FC: SelectObject.GDI32(00000000,00000000), ref: 100508D9
                      • Part of subcall function 100507FC: SetBkColor.GDI32(00000000,10050B80), ref: 100508E6
                      • Part of subcall function 100507FC: CreateCompatibleDC.GDI32(?), ref: 100508EF
                    • SelectObject.GDI32(?,00000000), ref: 1004DFED
                    • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 1004E011
                    • DeleteDC.GDI32(?), ref: 1004E018
                    • DeleteObject.GDI32(?), ref: 1004E027
                    • DeleteObject.GDI32(00000000), ref: 1004E02A
                    • DeleteObject.GDI32(00000000), ref: 1004E02D
                    • DeleteObject.GDI32(?), ref: 1004E032
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Object$Create$Compatible$Delete$Select$Bitmap$Rect$BrushFillSolid$ColorLoadSave
                    • String ID:
                    • API String ID: 1015963636-0
                    • Opcode ID: 1391e855d5c8f6fde976baa21b3b3f31a8063f649000c0b06ed11629b769e69c
                    • Instruction ID: 2b3ca6dfb54d53fea4111d8cb36588159ef179efaa58d0c89b062a05367f1bf0
                    • Opcode Fuzzy Hash: 1391e855d5c8f6fde976baa21b3b3f31a8063f649000c0b06ed11629b769e69c
                    • Instruction Fuzzy Hash: A341F976900119AFEB01DFA4CD89EEEBBB8FF4D310F144055FA01A6260D7359E01DB68
                    Function 1007A190 Relevance: 30.2, APIs: 20, Instructions: 156windowstringCOMMON
                    Download Yara Rule
                    APIs
                    • _memset.LIBCMT ref: 1007A1CD
                    • GetWindowRect.USER32(?,?), ref: 1007A1DD
                    • MapWindowPoints.USER32(00000000,1007A74F,?,00000002), ref: 1007A1F0
                    • GetWindowTextW.USER32(?,?,00000050), ref: 1007A20E
                    • SetWindowTextW.USER32(?,100C90D4), ref: 1007A229
                    • GetWindowLongW.USER32(?,000000F0), ref: 1007A238
                    • GetWindowLongW.USER32(?,000000EC), ref: 1007A244
                    • GetModuleHandleW.KERNEL32(00000000,00000000,?,00000000,?), ref: 1007A24C
                    • CreateWindowExW.USER32(00000000,100D4B70,00000000,00000000,0000000A,?,0000000A,?,1007A74F,000000FF,00000000), ref: 1007A294
                    • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 1007A2B8
                    • SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 1007A2C6
                    • SetWindowLongW.USER32(00000000,000000FC,1007C590), ref: 1007A2D0
                    • SetPropW.USER32(00000000,100D4B08,?), ref: 1007A2EA
                    • SetPropW.USER32(00000000,100D4B28,00000000), ref: 1007A2F3
                    • GetDC.USER32(00000000), ref: 1007A2F6
                    • SelectObject.GDI32(00000000,?), ref: 1007A319
                    • lstrlenW.KERNEL32(00000000,?,?,00000000,?), ref: 1007A32D
                    • GetTextExtentPoint32W.GDI32(00000000,00000000,00000000), ref: 1007A33C
                    • ReleaseDC.USER32(00000000,00000000), ref: 1007A344
                    • SetWindowPos.USER32(00000000,?,0000000A,?,00000000,00000000,00000002,?,00000000,?), ref: 1007A36D
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Window$LongText$MessagePropSend$CreateExtentHandleModuleObjectPoint32PointsRectReleaseSelect_memsetlstrlen
                    • String ID:
                    • API String ID: 2762062944-0
                    • Opcode ID: 1293526240b36410f9def14c693be936ec4cf5d70f2dcec6e87b55d6f4dcbebf
                    • Instruction ID: a056fe538a25f6e460cea6343a24a26e9964d572c2023b74c47f3d8903d8f722
                    • Opcode Fuzzy Hash: 1293526240b36410f9def14c693be936ec4cf5d70f2dcec6e87b55d6f4dcbebf
                    • Instruction Fuzzy Hash: 4C512E71901228AFEB208B648D89F9A7BBDEB49320F0041D5F609A7291DB745F80CF65
                    Function 10079ED0 Relevance: 28.7, APIs: 19, Instructions: 188stringwindowCOMMON
                    Download Yara Rule
                    APIs
                    • GetPropW.USER32(?,100D4954), ref: 10079EF7
                    • SendMessageW.USER32(01352D00,00000031,00000000,00000000), ref: 10079F22
                    • CopyRect.USER32(?,1007C42F), ref: 10079F35
                    • GetWindowDC.USER32(01352D00), ref: 10079F47
                    • SaveDC.GDI32(00000000), ref: 10079F51
                    • SelectObject.GDI32(840F0000,00000000), ref: 10079F61
                    • SetBkMode.GDI32(840F0000,00000001), ref: 10079F6C
                    • _memset.LIBCMT ref: 10079F88
                    • GetWindowTextW.USER32(01352D00,?,00000400), ref: 10079F9F
                    • SetTextColor.GDI32(840F0000,?), ref: 1007A04F
                    • lstrlenW.KERNEL32(?,?,00000025,?,?,?), ref: 1007A065
                    • DrawTextW.USER32(840F0000,?,00000000,?,?), ref: 1007A072
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Text$Window$ColorCopyDrawMessageModeObjectPropRectSaveSelectSend_memsetlstrlen
                    • String ID:
                    • API String ID: 4252396310-0
                    • Opcode ID: d7ff53919f2b40aa292ffc3e5cca595ef6067607229624c107b4e41b0f10e954
                    • Instruction ID: 907c89b9bda516e2b92f6c7dac289636d29eafb2a99c57696d7a648bdab27593
                    • Opcode Fuzzy Hash: d7ff53919f2b40aa292ffc3e5cca595ef6067607229624c107b4e41b0f10e954
                    • Instruction Fuzzy Hash: 84718D71900619AFDB51CFA0CD89B9ABBF9FF08310F0481A5EA8592160DB35AAD5CFD4
                    Function 100469DF Relevance: 28.7, APIs: 19, Instructions: 186windowstringCOMMON
                    Download Yara Rule
                    APIs
                    • GetDlgItem.USER32(?,00000004), ref: 10046A05
                    • SetFocus.USER32(00000000), ref: 10046A2F
                    • SendMessageW.USER32(00000000,000000B1,?,?), ref: 10046A3F
                    • CallWindowProcW.USER32(?,00000111,?,?), ref: 10046B56
                    • _memset.LIBCMT ref: 10046B8A
                    • LangLoadString.ISRT(?,000036B2,?,00000400), ref: 10046BA9
                    • _memset.LIBCMT ref: 10046BC2
                    • wsprintfW.USER32 ref: 10046BD6
                    • _memset.LIBCMT ref: 10046BF2
                    • LangLoadString.ISRT(?,00002B6B,?,00000064), ref: 10046C0E
                    • MessageBoxW.USER32(?,?,?,00000000), ref: 10046C28
                    • GetWindowLongW.USER32(?,000000EB), ref: 10046C3F
                    • lstrcpyW.KERNEL32(-00000004,00001A12), ref: 10046C50
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: _memset$LangLoadMessageStringWindow$CallFocusItemLongProcSendlstrcpywsprintf
                    • String ID:
                    • API String ID: 1324874037-0
                    • Opcode ID: 45e0f9f373fb06bdc19c0a5a3b62c1ddba5a82c2f6b2e179fab34ef88f3ec7f0
                    • Instruction ID: c2317e31358d6eaaf1dc99f7d3d68a0633c030b13f81119d5f8f5f045138b263
                    • Opcode Fuzzy Hash: 45e0f9f373fb06bdc19c0a5a3b62c1ddba5a82c2f6b2e179fab34ef88f3ec7f0
                    • Instruction Fuzzy Hash: 0351D471900129FFEB11DB60CD89EDE73BCEF09354F1001A6F505E6191EB74AE908BAA
                    Function 10010B2C Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 175sleepprocessstringCOMMON
                    Download Yara Rule
                    APIs
                    • _memset.LIBCMT ref: 10010B79
                    • lstrcpyW.KERNEL32(?,?), ref: 10010B89
                    • CoCreateGuid.COMBASE(?), ref: 10010B9E
                    • wsprintfW.USER32 ref: 10010BF6
                    • _memset.LIBCMT ref: 10010C0F
                    • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 10010C3D
                    • WaitForInputIdle.USER32(?,00004E20), ref: 10010C5C
                    • CloseHandle.KERNEL32(?), ref: 10010C6E
                    • CloseHandle.KERNEL32(?), ref: 10010C76
                    • CreateItemMoniker.OLE32(100C9928,?,00000000), ref: 10010CB1
                    • Sleep.KERNEL32(0000012C), ref: 10010CC2
                    • GetRunningObjectTable.OLE32(00000000,00000000), ref: 10010CD6
                    • Sleep.KERNEL32(0000012C), ref: 10010D06
                    • SysFreeString.OLEAUT32(?), ref: 10010D69
                    • SysFreeString.OLEAUT32(?), ref: 10010D71
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Create$CloseFreeHandleSleepString_memset$GuidIdleInputItemMonikerObjectProcessRunningTableWaitlstrcpywsprintf
                    • String ID: D
                    • API String ID: 1856294533-2746444292
                    • Opcode ID: be6a41b69cfae1265d962f6c49e2f509656b49cec1b0c19546ce88686640ff1e
                    • Instruction ID: bde7f5a4e14f1de5f49b64bef263a888cacadecbf84385591ca3317002cd642e
                    • Opcode Fuzzy Hash: be6a41b69cfae1265d962f6c49e2f509656b49cec1b0c19546ce88686640ff1e
                    • Instruction Fuzzy Hash: 0E614976A002299BDB50DBA0CD85B9A77F9FF48310F0480E5F988A7250DE71AE85CFD0
                    Function 1002094E Relevance: 27.1, APIs: 18, Instructions: 137windowCOMMON
                    Download Yara Rule
                    APIs
                    • BeginPaint.USER32(?,?), ref: 10020973
                    • GetClientRect.USER32(?,?), ref: 1002098A
                    • CreateSolidBrush.GDI32(?), ref: 10020996
                    • FillRect.USER32(00000000,?,00000000), ref: 100209A8
                    • DeleteObject.GDI32(00000000), ref: 100209AF
                    • EndPaint.USER32(?,?), ref: 100209BC
                    • BeginPaint.USER32(?,?), ref: 100209DE
                    • GetClientRect.USER32(?,?), ref: 100209F5
                    • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 10020A0A
                    • CreateCompatibleDC.GDI32(00000000), ref: 10020A1C
                    • SelectObject.GDI32(00000000,?), ref: 10020A30
                    • CreateSolidBrush.GDI32(?), ref: 10020A43
                    • FillRect.USER32(00000000,?,00000000), ref: 10020A56
                    • DeleteObject.GDI32(?), ref: 10020A5F
                    • BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 10020A97
                    • SelectObject.GDI32(00000000,?), ref: 10020AA1
                    • DeleteDC.GDI32(00000000), ref: 10020AA8
                    • DeleteObject.GDI32(?), ref: 10020AB1
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Object$CreateDeleteRect$Paint$BeginBrushClientCompatibleFillSelectSolid$Bitmap
                    • String ID:
                    • API String ID: 4216882110-0
                    • Opcode ID: dcae235bc30347595f705c85c3231635616e8c66f81efb30213dc9a685bf8e27
                    • Instruction ID: 84d275a2991a858254a0bf63fd3ab31b88f8800c1bac03560b88445171e4fccd
                    • Opcode Fuzzy Hash: dcae235bc30347595f705c85c3231635616e8c66f81efb30213dc9a685bf8e27
                    • Instruction Fuzzy Hash: FF412972900619AFEB01CBE4CE88EBF7BFDFB08310F504469F952D2161DB309A059B24
                    Function 070A56E0 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 248libraryloaderCOMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • InterlockedIncrement.KERNEL32(070CDC74), ref: 070A5765
                    • LoadLibraryA.KERNEL32(user32.dll), ref: 070A5781
                    • GetProcAddress.KERNEL32(?,wsprintfA), ref: 070A57A2
                    • OutputDebugStringA.KERNEL32(?,00000000,00000000), ref: 070A57E2
                    • InterlockedDecrement.KERNEL32(070CDC74), ref: 070A57ED
                      • Part of subcall function 070A55D0: DebugBreak.KERNEL32(?,070A5AA8), ref: 070A55D3
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: DebugInterlocked$AddressBreakDecrementIncrementLibraryLoadOutputProcString
                    • String ID: %s(%d) : %s$Second Chance Assertion Failed: File %s, Line %d$_CrtDbgReport: String too long or IO Error$user32.dll$wsprintfA
                    • API String ID: 1590524403-1062629290
                    • Opcode ID: 17bd2f35f346b78798884b6bc1e821a677210b3dff5f6f6441d616acac4c0006
                    • Instruction ID: 15bc18fc0d109eb8d5103782af99e4d7414cde981830e30b9828c80c16a76b8f
                    • Opcode Fuzzy Hash: 17bd2f35f346b78798884b6bc1e821a677210b3dff5f6f6441d616acac4c0006
                    • Instruction Fuzzy Hash: DFA1B1F5A00209FBDB14DFA4DC95BE977B8BB48311F0183A8E90996140E7789B98CF91
                    Function 10089C70 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 203filememoryCOMMON
                    Download Yara Rule
                    APIs
                    • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?), ref: 10089C9A
                    • ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 10089CD8
                    • ReadFile.KERNEL32(00000000,?,0000000C,00000004,00000000), ref: 10089D1B
                    • ReadFile.KERNEL32(00000000,?,00000004,0000000C,00000000), ref: 10089D45
                    • GlobalAlloc.KERNEL32(00000042,00000408), ref: 10089D64
                    • GlobalLock.KERNEL32(00000000), ref: 10089D71
                    • ReadFile.KERNEL32(00000000,00000000,00000004,00000004,00000000), ref: 10089D86
                    • ReadFile.KERNEL32(00000000,00000004,?,00000004,00000000), ref: 10089DB8
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: File$Read$Global$AllocCreateLock
                    • String ID: RIFF
                    • API String ID: 3955436798-110600796
                    • Opcode ID: 214247b5e2a5369a5a7ee421428739b91e645352418bb1742d8d323e79e79a43
                    • Instruction ID: b325d969660c78c56fa15b6f6c31297e284a36d5fd6ac797df390b01ff1ed6b7
                    • Opcode Fuzzy Hash: 214247b5e2a5369a5a7ee421428739b91e645352418bb1742d8d323e79e79a43
                    • Instruction Fuzzy Hash: 53618571E002289BEB50DB64DC46FEA77ACEF05714F0041E6E609D6180DBB5AF85CFA5
                    Function 10043F31 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 230stringwindowCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 10043F3B
                    • GetDlgItem.USER32(?,00000065), ref: 10043F89
                    • GetWindowTextW.USER32(00000000,?,00000032), ref: 10043F9F
                    • _wcstok.LIBCMT ref: 100440BD
                    • lstrcpyW.KERNEL32(?,00000000), ref: 100440D7
                    • lstrcmpiW.KERNEL32(00000000,100CCC90), ref: 100440E8
                    • lstrcpyW.KERNEL32(?,00000000), ref: 100440F8
                    • _wcstok.LIBCMT ref: 10044108
                    • LoadImageW.USER32(00000000,00000000,00000000,00000000,00000000,00001020), ref: 100441C9
                    • GetWindowLongW.USER32(?,000000F0), ref: 100441E3
                    • SetWindowLongW.USER32(?,000000F0,00000000), ref: 100441FA
                    • SendMessageW.USER32(?,000000F7,00000000,?), ref: 10044212
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Window$Long_wcstoklstrcpy$H_prolog3_ImageItemLoadMessageSendTextlstrcmpi
                    • String ID: ;$d
                    • API String ID: 112042989-1816696708
                    • Opcode ID: dba2d24d3bac704cb9a520962f3b819d3ecdd43abf23fb121fe1c5e7a0f412eb
                    • Instruction ID: 9ccb8b61e379ce5672cc974d10fe2f61944c5cc9fa6687564963c7d03110cd01
                    • Opcode Fuzzy Hash: dba2d24d3bac704cb9a520962f3b819d3ecdd43abf23fb121fe1c5e7a0f412eb
                    • Instruction Fuzzy Hash: CA819D76900629AFEB21CB60CD45BEEB7B9EB04310F2245E5E649F7190DBB06E84CF54
                    Function 1001E93F Relevance: 24.3, APIs: 16, Instructions: 313COMMON
                    Download Yara Rule
                    APIs
                    • RedrawWindow.USER32(?,00000000,00000000,00000507), ref: 1001E990
                    • IsWindow.USER32(?), ref: 1001E9A2
                    • GetSysColor.USER32(00000005), ref: 1001E9E2
                    • GetWindowLongW.USER32(?,000000F0), ref: 1001EA6D
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Window$ColorLongRedraw
                    • String ID:
                    • API String ID: 4056730343-0
                    • Opcode ID: 804c6507b956edd21670b03dc75d99b4c955d8d33d5c19dff492a14fe36176c7
                    • Instruction ID: f79a33ab99d57e47401c66ff583fc9ffac938056b14b3b8ea55e9904b8010ea4
                    • Opcode Fuzzy Hash: 804c6507b956edd21670b03dc75d99b4c955d8d33d5c19dff492a14fe36176c7
                    • Instruction Fuzzy Hash: E8B1B17560028AAFEB00CFA4CC84BAEB7E8FF09755F504529F9119B190DB74EE91CB90
                    Function 1009350A Relevance: 24.1, APIs: 16, Instructions: 92COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref$Sleep__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
                    • String ID:
                    • API String ID: 2661855409-0
                    • Opcode ID: 56c3f1755db7f2e8df9b011d80a52d75eda0a20ec6205464ae460876d48d3b3f
                    • Instruction ID: e14465ab5dbfd7b8ebbf825a93f28dc1d2feb07a8c41f9d1f191088b93240679
                    • Opcode Fuzzy Hash: 56c3f1755db7f2e8df9b011d80a52d75eda0a20ec6205464ae460876d48d3b3f
                    • Instruction Fuzzy Hash: F521273D408A11EBD722DF25DC02E0A7BE5EF45390B12C42EFA8C45162EF32A910BA91
                    Function 070A20F0 Relevance: 23.2, APIs: 1, Strings: 12, Instructions: 431COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    Strings
                    • _pLastBlock == pOldBlock, xrefs: 070A2535
                    • Client hook re-allocation failure., xrefs: 070A21EF
                    • _CrtIsValidHeapPointer(pUserData), xrefs: 070A22A6
                    • Client hook re-allocation failure at file %hs line %d., xrefs: 070A21CC
                    • fRealloc || (!fRealloc && pNewBlock == pOldBlock), xrefs: 070A24D6
                    • dbgheap.c, xrefs: 070A2167, 070A22B2, 070A230D, 070A2373, 070A24E2, 070A2541, 070A2595
                    • _BLOCK_TYPE(pOldBlock->nBlockUse)==_BLOCK_TYPE(nBlockUse), xrefs: 070A2367
                    • Error: memory allocation: bad memory block type., xrefs: 070A2270
                    • _CrtCheckMemory(), xrefs: 070A215B
                    • pOldBlock->nLine == IGNORE_LINE && pOldBlock->lRequest == IGNORE_REQ, xrefs: 070A2301
                    • Allocation too large or negative: %u bytes., xrefs: 070A2226
                    • _pFirstBlock == pOldBlock, xrefs: 070A2589
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: __malloc_dbg
                    • String ID: Allocation too large or negative: %u bytes.$Client hook re-allocation failure at file %hs line %d.$Client hook re-allocation failure.$Error: memory allocation: bad memory block type.$_BLOCK_TYPE(pOldBlock->nBlockUse)==_BLOCK_TYPE(nBlockUse)$_CrtCheckMemory()$_CrtIsValidHeapPointer(pUserData)$_pFirstBlock == pOldBlock$_pLastBlock == pOldBlock$dbgheap.c$fRealloc || (!fRealloc && pNewBlock == pOldBlock)$pOldBlock->nLine == IGNORE_LINE && pOldBlock->lRequest == IGNORE_REQ
                    • API String ID: 95588982-221452589
                    • Opcode ID: 561dc30f0d162a60b41bf400cbf81888b58f34136bdc933d0a38fd119de4ebf1
                    • Instruction ID: 13225252cb8935bd08fdcd9b2a469bc64a4a9af61e68f6353d8169021126fc5b
                    • Opcode Fuzzy Hash: 561dc30f0d162a60b41bf400cbf81888b58f34136bdc933d0a38fd119de4ebf1
                    • Instruction Fuzzy Hash: 82F18BF5A0020AFFDB24DF98D996BAE73F1FB84304F148269E915AB281D774E940CB51
                    Function 070A44E0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 173COMMON
                    Download Yara Rule
                    APIs
                    • GetEnvironmentStringsW.KERNEL32 ref: 070A44FD
                    • GetEnvironmentStrings.KERNEL32 ref: 070A4518
                    • GetEnvironmentStringsW.KERNEL32 ref: 070A454D
                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,070A10DD,00000000,00000000,00000000,00000000), ref: 070A45B7
                    • __malloc_dbg.LIBCMTD ref: 070A45D3
                    • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 070A45E8
                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,070A10DD,00000000,00000000,00000000,00000000), ref: 070A460D
                    • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 070A4630
                    • GetEnvironmentStrings.KERNEL32 ref: 070A4651
                    • __malloc_dbg.LIBCMTD ref: 070A46B1
                    • FreeEnvironmentStringsA.KERNEL32(00000000), ref: 070A46C6
                    • FreeEnvironmentStringsA.KERNEL32(00000000), ref: 070A46E8
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: EnvironmentStrings$Free$ByteCharMultiWide__malloc_dbg
                    • String ID: a_env.c
                    • API String ID: 3241012610-1218344748
                    • Opcode ID: 95324f7f616b7ecb51613c777bfdbb6cc5ff5ca3a40d4cec45cb02d8bb2955d5
                    • Instruction ID: 8874798f0567afda436cbd02bfb03f1b4caa6443fac66483ae9b967bda421b43
                    • Opcode Fuzzy Hash: 95324f7f616b7ecb51613c777bfdbb6cc5ff5ca3a40d4cec45cb02d8bb2955d5
                    • Instruction Fuzzy Hash: C1613EF4E0024AEFDB14CFE8D946BBEBBF1AB48305F104618F911A6281E7B45A40CF91
                    Function 10023328 Relevance: 22.6, APIs: 15, Instructions: 127windowsleepCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 1002332F
                    • IsWindow.USER32 ref: 10023338
                    • _memset.LIBCMT ref: 10023361
                    • VariantInit.OLEAUT32(?), ref: 1002336D
                    • PostMessageW.USER32(?,00000471,00000000,?), ref: 100233C8
                    • VariantClear.OLEAUT32(?), ref: 100233E3
                    • GetTickCount.KERNEL32 ref: 100233F1
                    • PostMessageW.USER32(?,00000464,?,00000004), ref: 1002340A
                    • PeekMessageW.USER32(100C90E8,00000000,00000000,00000000,00000001), ref: 10023423
                    • TranslateMessage.USER32(100C90E8), ref: 10023440
                    • DispatchMessageW.USER32(100C90E8), ref: 1002344A
                    • Sleep.KERNEL32(00000032,?,00000464,?,00000004,?,00000034,10023749,-00000001,?,00000001,000000FF,100CAB60,000000FF,00000000,00000000), ref: 10023452
                    • GetTickCount.KERNEL32 ref: 1002345E
                    • IsWindow.USER32 ref: 10023466
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Message$CountPostTickVariantWindow$ClearDispatchH_prolog3InitPeekSleepTranslate_memset
                    • String ID:
                    • API String ID: 2354914365-0
                    • Opcode ID: 87fb5bb0e5996a5aec8aad9619ccf5b918acbe517685b9f127e0b9b1972c184e
                    • Instruction ID: 4d20a3b7cfc7a04ce21426ee4c6a66f5f2e95d846f7a91de50c85ce4e0bab710
                    • Opcode Fuzzy Hash: 87fb5bb0e5996a5aec8aad9619ccf5b918acbe517685b9f127e0b9b1972c184e
                    • Instruction Fuzzy Hash: 7641C070A00359EFEB12DBA0CD88F9E7BF9EF04314F408899E155DB191D7B5AA04CB24
                    Function 10077E50 Relevance: 21.3, APIs: 14, Instructions: 290COMMON
                    Download Yara Rule
                    APIs
                    • SetWindowLongW.USER32(?,000000FC,?), ref: 10077E8E
                      • Part of subcall function 10072050: DeleteObject.GDI32(00000004), ref: 1007206B
                      • Part of subcall function 100721C0: GetLastError.KERNEL32(?,?,00000000,?,10077EAC,?,?), ref: 100721E7
                      • Part of subcall function 100721C0: SysFreeString.OLEAUT32(?), ref: 10072203
                      • Part of subcall function 100721C0: SysFreeString.OLEAUT32(00000004), ref: 1007220E
                      • Part of subcall function 100721C0: SetLastError.KERNEL32(?), ref: 1007222C
                    • GetLastError.KERNEL32(00000000,?,100CB88C,00000003), ref: 10077F14
                    • SysFreeString.OLEAUT32(?), ref: 10077F30
                    • SysFreeString.OLEAUT32(?), ref: 10077F3B
                    • SetLastError.KERNEL32(?), ref: 10077F59
                    • GetLastError.KERNEL32 ref: 10077F6D
                    • SysFreeString.OLEAUT32(?), ref: 10077F89
                    • SysFreeString.OLEAUT32(00000000), ref: 10077F94
                    • SetLastError.KERNEL32(00000004), ref: 10077FB4
                    • DeleteObject.GDI32(?), ref: 10078043
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorFreeLastString$DeleteObject$LongWindow
                    • String ID:
                    • API String ID: 1426220039-0
                    • Opcode ID: 94780778a64c6b232da840efae387a758364e18db846904ec79e87faa685a831
                    • Instruction ID: 31288dd75482ddf01f393c949976ab05e3d86010420f3daf424ba53279ddf0e3
                    • Opcode Fuzzy Hash: 94780778a64c6b232da840efae387a758364e18db846904ec79e87faa685a831
                    • Instruction Fuzzy Hash: 28C17A70900255DFEB41CF68C984B997BE4FF09354F0980B9EC889F266D735AE58CBA4
                    Function 10022831 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 104comCOMMON
                    Download Yara Rule
                    APIs
                    • GetStockObject.GDI32(00000011), ref: 10022878
                    • GetStockObject.GDI32(0000000D), ref: 10022880
                    • GetObjectW.GDI32(00000000,0000005C,?), ref: 10022891
                    • GetDC.USER32(00000000), ref: 100228E1
                    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 100228F1
                    • ReleaseDC.USER32(00000000), ref: 10022930
                    • OleCreateFontIndirect.OLEAUT32(00000020,100CA15C,?), ref: 1002295B
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Object$Stock$CapsCreateDeviceFontIndirectRelease
                    • String ID:
                    • API String ID: 2212500748-3916222277
                    • Opcode ID: 057ec21a973b887a3edda8114e89663ee485d35391923797ee3c1b90b0e9213d
                    • Instruction ID: d19e3413d761bf090026457a42af77615ac7b84a9fa6c95b62ce9e89017a71c2
                    • Opcode Fuzzy Hash: 057ec21a973b887a3edda8114e89663ee485d35391923797ee3c1b90b0e9213d
                    • Instruction Fuzzy Hash: 88413975D00329ABEB10DFE5CD88B9DBBB8FF08311F51406AE905AB291DB749A41CF64
                    Function 10022EA1 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 102registryclipboardCOMMON
                    Download Yara Rule
                    APIs
                    • RtlEnterCriticalSection.NTDLL(100FDA54), ref: 10022EAD
                    • RegisterClipboardFormatW.USER32(100CA584), ref: 10022EBE
                    • RegisterClipboardFormatW.USER32(100CA5A0), ref: 10022ECA
                    • GetClassInfoExW.USER32(100CA4AC,?), ref: 10022EED
                    • LoadCursorW.USER32(00000000,00007F00), ref: 10022F21
                    • RegisterClassExW.USER32(00000030), ref: 10022F44
                      • Part of subcall function 1001D6A6: __recalloc.LIBCMT ref: 1001D6E1
                    • _memset.LIBCMT ref: 10022F70
                    • GetClassInfoExW.USER32(100CA604,00000030), ref: 10022F8E
                    • LoadCursorW.USER32(00000000,00007F00), ref: 10022FC2
                    • RegisterClassExW.USER32(00000030), ref: 10022FE3
                    • RtlLeaveCriticalSection.NTDLL(100FDA54), ref: 10023008
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ClassRegister$ClipboardCriticalCursorFormatInfoLoadSection$EnterLeave__recalloc_memset
                    • String ID: 0
                    • API String ID: 105602053-4108050209
                    • Opcode ID: fed2e585b2db0ed7cf219ee493b04f065621092b89458b12307acc24d83e8f9e
                    • Instruction ID: de4b30a5dd0fea0416cd4121439c064233508c3c4425d2d9428e50defdaa75fb
                    • Opcode Fuzzy Hash: fed2e585b2db0ed7cf219ee493b04f065621092b89458b12307acc24d83e8f9e
                    • Instruction Fuzzy Hash: B2411AB1C05229AFDB01EFD4D9947DEBBB9EB08314F50405AE501F7240D7B49A04DFA9
                    Function 1000A96A Relevance: 19.9, APIs: 13, Instructions: 362COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: H_prolog3_
                    • String ID:
                    • API String ID: 2427045233-0
                    • Opcode ID: af7503e9fbc2d6c3cf2914755b457d09e72437ee37d23ed628862866a883d0c8
                    • Instruction ID: d9becd39ee0764b29ab5a15c3741cd3360a3ff4d725dcb31da9d2e307e69e5eb
                    • Opcode Fuzzy Hash: af7503e9fbc2d6c3cf2914755b457d09e72437ee37d23ed628862866a883d0c8
                    • Instruction Fuzzy Hash: 44E15975A002299FEB25CB60CC91BDEB3B8EF1A380F1041D9E549A7195DB70AEC4CF51
                    Function 070ABFEC Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 497COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: __malloc_dbg_get_int_arg
                    • String ID: -$.$5$ch != _T('\0')$output.c
                    • API String ID: 3840687771-969519535
                    • Opcode ID: dcb7958e3439dfe1277dd327ce8eb12a01ef2a8308aab8bb85c7b290e36fbea1
                    • Instruction ID: f7ab48a1d7d3a41e7655cead05b50bc13218b3a9c10a2f0a037c680f019ba97c
                    • Opcode Fuzzy Hash: dcb7958e3439dfe1277dd327ce8eb12a01ef2a8308aab8bb85c7b290e36fbea1
                    • Instruction Fuzzy Hash: 552239F5D14259EFEB24CF98C995BEEB7B1BF49300F148299D419AB240DB349A80CF60
                    Function 10046C5B Relevance: 19.7, APIs: 13, Instructions: 175stringCOMMON
                    Download Yara Rule
                    APIs
                    • LangLoadString.ISRT(?,000036B3,?,00000400), ref: 10046CE2
                    • lstrcpyW.KERNEL32(?,?), ref: 10046CFE
                    • lstrcpyW.KERNEL32(?,?), ref: 10046D08
                    • LangLoadString.ISRT(?,00002D6A,00000000,00000400), ref: 10046D26
                    • GetHandle.ISRT(?,000000FE), ref: 10046D2E
                    • lstrcpyW.KERNEL32(?,?,?,000000FE), ref: 10046D6C
                    • lstrcpyW.KERNEL32(?,?,?,000000FE), ref: 10046D96
                    • lstrcpyW.KERNEL32(?,?,?,?,000000FE), ref: 10046DBF
                    • SHGetSpecialFolderLocation.SHELL32(?,00000012,00000000), ref: 10046DF1
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: lstrcpy$LangLoadString$FolderHandleLocationSpecial
                    • String ID:
                    • API String ID: 2069734598-0
                    • Opcode ID: f05bc82a4a7fae2b553544b0edaca736c35362a1e384f44e524f92d8172a7d56
                    • Instruction ID: 9131891ec3807c30ad8492d3c7747cc0fed0cd9bf2b19b4d8e8d7acfb1cbd7f7
                    • Opcode Fuzzy Hash: f05bc82a4a7fae2b553544b0edaca736c35362a1e384f44e524f92d8172a7d56
                    • Instruction Fuzzy Hash: F9612BB5D01228DBDB21DF64CD89AD9B7F8EF08314F1041E6E909E7280EB71AE848F55
                    Function 1004606A Relevance: 19.6, APIs: 13, Instructions: 108windowCOMMON
                    Download Yara Rule
                    APIs
                    • GetDlgItem.USER32(?,00000004), ref: 10046095
                    • SHGetPathFromIDListW.SHELL32(?,?), ref: 100460A9
                    • SetWindowTextW.USER32(00000000,?), ref: 100460B7
                    • SHGetPathFromIDListW.SHELL32(?,?), ref: 100460C7
                    • SetWindowLongW.USER32(?,000000EB,?), ref: 100460D8
                    • GetWindowLongW.USER32(?,000000EC), ref: 100460E1
                    • SetWindowLongW.USER32(?,000000EC,00000000), ref: 100460F0
                    • GetDlgItem.USER32(?,00000004), ref: 1004610E
                    • PostMessageW.USER32(?,00000401,00000000,000000FF), ref: 10046127
                    • SendMessageW.USER32(?,00000468,00000000,?), ref: 10046144
                    • SendMessageW.USER32(?,00000467,00000001,?), ref: 10046152
                    • SetWindowTextW.USER32(?,?), ref: 10046166
                    • SetWindowLongW.USER32(?,000000FC,100469DF), ref: 10046174
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Window$Long$Message$FromItemListPathSendText$Post
                    • String ID:
                    • API String ID: 2829680824-0
                    • Opcode ID: fea4db01412238a055bf395439e7eb746809281c42842054862d145b70fb88d8
                    • Instruction ID: ffeebb54e621f9a9c10b781bc7a9beea56f2207336b4fd9f5419acb64a4cf14c
                    • Opcode Fuzzy Hash: fea4db01412238a055bf395439e7eb746809281c42842054862d145b70fb88d8
                    • Instruction Fuzzy Hash: EA319471104125BBEB01DB648DC9E7F377CEB4A721F200269F611E60D1EB749A05972A
                    Function 070B4420 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 330COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • CompareStringW.KERNEL32(00000000,00000000,070CBF38,00000001,070CBF38,00000001), ref: 070B4461
                    • CompareStringA.KERNEL32(00000000,00000000,070CBF34,00000001,070CBF34,00000001), ref: 070B4489
                    • CompareStringA.KERNEL32(00000000,070CC86C,00000000,00000000,070CC86C,00000000), ref: 070B44F9
                    Strings
                    • a_cmp.c, xrefs: 070B459F
                    • cchCount1==0 && cchCount2==1 || cchCount1==1 && cchCount2==0, xrefs: 070B4593
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: CompareString
                    • String ID: a_cmp.c$cchCount1==0 && cchCount2==1 || cchCount1==1 && cchCount2==0
                    • API String ID: 1825529933-3979739857
                    • Opcode ID: df17548d998e4d17186cffc54180c7b5a08f20d76ef81f894a0cedb3dd3f4910
                    • Instruction ID: e112bc6c250bbd76527930651e998ed9b02bad3ac9076be2121dc53c033bc15b
                    • Opcode Fuzzy Hash: df17548d998e4d17186cffc54180c7b5a08f20d76ef81f894a0cedb3dd3f4910
                    • Instruction Fuzzy Hash: 04C18AF0A1428ADBDB20CF98D845BEE77F5BB49704F008229F916A7282D778DB45CB51
                    Function 10045174 Relevance: 18.1, APIs: 12, Instructions: 144COMMON
                    Download Yara Rule
                    APIs
                    • GetWindowLongW.USER32(?,000000F0), ref: 10045193
                    • GetParent.USER32(?), ref: 100451A8
                    • GetWindow.USER32(?,00000004), ref: 100451B3
                    • GetWindowRect.USER32(?,?), ref: 100451C0
                    • GetWindowLongW.USER32(?,000000F0), ref: 100451D5
                    • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 100451F5
                    • GetWindowRect.USER32(?,?), ref: 10045210
                    • GetParent.USER32(?), ref: 10045219
                    • GetClientRect.USER32(00000000,?), ref: 1004522C
                    • GetClientRect.USER32(?,?), ref: 10045233
                    • MapWindowPoints.USER32(?,00000000,?,00000002), ref: 1004523D
                    • SetWindowPos.USER32(?,00000000,?,?,000000FF,000000FF,00000015), ref: 100452BE
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Window$Rect$ClientLongParent$InfoParametersPointsSystem
                    • String ID:
                    • API String ID: 2289592163-0
                    • Opcode ID: 528fbe5a183ef7c061336e1efc8dcf398a69b5a02fc18c32684a7394076f9953
                    • Instruction ID: 98f027db83cd79a04d3ba499d12a471b86ac68be9a2c2f7b9207c74b21e37308
                    • Opcode Fuzzy Hash: 528fbe5a183ef7c061336e1efc8dcf398a69b5a02fc18c32684a7394076f9953
                    • Instruction Fuzzy Hash: BD415171A00529AFDB10CFA8CEC5BAEB7B9EB45221F250165F901F7291D771BE04CB54
                    Function 070ABD63 Relevance: 18.0, APIs: 5, Strings: 5, Instructions: 479COMMON
                    Download Yara Rule
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID:
                    • String ID: $.$5$ch != _T('\0')$output.c
                    • API String ID: 0-2742865912
                    • Opcode ID: fc68b3b44c7881ea79ff4220ac04f3c375c7368b6baf96c3d7eb6db140f7f646
                    • Instruction ID: 4221296bd6d4fe5486d8574fa524210747bdff23c97d7d4b033b1ddb0b93bf6c
                    • Opcode Fuzzy Hash: fc68b3b44c7881ea79ff4220ac04f3c375c7368b6baf96c3d7eb6db140f7f646
                    • Instruction Fuzzy Hash: 2B2239F5D14259EFEB54CF98C995BEEB7B1BF49300F248299D419AB240DB349A80CF60
                    Function 070ABC1D Relevance: 18.0, APIs: 5, Strings: 5, Instructions: 479COMMON
                    Download Yara Rule
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID:
                    • String ID: $.$5$ch != _T('\0')$output.c
                    • API String ID: 0-2742865912
                    • Opcode ID: fc68b3b44c7881ea79ff4220ac04f3c375c7368b6baf96c3d7eb6db140f7f646
                    • Instruction ID: 4221296bd6d4fe5486d8574fa524210747bdff23c97d7d4b033b1ddb0b93bf6c
                    • Opcode Fuzzy Hash: fc68b3b44c7881ea79ff4220ac04f3c375c7368b6baf96c3d7eb6db140f7f646
                    • Instruction Fuzzy Hash: 2B2239F5D14259EFEB54CF98C995BEEB7B1BF49300F248299D419AB240DB349A80CF60
                    Function 10043B10 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 236stringCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 10043B1A
                    • IsWindow.USER32(?), ref: 10043B96
                      • Part of subcall function 10003B8B: GetLastError.KERNEL32(00000000,?,?,10004A1A,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10003BAA
                      • Part of subcall function 10003B8B: SetLastError.KERNEL32(?,?,?,10004A1A,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10003BD8
                      • Part of subcall function 1000EA8B: SysStringLen.OLEAUT32(?), ref: 1000EA98
                      • Part of subcall function 1000EA8B: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 1000EAB2
                    • GetClassNameW.USER32(?,00000000,00000100), ref: 10043C01
                      • Part of subcall function 100126FA: __EH_prolog3_GS.LIBCMT ref: 10012701
                      • Part of subcall function 100126FA: GetLastError.KERNEL32(00000038,10054A54,1000B0C9,100C95EC,?), ref: 10012708
                      • Part of subcall function 100126FA: SetLastError.KERNEL32(00000000), ref: 1001275C
                    • IsWindow.USER32(?), ref: 10043DB1
                    • IsWindow.USER32(?), ref: 10043DDF
                    • IsWindow.USER32(?), ref: 10043E29
                    • GetClassNameW.USER32(?,?,00000100), ref: 10043E41
                    • lstrcmpiW.KERNEL32(?,100CCDA4), ref: 10043E53
                    • IsWindow.USER32(?), ref: 10043E87
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Window$ErrorLast$ClassH_prolog3_NameString$Alloclstrcmpi
                    • String ID: N
                    • API String ID: 828550879-1130791706
                    • Opcode ID: 1020b00b91a985febe36e7789d044e393fe255cfdfa66e76276898f8a2ae431f
                    • Instruction ID: 46ae4c6c5052adef60f387b84c5e1cca1ed3ec159ea1fc4f7f4c1d5a8ae3171b
                    • Opcode Fuzzy Hash: 1020b00b91a985febe36e7789d044e393fe255cfdfa66e76276898f8a2ae431f
                    • Instruction Fuzzy Hash: 0091AD35A0212A9EDF60EB24CD99BDDBBB4EF00340F6091E5E509E7190DB71AE85CF54
                    Function 10055AE7 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 208stringCOMMON
                    Download Yara Rule
                    APIs
                    • lstrlenW.KERNEL32(00000000,?,00000000,?,000000FF,000000FF,?,10015976,000000FF,00000000,80400100,?,00000000,1005451E,100C9108,40000000), ref: 10055B5A
                    • lstrcpyW.KERNEL32(00000000,00000000,?,000000FF,000000FF,?,10015976,000000FF,00000000,80400100,?,00000000,1005451E,100C9108,40000000,00000001), ref: 10055B7B
                    • lstrlenW.KERNEL32(00000000,?,00000000,?,000000FF,000000FF,?,10015976,000000FF,00000000,80400100,?,00000000,1005451E,100C9108,40000000), ref: 10055B82
                    • lstrlenW.KERNEL32(00000000,?,000000FF,000000FF,?,10015976,000000FF,00000000,80400100,?,00000000,1005451E,100C9108,40000000,00000001,00000080), ref: 10055BA6
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: lstrlen$lstrcpy
                    • String ID: @
                    • API String ID: 805584807-2766056989
                    • Opcode ID: 7027d2e2be13abaac70c9ea895559d1266a226411330ab0ddcdbe5ee2dae1769
                    • Instruction ID: 3d3b8d22efedb1d54b7475c83fa67f778dd7875ef283fb50ad5130a4c0c3e467
                    • Opcode Fuzzy Hash: 7027d2e2be13abaac70c9ea895559d1266a226411330ab0ddcdbe5ee2dae1769
                    • Instruction Fuzzy Hash: 5661B171600301AFEB14DF68CD9AAAAB7F8FF44351F10852EF902CA691DBB1E941CB10
                    Function 1003DBAB Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 116COMMON
                    Download Yara Rule
                    APIs
                    • _memset.LIBCMT ref: 1003DBD8
                    • __swprintf.LIBCMT ref: 1003DC58
                    • _memset.LIBCMT ref: 1003DC6A
                    • ShellExecuteExW.SHELL32(?), ref: 1003DCC8
                      • Part of subcall function 1003D973: lstrcmpW.KERNEL32(00000418,100C90D4,00000000), ref: 1003D990
                      • Part of subcall function 1003D973: lstrcatW.KERNEL32(00000418,100CC660), ref: 1003D9A0
                      • Part of subcall function 1003D973: lstrcatW.KERNEL32(00000418,?), ref: 1003D9AA
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: _memsetlstrcat$ExecuteShell__swprintflstrcmp
                    • String ID: <$@$B
                    • API String ID: 2756431898-2483279401
                    • Opcode ID: 8e9ae2c8e0070b8c4e8e8113ed75320fe07b26e80f6830da42344a05dd05866f
                    • Instruction ID: 42899d987d41a0103bd00b835c24c7ed1f30095fac21a5abdb8ab458629a7d72
                    • Opcode Fuzzy Hash: 8e9ae2c8e0070b8c4e8e8113ed75320fe07b26e80f6830da42344a05dd05866f
                    • Instruction Fuzzy Hash: 7041AE7590022C9FDB21EB64ED89BDDB7B8EB44301F5005EBE40DA6151DB34AE848F44
                    Function 100502C9 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 97COMMON
                    Download Yara Rule
                    APIs
                    • GetDlgItem.USER32(?,?), ref: 100502E9
                    • GetWindowPlacement.USER32(00000000,?), ref: 1005030C
                    • DestroyWindow.USER32(?), ref: 1005031F
                    • CreateWindowExW.USER32(00000000,100CE768,100CE744,40210000,?,?,?,?,?,?,00000000), ref: 1005035E
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Window$CreateDestroyItemPlacement
                    • String ID: ,
                    • API String ID: 3219888107-3772416878
                    • Opcode ID: 5ab9ed8fc566fe0cf6072d37a943056a40a3aa263f56645c5507d1268ee44060
                    • Instruction ID: ba81d412e7dad22dd4e63bbe376fb1cdbc515e8b0c6f8920c26fae83c838580b
                    • Opcode Fuzzy Hash: 5ab9ed8fc566fe0cf6072d37a943056a40a3aa263f56645c5507d1268ee44060
                    • Instruction Fuzzy Hash: 3D318F72801214BFDB11DFA4CE8CE9F7BB9EF09360F100165F905AA151DB706A00DB64
                    Function 1003A292 Relevance: 16.8, APIs: 11, Instructions: 342librarystringloaderCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_catch_GS.LIBCMT ref: 1003A29C
                      • Part of subcall function 100541FD: __EH_prolog3_catch_GS.LIBCMT ref: 10054207
                      • Part of subcall function 100541FD: vswprintf.LIBCMT ref: 100542BC
                    • lstrlenW.KERNEL32(?), ref: 1003A323
                    • GetModuleHandleW.KERNEL32(100CBEF4), ref: 1003A332
                    • GetProcAddress.KERNEL32(00000000,100CBF08), ref: 1003A33E
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: H_prolog3_catch_$AddressHandleModuleProclstrlenvswprintf
                    • String ID:
                    • API String ID: 4272848515-0
                    • Opcode ID: c84e72a40fee3ef019d67f32f33d06204858d9c2cecd3bafd6f49ffc91f9ac4a
                    • Instruction ID: 29008e0da4c9f60f524f82199e7f893611a37804967291427e2ca56074f921e5
                    • Opcode Fuzzy Hash: c84e72a40fee3ef019d67f32f33d06204858d9c2cecd3bafd6f49ffc91f9ac4a
                    • Instruction Fuzzy Hash: 50D16B74D00349AFDB05CBE4C989BAEBBB8EF56315F104198E909AF291DB749E84CB50
                    Function 10028C3B Relevance: 16.7, APIs: 11, Instructions: 216COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 10028C42
                    • _wcsstr.LIBCMT ref: 10028CD1
                    • CharNextW.USER32(?,?,00000000,00000001,0000005C,1002909B,?,00000000), ref: 10028CE2
                    • CharNextW.USER32(00000000,?,?,00000000,00000001,0000005C,1002909B,?,00000000), ref: 10028CE7
                    • CharNextW.USER32(00000000,?,?,00000000,00000001,0000005C,1002909B,?,00000000), ref: 10028CEC
                    • CharNextW.USER32(00000000,?,?,00000000,00000001,0000005C,1002909B,?,00000000), ref: 10028CF1
                    • CharNextW.USER32(00000000,100CB220,?,00000000,00000001,0000005C,1002909B,?,00000000), ref: 10028D99
                    • CharNextW.USER32(?,00000000,?), ref: 10028E1A
                    • CharNextW.USER32(?,00000000,00000001,0000005C,1002909B,?,00000000), ref: 10028E2E
                    • CoTaskMemFree.COMBASE(?), ref: 10028E6C
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: CharNext$FreeH_prolog3_Task_wcsstr
                    • String ID:
                    • API String ID: 2086807494-0
                    • Opcode ID: 75cda49638fd74eeaf43d78658a0e088f7735a6b4b7ad2bae2fe334ef7b6abb6
                    • Instruction ID: 3c079796271ee55d412cfc2955aa5600a2c3ebe2900501c0f5b877c4fd1a692f
                    • Opcode Fuzzy Hash: 75cda49638fd74eeaf43d78658a0e088f7735a6b4b7ad2bae2fe334ef7b6abb6
                    • Instruction Fuzzy Hash: 8871A3789013969FDF04DBB4E851A9EB7F4EF24350FA24025F804AB295EB30DE54C710
                    Function 100B58EE Relevance: 16.7, APIs: 11, Instructions: 206stringCOMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: _memmove$lstrcmp$H_prolog3_memset
                    • String ID:
                    • API String ID: 3198123400-0
                    • Opcode ID: af7702d7aed7d543aa0fca394ecd6ba5538a81ef40c04351d7e7baa22ccae1d1
                    • Instruction ID: 0521c3e624f4f829a74a561220f11daf135fc188bd604cc72d4864ca906e2904
                    • Opcode Fuzzy Hash: af7702d7aed7d543aa0fca394ecd6ba5538a81ef40c04351d7e7baa22ccae1d1
                    • Instruction Fuzzy Hash: 3661B379A00302EFDF10CF60D885F9ABBF5FF45305F2444AAE98596282E3769594CF50
                    Function 10010D86 Relevance: 16.6, APIs: 11, Instructions: 108stringCOMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Module$FileFreeHandleLibraryLoadNameString_memset_wcschr_wcsrchrlstrcpylstrlenwsprintf
                    • String ID:
                    • API String ID: 836880797-0
                    • Opcode ID: e04ad917dcca5b33ccd99c99a23291233bb500c2a6eed9a1c2baa293dea19ff1
                    • Instruction ID: 9326d0e2d7881d5b6dbf28313e1eb8f72f07ddd0d9577d86f18f13bfdf05a3c2
                    • Opcode Fuzzy Hash: e04ad917dcca5b33ccd99c99a23291233bb500c2a6eed9a1c2baa293dea19ff1
                    • Instruction Fuzzy Hash: 18317075A01329ABEB10DBA4CD4DEDE73BCEF04310F004596F619E7151EA74EB848B64
                    Function 10089B70 Relevance: 16.6, APIs: 11, Instructions: 105COMMON
                    Download Yara Rule
                    APIs
                    • FindResourceW.KERNEL32(?,00000000,100CCE48,?,00000000,?,?,?,10043A2A,00000000,?,?), ref: 10089B98
                    • FindResourceW.KERNEL32(?,00000000,00000002,?,?,?,10043A2A,00000000,?,?), ref: 10089BA9
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: FindResource
                    • String ID:
                    • API String ID: 1635176832-0
                    • Opcode ID: afe868969e1d23eeb528d504652c7154a7d37e32e4b5b4e7830441d87a1e5e3a
                    • Instruction ID: 1fffffa0df821f623bff362759f1317c1c168391335633234446e760ef2fa3c3
                    • Opcode Fuzzy Hash: afe868969e1d23eeb528d504652c7154a7d37e32e4b5b4e7830441d87a1e5e3a
                    • Instruction Fuzzy Hash: 1E31E972A01369AFE7009FA4DD88AAFBBECFF45665F050066FD04C2211E775DE1187A4
                    Function 1004E046 Relevance: 16.6, APIs: 11, Instructions: 86windowCOMMON
                    Download Yara Rule
                    APIs
                    • CreateCompatibleDC.GDI32(?), ref: 1004E07A
                    • CreateCompatibleBitmap.GDI32(?,00000010), ref: 1004E08E
                    • SelectObject.GDI32(00000000,00000000), ref: 1004E0A8
                    • SetBkColor.GDI32(00000000,?), ref: 1004E0B0
                    • CreateSolidBrush.GDI32(?), ref: 1004E0D1
                    • FillRect.USER32(?,00000000,00000000), ref: 1004E0E1
                    • DeleteObject.GDI32(00000000), ref: 1004E0EE
                    • BitBlt.GDI32(?,00000000,?,?,00000000,00000000,00CC0020), ref: 1004E128
                    • SelectObject.GDI32(?,00000000), ref: 1004E133
                    • DeleteObject.GDI32(?), ref: 1004E138
                    • DeleteDC.GDI32(?), ref: 1004E13B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Object$CreateDelete$CompatibleSelect$BitmapBrushColorFillRectSolid
                    • String ID:
                    • API String ID: 1945910462-0
                    • Opcode ID: 1922abcc871d0940344715fe44631df23c6fefa3092b69e17be8f874d0602a6a
                    • Instruction ID: 25e087d8664b7d6c62cd89c7b2ff51b998480162b48ba800b25d4f56f65e98ea
                    • Opcode Fuzzy Hash: 1922abcc871d0940344715fe44631df23c6fefa3092b69e17be8f874d0602a6a
                    • Instruction Fuzzy Hash: 51310B72910129EFEB019FA0CD85AAEBBB9FB0C310F104055FA11A2260C7759E51EF68
                    Function 1004C80B Relevance: 16.6, APIs: 11, Instructions: 71stringCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1004C815
                    • lstrlenW.KERNEL32(?,000000B0), ref: 1004C81E
                    • CreateICW.GDI32(100CE57C,00000000,00000000,00000000), ref: 1004C83A
                    • _memset.LIBCMT ref: 1004C880
                    • _wcsncpy.LIBCMT ref: 1004C891
                    • CreateFontIndirectW.GDI32 ref: 1004C8A1
                    • SelectObject.GDI32(00000000,00000000), ref: 1004C8B9
                    • GetTextMetricsW.GDI32(?,?), ref: 1004C8CA
                    • SelectObject.GDI32(?,00000000), ref: 1004C8DA
                    • DeleteObject.GDI32(?), ref: 1004C8E2
                    • DeleteDC.GDI32(?), ref: 1004C8E9
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Object$CreateDeleteSelect$FontH_prolog3_IndirectMetricsText_memset_wcsncpylstrlen
                    • String ID:
                    • API String ID: 3055916118-0
                    • Opcode ID: 3872167e6bd8bce6bbb7c39f4ecf05a871ba00e4d8ef3fd19761d824b4af0447
                    • Instruction ID: b7a2e4b40dc8352756172dc2c7b7bb953936e58709e4faa171484730c45377d1
                    • Opcode Fuzzy Hash: 3872167e6bd8bce6bbb7c39f4ecf05a871ba00e4d8ef3fd19761d824b4af0447
                    • Instruction Fuzzy Hash: 18210C71D00228AFEB90DBA48C85F9E76BDEF09250F1140EAF608E2151DB705E858F66
                    Function 1001EEF3 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 146comCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1001EEFA
                    • CoCreateInstance.COMBASE(100CA2E0,00000000,00000001,?,?), ref: 1001EFD7
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: CreateH_prolog3_Instance
                    • String ID: M$m
                    • API String ID: 3671951861-1172847554
                    • Opcode ID: 05688e3bdb1853044c99bd8ae4b3424a46f18e3c7c313f294e0be4914805af8d
                    • Instruction ID: 7bc95dbe359df243d9a59d02b948223548ff4e3cf61727aa1238064491819efd
                    • Opcode Fuzzy Hash: 05688e3bdb1853044c99bd8ae4b3424a46f18e3c7c313f294e0be4914805af8d
                    • Instruction Fuzzy Hash: D1516A74900656AADB11CB94C880BEEB6F4EF0D7A0F21406EF945EA281DB35DEC28765
                    Function 1001B827 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 119COMMON
                    Download Yara Rule
                    APIs
                    • RtlEnterCriticalSection.NTDLL(?), ref: 1001B85F
                    • GetClassInfoExW.USER32(00000000,?,?), ref: 1001B896
                    • GetClassInfoExW.USER32(?,?,00000030), ref: 1001B8A6
                    • RtlLeaveCriticalSection.NTDLL(?), ref: 1001B8AF
                    • LoadCursorW.USER32(?,?), ref: 1001B8EE
                    • swprintf.LIBCMT ref: 1001B916
                    • GetClassInfoExW.USER32(?,00000000,?), ref: 1001B935
                    • RtlLeaveCriticalSection.NTDLL(?), ref: 1001B956
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ClassCritiusernfoSection$Leave$CursorEnterLoadswprintf
                    • String ID: 0
                    • API String ID: 1916026773-4108050209
                    • Opcode ID: 80017b51f4c3612ad83247a75b50f340cad473bf72e3b4e238d160f6e65ca4be
                    • Instruction ID: 1a8ebd2af62b5bf537bfbca897046eca0606ba860a9f50d822a5b2d1e4174a12
                    • Opcode Fuzzy Hash: 80017b51f4c3612ad83247a75b50f340cad473bf72e3b4e238d160f6e65ca4be
                    • Instruction Fuzzy Hash: B6413676900605EBEF55DFA4C984A9A7BB8FF087A0B014099ED04AF255EB31DD81CF50
                    Function 1004BFCB Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105stringCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1004BFD2
                    • GetDC.USER32(00000000), ref: 1004BFEF
                    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 1004C000
                      • Part of subcall function 1004C10C: _wcscpy.LIBCMT ref: 1004C14C
                      • Part of subcall function 1004C10C: EnumFontFamiliesExW.GDI32(?,?,1004BF59,?,00000000,?,?,00000001,?,00000000), ref: 1004C16F
                      • Part of subcall function 1004C10C: ReleaseDC.USER32(00000000,?), ref: 1004C17D
                    • lstrcmpiW.KERNEL32(00000000,?,00000000,?,?), ref: 1004C037
                    • lstrcpyW.KERNEL32(?,00000000), ref: 1004C058
                    • lstrcpyW.KERNEL32(?,100CE58C,00000000,?,?), ref: 1004C083
                    • CreateFontIndirectW.GDI32(?), ref: 1004C0E5
                    • ReleaseDC.USER32(00000000,?), ref: 1004C0F4
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: FontReleaselstrcpy$CapsCreateDeviceEnumFamiliesH_prolog3_Indirect_wcscpylstrcmpi
                    • String ID: "
                    • API String ID: 627797698-123907689
                    • Opcode ID: 7e8312808e33b36b746cf10c9ce3ec6c199e38127dc04fe2114a2fbee633eb21
                    • Instruction ID: 84a173d0961ff784f3b2e54ad3efd28848e0f8f75a28bae4f872b582598c99df
                    • Opcode Fuzzy Hash: 7e8312808e33b36b746cf10c9ce3ec6c199e38127dc04fe2114a2fbee633eb21
                    • Instruction Fuzzy Hash: 0B4145719052A8CEEB21CFF58984ADEBBF8BF09300F644069E945EB252CB749A45CF54
                    Function 070ACB00 Relevance: 15.3, APIs: 10, Instructions: 253COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • LCMapStringW.KERNEL32(00000000,00000100,070CBF38,00000001,00000000,00000000), ref: 070ACB41
                    • LCMapStringA.KERNEL32(00000000,00000100,070CBF34,00000001,00000000,00000000), ref: 070ACB69
                    • LCMapStringA.KERNEL32(00000000,00000003,070AA436,00000000,00000100,00000200), ref: 070ACBC0
                    • MultiByteToWideChar.KERNEL32(00000000,070ACFFF,070AA436,00000000,00000000,00000000), ref: 070ACC05
                    • MultiByteToWideChar.KERNEL32(00000000,00000001,070AA436,00000000,00000000,00000000), ref: 070ACC80
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: String$ByteCharMultiWide
                    • String ID:
                    • API String ID: 352835431-0
                    • Opcode ID: c2764afc50cc9afe0cd51c8cc736240a3024d56ffa69822ded6d2f116ae478a2
                    • Instruction ID: 8083b2fc3d02f2c37a7f15dc00d1401452f11422e2199815d118c3ade88472ae
                    • Opcode Fuzzy Hash: c2764afc50cc9afe0cd51c8cc736240a3024d56ffa69822ded6d2f116ae478a2
                    • Instruction Fuzzy Hash: E791F8B1A15209BFEB50CFE8D846BAF7BF5BB48710F118718F916A7280D77898418B64
                    Function 1004F47A Relevance: 15.2, APIs: 10, Instructions: 233stringCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1004F484
                    • lstrlenW.KERNEL32(?), ref: 1004F4AF
                    • lstrcpyW.KERNEL32(00000000,?), ref: 1004F4DB
                    • lstrcatW.KERNEL32(?,100CDC5C), ref: 1004F54A
                    • lstrcatW.KERNEL32(?,100FB980), ref: 1004F555
                    • SetWindowTextW.USER32(?,?), ref: 1004F6A9
                    • PathCompactPathPixel.ISRT(?,?,00000000,?,?,00000000,-00000004,?,00000001,?,100C90D4,?,00000000,?,?,?), ref: 1004F63B
                      • Part of subcall function 1003CE45: GetDC.USER32(?), ref: 1003CE6B
                      • Part of subcall function 1001CD08: __EH_prolog3_GS.LIBCMT ref: 1001CD0F
                      • Part of subcall function 1001CD08: GetLastError.KERNEL32(00000038,1002271F), ref: 1001CD16
                      • Part of subcall function 1001CD08: SetLastError.KERNEL32(00000000), ref: 1001CD6A
                    • SetWindowTextW.USER32(?,?), ref: 1004F561
                      • Part of subcall function 1000EA30: SysStringLen.OLEAUT32(00000024), ref: 1000EA3D
                      • Part of subcall function 1000EA30: SysReAllocStringLen.OLEAUT32(00000024,00000004,?), ref: 1000EA57
                    • PathCompactPathPixel.ISRT(?,?,00000000,?,?,00000000,-00000004,?,00000001,?,100C90D4,?,00000000,?,?,?), ref: 1004F748
                    • SetWindowTextW.USER32(?,?), ref: 1004F7B6
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Path$TextWindow$CompactErrorH_prolog3_LastPixelStringlstrcat$Alloclstrcpylstrlen
                    • String ID:
                    • API String ID: 4121966943-0
                    • Opcode ID: 2c22f01515afbbff39d9e6a1674236f176cf8d5f51cd9241d4739796af25295c
                    • Instruction ID: cc7759134fe5046e64433557e34838e56753c7b073b389104cf5e9332b64d763
                    • Opcode Fuzzy Hash: 2c22f01515afbbff39d9e6a1674236f176cf8d5f51cd9241d4739796af25295c
                    • Instruction Fuzzy Hash: 4EA1797590025AEFDB15CBA4CD99BEDBBB8FF14300F1040A9E14AA7152EB746B84CF61
                    Function 1004B36A Relevance: 15.2, APIs: 10, Instructions: 168windowCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1004B371
                    • GetPropW.USER32(?,100CE534), ref: 1004B38B
                    • GetPropW.USER32(?,100CE550), ref: 1004B397
                    • SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 1004B42C
                    • SendMessageW.USER32(?,0000110A,00000004,?), ref: 1004B44E
                      • Part of subcall function 1004B288: GetCursorPos.USER32(?), ref: 1004B29D
                      • Part of subcall function 1004B288: ScreenToClient.USER32(?,?), ref: 1004B2A8
                      • Part of subcall function 1004B288: SendMessageW.USER32(?,00001111,00000000,?), ref: 1004B2BA
                    • SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 1004B4BB
                    • SendMessageW.USER32(?,00001101,00000000,FFFF0000), ref: 1004B559
                    • SetWindowLongW.USER32(?,000000FC,00000000), ref: 1004B566
                    • RemovePropW.USER32(?,100CE534), ref: 1004B578
                    • RemovePropW.USER32(?,100CE550), ref: 1004B582
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: MessageSend$Prop$Remove$ClientCursorH_prolog3_LongScreenWindow
                    • String ID:
                    • API String ID: 1355770198-0
                    • Opcode ID: 97b3940a88f164ac2908f63f0b9f448f7e992195d9da406cf9f9174e03b78aec
                    • Instruction ID: d3764d0478108bb60eaa144171d0f79df113976e290fb4ad04989d884edc7b03
                    • Opcode Fuzzy Hash: 97b3940a88f164ac2908f63f0b9f448f7e992195d9da406cf9f9174e03b78aec
                    • Instruction Fuzzy Hash: 69516B34900A15EBDB24DFA0CC85B9EBBB4FF44360F204269FA11EB1A2C775A951CF58
                    Function 10016029 Relevance: 15.1, APIs: 10, Instructions: 124COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_catch.LIBCMT ref: 10016030
                    • _memset.LIBCMT ref: 10016062
                    • VariantInit.OLEAUT32(?), ref: 10016074
                    • _memset.LIBCMT ref: 10016088
                    • VariantInit.OLEAUT32(?), ref: 10016094
                      • Part of subcall function 100053B7: SysAllocString.OLEAUT32(?), ref: 100053D8
                    • VariantClear.OLEAUT32(?), ref: 10016123
                    • VariantClear.OLEAUT32(?), ref: 10016129
                    • VariantClear.OLEAUT32(?), ref: 1001612F
                    • VariantClear.OLEAUT32(?), ref: 10016135
                    • VariantClear.OLEAUT32(?), ref: 1001613B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Variant$Clear$Init_memset$AllocH_prolog3_catchString
                    • String ID:
                    • API String ID: 24258358-0
                    • Opcode ID: a9f348809643effa963e924bb317b5c76d008c7dbc0ac83f69651b893ffa2f53
                    • Instruction ID: f090199dfc5394c24b6f1030ce079b8cb396faaad915a4dc78262b9dc9ace7d3
                    • Opcode Fuzzy Hash: a9f348809643effa963e924bb317b5c76d008c7dbc0ac83f69651b893ffa2f53
                    • Instruction Fuzzy Hash: 0341F572D0062D9BDF01EFA8DD85ADEB7BAFF46304F040445EE04AF145E7B2AA058B91
                    Function 10050B09 Relevance: 15.1, APIs: 10, Instructions: 85windowCOMMON
                    Download Yara Rule
                    APIs
                    • LoadBitmapW.USER32(?,00000000), ref: 10050B36
                    • GetObjectW.GDI32(00000000,00000018,?), ref: 10050B48
                    • SetRect.USER32(?,?,?,?,?), ref: 10050B65
                      • Part of subcall function 100507FC: SaveDC.GDI32(?), ref: 1005081B
                      • Part of subcall function 100507FC: CreateCompatibleDC.GDI32(?), ref: 1005082D
                      • Part of subcall function 100507FC: CreateCompatibleBitmap.GDI32(?,?,?), ref: 10050848
                      • Part of subcall function 100507FC: SelectObject.GDI32(00000000,00000000), ref: 10050851
                      • Part of subcall function 100507FC: CreateCompatibleDC.GDI32(?), ref: 1005085A
                      • Part of subcall function 100507FC: CreateCompatibleBitmap.GDI32(?,?,?), ref: 10050872
                      • Part of subcall function 100507FC: SelectObject.GDI32(1004DF85,00000000), ref: 1005087B
                      • Part of subcall function 100507FC: CreateCompatibleDC.GDI32(?), ref: 10050887
                      • Part of subcall function 100507FC: SelectObject.GDI32(00000000,00000000), ref: 1005088E
                      • Part of subcall function 100507FC: CreateCompatibleDC.GDI32(?), ref: 1005089A
                      • Part of subcall function 100507FC: CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 100508B7
                      • Part of subcall function 100507FC: SelectObject.GDI32(00000000,00000000), ref: 100508C2
                      • Part of subcall function 100507FC: CreateCompatibleDC.GDI32(?), ref: 100508CE
                      • Part of subcall function 100507FC: SelectObject.GDI32(00000000,00000000), ref: 100508D9
                      • Part of subcall function 100507FC: SetBkColor.GDI32(00000000,10050B80), ref: 100508E6
                      • Part of subcall function 100507FC: CreateCompatibleDC.GDI32(?), ref: 100508EF
                    • CreateCompatibleDC.GDI32(1004DF85), ref: 10050B83
                    • SelectObject.GDI32(00000000,00000000), ref: 10050B8D
                    • BitBlt.GDI32(1004DF85,00000000,?,?,?,00000000,00000000,00000000,00CC0020), ref: 10050BAC
                    • DeleteObject.GDI32(00000000), ref: 10050BBB
                    • DeleteObject.GDI32(?), ref: 10050BC0
                    • DeleteDC.GDI32(00000000), ref: 10050BC3
                    • DeleteObject.GDI32(00000000), ref: 10050BCA
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: CreateObject$Compatible$Select$BitmapDelete$ColorLoadRectSave
                    • String ID:
                    • API String ID: 419779404-0
                    • Opcode ID: 29c8ba7847a4e886e84a594b2c7563a812721a6c3161c8f111033f61cf925a3f
                    • Instruction ID: 07e1873a1aede8960a3939f0568b96df0a542224362827a2cdf998d03b18e9fc
                    • Opcode Fuzzy Hash: 29c8ba7847a4e886e84a594b2c7563a812721a6c3161c8f111033f61cf925a3f
                    • Instruction Fuzzy Hash: AC21EA76900228AFEB10DFA4DD85EAFBBBDFB48710F104056FA01E3260D674AE019B64
                    Function 10079DE0 Relevance: 15.1, APIs: 10, Instructions: 82windowCOMMON
                    Download Yara Rule
                    APIs
                    • GetWindowRect.USER32(?,?), ref: 10079E04
                    • ScreenToClient.USER32(1007A78F,?), ref: 10079E16
                    • ScreenToClient.USER32(1007A78F,?), ref: 10079E2A
                    • CreateCompatibleDC.GDI32(5350EC45), ref: 10079E47
                    • CreateCompatibleBitmap.GDI32(?,?,?), ref: 10079E5A
                    • SelectObject.GDI32(00000000,00000000), ref: 10079E64
                    • BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,00CC0020), ref: 10079E87
                    • CreatePatternBrush.GDI32(00000000), ref: 10079E8E
                    • DeleteObject.GDI32(00000000), ref: 10079E97
                    • DeleteDC.GDI32(00000000), ref: 10079E9E
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Create$ClientCompatibleDeleteObjectScreen$BitmapBrushPatternRectSelectWindow
                    • String ID:
                    • API String ID: 3450704212-0
                    • Opcode ID: 1acb42c944850e0e013043cb3939d557b9d6a1a3808a4f6bd2435c5595021c70
                    • Instruction ID: fb1c1a49387723a46748aa38b33d93c234f9f79e2872c6e5d06a0b0f67a2ace4
                    • Opcode Fuzzy Hash: 1acb42c944850e0e013043cb3939d557b9d6a1a3808a4f6bd2435c5595021c70
                    • Instruction Fuzzy Hash: 5C31FA76900229AFDB00DFA4CD89DEEBBB8FF4C310F144096EA05A7220D7306A05DBA4
                    Function 070A1770 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 236COMMON
                    Download Yara Rule
                    APIs
                    • __malloc_dbg.LIBCMTD ref: 070A1787
                    • GetStartupInfoA.KERNEL32 ref: 070A17F7
                    • __malloc_dbg.LIBCMTD ref: 070A1882
                    • GetFileType.KERNEL32(070A10E7), ref: 070A1956
                    • GetStdHandle.KERNEL32(?), ref: 070A19F8
                    • GetFileType.KERNEL32(000000FF), ref: 070A1A0B
                    • SetHandleCount.KERNEL32(00000020), ref: 070A1A8A
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: FileHandleType__malloc_dbg$CountInfoStartup
                    • String ID: ioinit.c
                    • API String ID: 2656353590-350981760
                    • Opcode ID: 9f4ebf0505c0140789b99b80717c2480cc5b3ef3807c7f923549a3d4c24e41b0
                    • Instruction ID: cca2ae07ee122814127dfec3172c96957b8eb531121ffd1fa0f7d3dc95dd740f
                    • Opcode Fuzzy Hash: 9f4ebf0505c0140789b99b80717c2480cc5b3ef3807c7f923549a3d4c24e41b0
                    • Instruction Fuzzy Hash: 70B125B4A05389DFDB04CFD8C895AADBBF2BF46308F248258D8156F389C7749845CB41
                    Function 070A5A70 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 197COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,070A5A36,00000002,00000000,00000000,?,?), ref: 070A5ABC
                      • Part of subcall function 070A55D0: DebugBreak.KERNEL32(?,070A5AA8), ref: 070A55D3
                    Strings
                    • ..., xrefs: 070A5B0C, 070A5B64
                    • Microsoft Visual C++ Debug Library, xrefs: 070A5D32
                    • Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 070A5CFC
                    • szUserMessage != NULL, xrefs: 070A5A83
                    • <program name unknown>, xrefs: 070A5AC6
                    • dbgrpt.c, xrefs: 070A5A8F
                    • _CrtDbgReport: String too long or IO Error, xrefs: 070A5D19
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: BreakDebugFileModuleName
                    • String ID: ...$<program name unknown>$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$dbgrpt.c$szUserMessage != NULL
                    • API String ID: 3969911889-457056794
                    • Opcode ID: 60c0cb43c1cf81e6c6891aef00938de4bb3538a6c610042a88e6e66a4265af8f
                    • Instruction ID: 3e9cd30cf6dfd187fbf49b6718358572ded2f3614a927eae1dd260bb0ec7432c
                    • Opcode Fuzzy Hash: 60c0cb43c1cf81e6c6891aef00938de4bb3538a6c610042a88e6e66a4265af8f
                    • Instruction Fuzzy Hash: 598170F4E10229FFCB68DF94CC86ADEB7B4BB58305F0046D8E6195A244E6709B94CF91
                    Function 10087C30 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 187windowCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 100B56AC: __EH_prolog3.LIBCMT ref: 100B56B3
                    • _memmove.LIBCMT ref: 10087D9D
                    • GetWindowDC.USER32(00000000), ref: 10087DAD
                    • CreateDIBitmap.GDI32(00000000,00000000,00000004,00000002,00000000,00000000), ref: 10087DC2
                    • ReleaseDC.USER32(00000000,00000000), ref: 10087DF3
                    • _memset.LIBCMT ref: 10087E26
                    • _memmove.LIBCMT ref: 10087E33
                    • _memmove.LIBCMT ref: 10087E47
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: _memmove$BitmapCreateH_prolog3ReleaseWindow_memset
                    • String ID: `cu
                    • API String ID: 3696145347-4120539311
                    • Opcode ID: c4b21d6ab62a59b56dd366df6b2c595d3a81b7650126fb8abecf08eff2da7551
                    • Instruction ID: 8404b1d80460ed309790d94cc4715b97fde642b0da12be4c1959f36cd6b42a32
                    • Opcode Fuzzy Hash: c4b21d6ab62a59b56dd366df6b2c595d3a81b7650126fb8abecf08eff2da7551
                    • Instruction Fuzzy Hash: F17118B5D002199FEB54CFA4C885B9DBBF5FF09310F1041AAE909EB241EB35AA55CF90
                    Function 10046193 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 175fileCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1004619D
                      • Part of subcall function 10003BE6: __EH_prolog3.LIBCMT ref: 10003BED
                      • Part of subcall function 10003BE6: GetLastError.KERNEL32(00000004,10003F3B,00000000,?,00000000,?), ref: 10003C0F
                      • Part of subcall function 10003BE6: SetLastError.KERNEL32(00000000,00000000,?), ref: 10003C48
                      • Part of subcall function 10003B8B: GetLastError.KERNEL32(00000000,?,?,10004A1A,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10003BAA
                      • Part of subcall function 10003B8B: SetLastError.KERNEL32(?,?,?,10004A1A,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10003BD8
                      • Part of subcall function 10004EC2: GetLastError.KERNEL32(00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10004ED0
                      • Part of subcall function 10004EC2: SysFreeString.OLEAUT32(?), ref: 10004EE4
                      • Part of subcall function 10004EC2: SetLastError.KERNEL32(?,00000001,00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000), ref: 10004EFE
                    • CreateDirectoryW.KERNEL32(?,00000000,?,00000000,00000001,?,00000000,?,?,00000001,?,?,00000000,100C90D0,100C90D4,?), ref: 100462C9
                    • GetFileAttributesW.KERNEL32(?), ref: 100462E8
                    • _memset.LIBCMT ref: 1004637E
                    • GetTempFileNameW.KERNEL32(100C9104,100CD68C,00000000,?,100C90D4,?,00000000), ref: 1004640E
                    • DeleteFileW.KERNEL32(?), ref: 10046454
                    • RemoveDirectoryW.KERNEL32(?), ref: 1004647A
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$File$Directory$AttributesCreateDeleteFreeH_prolog3H_prolog3_NameRemoveStringTemp_memset
                    • String ID: \
                    • API String ID: 1042923889-2967466578
                    • Opcode ID: 69c95d2e821ff62ad2532597e3d4455f09598d851398617b1af28de53934bf61
                    • Instruction ID: b0db45bc0efe7df4c3b9164534713b8c3542afd1d4703840b2ddb52144c8ff6c
                    • Opcode Fuzzy Hash: 69c95d2e821ff62ad2532597e3d4455f09598d851398617b1af28de53934bf61
                    • Instruction Fuzzy Hash: AB8135759002A9DEDF60DB64CC8DBDEB7B8EF18244F5002E9E509A2151EB306F85CF15
                    Function 1004A726 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 90libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1004A730
                      • Part of subcall function 10040D44: __EH_prolog3_GS.LIBCMT ref: 10040D4B
                      • Part of subcall function 10040D44: GetWindowsDirectoryW.KERNEL32(00000000,00000104,00000000,00000104,?,00000000,00000078,1005E096,00000000,00000000,00000068,10077762,00000000,100C90E8,100CB3E4,?), ref: 10040DA3
                      • Part of subcall function 10040D44: __CxxThrowException@8.LIBCMT ref: 10040DD0
                      • Part of subcall function 10003AA0: __EH_prolog3.LIBCMT ref: 10003AA7
                      • Part of subcall function 10003AA0: GetLastError.KERNEL32(00000004,100049CB,0000005C,00000000,00000000,00000000,?,1000DB12,00000000,00000001,00000000,?,000000FF,00000001,00000048,1000E682), ref: 10003AC9
                      • Part of subcall function 10003AA0: SetLastError.KERNEL32(?,00000000,?,1000DB12,00000000,00000001,00000000,?,000000FF,00000001,00000048,1000E682,?), ref: 10003B01
                      • Part of subcall function 10004EC2: GetLastError.KERNEL32(00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10004ED0
                      • Part of subcall function 10004EC2: SysFreeString.OLEAUT32(?), ref: 10004EE4
                      • Part of subcall function 10004EC2: SetLastError.KERNEL32(?,00000001,00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000), ref: 10004EFE
                      • Part of subcall function 10003BE6: __EH_prolog3.LIBCMT ref: 10003BED
                      • Part of subcall function 10003BE6: GetLastError.KERNEL32(00000004,10003F3B,00000000,?,00000000,?), ref: 10003C0F
                      • Part of subcall function 10003BE6: SetLastError.KERNEL32(00000000,00000000,?), ref: 10003C48
                    • LoadLibraryW.KERNEL32(?,?,100CCCAC,?,00000000,00000000,00000000), ref: 1004A7BB
                    • GetProcAddress.KERNEL32(00000000,100CCCC4), ref: 1004A7D3
                    • MonitorFromPoint.USER32(00000001,00000001,00000002), ref: 1004A7E9
                    • GetDC.USER32(00000000), ref: 1004A818
                    • GetDeviceCaps.GDI32(00000000,00000058), ref: 1004A827
                    • ReleaseDC.USER32(00000000,00000000), ref: 1004A835
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$H_prolog3H_prolog3_$AddressCapsDeviceDirectoryException@8FreeFromLibraryLoadMonitorPointProcReleaseStringThrowWindows
                    • String ID: `
                    • API String ID: 4093503460-2679148245
                    • Opcode ID: 2a69e53b75b7fe1bb870e83b231b676d10fbbd5a7fbac4bb196f3b15ac90882e
                    • Instruction ID: 14e8ae264eb0a0981f01178932e7a5d82ae55a88b277dcb514d753f8a0d28f63
                    • Opcode Fuzzy Hash: 2a69e53b75b7fe1bb870e83b231b676d10fbbd5a7fbac4bb196f3b15ac90882e
                    • Instruction Fuzzy Hash: E0319CB5D00228AEDB21CBA4CD88BDEB7B8FF15300F540099F605A3241DB705A46CF65
                    Function 1004B07A Relevance: 13.7, APIs: 9, Instructions: 156windowCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1004B081
                    • SetPropW.USER32(?,100CE534,?), ref: 1004B0A4
                    • GetWindowLongW.USER32(?,000000FC), ref: 1004B0BA
                    • SetPropW.USER32(?,100CE550,00000000), ref: 1004B0CC
                    • SendMessageW.USER32(?,00001109,00000002,?), ref: 1004B1B7
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Prop$H_prolog3_LongMessageSendWindow
                    • String ID:
                    • API String ID: 3213744336-0
                    • Opcode ID: 3f0a5db13d42ed78de950e7d135125825e98c9c57a06e15043f21a61787915f2
                    • Instruction ID: 35dcb02eb679208246e69cab983a6605136a5d00717c4e82b2d3bff2dce61346
                    • Opcode Fuzzy Hash: 3f0a5db13d42ed78de950e7d135125825e98c9c57a06e15043f21a61787915f2
                    • Instruction Fuzzy Hash: 7C51F971940B05BBEF11DBB0CD8AFDE76A8EF04350F210568F665E61D1EBB4AA01CB18
                    Function 1004C1DE Relevance: 13.6, APIs: 9, Instructions: 107threadCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1004C1E5
                    • _memset.LIBCMT ref: 1004C1F6
                    • VariantInit.OLEAUT32(?), ref: 1004C202
                      • Part of subcall function 10012EB8: __EH_prolog3_GS.LIBCMT ref: 10012EBF
                    • FindWindowW.USER32(100CA06C,00000000), ref: 1004C25A
                    • FindWindowW.USER32(100CA334,00000000), ref: 1004C26C
                    • GetWindowThreadProcessId.USER32(00000000,?), ref: 1004C275
                    • OpenProcess.KERNEL32(00000410,00000000,?), ref: 1004C284
                      • Part of subcall function 10003B8B: GetLastError.KERNEL32(00000000,?,?,10004A1A,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10003BAA
                      • Part of subcall function 10003B8B: SetLastError.KERNEL32(?,?,?,10004A1A,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10003BD8
                      • Part of subcall function 1000EA8B: SysStringLen.OLEAUT32(?), ref: 1000EA98
                      • Part of subcall function 1000EA8B: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 1000EAB2
                      • Part of subcall function 100126FA: __EH_prolog3_GS.LIBCMT ref: 10012701
                      • Part of subcall function 100126FA: GetLastError.KERNEL32(00000038,10054A54,1000B0C9,100C95EC,?), ref: 10012708
                      • Part of subcall function 100126FA: SetLastError.KERNEL32(00000000), ref: 1001275C
                    • CloseHandle.KERNEL32(00000000,100CE598,00000000,00000000,00000000,00000000,00000104,?,00000104,?), ref: 1004C30A
                      • Part of subcall function 10004EC2: GetLastError.KERNEL32(00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10004ED0
                      • Part of subcall function 10004EC2: SysFreeString.OLEAUT32(?), ref: 10004EE4
                      • Part of subcall function 10004EC2: SetLastError.KERNEL32(?,00000001,00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000), ref: 10004EFE
                    • VariantClear.OLEAUT32(?), ref: 1004C320
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$H_prolog3_StringWindow$FindProcessVariant$AllocClearCloseFreeHandleInitOpenThread_memset
                    • String ID:
                    • API String ID: 2220225304-0
                    • Opcode ID: 1c961048ae7bbbc8fa7b5e25f03c12d22dced6d2ae14f7a1e0d216ff7aa3a171
                    • Instruction ID: e8ec7dff72397c5910c12a01106ca7f58465d7740cd8215881c5bb555a5fcba4
                    • Opcode Fuzzy Hash: 1c961048ae7bbbc8fa7b5e25f03c12d22dced6d2ae14f7a1e0d216ff7aa3a171
                    • Instruction Fuzzy Hash: EA31B276800258AFEB01DBE0CD95EEE77BCEF04354F144559FA02AB291DF70AE4587A1
                    Function 1004AEE2 Relevance: 13.6, APIs: 9, Instructions: 96windowCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1004AEE9
                    • SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 1004AF1C
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: H_prolog3_MessageSend
                    • String ID:
                    • API String ID: 591282594-0
                    • Opcode ID: 6eb8f6f732a3b28c237594cd70918b5f2944ddec533dba58d2ef2f78c72e74ae
                    • Instruction ID: c14d2ca6c06b620450ebbf74ef05fde77179bfba24d06733e80b80b9cee711ef
                    • Opcode Fuzzy Hash: 6eb8f6f732a3b28c237594cd70918b5f2944ddec533dba58d2ef2f78c72e74ae
                    • Instruction Fuzzy Hash: A2318C34A81219BFEB25CBA0CC85FEEBB69FF04750F204124B604AB1D1DBB16D55CB94
                    Function 10016B26 Relevance: 13.6, APIs: 9, Instructions: 88COMMON
                    Download Yara Rule
                    APIs
                    • FindResourceW.KERNEL32(?,?,?), ref: 10016B3C
                    • LoadResource.KERNEL32(?,00000000), ref: 10016B4C
                    • SizeofResource.KERNEL32(?,00000000), ref: 10016B62
                    • _memset.LIBCMT ref: 10016B83
                    • LockResource.KERNEL32(00000000,?), ref: 10016B8F
                    • _memmove.LIBCMT ref: 10016B98
                    • __CxxThrowException@8.LIBCMT ref: 10016BAB
                    • GlobalLock.KERNEL32(00000000), ref: 10016BCD
                      • Part of subcall function 10016F98: _memmove.LIBCMT ref: 10016FBE
                    • GlobalUnlock.KERNEL32(00000000), ref: 10016BE8
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Resource$GlobalLock_memmove$Exception@8FindLoadSizeofThrowUnlock_memset
                    • String ID:
                    • API String ID: 2369374859-0
                    • Opcode ID: 67cbda3937c04cab4df2d6d2a6ea2eb0ddba91fbee6e2a1ee248b7a8e573e522
                    • Instruction ID: 70c13b3494605a37216a1e9ee4ed0bf951b037dc455e790cacabf5609586f759
                    • Opcode Fuzzy Hash: 67cbda3937c04cab4df2d6d2a6ea2eb0ddba91fbee6e2a1ee248b7a8e573e522
                    • Instruction Fuzzy Hash: 9221F575104315BFEB109F25DC88EAB7FADEF887A0F104439F909C6211DB71D99187A0
                    Function 1001F418 Relevance: 13.6, APIs: 9, Instructions: 80COMMON
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 4c041e2856c176cca7b4683b5549c68872bc2acea3b43305a6b9aa8017436f13
                    • Instruction ID: 342546ef01e369dadf339950648a78a048b68dcc1ca1de0d2a3a3959cc52935d
                    • Opcode Fuzzy Hash: 4c041e2856c176cca7b4683b5549c68872bc2acea3b43305a6b9aa8017436f13
                    • Instruction Fuzzy Hash: A5318971A0025AAFEB11CFA8CD88B6FBBF8FF18250F11045DED81A6161D774DA90CB64
                    Function 10017099 Relevance: 13.6, APIs: 9, Instructions: 75windowCOMMON
                    Download Yara Rule
                    APIs
                    • GetDC.USER32(?), ref: 100170C0
                    • CreateCompatibleDC.GDI32(00000003), ref: 100170F5
                    • CreateCompatibleBitmap.GDI32(00000003,?,00000000), ref: 10017103
                    • SelectObject.GDI32(00000000,00000000), ref: 10017113
                    • DrawFrameControl.USER32(00000000,00000000,00000002,00000020), ref: 10017127
                    • DeleteObject.GDI32(?), ref: 10017133
                    • SelectObject.GDI32(00000000,00000000), ref: 10017145
                    • DeleteObject.GDI32(00000000), ref: 1001714C
                    • ReleaseDC.USER32(00013D85,00000003), ref: 1001715B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Object$CompatibleCreateDeleteSelect$BitmapControlDrawFrameRelease
                    • String ID:
                    • API String ID: 4060265701-0
                    • Opcode ID: 3fada6394083b55b84bd32359730fa4a826bf012d2d8c1dc59e30d6ff1c93191
                    • Instruction ID: f853669f058abfe05b60b209fa0eb755144c69da9b377b43fd65a7f849870bfa
                    • Opcode Fuzzy Hash: 3fada6394083b55b84bd32359730fa4a826bf012d2d8c1dc59e30d6ff1c93191
                    • Instruction Fuzzy Hash: 75310471D00219EFEF018FA4CD899AEBBF8FF48321F14406AE901A6220D7759A51DFA4
                    Function 100397E3 Relevance: 13.6, APIs: 9, Instructions: 64COMMON
                    Download Yara Rule
                    APIs
                    • GetHandle.ISRT(?,000000FC), ref: 100397FB
                    • FindResourceW.KERNEL32(00000000,0000007B,0000007C,?,000000FC), ref: 10039807
                    • GetHandle.ISRT(?,000000FD), ref: 10039816
                    • FindResourceW.KERNEL32(00000000,0000007B,0000007C,?,000000FD), ref: 10039822
                    • LoadResource.KERNEL32(00000000,00000000), ref: 10039830
                    • LockResource.KERNEL32(00000000), ref: 1003983B
                    • SizeofResource.KERNEL32(00000000,00000000), ref: 10039849
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Resource$FindHandle$LoadLockSizeof
                    • String ID:
                    • API String ID: 959953519-0
                    • Opcode ID: bf843f87264fb02a7baa76de1be198876277452c19c1a8d76a2937ea06776cac
                    • Instruction ID: 0b0692b7f8174a8d2f3f979cae36bb96621652682ab8d88e6f4f49dc4dc2caff
                    • Opcode Fuzzy Hash: bf843f87264fb02a7baa76de1be198876277452c19c1a8d76a2937ea06776cac
                    • Instruction Fuzzy Hash: 8901C8356046127AE722AB758C84E5B3B9CDFC76B1F220635FE19D91A1DF34DA014164
                    Function 070A4B60 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 131fileCOMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • GetStdHandle.KERNEL32(000000F4,?,00000000), ref: 070A4C16
                    • WriteFile.KERNEL32(00000000,?,00000000), ref: 070A4C1D
                    • GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 070A4C43
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: File$HandleModuleNameWrite
                    • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
                    • API String ID: 3784150691-4022980321
                    • Opcode ID: 3894f9590109f8c3d45be6ffc1599443f7420bbbe7ae6c10b82cae472a1591d3
                    • Instruction ID: 87bd297fda60823e0f2554f8ed88ed2a0a71d9784f2eb01b3fd30c23fa606a78
                    • Opcode Fuzzy Hash: 3894f9590109f8c3d45be6ffc1599443f7420bbbe7ae6c10b82cae472a1591d3
                    • Instruction Fuzzy Hash: 86418FF9E10308BBCB14DBD8EC82FEE77B8AB48304F054759F90556240E7B5A694CB91
                    Function 10055E61 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 116stringCOMMON
                    Download Yara Rule
                    APIs
                    • GetLastError.KERNEL32(?,100560BA,?,?,?,00000000,?,100117C3,?,?,?,0000010C,100156F0,?,00000003,00000000), ref: 10055E91
                    • wsprintfW.USER32 ref: 10055EC5
                    • lstrcatW.KERNEL32(?,?,?,100560BA,?,?,?,00000000,?,100117C3,?,?,?,0000010C,100156F0,?), ref: 10055ED9
                    • ResetEvent.KERNEL32(?,00000002,?,100560BA,?,?,?,00000000,?,100117C3,?,?,?,0000010C,100156F0,?), ref: 10055EE8
                    • GetLastError.KERNEL32(?,100560BA,?,?,?,00000000,?,100117C3,?,?,?,0000010C,100156F0,?,00000003,00000000), ref: 10055EF4
                    • ResetEvent.KERNEL32(0000000E,00000002,?,100560BA,?,?,?,00000000,?,100117C3,?,?,?,0000010C,100156F0,?), ref: 10055F4F
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorEventLastReset$lstrcatwsprintf
                    • String ID: A
                    • API String ID: 2894917480-3554254475
                    • Opcode ID: b1ebbe45ac64568f130f3204b9c93bdc3feee874b7ec73dcd6a4a8a9ce974757
                    • Instruction ID: a6921aeb690f574a090a591ded9654e57d3168e7a526075e0db681fa7528fa95
                    • Opcode Fuzzy Hash: b1ebbe45ac64568f130f3204b9c93bdc3feee874b7ec73dcd6a4a8a9ce974757
                    • Instruction Fuzzy Hash: 98418831200100EFEF49DF64CDE9A5A3BA9EF49352B1440A9FE05CA16AE732DD49DB20
                    Function 1001A78F Relevance: 12.3, APIs: 8, Instructions: 275COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Variant$ClearH_prolog3_Init
                    • String ID:
                    • API String ID: 313008876-0
                    • Opcode ID: 400bbfeb98f19ff491b5591c39d0e8897392d1df8f3aca384332a15f6404f408
                    • Instruction ID: 315bd9f6c7630dadf58e875e7a063efd46104e4b99f9f34876e308e1dfdd7a58
                    • Opcode Fuzzy Hash: 400bbfeb98f19ff491b5591c39d0e8897392d1df8f3aca384332a15f6404f408
                    • Instruction Fuzzy Hash: FBB12674A002099FDF44CFE5CA84A9DBBF9FF89704F618058A905AB245DB75EE86CB10
                    Function 10056133 Relevance: 12.2, APIs: 8, Instructions: 163COMMON
                    Download Yara Rule
                    APIs
                    • QueryPerformanceCounter.KERNEL32(00000003,00000000,00000002,00000000,00000003,00000000,00000000,00000000), ref: 1005618C
                    • GetTickCount.KERNEL32 ref: 10056194
                    • ResetEvent.KERNEL32(?), ref: 100561A4
                    • QueryPerformanceCounter.KERNEL32(?), ref: 100561F7
                    • GetTickCount.KERNEL32 ref: 10056205
                    • __alldvrm.LIBCMT ref: 10056272
                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 10056289
                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 100562AE
                      • Part of subcall function 100563FE: GetTickCount.KERNEL32 ref: 1005640D
                      • Part of subcall function 100563FE: GetTickCount.KERNEL32 ref: 10056436
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: CountTick$CounterPerformanceQueryUnothrow_t@std@@@__ehfuncinfo$??2@$EventReset__alldvrm
                    • String ID:
                    • API String ID: 3317835756-0
                    • Opcode ID: 11eff6b8070100286276dda4572516710e0a19f970080971c44ef31341fdceb0
                    • Instruction ID: 17ba8dabefc4ab09387faa06705970cba991512eddc80d5e8d621529f552ccf0
                    • Opcode Fuzzy Hash: 11eff6b8070100286276dda4572516710e0a19f970080971c44ef31341fdceb0
                    • Instruction Fuzzy Hash: C6517C71A00B449FDB60CFA4DC85BAAB7F9FB88714F10882EE586D7251D774A945CF10
                    Function 100505FA Relevance: 12.1, APIs: 8, Instructions: 147COMMON
                    Download Yara Rule
                    APIs
                    • LangLoadString.ISRT(?,00002CF8,100FB980,00000004,?,?,10050425,?,00000014,00000000,00000000), ref: 10050680
                    • GetDlgItem.USER32(?,?), ref: 100506BD
                    • GetDlgItem.USER32(?,?), ref: 10050703
                    • GetDlgItem.USER32(?,?), ref: 10050751
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Item$LangLoadString
                    • String ID:
                    • API String ID: 1928067691-0
                    • Opcode ID: baaf1e5518bd35ec8d29ebfb186e0830bdcd2d49ee636952ffb930fc2d94a595
                    • Instruction ID: b95000d982e87a88db55c5804d64991722df78ecbddad0920dacce938e6a9c86
                    • Opcode Fuzzy Hash: baaf1e5518bd35ec8d29ebfb186e0830bdcd2d49ee636952ffb930fc2d94a595
                    • Instruction Fuzzy Hash: 4C5119B9949B4EEFDB50CF64C9889AE7BE1FB08280F104859FC5A97260D730A954DF60
                    Function 100B7638 Relevance: 12.1, APIs: 8, Instructions: 142fileCOMMON
                    Download Yara Rule
                    APIs
                    • CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,?,?,00000000), ref: 100B7673
                    • GetFileSize.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 100B76AA
                    • CreateFileMappingW.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?,?,?,?,00000000), ref: 100B76BD
                    • MapViewOfFile.KERNEL32(00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,00000000), ref: 100B76D5
                    • __allrem.LIBCMT ref: 100B7714
                    • UnmapViewOfFile.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 100B777A
                    • CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 100B7783
                    • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 100B778D
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: File$CloseCreateHandleView$MappingSizeUnmap__allrem
                    • String ID:
                    • API String ID: 3476395881-0
                    • Opcode ID: 8de135e8b8458a7760705f51a8c003e21d26ae3645205125fa2af87edb68a85d
                    • Instruction ID: 24c6608325d8e27e93222402d42719faac988ab4a7b16f500336be21f4ff0842
                    • Opcode Fuzzy Hash: 8de135e8b8458a7760705f51a8c003e21d26ae3645205125fa2af87edb68a85d
                    • Instruction Fuzzy Hash: 394140B9900229AFDB11DF95CC859AFBFB9FF08650F14455AF919E3251DB309A00CBE4
                    Function 100291A0 Relevance: 12.1, APIs: 8, Instructions: 97libraryCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_catch_GS.LIBCMT ref: 100291AA
                    • LoadLibraryExW.KERNEL32(?,00000000,00000060,00000424,10029A0C,?,00000000,?,00000000,00000004,10029FD1,?,?,?,100CB25C,?), ref: 100291E9
                    • LoadLibraryExW.KERNEL32(?,00000000,00000002), ref: 100291FF
                    • FindResourceW.KERNEL32(00000000,?,?), ref: 1002922A
                    • LoadResource.KERNEL32(00000000,00000000), ref: 10029242
                    • SizeofResource.KERNEL32(00000000,00000000), ref: 10029254
                      • Part of subcall function 1001DDC8: GetLastError.KERNEL32(80004003,?,?,8007000E,?,10039749,00000000,00000000,00000010,?,00000010), ref: 1001DDC8
                    • FreeLibrary.KERNEL32(00000000), ref: 100292EE
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: LibraryLoadResource$ErrorFindFreeH_prolog3_catch_LastSizeof
                    • String ID:
                    • API String ID: 1818814483-0
                    • Opcode ID: 36491c5b092a862779365814e4b8d58e58cb8ac481d434f829f207d322527dab
                    • Instruction ID: c27de706eb8a64e2b3b222b5ae176176d0d989276f93b7c6e1c517c06d58242d
                    • Opcode Fuzzy Hash: 36491c5b092a862779365814e4b8d58e58cb8ac481d434f829f207d322527dab
                    • Instruction Fuzzy Hash: BD4131B5901229EBDB21CF149C84BDD7AB4EF48790F9140E9F908A3251DB309F85CFA9
                    Function 10061A75 Relevance: 12.1, APIs: 8, Instructions: 95libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 10061A7F
                    • GetModuleHandleW.KERNEL32(100D2F68,100D3F3C,000002A8,1005DF3F,?,?), ref: 10061A97
                    • GetProcAddress.KERNEL32(00000000), ref: 10061A9A
                    • GetModuleHandleW.KERNEL32(100D3910,100D3F58), ref: 10061AD5
                    • GetProcAddress.KERNEL32(00000000), ref: 10061AD8
                    • GetModuleHandleW.KERNEL32(100D3910,100D3F68), ref: 10061AEE
                    • GetProcAddress.KERNEL32(00000000), ref: 10061AF1
                    • _memset.LIBCMT ref: 10061B1C
                      • Part of subcall function 10061BD2: __EH_prolog3_GS.LIBCMT ref: 10061BDC
                      • Part of subcall function 10061BD2: GetModuleHandleW.KERNEL32(100D3F94,100D3F78,?,00000400,?,000004A0,10061BC0,00000000), ref: 10061C0C
                      • Part of subcall function 10061BD2: GetProcAddress.KERNEL32(00000000), ref: 10061C13
                      • Part of subcall function 10061BD2: OpenProcess.KERNEL32(00000400,00000000,?), ref: 10061C3F
                      • Part of subcall function 10061BD2: _memset.LIBCMT ref: 10061C64
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: AddressHandleModuleProc$H_prolog3__memset$OpenProcess
                    • String ID:
                    • API String ID: 2047754285-0
                    • Opcode ID: 3888305fd57e7f3fced801907e6d9043cb69b953eb03426369e8ec02075ab779
                    • Instruction ID: 018a0eedf1280e44633f33b279abdbc99c4e14c90d1408435428ab6441a62010
                    • Opcode Fuzzy Hash: 3888305fd57e7f3fced801907e6d9043cb69b953eb03426369e8ec02075ab779
                    • Instruction Fuzzy Hash: 01315B75E01258ABDB10DBA0CD89BDEB7B8EF05300F14419AF545A2192EF70AF458F62
                    Function 1007C590 Relevance: 12.1, APIs: 8, Instructions: 74windowCOMMON
                    Download Yara Rule
                    APIs
                    • GetPropW.USER32(?,100D4B08), ref: 1007C5B1
                    • GetPropW.USER32(?,100D4B28), ref: 1007C5BC
                    • GetDC.USER32(?), ref: 1007C5CB
                    • GetWindowRect.USER32(?,?), ref: 1007C5D8
                    • MapWindowPoints.USER32(00000000,?,?,00000002), ref: 1007C5EB
                    • BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,00CC0020), ref: 1007C61E
                    • ReleaseDC.USER32(?,00000000), ref: 1007C626
                    • CallWindowProcW.USER32(?,?,?,?,?), ref: 1007C63B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Window$Prop$CallPointsProcRectRelease
                    • String ID:
                    • API String ID: 880400865-0
                    • Opcode ID: 71f425a4664641d1833f43ef9c507e9e9e81faa1a216d63cca20e979bbb5b09f
                    • Instruction ID: 4c82ee3551d3bf1ebff22e3dfd4174719d0d32073cdcb9f177d6f0bf86016994
                    • Opcode Fuzzy Hash: 71f425a4664641d1833f43ef9c507e9e9e81faa1a216d63cca20e979bbb5b09f
                    • Instruction Fuzzy Hash: 50210C75900219AFDB10DFA4CD89EEFBBB8FB48320F11445AF905A3251CA70AA00DBA4
                    Function 100171EC Relevance: 12.1, APIs: 8, Instructions: 72windowCOMMON
                    Download Yara Rule
                    APIs
                    • GetDC.USER32(?), ref: 1001720F
                      • Part of subcall function 100172B9: GetDC.USER32(00000000), ref: 100172C4
                      • Part of subcall function 100172B9: ReleaseDC.USER32(00000000,00000000), ref: 100172E9
                    • CreateCompatibleDC.GDI32(00000000), ref: 1001723C
                    • CreateCompatibleBitmap.GDI32(00000003,?,00000000), ref: 1001724D
                    • SelectObject.GDI32(00000000,00000000), ref: 10017257
                    • DeleteObject.GDI32(00000000), ref: 1001727F
                    • SelectObject.GDI32(00000000,?), ref: 1001728C
                    • DeleteObject.GDI32(00000000), ref: 10017293
                    • ReleaseDC.USER32(?,00000003), ref: 1001729F
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Object$CompatibleCreateDeleteReleaseSelect$Bitmap
                    • String ID:
                    • API String ID: 1865722587-0
                    • Opcode ID: 7f4d20b687e3cded3be90f3c39e6414e9307d8811e169a78f4cf5a3f6332ce31
                    • Instruction ID: 5f3aea070f3dd8d5d36850d76b2eae7f3f1e81536558c4e67b7e4f1f8c18f5d4
                    • Opcode Fuzzy Hash: 7f4d20b687e3cded3be90f3c39e6414e9307d8811e169a78f4cf5a3f6332ce31
                    • Instruction Fuzzy Hash: F7210A75900219EFDF019FA0CD89AEEBFB9FF08311F144459F905A2220D7759A51DF64
                    Function 1001C128 Relevance: 12.1, APIs: 8, Instructions: 61COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 1001C12F
                    • VariantInit.OLEAUT32 ref: 1001C13A
                    • _memset.LIBCMT ref: 1001C15A
                    • VariantInit.OLEAUT32(?), ref: 1001C166
                    • SafeArrayGetElement.OLEAUT32(?,?,?), ref: 1001C178
                    • __CxxThrowException@8.LIBCMT ref: 1001C194
                      • Part of subcall function 1008BE0A: RaiseException.KERNEL32(?,?,10051E9E,?,?,?,?,?,10051E9E,?,100ECD18,00000000), ref: 1008BE5B
                    • VariantClear.OLEAUT32(?), ref: 1001C1CD
                    • VariantClear.OLEAUT32(?), ref: 1001C1D3
                      • Part of subcall function 10004A75: __EH_prolog3.LIBCMT ref: 10004A7C
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Variant$ClearH_prolog3Init$ArrayElementExceptionException@8RaiseSafeThrow_memset
                    • String ID:
                    • API String ID: 2707471088-0
                    • Opcode ID: d9300c0d793750705d1f12c1b4a0b25cd57c831aa60898ffe6524cc5099e9d70
                    • Instruction ID: 7bbfd869e2ef839a31d13665e10b2c75767655a6a7826fac98d5aba0b8ce69ba
                    • Opcode Fuzzy Hash: d9300c0d793750705d1f12c1b4a0b25cd57c831aa60898ffe6524cc5099e9d70
                    • Instruction Fuzzy Hash: 9C11F775900269ABDF04DFA4CD85EEE77ACFF08204F40046AF605EB152DB74E6088BA0
                    Function 10051E9F Relevance: 12.1, APIs: 8, Instructions: 58COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • std::exception::exception.LIBCMT ref: 10051EB2
                      • Part of subcall function 1008BC3C: std::exception::_Copy_str.LIBCMT ref: 1008BC55
                    • __CxxThrowException@8.LIBCMT ref: 10051EC7
                      • Part of subcall function 1008BE0A: RaiseException.KERNEL32(?,?,10051E9E,?,?,?,?,?,10051E9E,?,100ECD18,00000000), ref: 1008BE5B
                    • std::exception::exception.LIBCMT ref: 10051EE0
                    • __CxxThrowException@8.LIBCMT ref: 10051EF5
                    • std::regex_error::regex_error.LIBCPMT ref: 10051F07
                      • Part of subcall function 10051B77: std::exception::exception.LIBCMT ref: 10051B91
                    • __CxxThrowException@8.LIBCMT ref: 10051F15
                    • std::exception::exception.LIBCMT ref: 10051F2E
                    • __CxxThrowException@8.LIBCMT ref: 10051F43
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
                    • String ID:
                    • API String ID: 2464034642-0
                    • Opcode ID: 7eafc7b85d58c77ec3530adf4ca3041571e9218fed39f0c9195d5473a85062a4
                    • Instruction ID: 54ab167bd8d848be67dbf14b50af698af06d53159d3108753ca1d0e9b4233974
                    • Opcode Fuzzy Hash: 7eafc7b85d58c77ec3530adf4ca3041571e9218fed39f0c9195d5473a85062a4
                    • Instruction Fuzzy Hash: AB11D079C0064CBFCB04EFA5D945CDE7BBCFA04240F9081A6BA15A7201EB75B7498BD1
                    Function 070AFEC0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 284COMMON
                    Download Yara Rule
                    APIs
                    • __malloc_dbg.LIBCMTD ref: 070AFF1E
                    • __malloc_dbg.LIBCMTD ref: 070AFF37
                    • __malloc_dbg.LIBCMTD ref: 070AFF50
                    • __malloc_dbg.LIBCMTD ref: 070AFF69
                      • Part of subcall function 070B2860: GetLastError.KERNEL32 ref: 070B28C0
                    • GetCPInfo.KERNEL32(00000000,?), ref: 070AFFD0
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: __malloc_dbg$ErrorInfoLast
                    • String ID: initctyp.c
                    • API String ID: 1500541472-2450708257
                    • Opcode ID: 8569a93f5f1da70bf254ad8eef15862bc9017fdba60fbafd31eb5c7ea4e66dab
                    • Instruction ID: 3ade71803612e08ed12450a37ab321d15eb73e3f46606455d3a0e7c0f790191b
                    • Opcode Fuzzy Hash: 8569a93f5f1da70bf254ad8eef15862bc9017fdba60fbafd31eb5c7ea4e66dab
                    • Instruction Fuzzy Hash: B0B16CF0E1020AEFDB24CB94DC46BEEB7B1BF49305F148629D914AB381E7799940CB65
                    Function 1000A546 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 280COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: H_prolog3_InitVariant_memset
                    • String ID: \
                    • API String ID: 1537905559-2967466578
                    • Opcode ID: a777b4a2fa72fec6a31ba9cad43af059ad5d32c275393cb0f448fa1c24391ec5
                    • Instruction ID: 9ae6438887c11d2eee8b3b8aaf2af0461ccad047b1b55fa4ffb653fa6b35fe0a
                    • Opcode Fuzzy Hash: a777b4a2fa72fec6a31ba9cad43af059ad5d32c275393cb0f448fa1c24391ec5
                    • Instruction Fuzzy Hash: 2FC17875904268EEEB25DBA0CC94BEEB778FF15340F1042D9E50AA3185DB706B89CF61
                    Function 10063520 Relevance: 10.8, APIs: 7, Instructions: 279COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1006352A
                      • Part of subcall function 10003B8B: GetLastError.KERNEL32(00000000,?,?,10004A1A,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10003BAA
                      • Part of subcall function 10003B8B: SetLastError.KERNEL32(?,?,?,10004A1A,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10003BD8
                    • GetErrorInfo.OLEAUT32(00000000,?,?,00000000,00000264,10055347,?,?,?,00000001), ref: 10063566
                    • CreateErrorInfo.OLEAUT32(?), ref: 100635C5
                    • ProgIDFromCLSID.COMBASE(?,?), ref: 100635F2
                    • CoTaskMemFree.COMBASE(?), ref: 10063616
                      • Part of subcall function 1000EA8B: SysStringLen.OLEAUT32(?), ref: 1000EA98
                      • Part of subcall function 1000EA8B: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 1000EAB2
                    • SetErrorInfo.OLEAUT32(00000000,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00000000), ref: 10063873
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Error$Info$LastString$AllocCreateFreeFromH_prolog3_ProgTask
                    • String ID:
                    • API String ID: 290475581-0
                    • Opcode ID: 05f92bf89d1e1e3d412e5b655caa6db0c3345a8d751df686e8d35258395c164c
                    • Instruction ID: e4976dc236fb7f666255f3ce36b9bab1768297613dbcdbfcdc5a48338ceda50a
                    • Opcode Fuzzy Hash: 05f92bf89d1e1e3d412e5b655caa6db0c3345a8d751df686e8d35258395c164c
                    • Instruction Fuzzy Hash: A0C13975901268EEDB15DBA0CC88BEEB7B8FF58300F1441D9E50AA7242DB70AF45CB65
                    Function 10081270 Relevance: 10.7, APIs: 7, Instructions: 243COMMON
                    Download Yara Rule
                    APIs
                    • GetLastError.KERNEL32(?,?,AD4A72FF,?,?,0000000A), ref: 100812DD
                    • SetLastError.KERNEL32(100C90B8,?,0000000A), ref: 10081309
                    • GetLastError.KERNEL32(?,0000000A), ref: 10081320
                    • SetLastError.KERNEL32(100C90B8,?,0000000A), ref: 10081358
                      • Part of subcall function 10001123: GetLastError.KERNEL32(00000000,100C90D4,10005872,100C90D8,100C90D4,?,00000000,100C90D4,?,00000000), ref: 10001131
                      • Part of subcall function 10001123: SysFreeString.OLEAUT32(?), ref: 10001145
                      • Part of subcall function 10001123: SetLastError.KERNEL32(?,00000001,00000000), ref: 1000115F
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$FreeString
                    • String ID:
                    • API String ID: 2425351278-0
                    • Opcode ID: 8a64044fc023a0de4b0c0b4bc7ecb0ff5473f61279fe935120319eb6b4bbc62d
                    • Instruction ID: d38505b6b3218878088dfdcb14ee0324f5b19a7d04b63f6e1ad1b7ec47d46a91
                    • Opcode Fuzzy Hash: 8a64044fc023a0de4b0c0b4bc7ecb0ff5473f61279fe935120319eb6b4bbc62d
                    • Instruction Fuzzy Hash: 97B11775D00218DFEB14DFA4C985BDDBBB8FF18300F1041AAE919A7291EB74AA44CF61
                    Function 070B4870 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 224COMMON
                    Download Yara Rule
                    APIs
                    • __malloc_dbg.LIBCMTD ref: 070B492B
                    • _findenv.LIBCMTD ref: 070B49A9
                    • __malloc_dbg.LIBCMTD ref: 070B4AE6
                    • SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 070B4B35
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: __malloc_dbg$EnvironmentVariable_findenv
                    • String ID: setenv.c
                    • API String ID: 1519929335-187379886
                    • Opcode ID: 42c34d4a17bda78897101d5d845663773ae3541f4b9edbf35e0a5735dcaf6571
                    • Instruction ID: 5b414347411dde5aaf42021ce2601cdbd84fe04bcbb33bcde25d6c5c1cb5be99
                    • Opcode Fuzzy Hash: 42c34d4a17bda78897101d5d845663773ae3541f4b9edbf35e0a5735dcaf6571
                    • Instruction Fuzzy Hash: 1B915CF5D00249EFDB20DFA8D886BEEB7B0BB45314F118359E91567282D7789B80CB81
                    Function 070A4760 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 154COMMON
                    Download Yara Rule
                    APIs
                    • GetVersionExA.KERNEL32(00000094), ref: 070A4788
                    • GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 070A47BF
                    • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 070A4846
                    • _mbtowc.LIBCMTD ref: 070A4923
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: EnvironmentFileModuleNameVariableVersion_mbtowc
                    • String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
                    • API String ID: 134279942-4131005785
                    • Opcode ID: 968d0e5190d2a8c849bcc56cf1bcc5fa71a04bfbf472b0044e074a70e431d1af
                    • Instruction ID: 2dd3150a719dbc06cd39e786fbe66deba292689cacdf87ea38132d3c61847d16
                    • Opcode Fuzzy Hash: 968d0e5190d2a8c849bcc56cf1bcc5fa71a04bfbf472b0044e074a70e431d1af
                    • Instruction Fuzzy Hash: 55518DB8A00299EFDB64CB98D880AEDB7F5AF46305F2443D9E415AB250D3749FA4CF01
                    Function 1003A6C2 Relevance: 10.6, APIs: 7, Instructions: 149comCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_catch_GS.LIBCMT ref: 1003A6CC
                      • Part of subcall function 100541FD: __EH_prolog3_catch_GS.LIBCMT ref: 10054207
                      • Part of subcall function 100541FD: vswprintf.LIBCMT ref: 100542BC
                    • VariantInit.OLEAUT32(?), ref: 1003A72F
                      • Part of subcall function 100394F8: _memcpy_s.LIBCMT ref: 1003950D
                    • CLSIDFromProgID.COMBASE(-00000004,?), ref: 1003A762
                    • VariantClear.OLEAUT32(?), ref: 1003A77A
                    • CoCreateInstance.COMBASE(?,00000000,00000015,100CF6D0,?), ref: 1003A7AB
                    • VariantClear.OLEAUT32(?), ref: 1003A7BB
                    • VariantClear.OLEAUT32(?), ref: 1003A805
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Variant$Clear$H_prolog3_catch_$CreateFromInitInstanceProg_memcpy_svswprintf
                    • String ID:
                    • API String ID: 1391584398-0
                    • Opcode ID: 697d21a8d2a9628434cec00d8a1ec95a15e96c65b0199f3dbf4cf3bc665a8703
                    • Instruction ID: 549236630e12d0a1925adbce0cdeacc52f51a52f8670498967e435003eb839c7
                    • Opcode Fuzzy Hash: 697d21a8d2a9628434cec00d8a1ec95a15e96c65b0199f3dbf4cf3bc665a8703
                    • Instruction Fuzzy Hash: FB518C75D00209AFDF01DFE4CD899EEBBB8EF05350F104169F915AB291D731AA06CB50
                    Function 070AE440 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 135COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 070A4E50: __malloc_dbg.LIBCMTD ref: 070A4E6F
                      • Part of subcall function 070A4E50: InitializeCriticalSection.KERNEL32(00000000,?,00000009), ref: 070A4EA5
                      • Part of subcall function 070A4E50: EnterCriticalSection.KERNEL32(00000000,00000000,?,070A273A,00000009), ref: 070A4EDD
                    • InitializeCriticalSection.KERNEL32(?), ref: 070AE4EA
                    • EnterCriticalSection.KERNEL32(?), ref: 070AE510
                    • LeaveCriticalSection.KERNEL32(?), ref: 070AE52B
                    • __malloc_dbg.LIBCMTD ref: 070AE584
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: CriticalSection$EnterInitialize__malloc_dbg$Leave
                    • String ID: @$osfinfo.c
                    • API String ID: 2147025949-966336706
                    • Opcode ID: 2da7d159090ebcd028952784088ccf9c9167e4d83fd4007e0654ec65937c3094
                    • Instruction ID: 3d95b803f63bc98788951700bab28831fe7e779874abe3ebc94116fbce1cd357
                    • Opcode Fuzzy Hash: 2da7d159090ebcd028952784088ccf9c9167e4d83fd4007e0654ec65937c3094
                    • Instruction Fuzzy Hash: 04514BB4D00248FFCB04CFE8E596AADB7B1EB41308F248699D81567381E774AE40DB42
                    Function 10041F69 Relevance: 10.6, APIs: 7, Instructions: 71stringwindowCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 10041F70
                    • GetWindowLongW.USER32(?,000000F0), ref: 10041F81
                    • SetWindowLongW.USER32(?,000000F0,00000000), ref: 10041F9F
                    • lstrlenW.KERNEL32(?,?,?,00000001), ref: 10041FD2
                    • __wcsnicmp.LIBCMT ref: 10042005
                    • SendMessageW.USER32(?,00000449,-00000012,?), ref: 10042022
                    • SetWindowLongW.USER32(?,000000F0,00000000), ref: 10042036
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: LongWindow$H_prolog3_MessageSend__wcsnicmplstrlen
                    • String ID:
                    • API String ID: 1252308736-0
                    • Opcode ID: 675fee8c0d87a661eedafd61b2f0ae71f425babeaf4467f6e53d629518923753
                    • Instruction ID: 0af4489cbaebbe9d3cf1610538043fad7dddf30393a5ccfe19d61e1a9931e5b7
                    • Opcode Fuzzy Hash: 675fee8c0d87a661eedafd61b2f0ae71f425babeaf4467f6e53d629518923753
                    • Instruction Fuzzy Hash: B3212675D10259AFDB00CFE0CD85BEDBBB5FF04321F144229E515A62D5EB786A068B44
                    Function 100014E9 Relevance: 10.6, APIs: 7, Instructions: 61COMMON
                    Download Yara Rule
                    APIs
                    • GetDlgItem.USER32(?,00000007), ref: 1000150B
                    • GetDlgItem.USER32(?,00000514), ref: 10001515
                    • GetWindowRect.USER32(00000000,?), ref: 1000152D
                    • GetWindowRect.USER32(00000000,?), ref: 10001534
                    • ScreenToClient.USER32(?,?), ref: 1000154F
                    • ScreenToClient.USER32(?,?), ref: 10001558
                    • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 10001567
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Window$ClientItemRectScreen$Move
                    • String ID:
                    • API String ID: 1542492723-0
                    • Opcode ID: 4ff5e711eebb42fb07808ac5765643cad76b2d89d63aae2e78254be6b0b0572e
                    • Instruction ID: 367f1e14fb8c37c9572755a5ed2b2e97d3e5d899a2a536f24a0f6e7104f7f145
                    • Opcode Fuzzy Hash: 4ff5e711eebb42fb07808ac5765643cad76b2d89d63aae2e78254be6b0b0572e
                    • Instruction Fuzzy Hash: F611A772D0021DABDF00DBA9CD859EEBBB9EB48650F510056E905B3150DA71AE049BA4
                    Function 070A15A0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48threadCOMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • GetLastError.KERNEL32(?,?,?,00000000), ref: 070A15A6
                    • TlsGetValue.KERNEL32(00000035,?,?,?,00000000), ref: 070A15B5
                    • SetLastError.KERNEL32(?), ref: 070A162B
                      • Part of subcall function 070A1FD0: __malloc_dbg.LIBCMTD ref: 070A1FF0
                    • TlsSetValue.KERNEL32(00000035,00000000), ref: 070A15F0
                    • GetCurrentThreadId.KERNEL32 ref: 070A1606
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: ErrorLastValue$CurrentThread__malloc_dbg
                    • String ID: tidtable.c
                    • API String ID: 83412565-1617207422
                    • Opcode ID: 157b30bab731baa1ecaae41787fa51168ebbacb2bec8f60dbc6437ee7ec44ad7
                    • Instruction ID: 9b97d1e83cee6a0e1073f6dc613a8ad1975152ebf35d9eea451bd14454dd62c0
                    • Opcode Fuzzy Hash: 157b30bab731baa1ecaae41787fa51168ebbacb2bec8f60dbc6437ee7ec44ad7
                    • Instruction Fuzzy Hash: AD112AF8E01208FFDB10EBE4E94AA9DB7B4AB18305F254764ED05A7380D6799A40DB51
                    Function 070A4DB0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47COMMON
                    Download Yara Rule
                    APIs
                    • DeleteCriticalSection.KERNEL32(0000002F,?,?,070A1558), ref: 070A4DFC
                    • DeleteCriticalSection.KERNEL32(070D1C28,?,?,070A1558), ref: 070A4E1F
                    • DeleteCriticalSection.KERNEL32(070D1C40,?,?,070A1558), ref: 070A4E2C
                    • DeleteCriticalSection.KERNEL32(070D1C10,?,?,070A1558), ref: 070A4E39
                    • DeleteCriticalSection.KERNEL32(070D1BF8,?,?,070A1558), ref: 070A4E45
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: CriticalDeleteSection
                    • String ID: 0
                    • API String ID: 166494926-4108050209
                    • Opcode ID: 8abb2dc6b26886163cd7f34a0756ff6b69b55b5cc3f44b3c7b522f61524fd05e
                    • Instruction ID: b2207ad1f7af3682123a8be9b5c405e05c088d0f426b3cb1b7736dc8edf35a10
                    • Opcode Fuzzy Hash: 8abb2dc6b26886163cd7f34a0756ff6b69b55b5cc3f44b3c7b522f61524fd05e
                    • Instruction Fuzzy Hash: DD1145B9A81249FBCB00DBD8E54A99DB3F4BB25309F224368F80153240C77CAE50DB61
                    Function 1004345A Relevance: 9.3, APIs: 6, Instructions: 339COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 10043464
                      • Part of subcall function 1000395E: GetLastError.KERNEL32(?,?,?,10007B00,?,?,?,?,00000000,00000040,1000A532,?,?,?,?,?), ref: 1000397D
                      • Part of subcall function 1000395E: SetLastError.KERNEL32(?,?,?,?,10007B00,?,?,?,?,00000000,00000040,1000A532,?,?,?,?), ref: 100039AB
                      • Part of subcall function 10003D09: __EH_prolog3_GS.LIBCMT ref: 10003D10
                      • Part of subcall function 10019415: SysFreeString.OLEAUT32(?), ref: 10019424
                      • Part of subcall function 10042E51: __EH_prolog3_GS.LIBCMT ref: 10042E5B
                    • _swscanf.LIBCMT ref: 1004363B
                      • Part of subcall function 1009170F: _vscan_fn.LIBCMT ref: 10091723
                    • __itow.LIBCMT ref: 10043665
                      • Part of subcall function 10091598: _xtoa@16.LIBCMT ref: 100915B9
                    • __itow.LIBCMT ref: 100436BC
                    • _swscanf.LIBCMT ref: 100437FA
                    • _swscanf.LIBCMT ref: 1004387D
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: H_prolog3__swscanf$ErrorLast__itow$FreeString_vscan_fn_xtoa@16
                    • String ID:
                    • API String ID: 2772323397-0
                    • Opcode ID: 0efc35de2831819ef49a8e5a1b548d8d4eb0770ae0898eb2768e1e35423ac051
                    • Instruction ID: 9acac71013be129515644b385bffed54f6ecdee1a7eb6562cdd3d5fcf14c8219
                    • Opcode Fuzzy Hash: 0efc35de2831819ef49a8e5a1b548d8d4eb0770ae0898eb2768e1e35423ac051
                    • Instruction Fuzzy Hash: 11E14C75C0021DAADB21CB90CD85BDEB7B8EF19340F5081EAE559A3141EB716B88CFA1
                    Function 070A7E50 Relevance: 9.3, APIs: 3, Strings: 3, Instructions: 331COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • IsBadWritePtr.KERNEL32(00000000,00000000), ref: 070A7E69
                    • IsBadWritePtr.KERNEL32(?,000041C4), ref: 070A7ECF
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: Write
                    • String ID: $ $?
                    • API String ID: 3165279579-1466984971
                    • Opcode ID: 2c7e56f2baebc6ff92f714fbea12847356e2217f672ee77656418092ae24c7a2
                    • Instruction ID: ab72dc62193b487eb42dbe819e35a0a246b01ae433c059932fab194597b25ae0
                    • Opcode Fuzzy Hash: 2c7e56f2baebc6ff92f714fbea12847356e2217f672ee77656418092ae24c7a2
                    • Instruction Fuzzy Hash: 39F1C4B0A11529DFCB65CF98C894BEDB7B1BB86314F1082D9D419AB394D774AE81CF80
                    Function 10027F23 Relevance: 9.2, APIs: 6, Instructions: 245COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 10029FEE: lstrcmpiW.KERNEL32(?,?,?,10027FAF,?,?,?,AD4A72FF,?,?,?,?,?,100BC7AA,000000FF), ref: 1002A05D
                    • CharNextW.USER32(00000000), ref: 1002806A
                    • CharNextW.USER32(00000000), ref: 10028087
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: CharNext$lstrcmpi
                    • String ID:
                    • API String ID: 3586774192-0
                    • Opcode ID: 8c2b93348439d20475a78e567bb1da3e6f435e6dfb2b6389539b0af353f283bb
                    • Instruction ID: 31420fd803d8161cfb7cf3bce2afe17b7eb7eac3f87ac1d923339fe69aa4a294
                    • Opcode Fuzzy Hash: 8c2b93348439d20475a78e567bb1da3e6f435e6dfb2b6389539b0af353f283bb
                    • Instruction Fuzzy Hash: A7917E79901229DBDB24CB64DC899DDB7B8EB28350F5100EAFB09A3250D7349F98CF91
                    Function 1003FEA7 Relevance: 9.2, APIs: 6, Instructions: 206memoryCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1003FEB1
                      • Part of subcall function 100541FD: __EH_prolog3_catch_GS.LIBCMT ref: 10054207
                      • Part of subcall function 100541FD: vswprintf.LIBCMT ref: 100542BC
                    • _memset.LIBCMT ref: 1003FF31
                    • VariantInit.OLEAUT32(?), ref: 1003FF43
                    • SysAllocStringLen.OLEAUT32(-00000004,?), ref: 1003FFB5
                    • SysAllocString.OLEAUT32(?), ref: 1004008D
                    • VariantClear.OLEAUT32(?), ref: 1004013D
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: AllocStringVariant$ClearH_prolog3_H_prolog3_catch_Init_memsetvswprintf
                    • String ID:
                    • API String ID: 1305379103-0
                    • Opcode ID: 220aaa569aff793f26ad11a5982a178392bd254f615f9780a351b624e7f8d70a
                    • Instruction ID: 37b6c73eb5e631cb7e7b8b587f93aa75d94d6f3ff403ced3ed02475269f2d0d0
                    • Opcode Fuzzy Hash: 220aaa569aff793f26ad11a5982a178392bd254f615f9780a351b624e7f8d70a
                    • Instruction Fuzzy Hash: B1717A75D00219AEEF21CBA4CC45FEEBBB9EF08314F108099F905A7192DB315A49CF61
                    Function 070B2B00 Relevance: 9.2, APIs: 6, Instructions: 186COMMON
                    Download Yara Rule
                    APIs
                    • GetStringTypeW.KERNEL32(00000001,070CBF38,00000001,070B00DB), ref: 070B2B3C
                    • GetStringTypeA.KERNEL32(00000000,00000001,070CBF34,00000001,070B00DB), ref: 070B2B61
                    • GetStringTypeW.KERNEL32(00000000,-00000002,00000100,00000000), ref: 070B2B97
                    • WideCharToMultiByte.KERNEL32(00000000,00000220,-00000002,00000100,00000000,00000000,00000000,00000000), ref: 070B2BD6
                    • WideCharToMultiByte.KERNEL32(00000000,00000220,-00000002,00000100,00000000,00000000,00000000,00000000), ref: 070B2C68
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: StringType$ByteCharMultiWide
                    • String ID:
                    • API String ID: 3852931651-0
                    • Opcode ID: c8b6686a66ed6699ce2aed45d9b8d45ca126bba322173d503d156ed4056f7195
                    • Instruction ID: 71c2109763fb86097d63efc3f0cfbc2ce658be17efbb7979771195048fc63f22
                    • Opcode Fuzzy Hash: c8b6686a66ed6699ce2aed45d9b8d45ca126bba322173d503d156ed4056f7195
                    • Instruction Fuzzy Hash: 52715EB5A11209EFDB20CF98D885BEE77F5FF48710F108618F915A7290D7789A41CBA1
                    Function 1001F88A Relevance: 9.1, APIs: 6, Instructions: 148COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1001F894
                    • RtlEnterCriticalSection.NTDLL(100FD798), ref: 1001F8C1
                    • GetModuleFileNameW.KERNEL32(?,00000104), ref: 1001F91A
                    • LoadTypeLib.OLEAUT32(?,00000000), ref: 1001F941
                    • LoadRegTypeLib.OLEAUT32(?,?,?,?,00000000), ref: 1001F960
                    • RtlLeaveCriticalSection.NTDLL(100FD798), ref: 1001FA79
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: CriticalLoadSectionType$EnterFileH_prolog3_LeaveModuleName
                    • String ID:
                    • API String ID: 500997196-0
                    • Opcode ID: 702bbaf2484ab440b715d0fb74b0308db2a265b6ad54f88874dbe74d21514b02
                    • Instruction ID: 21350d1289cf15b143e1d99e1b5d64fc63852dbe755d05438380db0be74dea25
                    • Opcode Fuzzy Hash: 702bbaf2484ab440b715d0fb74b0308db2a265b6ad54f88874dbe74d21514b02
                    • Instruction Fuzzy Hash: D2516C75900219AFDB20DB60C988BAAB7F5EF54310F10849DE40ADB251DB35DE81CF11
                    Function 070AC940 Relevance: 9.1, APIs: 6, Instructions: 143COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • GetStringTypeW.KERNEL32(00000001,070CBF38,00000001,00000001,?), ref: 070AC97C
                    • GetStringTypeA.KERNEL32(00000000,00000001,070CBF34,00000001,00000001), ref: 070AC9A1
                    • GetStringTypeA.KERNEL32(00000000,00000000,00000000,00000157,00000001,?), ref: 070AC9EA
                    • MultiByteToWideChar.KERNEL32(00000000,070A952C,00000000,00000157,00000000,00000000,?), ref: 070ACA2F
                    • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000157,00000000,00000000), ref: 070ACABB
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: StringType$ByteCharMultiWide
                    • String ID:
                    • API String ID: 3852931651-0
                    • Opcode ID: f6a5f81545fe71e6549a746ceb3aac36699e29d295928540db0ca23cdc9aa3de
                    • Instruction ID: b1cf28c376a94173028891e399a51b9bb115da8760aaa3b60db71a48c41b1522
                    • Opcode Fuzzy Hash: f6a5f81545fe71e6549a746ceb3aac36699e29d295928540db0ca23cdc9aa3de
                    • Instruction Fuzzy Hash: 565119B1A14209AFEB50CF98D846BEF77F9AB48714F118719F915A7280D7789940CFA0
                    Function 10045E3B Relevance: 9.1, APIs: 6, Instructions: 126memoryCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 10045E45
                      • Part of subcall function 1000395E: GetLastError.KERNEL32(?,?,?,10007B00,?,?,?,?,00000000,00000040,1000A532,?,?,?,?,?), ref: 1000397D
                      • Part of subcall function 1000395E: SetLastError.KERNEL32(?,?,?,?,10007B00,?,?,?,?,00000000,00000040,1000A532,?,?,?,?), ref: 100039AB
                    • LocalAlloc.KERNEL32(00000000,?), ref: 10045ED7
                    • _memset.LIBCMT ref: 10045EEC
                    • GetLastError.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,00000104), ref: 10045F68
                    • GetLastError.KERNEL32(00000000,?,00000000,?,?,?,?,?,00000104), ref: 10045F7F
                    • LocalFree.KERNEL32(00000000), ref: 10045FA6
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$Local$AllocFreeH_prolog3__memset
                    • String ID:
                    • API String ID: 2909533094-0
                    • Opcode ID: fae5a47d226a310d4b557583e173efa299ff44221a5b1650409cbacd32e92d96
                    • Instruction ID: a499124eaff9a4268972fec14b471687548b33f7533507359a6591e0cd2ec557
                    • Opcode Fuzzy Hash: fae5a47d226a310d4b557583e173efa299ff44221a5b1650409cbacd32e92d96
                    • Instruction Fuzzy Hash: 92413BB6800518EFDB15DBA4CD84ADDBBB8FF48200F6440ADF546E7242DB71AA49CB91
                    Function 1006462E Relevance: 9.1, APIs: 6, Instructions: 81libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 1006472E: GetModuleHandleW.KERNEL32(100D3E90,100D3EA4,?,?,?,100161C2,00000048,10016958,?,?,?,?), ref: 10064741
                      • Part of subcall function 1006472E: GetProcAddress.KERNEL32(00000000), ref: 10064748
                      • Part of subcall function 1006472E: GetCurrentProcess.KERNEL32(00000000,?,?,?,100161C2,00000048,10016958,?,?,?,?), ref: 10064758
                    • GetModuleHandleW.KERNEL32(100D3E90,100D3EB4,?,?,?,?,?,1004A717,?), ref: 10064651
                    • GetProcAddress.KERNEL32(00000000), ref: 1006465A
                    • GetModuleHandleW.KERNEL32(100D3E90,100D3ED4,?,?,?,?,?,1004A717,?), ref: 10064665
                    • GetProcAddress.KERNEL32(00000000), ref: 10064668
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: AddressHandleModuleProc$CurrentProcess
                    • String ID:
                    • API String ID: 565683799-0
                    • Opcode ID: fc8a98a27525211b5bef64a18289f2630ac55c5ab1e34176b263c41cc8d501bd
                    • Instruction ID: 40f53a04d6c5f03732af945574af2c06631234a0ba3205aa6bdee92b39b0c58d
                    • Opcode Fuzzy Hash: fc8a98a27525211b5bef64a18289f2630ac55c5ab1e34176b263c41cc8d501bd
                    • Instruction Fuzzy Hash: 9D11A271A0036AA7DB04EBB9DD94E9E77DFEF45280B02402AF501D3191DEB4DE44EBA1
                    Function 070A4A20 Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON
                    Download Yara Rule
                    APIs
                    • VirtualFree.KERNEL32(?,00100000,00004000), ref: 070A4A69
                    • VirtualFree.KERNEL32(?,00000000,00008000), ref: 070A4A7D
                    • HeapFree.KERNEL32(073A0000,00000000,?), ref: 070A4A92
                    • HeapFree.KERNEL32(073A0000,00000000,00000000), ref: 070A4AB2
                    • VirtualFree.KERNEL32(?,00000000,00008000), ref: 070A4AE1
                    • HeapDestroy.KERNEL32(073A0000,?,?,070A1158), ref: 070A4AFE
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: Free$HeapVirtual$Destroy
                    • String ID:
                    • API String ID: 716807051-0
                    • Opcode ID: aae3147c479b93cc0db2a3214b6fbfa72572444fcc1da2f320fe68c2b4a9af7a
                    • Instruction ID: 25001636675b560444fc0fcdd47851110fb1149ac5805237dc5d6da327deeb0d
                    • Opcode Fuzzy Hash: aae3147c479b93cc0db2a3214b6fbfa72572444fcc1da2f320fe68c2b4a9af7a
                    • Instruction Fuzzy Hash: 8C21D3B8A02344EFCB04CF98D99AB6DB7B5BB44704F118298E9516B381C7BCA945CB85
                    Function 10022226 Relevance: 9.1, APIs: 6, Instructions: 67memoryCOMMON
                    Download Yara Rule
                    APIs
                    • SysFreeString.OLEAUT32(?), ref: 10022274
                    • SysStringLen.OLEAUT32(?), ref: 10022287
                    • SysStringLen.OLEAUT32(?), ref: 10022290
                    • CoTaskMemAlloc.COMBASE(75633F50), ref: 1002229A
                    • SysFreeString.OLEAUT32(?), ref: 100222A9
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: String$Free$AllocTask
                    • String ID:
                    • API String ID: 2715170445-0
                    • Opcode ID: 065218972631edb35e0f28e4b08e0f52522a29edbca1e4f1f948411e3b433446
                    • Instruction ID: 1b01ea1a6ba4f09571ed81baf1b8bf1a5889acc82a8fd61ba73c9e4df111d948
                    • Opcode Fuzzy Hash: 065218972631edb35e0f28e4b08e0f52522a29edbca1e4f1f948411e3b433446
                    • Instruction Fuzzy Hash: 54116A7220020AFFEB11DFA4ED84AAA3BA9FF843A1F410015FC0596121DB32DD64DB66
                    Function 100250A9 Relevance: 9.1, APIs: 6, Instructions: 61COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 100250B0
                    • GetLastError.KERNEL32(00000004,10025083,?,00000000,?,00000001), ref: 100250D2
                    • SetLastError.KERNEL32(?), ref: 10025105
                    • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,?,00000000,00000000), ref: 10025126
                    • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,?,00000003,00000000,00000000,00000000), ref: 1002514D
                    • SetLastError.KERNEL32(?), ref: 1002515B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$ByteCharMultiWide$H_prolog3
                    • String ID:
                    • API String ID: 1573742327-0
                    • Opcode ID: 6b1b8032f46c9ea4664e3225b0247641b447e11ead87d20c8e3e68c23104881b
                    • Instruction ID: e87b48d7eabcebeaaa17bf71e48e5ec88eeeba401d9af4237d70604eb8aa8eff
                    • Opcode Fuzzy Hash: 6b1b8032f46c9ea4664e3225b0247641b447e11ead87d20c8e3e68c23104881b
                    • Instruction Fuzzy Hash: 9D2115B5600205EFEB14CF64CD88B9ABBF8FF08315F51855AF9099B660C771AA50CB98
                    Function 1005360A Relevance: 9.1, APIs: 6, Instructions: 61COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 10053611
                    • GetLastError.KERNEL32(00000004,100535E4,?,00000000,?,00000001), ref: 10053633
                    • SetLastError.KERNEL32(?), ref: 10053666
                    • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000), ref: 10053687
                    • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000027,00000000,00000000,00000000), ref: 100536AE
                    • SetLastError.KERNEL32(?), ref: 100536BC
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$ByteCharMultiWide$H_prolog3
                    • String ID:
                    • API String ID: 1573742327-0
                    • Opcode ID: 6113579fdc352971fe67938e174ede51c92514d24e111ab3c60b3680ea7b85fa
                    • Instruction ID: 451e3db7728c96765f0b0d98f4d127270eaaad7c8bfda33045a152cf2fd84d7c
                    • Opcode Fuzzy Hash: 6113579fdc352971fe67938e174ede51c92514d24e111ab3c60b3680ea7b85fa
                    • Instruction Fuzzy Hash: 33212974600605EFEB14CF64C988B9ABBF4FF08311F158559F9499B750C770EA54CB94
                    Function 1003ED9F Relevance: 9.1, APIs: 6, Instructions: 61stringCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1003EDA6
                      • Part of subcall function 100053B7: SysAllocString.OLEAUT32(?), ref: 100053D8
                      • Part of subcall function 1000EA30: SysStringLen.OLEAUT32(00000024), ref: 1000EA3D
                      • Part of subcall function 1000EA30: SysReAllocStringLen.OLEAUT32(00000024,00000004,?), ref: 1000EA57
                      • Part of subcall function 10001123: GetLastError.KERNEL32(00000000,100C90D4,10005872,100C90D8,100C90D4,?,00000000,100C90D4,?,00000000), ref: 10001131
                      • Part of subcall function 10001123: SysFreeString.OLEAUT32(?), ref: 10001145
                      • Part of subcall function 10001123: SetLastError.KERNEL32(?,00000001,00000000), ref: 1000115F
                    • VariantChangeType.OLEAUT32(?,?,00000000,00000008), ref: 1003EE0E
                    • lstrlenW.KERNEL32(?), ref: 1003EE1D
                    • lstrlenW.KERNEL32(?), ref: 1003EE27
                    • lstrcpyW.KERNEL32(?,?), ref: 1003EE36
                    • VariantClear.OLEAUT32(?), ref: 1003EE42
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: String$AllocErrorLastVariantlstrlen$ChangeClearFreeH_prolog3_Typelstrcpy
                    • String ID:
                    • API String ID: 3562013027-0
                    • Opcode ID: afb5bea61536a7cb72497ae1dce2a3c0f410423c677957793a46cab53cd084e3
                    • Instruction ID: 044222c037d851172a26687d0d26b77fb72f3686ddc227320186c4c6ec75a219
                    • Opcode Fuzzy Hash: afb5bea61536a7cb72497ae1dce2a3c0f410423c677957793a46cab53cd084e3
                    • Instruction Fuzzy Hash: 6E212C79900269DFEF01DFE0CD84AAE7BB4FF58310F148455E901AB295DB35AE0ACB91
                    Function 1001370E Relevance: 9.1, APIs: 6, Instructions: 57windowCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 10013715
                      • Part of subcall function 1000380E: __EH_prolog3.LIBCMT ref: 10003815
                      • Part of subcall function 1000380E: GetLastError.KERNEL32(00000004,10002E96,?,00000000,00000004,10002ADC,00000000,?,00000008,10002A85,?,?,00000000,?,00000000,00000000), ref: 10003837
                      • Part of subcall function 1000380E: SetLastError.KERNEL32(100C90E0,00000000,?,?,1000C93A,?,0000000E,00000000,00000010,1000CA32,00000000,0000000E,?,?,?), ref: 1000386F
                    • IsWindow.USER32(?), ref: 10013778
                    • EnableWindow.USER32(?,00000001), ref: 10013790
                    • IsWindow.USER32(?), ref: 100137BB
                    • EnableWindow.USER32(?,00000001), ref: 100137CD
                    • SetFocus.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000034,10013F8C), ref: 100137D9
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Window$EnableErrorLast$FocusH_prolog3H_prolog3_
                    • String ID:
                    • API String ID: 2843960835-0
                    • Opcode ID: dac6910d4759fe6d802f7c88c607ef5f25d3a631465806efb5fc09a776f8d187
                    • Instruction ID: ecb13688d8a24b58cde6bf8be0b4e579d7c895428c85a7a41b4232a33a9b9c7c
                    • Opcode Fuzzy Hash: dac6910d4759fe6d802f7c88c607ef5f25d3a631465806efb5fc09a776f8d187
                    • Instruction Fuzzy Hash: E5216DB4500651DFDB20DFA0CD84BAEB7B0FF00340F0584ACE5526B1A1CB71AD85CB50
                    Function 1003FC66 Relevance: 9.1, APIs: 6, Instructions: 56COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 1003FC6D
                    • _memset.LIBCMT ref: 1003FC7A
                    • VariantInit.OLEAUT32(?), ref: 1003FC86
                      • Part of subcall function 1003EFF3: __EH_prolog3_GS.LIBCMT ref: 1003EFFA
                    • SysStringByteLen.OLEAUT32(?), ref: 1003FCC2
                    • _memmove.LIBCMT ref: 1003FCE0
                    • VariantClear.OLEAUT32(?), ref: 1003FCF8
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Variant$ByteClearH_prolog3H_prolog3_InitString_memmove_memset
                    • String ID:
                    • API String ID: 2180547488-0
                    • Opcode ID: 8b31c86efd4d6b6ea8427f2eb4816affd26cfa5179c0657dc797383ee7c29fd6
                    • Instruction ID: 49d2cd59c5dbab1ca959bd6623a97554600c39f1495b21685484974067e05758
                    • Opcode Fuzzy Hash: 8b31c86efd4d6b6ea8427f2eb4816affd26cfa5179c0657dc797383ee7c29fd6
                    • Instruction Fuzzy Hash: 6D116736C4022A9FCF12DF90CD45AEEBBB9FB08321F100125FE50A7190D775AA699B90
                    Function 10001204 Relevance: 9.0, APIs: 6, Instructions: 48stringCOMMON
                    Download Yara Rule
                    APIs
                    • GetDC.USER32(?), ref: 1000121E
                    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 1000122B
                    • MulDiv.KERNEL32(100013D0,00000000), ref: 10001235
                    • ReleaseDC.USER32(00000000,00000000), ref: 10001244
                    • lstrcpyW.KERNEL32(?,000000A0), ref: 10001265
                    • CreateFontIndirectW.GDI32(?), ref: 1000126F
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: CapsCreateDeviceFontIndirectReleaselstrcpy
                    • String ID:
                    • API String ID: 3504513423-0
                    • Opcode ID: 3090a36643f2413122c1b9bc2a3ba1dc3373187ac182c4d01d64a91c2bdbea70
                    • Instruction ID: 2ec6287bafc69a6a4742ba1fae316675eea87a697073db2341d3f7bb1a4e1962
                    • Opcode Fuzzy Hash: 3090a36643f2413122c1b9bc2a3ba1dc3373187ac182c4d01d64a91c2bdbea70
                    • Instruction Fuzzy Hash: F701D7B190022CAFEB00DFE9CD899AEBBF8FB09311F444469E606E7150C7749A058B54
                    Function 10050A8F Relevance: 9.0, APIs: 6, Instructions: 48windowCOMMON
                    Download Yara Rule
                    APIs
                    • CreateCompatibleDC.GDI32(1004DF85), ref: 10050A98
                    • CreateCompatibleBitmap.GDI32(1004DF85,?,?), ref: 10050AB6
                    • SelectObject.GDI32(00000000,00000000), ref: 10050AC1
                    • BitBlt.GDI32(00000000,00000000,00000000,?,?,1004DF85,00000000,?,00CC0020), ref: 10050AEB
                    • SelectObject.GDI32(00000000,00000000), ref: 10050AF3
                    • DeleteDC.GDI32(00000000), ref: 10050AFA
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: CompatibleCreateObjectSelect$BitmapDelete
                    • String ID:
                    • API String ID: 1931044818-0
                    • Opcode ID: e5a812fd2375b99b8984684a458d5dc7f2832dddfc368d890013840edba6fbee
                    • Instruction ID: 54f2b8c7c7e4a41a6cd52e91887d23a9097068472daab0b70b2696a3723473b8
                    • Opcode Fuzzy Hash: e5a812fd2375b99b8984684a458d5dc7f2832dddfc368d890013840edba6fbee
                    • Instruction Fuzzy Hash: 9E01DB75500124FFDB14DFA4CDC9EAA7FA8FB08360B14C198FE0A9A255D770AD00DB68
                    Function 1001DD53 Relevance: 9.0, APIs: 6, Instructions: 46COMMON
                    Download Yara Rule
                    APIs
                    • GetDC.USER32(00000000), ref: 1001DD68
                    • GetDeviceCaps.GDI32(00000000,00000058), ref: 1001DD79
                    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 1001DD80
                    • ReleaseDC.USER32(00000000,00000000), ref: 1001DD88
                    • MulDiv.KERNEL32(00000000,00000000,000009EC), ref: 1001DD9F
                    • MulDiv.KERNEL32(?,?,000009EC), ref: 1001DDB1
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: CapsDevice$Release
                    • String ID:
                    • API String ID: 1035833867-0
                    • Opcode ID: 84ff9a390d7d9b22f2e0193662afff0a6c173e9c9a66f47f76928077205fb6a1
                    • Instruction ID: e0945698115bab7b89929009b847b8276d93d9ef873cb40202da529d8f2dc50d
                    • Opcode Fuzzy Hash: 84ff9a390d7d9b22f2e0193662afff0a6c173e9c9a66f47f76928077205fb6a1
                    • Instruction Fuzzy Hash: 3B01A271900228BFEB11AFA5CC89F5E7FA8EB45761F008056FE056B190D7B09941CFA1
                    Function 1001DEDC Relevance: 9.0, APIs: 6, Instructions: 46COMMON
                    Download Yara Rule
                    APIs
                    • GetDC.USER32(00000000), ref: 1001DEF1
                    • GetDeviceCaps.GDI32(00000000,00000058), ref: 1001DF02
                    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 1001DF09
                    • ReleaseDC.USER32(00000000,00000000), ref: 1001DF11
                    • MulDiv.KERNEL32(000009EC,?,00000000), ref: 1001DF28
                    • MulDiv.KERNEL32(000009EC,?,?), ref: 1001DF3A
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: CapsDevice$Release
                    • String ID:
                    • API String ID: 1035833867-0
                    • Opcode ID: 430046fb5a241639a6ef1e3425756408daf82f7217f0e1296ded3c066be6c6f0
                    • Instruction ID: bec34926d35fa4e4b39e13ab8863d696c463a8a343a1966a42f586480384fed9
                    • Opcode Fuzzy Hash: 430046fb5a241639a6ef1e3425756408daf82f7217f0e1296ded3c066be6c6f0
                    • Instruction Fuzzy Hash: 42016775900218FFFB109FA1CC89F5A7FA8EB447A1F108056FE056B290D6709D41CFA1
                    Function 1004DDE0 Relevance: 9.0, APIs: 6, Instructions: 45COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 1004E923: GetClientRect.USER32(?,00000000), ref: 1004E949
                    • SaveDC.GDI32(00000001), ref: 1004DE0A
                    • GetSysColor.USER32(00000005), ref: 1004DE14
                    • CreateSolidBrush.GDI32(00000000), ref: 1004DE1B
                    • FillRect.USER32(00000001,?,00000000), ref: 1004DE29
                    • DeleteObject.GDI32(00000000), ref: 1004DE30
                    • RestoreDC.GDI32(00000001,00000000), ref: 1004DE38
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Rect$BrushClientColorCreateDeleteFillObjectRestoreSaveSolid
                    • String ID:
                    • API String ID: 2050985494-0
                    • Opcode ID: 7baef63ccbc518a70535997cde50c11e7fbb3579e4b09a67bb47366e3cdd6faf
                    • Instruction ID: b8eabbc7d958b7c6c3312ae6b6c0c5eb33ba9720fa129fdc39a15a9e20311a80
                    • Opcode Fuzzy Hash: 7baef63ccbc518a70535997cde50c11e7fbb3579e4b09a67bb47366e3cdd6faf
                    • Instruction Fuzzy Hash: B801C2B6500218BFDB00DFB5DD8DCAF77ECFB496617140455FA02D2151DA34DA01CB65
                    Function 1000148D Relevance: 9.0, APIs: 6, Instructions: 38COMMON
                    Download Yara Rule
                    APIs
                    • GetDlgItem.USER32(?,00000514), ref: 10001499
                    • GetWindowLongW.USER32(00000000,000000F0), ref: 100014A8
                    • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 100014B8
                    • GetWindowLongW.USER32(00000000,000000EC), ref: 100014C1
                    • SetWindowLongW.USER32(00000000,000000EC,00000000), ref: 100014D0
                    • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000027,?,1004276C,?), ref: 100014E0
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Window$Long$Item
                    • String ID:
                    • API String ID: 4195074732-0
                    • Opcode ID: 108acd57d0f2979863102010de07f9dbaedf43486624aad1a351b04cac08a3aa
                    • Instruction ID: 951b1c5b106006f8e69bbe009df7354317e452dd5d10e20110f52abe44bf1c6a
                    • Opcode Fuzzy Hash: 108acd57d0f2979863102010de07f9dbaedf43486624aad1a351b04cac08a3aa
                    • Instruction Fuzzy Hash: 12F039B1118626BBF7002BB48DCDF2B3A5DFB01376B201B50F632D00E2CB649A008B6C
                    Function 070AF730 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 180COMMON
                    Download Yara Rule
                    APIs
                    • __malloc_dbg.LIBCMTD ref: 070AF908
                      • Part of subcall function 070B2860: GetLastError.KERNEL32 ref: 070B28C0
                      • Part of subcall function 070B2860: __malloc_dbg.LIBCMTD ref: 070B290A
                    • _fix_grouping.LIBCMTD ref: 070AF7B3
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: __malloc_dbg$ErrorLast_fix_grouping
                    • String ID: initnum.c
                    • API String ID: 2186063243-3093638918
                    • Opcode ID: 2dab90cd90d5d791398aea37a9b6a01fb4c3b9b514e071c9e850074524c9d811
                    • Instruction ID: 7cacbeabac8b614e0e1ef3c2655fa266fa8c883b6400237dc202cd716425c807
                    • Opcode Fuzzy Hash: 2dab90cd90d5d791398aea37a9b6a01fb4c3b9b514e071c9e850074524c9d811
                    • Instruction Fuzzy Hash: 7A716EB8A41305EFD380DBA4E857BA577F1BB84315F228759D8085B3C2DABDAD50CB81
                    Function 10080CC0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 166COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 10085D10: GetLastError.KERNEL32(AD4A72FF,00000000,00000000,?,?,100C6C68,000000FF,?,10080BEB,?,00000000,00000000,100D4A60,000000FF,00000001,100D4A60), ref: 10085D4E
                      • Part of subcall function 10085D10: SetLastError.KERNEL32(?,00000000,?,00000000,?,10080BEB,?,00000000,00000000,100D4A60,000000FF,00000001,100D4A60,00000000,00000001,00000000), ref: 10085DAA
                    • GetLastError.KERNEL32(100D4A60,00000001,00000001,?,?,7563E860,00000000,?,?,?,?,?,?,00000000,100C6670,000000FF), ref: 10080E46
                    • SysFreeString.OLEAUT32(100C6670), ref: 10080E62
                    • SysFreeString.OLEAUT32(00000000), ref: 10080E6D
                    • SetLastError.KERNEL32(`cu,?,?,?,7563E860,00000000), ref: 10080E8D
                      • Part of subcall function 10001123: GetLastError.KERNEL32(00000000,100C90D4,10005872,100C90D8,100C90D4,?,00000000,100C90D4,?,00000000), ref: 10001131
                      • Part of subcall function 10001123: SysFreeString.OLEAUT32(?), ref: 10001145
                      • Part of subcall function 10001123: SetLastError.KERNEL32(?,00000001,00000000), ref: 1000115F
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$FreeString
                    • String ID: `cu
                    • API String ID: 2425351278-4120539311
                    • Opcode ID: c16f682e19a46bf949432bebdb8eebeaf2a603fc4cc28f4607ece924e566a7ff
                    • Instruction ID: c9a62470db7844325e39d38240ced4df506c22f078883fdc12873a380974c76f
                    • Opcode Fuzzy Hash: c16f682e19a46bf949432bebdb8eebeaf2a603fc4cc28f4607ece924e566a7ff
                    • Instruction Fuzzy Hash: 8951BE31D44309AFEB54DFA4CD82BDEBBB5FF08355F11451AFA11A62A0EB706904CB61
                    Function 070AC1DC Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 107COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: __aulldiv__aullrem
                    • String ID: '$0$9
                    • API String ID: 3839614884-269856862
                    • Opcode ID: ba4a52d8e1ad06c0bd01aa6396cba8aef8c7bb049b67ef02d2a465a7b9ca6e8f
                    • Instruction ID: d69edd814f29229423066c13e5386b4d589c3a7bc0f8558fb7f4b5ac46693486
                    • Opcode Fuzzy Hash: ba4a52d8e1ad06c0bd01aa6396cba8aef8c7bb049b67ef02d2a465a7b9ca6e8f
                    • Instruction Fuzzy Hash: 8B51E4B1D09219DFEF64DFA8C998BAEB7B1BB44304F2482D9D44DAA240D7355E85CF20
                    Function 1004AABE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • GetModuleHandleW.KERNEL32(100CE4DC), ref: 1004AAE0
                    • GetProcAddress.KERNEL32(00000000,100CE508), ref: 1004AAF0
                    • _memset.LIBCMT ref: 1004AB0A
                    • GlobalMemoryStatus.KERNEL32(?), ref: 1004AB35
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: AddressGlobalHandleMemoryModuleProcStatus_memset
                    • String ID: @
                    • API String ID: 2048749600-2766056989
                    • Opcode ID: ef50c824db5176be801035a7e27302c3e627f643560f8f5542f7d4a168bea02a
                    • Instruction ID: 08ac894d3c8f9d7edf6b822dbe5343ee9ea9785e248c2027b3127f79b97a44aa
                    • Opcode Fuzzy Hash: ef50c824db5176be801035a7e27302c3e627f643560f8f5542f7d4a168bea02a
                    • Instruction Fuzzy Hash: 70213B75E002199FDF04CFA4DD85A9EBBF9EF49750F20402AE909E7281E734E945CBA4
                    Function 10001000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78libraryCOMMON
                    Download Yara Rule
                    APIs
                    • _strstr.LIBCMT ref: 10001045
                    • _memset.LIBCMT ref: 1000106B
                    • GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 1000107F
                    • LoadLibraryA.KERNEL32(00000000), ref: 100010D5
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: DirectoryLibraryLoadSystem_memset_strstr
                    • String ID: api-ms-win-core-
                    • API String ID: 3657221724-1285793476
                    • Opcode ID: b9b9d01561fea11a8459de0c5da37f5ce71fb32587d1da6eff6e43659d0c08de
                    • Instruction ID: bd733d76c80ed550048322d56bebb49a533df15aa1a26ee22b1f193883dbb310
                    • Opcode Fuzzy Hash: b9b9d01561fea11a8459de0c5da37f5ce71fb32587d1da6eff6e43659d0c08de
                    • Instruction Fuzzy Hash: 0921C4319082989FFB61CB64DC84BDABBE8EB05394F104499D4C6A7185D6F5AEC8CB50
                    Function 10029317 Relevance: 7.9, APIs: 5, Instructions: 431stringregistryCOMMON
                    Download Yara Rule
                    APIs
                    • lstrcmpiW.KERNEL32(?,100CAF28,?,AD4A72FF,?,00000000,00000000,?,100BC853,000000FF,?,10029160,?,00000000,00000000,00000000), ref: 100293A4
                    • lstrcmpiW.KERNEL32(?,100CAEF4,?,00000000,00000000,?,100BC853,000000FF,?,10029160,?,00000000,00000000,00000000,?,?), ref: 100293BB
                    • lstrcmpiW.KERNEL32(?,100CAF10,?,?,00000000,00000000,?,100BC853,000000FF,?,10029160,?,00000000,00000000,00000000,?), ref: 100294A1
                    • lstrcmpiW.KERNEL32(?,100CAEE8,?,00000000,00000000,?,100BC853,000000FF,?,10029160,?,00000000,00000000,00000000,?,?), ref: 100294C9
                      • Part of subcall function 10028AA5: CharNextW.USER32(?,?,00000000,?,?,?,?,10027F94,?,AD4A72FF,?,?,?,?,?,100BC7AA), ref: 10028AE0
                      • Part of subcall function 10028AA5: CharNextW.USER32(?,?,?,00000000,?,?,?,?,10027F94,?,AD4A72FF), ref: 10028B66
                    • RegDeleteValueW.ADVAPI32(?,?,?,?), ref: 100295C4
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: lstrcmpi$CharNext$DeleteValue
                    • String ID:
                    • API String ID: 3631157437-0
                    • Opcode ID: edaaad466aeae76ae648027e02d69eeea8900028efe46c8dd02a804ad8dda707
                    • Instruction ID: 336a5bae6f2bed8b0f860ba62ae132cc8b9dd48dff1e7c1b0da0e26dad451ebf
                    • Opcode Fuzzy Hash: edaaad466aeae76ae648027e02d69eeea8900028efe46c8dd02a804ad8dda707
                    • Instruction Fuzzy Hash: 98E1B575D01235AADB25DFA0AC58A9EB3F8EF55790F8101AAF805E3151DB349F84CF90
                    Function 100493F7 Relevance: 7.7, APIs: 5, Instructions: 193COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: H_prolog3_
                    • String ID:
                    • API String ID: 2427045233-0
                    • Opcode ID: 9d2ad363d89484a410a959ba3788df736f5168b9ab211353dc917564df9e25bd
                    • Instruction ID: e6f2dcaa33b8f9d6f3e8e92b47ed658d68146de663e0dfbd30750c711dd9a5a6
                    • Opcode Fuzzy Hash: 9d2ad363d89484a410a959ba3788df736f5168b9ab211353dc917564df9e25bd
                    • Instruction Fuzzy Hash: E0815675900269DFEB10DB60CC44F9EB77AEF45310F1180D8E949AB281DB71AE85CF62
                    Function 1004FC4B Relevance: 7.7, APIs: 5, Instructions: 158stringCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1004FC55
                      • Part of subcall function 1004E850: lstrcmpiW.KERNEL32(?,00000001,?,?,00000000,?,?,00000001), ref: 1004E895
                      • Part of subcall function 1004E850: lstrcpyW.KERNEL32(00000001,?), ref: 1004E8A8
                      • Part of subcall function 10003BE6: __EH_prolog3.LIBCMT ref: 10003BED
                      • Part of subcall function 10003BE6: GetLastError.KERNEL32(00000004,10003F3B,00000000,?,00000000,?), ref: 10003C0F
                      • Part of subcall function 10003BE6: SetLastError.KERNEL32(00000000,00000000,?), ref: 10003C48
                      • Part of subcall function 100057B6: __EH_prolog3.LIBCMT ref: 100057C0
                      • Part of subcall function 10001123: GetLastError.KERNEL32(00000000,100C90D4,10005872,100C90D8,100C90D4,?,00000000,100C90D4,?,00000000), ref: 10001131
                      • Part of subcall function 10001123: SysFreeString.OLEAUT32(?), ref: 10001145
                      • Part of subcall function 10001123: SetLastError.KERNEL32(?,00000001,00000000), ref: 1000115F
                      • Part of subcall function 10004EC2: GetLastError.KERNEL32(00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10004ED0
                      • Part of subcall function 10004EC2: SysFreeString.OLEAUT32(?), ref: 10004EE4
                      • Part of subcall function 10004EC2: SetLastError.KERNEL32(?,00000001,00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000), ref: 10004EFE
                      • Part of subcall function 1004F7DB: _memset.LIBCMT ref: 1004F7F9
                      • Part of subcall function 1004F7DB: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1004F838
                      • Part of subcall function 1004F7DB: _memset.LIBCMT ref: 1004F85A
                    • lstrcmpiW.KERNEL32(?,?), ref: 1004FD94
                    • lstrcpyW.KERNEL32(?,?), ref: 1004FDB7
                    • _ComponentIsItemSelected.ISRT(?,?,?), ref: 1004FDD2
                    • _ComponentGetData.ISRT(?,?,?,0000000E,?,00000000,00000000,?,?,?,?), ref: 1004FE6F
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$ComponentFreeH_prolog3String_memsetlstrcmpilstrcpy$DataH_prolog3_ItemSelectedUnothrow_t@std@@@__ehfuncinfo$??2@
                    • String ID:
                    • API String ID: 1325687814-0
                    • Opcode ID: 0ea7f3a01b3feac8da11b6f8437202e5546db398fb3012ba369197e1c539ac53
                    • Instruction ID: da7e41b029e8b9d712888553630235820b7a1ae5963079915935c1f4654b10ed
                    • Opcode Fuzzy Hash: 0ea7f3a01b3feac8da11b6f8437202e5546db398fb3012ba369197e1c539ac53
                    • Instruction Fuzzy Hash: 3B61A175A04119AFDB64CFA4C985BE9B7B8FF04304F1041ADEA09D7241DB34AE54CF90
                    Function 100398A8 Relevance: 7.6, APIs: 5, Instructions: 147COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 100398AF
                      • Part of subcall function 10039E1E: __EH_prolog3_GS.LIBCMT ref: 10039E25
                      • Part of subcall function 10039E1E: LoadLibraryW.KERNEL32(100CC1BC), ref: 10039E52
                      • Part of subcall function 10039E1E: __CxxThrowException@8.LIBCMT ref: 10039E6F
                      • Part of subcall function 10039E1E: GetProcAddress.KERNEL32(00000000,100CC1D4), ref: 10039E7A
                    • GetFileAttributesW.KERNEL32(?,00000058,10038F62,?,00000000,?,00000000,?,00000000,00000004,1003AC7F,?,?,?,?,?), ref: 100398D3
                    • _memset.LIBCMT ref: 100399A2
                    • VariantInit.OLEAUT32(00000001), ref: 100399AE
                    • VariantClear.OLEAUT32(00000001), ref: 100399FF
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: H_prolog3_Variant$AddressAttributesClearException@8FileInitLibraryLoadProcThrow_memset
                    • String ID:
                    • API String ID: 2867828822-0
                    • Opcode ID: de98718a67012cd094558583ed039bbeaa95d4d6eaf97de4293331ec2d9ac61f
                    • Instruction ID: c611a5f5ee38cd6aeecb12568023a7b22ca2c42a3ae0812bf7d9db01e9f8c016
                    • Opcode Fuzzy Hash: de98718a67012cd094558583ed039bbeaa95d4d6eaf97de4293331ec2d9ac61f
                    • Instruction Fuzzy Hash: 8B512A74D00209DFDF05CFE4C998A9DBBB8FF86305F144498E806AF295DB34AA46CB11
                    Function 100176C5 Relevance: 7.6, APIs: 5, Instructions: 135libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 100176CC
                      • Part of subcall function 100541FD: __EH_prolog3_catch_GS.LIBCMT ref: 10054207
                      • Part of subcall function 100541FD: vswprintf.LIBCMT ref: 100542BC
                    • LoadLibraryW.KERNEL32(?), ref: 10017726
                    • GetProcAddress.KERNEL32(00000000,?), ref: 1001778E
                    • FreeLibrary.KERNEL32(?), ref: 1001779B
                    • FreeLibrary.KERNEL32(?), ref: 100177FE
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Library$Free$AddressH_prolog3H_prolog3_catch_LoadProcvswprintf
                    • String ID:
                    • API String ID: 558468592-0
                    • Opcode ID: 8d0f7b0ee1a22317e91fb05e3572d08f32150829b48d18e905326554f8c964cb
                    • Instruction ID: 4b9a55e8ca7a2773058dd74b7f96d0db1a32ffea6b9151ea9ce7fcabee453313
                    • Opcode Fuzzy Hash: 8d0f7b0ee1a22317e91fb05e3572d08f32150829b48d18e905326554f8c964cb
                    • Instruction Fuzzy Hash: D0416D7590024ABFDF00DF64CD8AEEF3F78EB057A4F104244FA2556195D7319B548BA2
                    Function 100B5F22 Relevance: 7.6, APIs: 5, Instructions: 126COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: _memmove
                    • String ID:
                    • API String ID: 4104443479-0
                    • Opcode ID: 6bd16e450ab958da9b323628c0cec54608c692a05ff150c863338883352f4013
                    • Instruction ID: 3aeae82b4436628d58f1a0781f2d6ee9a7299bcfd74754dd70a6c0c9630683f9
                    • Opcode Fuzzy Hash: 6bd16e450ab958da9b323628c0cec54608c692a05ff150c863338883352f4013
                    • Instruction Fuzzy Hash: 4741E779A10203ABDF24DF55C881B6AFBF5FF09346F2044BAE985C5242D73AD591CB50
                    Function 10028AA5 Relevance: 7.6, APIs: 5, Instructions: 121COMMON
                    Download Yara Rule
                    APIs
                    • CharNextW.USER32(?,?,00000000,?,?,?,?,10027F94,?,AD4A72FF,?,?,?,?,?,100BC7AA), ref: 10028AE0
                    • CharNextW.USER32(?,?,?,00000000,?,?,?,?,10027F94,?,AD4A72FF), ref: 10028B66
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: CharNext
                    • String ID:
                    • API String ID: 3213498283-0
                    • Opcode ID: c60b4205a23c443bb3454a9ca4e4ea1e2895c1d9035b9a140452a7d8a76db711
                    • Instruction ID: dfdb38b351d50373dae077dff7d99f15bb48e48e2c455b65c2fe66217318427e
                    • Opcode Fuzzy Hash: c60b4205a23c443bb3454a9ca4e4ea1e2895c1d9035b9a140452a7d8a76db711
                    • Instruction Fuzzy Hash: AF41EFB9602316DFD711CF28D8805AAB7E5FF48390BA1446EF9859B310E730AE80CB80
                    Function 10040D44 Relevance: 7.6, APIs: 5, Instructions: 116COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 10040D4B
                      • Part of subcall function 10003B8B: GetLastError.KERNEL32(00000000,?,?,10004A1A,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10003BAA
                      • Part of subcall function 10003B8B: SetLastError.KERNEL32(?,?,?,10004A1A,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10003BD8
                    • GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 10040E81
                      • Part of subcall function 100123AB: __EH_prolog3.LIBCMT ref: 100123B2
                      • Part of subcall function 100123AB: GetLastError.KERNEL32(00000004,10011EF3,00000008,10014A6D,100C99E4,00000001,?,00000000), ref: 100123CB
                    • __CxxThrowException@8.LIBCMT ref: 10040DD0
                      • Part of subcall function 1008BE0A: RaiseException.KERNEL32(?,?,10051E9E,?,?,?,?,?,10051E9E,?,100ECD18,00000000), ref: 1008BE5B
                    • GetWindowsDirectoryW.KERNEL32(00000000,00000104,00000000,00000104,?,00000000,00000078,1005E096,00000000,00000000,00000068,10077762,00000000,100C90E8,100CB3E4,?), ref: 10040DA3
                      • Part of subcall function 100126FA: __EH_prolog3_GS.LIBCMT ref: 10012701
                      • Part of subcall function 100126FA: GetLastError.KERNEL32(00000038,10054A54,1000B0C9,100C95EC,?), ref: 10012708
                      • Part of subcall function 100126FA: SetLastError.KERNEL32(00000000), ref: 1001275C
                    • GetWindowsDirectoryW.KERNEL32(00000000,00000104,00000000,00000104,?,00000000,00000078,1005E096,00000000,00000000,00000068,10077762,00000000,100C90E8,100CB3E4,?), ref: 10040E14
                      • Part of subcall function 1000EA8B: SysStringLen.OLEAUT32(?), ref: 1000EA98
                      • Part of subcall function 1000EA8B: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 1000EAB2
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$Directory$H_prolog3_StringWindows$AllocExceptionException@8H_prolog3RaiseSystemThrow
                    • String ID:
                    • API String ID: 415710860-0
                    • Opcode ID: 69605a0b64b374d8591ac18e155419293ff671302f17c0c282318b99429b114d
                    • Instruction ID: 3608333e513f30059c323bddd38f89059c460bc6fe35f2ff9eac0b53a6bc6e10
                    • Opcode Fuzzy Hash: 69605a0b64b374d8591ac18e155419293ff671302f17c0c282318b99429b114d
                    • Instruction Fuzzy Hash: 0941B278904288DEDB10DBE4CA99BDDBB74FF15300F648098E6427B152DF756A09DB21
                    Function 10006493 Relevance: 7.6, APIs: 5, Instructions: 109COMMON
                    Download Yara Rule
                    APIs
                    • VariantClear.OLEAUT32(?), ref: 10006494
                    • __EH_prolog3_GS.LIBCMT ref: 100064AD
                    • _GetDiskSpaceEx.ISRT(00000014,?,?,0000000A,00000001), ref: 10006552
                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1000656C
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ClearDiskH_prolog3_SpaceUnothrow_t@std@@@Variant__ehfuncinfo$??2@
                    • String ID:
                    • API String ID: 1178576253-0
                    • Opcode ID: b12e7466dc9efecd529d4ccaa34aef04f6e3be9460ccf244f4f65c827132f40c
                    • Instruction ID: 3b029fd767016f6ea46ed3486a39a6202991fb141b53d9b2873d74fa55ff8f1e
                    • Opcode Fuzzy Hash: b12e7466dc9efecd529d4ccaa34aef04f6e3be9460ccf244f4f65c827132f40c
                    • Instruction Fuzzy Hash: DC413A75D00618DFDB10DFE4CC85ACEBBB5FF08340F21456AEA12AB289DB31A945CB90
                    Function 100B57A6 Relevance: 7.6, APIs: 5, Instructions: 100stringCOMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: _memmove$lstrcmp
                    • String ID:
                    • API String ID: 1993653321-0
                    • Opcode ID: 71b7306b151810dd6911a8480e14027d28ae0a476cd73acf2c1344452ba2de39
                    • Instruction ID: b16c9b232b1b38ee7273bd01cfb8cfa561e4f675377e94784965bdeb073b1953
                    • Opcode Fuzzy Hash: 71b7306b151810dd6911a8480e14027d28ae0a476cd73acf2c1344452ba2de39
                    • Instruction Fuzzy Hash: 49317E75E0031AEFDF11CFA4D845B9EB7F8FF49345F1008AAE180A6201E775A940CB51
                    Function 100419E1 Relevance: 7.6, APIs: 5, Instructions: 91stringCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 10043B10: __EH_prolog3_GS.LIBCMT ref: 10043B1A
                      • Part of subcall function 10043B10: IsWindow.USER32(?), ref: 10043B96
                      • Part of subcall function 10043B10: GetClassNameW.USER32(?,00000000,00000100), ref: 10043C01
                    • GetClassNameW.USER32(?,?,00000100), ref: 10041A3E
                    • lstrcmpiW.KERNEL32(?,100CCD80), ref: 10041A56
                    • lstrcmpiW.KERNEL32(?,100CCD90), ref: 10041A72
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ClassNamelstrcmpi$H_prolog3_Window
                    • String ID:
                    • API String ID: 1664259325-0
                    • Opcode ID: 0509085d5b2e81fb8f6cae891297459d911dd36cbc8be5234f70903721f5d2e7
                    • Instruction ID: dcbfd890c9cbe254137d3635fe14783502427cb4c2ae80724662b04b996be4a1
                    • Opcode Fuzzy Hash: 0509085d5b2e81fb8f6cae891297459d911dd36cbc8be5234f70903721f5d2e7
                    • Instruction Fuzzy Hash: 2C21087AB0566A97CB20D6BC9D489CA72ACDB042D4F320272FE10D7190D730DE61975A
                    Function 1002235C Relevance: 7.6, APIs: 5, Instructions: 88COMMON
                    Download Yara Rule
                    APIs
                    • CallWindowProcW.USER32(?,?,?,?,?), ref: 100223BD
                    • GetWindowLongW.USER32(?,000000FC), ref: 100223D3
                    • CallWindowProcW.USER32(?,?,00000082,?,?), ref: 100223E9
                    • GetWindowLongW.USER32(?,000000FC), ref: 10022402
                    • SetWindowLongW.USER32(?,000000FC,?), ref: 10022411
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Window$Long$CallProc
                    • String ID:
                    • API String ID: 513923721-0
                    • Opcode ID: f84b596e16fce7fdb9ffa164382cee5a0e5c5c41b15aab9ab55eacb9bde20497
                    • Instruction ID: 81d298417f4b766c5625eebb3dd8392e4b84d47a729f4542e4ca868df112d64d
                    • Opcode Fuzzy Hash: f84b596e16fce7fdb9ffa164382cee5a0e5c5c41b15aab9ab55eacb9bde20497
                    • Instruction Fuzzy Hash: 2F312631100609AFCB25DF54CD45E9ABBF1FF48720B108A1DF9AA966A0D731EA60DF90
                    Function 1005445F Relevance: 7.6, APIs: 5, Instructions: 87stringCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_catch_GS.LIBCMT ref: 10054469
                    • RtlEnterCriticalSection.NTDLL(00000090), ref: 10054479
                    • _strncpy.LIBCMT ref: 100544A6
                    • lstrlen.KERNEL32(00000000), ref: 100544AF
                      • Part of subcall function 10011DEB: __EH_prolog3.LIBCMT ref: 10011DF2
                      • Part of subcall function 10003AA0: __EH_prolog3.LIBCMT ref: 10003AA7
                      • Part of subcall function 10003AA0: GetLastError.KERNEL32(00000004,100049CB,0000005C,00000000,00000000,00000000,?,1000DB12,00000000,00000001,00000000,?,000000FF,00000001,00000048,1000E682), ref: 10003AC9
                      • Part of subcall function 10003AA0: SetLastError.KERNEL32(?,00000000,?,1000DB12,00000000,00000001,00000000,?,000000FF,00000001,00000048,1000E682,?), ref: 10003B01
                      • Part of subcall function 10015898: __EH_prolog3.LIBCMT ref: 1001589F
                    • RtlLeaveCriticalSection.NTDLL(100C9108), ref: 1005458A
                      • Part of subcall function 10015AF0: __EH_prolog3_GS.LIBCMT ref: 10015AFA
                      • Part of subcall function 10015AF0: __CxxThrowException@8.LIBCMT ref: 10015B5E
                      • Part of subcall function 10015AF0: SetFilePointer.KERNEL32(?,?,?,?,00000108,10015734,00000000,00000000,00000000,00000000,00000000,00000010,10015912,00000000,00000000,100FBAB8), ref: 10015B6A
                      • Part of subcall function 10015AF0: GetLastError.KERNEL32 ref: 10015BBD
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorH_prolog3Last$CriticalSection$EnterException@8FileH_prolog3_H_prolog3_catch_LeavePointerThrow_strncpylstrlen
                    • String ID:
                    • API String ID: 817104565-0
                    • Opcode ID: 94e0d6bd57ffb18202492a23590094f06b48fc3687db2d2bdbb762160e616ccb
                    • Instruction ID: 2d5ff4a5785ac3f6c51587ccec1a90e77389dbf000a8d892eafb7620a625bffd
                    • Opcode Fuzzy Hash: 94e0d6bd57ffb18202492a23590094f06b48fc3687db2d2bdbb762160e616ccb
                    • Instruction Fuzzy Hash: 84317EB5901258AEEB11DBA0CD96FDE7B78EF55300F4040D8F60966182DF742B49CB66
                    Function 100532F7 Relevance: 7.6, APIs: 5, Instructions: 85libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 10053301
                    • GetModuleHandleW.KERNEL32(100CE4DC), ref: 10053324
                    • GetProcAddress.KERNEL32(00000000,100D3114), ref: 10053338
                      • Part of subcall function 10003BE6: __EH_prolog3.LIBCMT ref: 10003BED
                      • Part of subcall function 10003BE6: GetLastError.KERNEL32(00000004,10003F3B,00000000,?,00000000,?), ref: 10003C0F
                      • Part of subcall function 10003BE6: SetLastError.KERNEL32(00000000,00000000,?), ref: 10003C48
                      • Part of subcall function 10003AA0: __EH_prolog3.LIBCMT ref: 10003AA7
                      • Part of subcall function 10003AA0: GetLastError.KERNEL32(00000004,100049CB,0000005C,00000000,00000000,00000000,?,1000DB12,00000000,00000001,00000000,?,000000FF,00000001,00000048,1000E682), ref: 10003AC9
                      • Part of subcall function 10003AA0: SetLastError.KERNEL32(?,00000000,?,1000DB12,00000000,00000001,00000000,?,000000FF,00000001,00000048,1000E682,?), ref: 10003B01
                    • GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 100533BC
                    • __CxxThrowException@8.LIBCMT ref: 100533DD
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$H_prolog3$AddressDirectoryException@8H_prolog3_HandleModuleProcThrowWindows
                    • String ID:
                    • API String ID: 4209068821-0
                    • Opcode ID: 7c4ee6e6419de1d1d3422368cae98a3c136862936e758dd1b5894313a8e6da0b
                    • Instruction ID: e60575e37d9661e2e66c41a55fc7a183d0bedb6016000481710cf3c3c970d0b7
                    • Opcode Fuzzy Hash: 7c4ee6e6419de1d1d3422368cae98a3c136862936e758dd1b5894313a8e6da0b
                    • Instruction Fuzzy Hash: E1316FB59102199BDB60DF64CC99BCEB3BCEF14350F5042DAA64AA3251DF74AB88CF50
                    Function 1004FEE9 Relevance: 7.6, APIs: 5, Instructions: 85stringCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1004FEF3
                    • _memset.LIBCMT ref: 1004FF0A
                      • Part of subcall function 10003BE6: __EH_prolog3.LIBCMT ref: 10003BED
                      • Part of subcall function 10003BE6: GetLastError.KERNEL32(00000004,10003F3B,00000000,?,00000000,?), ref: 10003C0F
                      • Part of subcall function 10003BE6: SetLastError.KERNEL32(00000000,00000000,?), ref: 10003C48
                      • Part of subcall function 100057B6: __EH_prolog3.LIBCMT ref: 100057C0
                      • Part of subcall function 10001123: GetLastError.KERNEL32(00000000,100C90D4,10005872,100C90D8,100C90D4,?,00000000,100C90D4,?,00000000), ref: 10001131
                      • Part of subcall function 10001123: SysFreeString.OLEAUT32(?), ref: 10001145
                      • Part of subcall function 10001123: SetLastError.KERNEL32(?,00000001,00000000), ref: 1000115F
                      • Part of subcall function 10004EC2: GetLastError.KERNEL32(00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10004ED0
                      • Part of subcall function 10004EC2: SysFreeString.OLEAUT32(?), ref: 10004EE4
                      • Part of subcall function 10004EC2: SetLastError.KERNEL32(?,00000001,00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000), ref: 10004EFE
                      • Part of subcall function 1004F7DB: _memset.LIBCMT ref: 1004F7F9
                      • Part of subcall function 1004F7DB: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1004F838
                      • Part of subcall function 1004F7DB: _memset.LIBCMT ref: 1004F85A
                    • lstrcatW.KERNEL32(?,100CDC5C), ref: 1004FFF1
                    • lstrcatW.KERNEL32(?,100FB980), ref: 1004FFFC
                    • SetWindowTextW.USER32(?,?), ref: 10050008
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$_memset$FreeH_prolog3Stringlstrcat$H_prolog3_TextUnothrow_t@std@@@Window__ehfuncinfo$??2@
                    • String ID:
                    • API String ID: 3382001237-0
                    • Opcode ID: 46eda46af4ffe815149e0b4ae770dcc2af360f24131ba0953fbe343a33033529
                    • Instruction ID: fca08763223674df9cee5fe99b0682eac32cbc2faae81ac2be17ac173f0b4d1b
                    • Opcode Fuzzy Hash: 46eda46af4ffe815149e0b4ae770dcc2af360f24131ba0953fbe343a33033529
                    • Instruction Fuzzy Hash: 7B316A75A00228EFDB24DBA0CC95BEEB778FF45300F400199F60AA3141DB756A85CF91
                    Function 10061BD2 Relevance: 7.6, APIs: 5, Instructions: 82libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 10061BDC
                    • GetModuleHandleW.KERNEL32(100D3F94,100D3F78,?,00000400,?,000004A0,10061BC0,00000000), ref: 10061C0C
                    • GetProcAddress.KERNEL32(00000000), ref: 10061C13
                    • OpenProcess.KERNEL32(00000400,00000000,?), ref: 10061C3F
                    • _memset.LIBCMT ref: 10061C64
                      • Part of subcall function 10004EC2: GetLastError.KERNEL32(00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10004ED0
                      • Part of subcall function 10004EC2: SysFreeString.OLEAUT32(?), ref: 10004EE4
                      • Part of subcall function 10004EC2: SetLastError.KERNEL32(?,00000001,00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000), ref: 10004EFE
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$AddressFreeH_prolog3_HandleModuleOpenProcProcessString_memset
                    • String ID:
                    • API String ID: 3739051427-0
                    • Opcode ID: a5d8568707443c297be8120c3eaaf411462170e57de6f46fbe0bf79206359e72
                    • Instruction ID: 521119b4639717836c490278cb29d2aa479df22861011bd35b7b25f975495a0e
                    • Opcode Fuzzy Hash: a5d8568707443c297be8120c3eaaf411462170e57de6f46fbe0bf79206359e72
                    • Instruction Fuzzy Hash: 3B312BB5D0022D9BEB20DBA0CD85BDDB7B8EF44214F4044E5E749A7182DB70AF898F59
                    Function 10043149 Relevance: 7.6, APIs: 5, Instructions: 74stringCOMMON
                    Download Yara Rule
                    APIs
                    • GetClassNameW.USER32(?,?,00000100), ref: 1004316D
                    • lstrcmpiW.KERNEL32(?,100CCDA4), ref: 10043185
                    • lstrcmpiW.KERNEL32(?,100CCD90), ref: 100431B6
                    • lstrcmpiW.KERNEL32(?,100CCDB0), ref: 100431E3
                    • lstrcmpiW.KERNEL32(?,100CCD80), ref: 10043205
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: lstrcmpi$ClassName
                    • String ID:
                    • API String ID: 1602732865-0
                    • Opcode ID: e7a32c9152f69d7ed83c1bfb0de1d0eb03cf0faae12641aad0ace9b99009d237
                    • Instruction ID: e171aadbe389be55df343540d7e74e0bd5c56ec56efcd5e2713d32f832836706
                    • Opcode Fuzzy Hash: e7a32c9152f69d7ed83c1bfb0de1d0eb03cf0faae12641aad0ace9b99009d237
                    • Instruction Fuzzy Hash: B3219371A1021EA7EB10DB74CE45EDE37E8DB05290F6098B2EA12D3191E634EA05CB68
                    Function 1003FDCF Relevance: 7.6, APIs: 5, Instructions: 70memoryCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 1003FDD6
                      • Part of subcall function 100541FD: __EH_prolog3_catch_GS.LIBCMT ref: 10054207
                      • Part of subcall function 100541FD: vswprintf.LIBCMT ref: 100542BC
                    • _memset.LIBCMT ref: 1003FE34
                    • VariantInit.OLEAUT32(?), ref: 1003FE43
                    • SysAllocStringByteLen.OLEAUT32(?,?), ref: 1003FE59
                      • Part of subcall function 1001FF83: VariantCopy.OLEAUT32(?,1001C1AC), ref: 1001FF8D
                      • Part of subcall function 1003F0C4: __EH_prolog3_GS.LIBCMT ref: 1003F0CE
                      • Part of subcall function 1003F0C4: VariantClear.OLEAUT32(?), ref: 1003F279
                    • VariantClear.OLEAUT32(?), ref: 1003FE97
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Variant$Clear$AllocByteCopyH_prolog3H_prolog3_H_prolog3_catch_InitString_memsetvswprintf
                    • String ID:
                    • API String ID: 3006337806-0
                    • Opcode ID: 5ffd103beb7289b9665ee999b0c673855fa85cf23766e80e95e7d6c9fe3ebff6
                    • Instruction ID: 2313df8e9a39a1d8c2b7d119d9bd762c2fa33d3c44311c4cd20a67ea74173d4f
                    • Opcode Fuzzy Hash: 5ffd103beb7289b9665ee999b0c673855fa85cf23766e80e95e7d6c9fe3ebff6
                    • Instruction Fuzzy Hash: F0213E7690020DBBEF15DFA0CD06EEE7F79EF08360F044115FA11A6161D73196659BA1
                    Function 10023572 Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON
                    Download Yara Rule
                    APIs
                    • GetModuleHandleW.KERNEL32(00000000,?,00000000), ref: 1002358C
                    • GetClassInfoW.USER32(00000000,100CAB44,?), ref: 100235C5
                    • RegisterClassW.USER32(00000003), ref: 100235D3
                    • CreateWindowExW.USER32(00000000,100CAB44,100CAB44,80000000,00000000,00000000,0000000A,0000000A,00000000,00000000,00000000,00000000), ref: 100235F5
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Class$CreateHandleInfoModuleRegisterWindow
                    • String ID:
                    • API String ID: 1095930407-0
                    • Opcode ID: 5f46f5439a7a94fdcc74ae5b4f034017013174dc954522259d011b1a0ebd4cf3
                    • Instruction ID: 4d09cf3d86eb673cf6649e65039373157026077062d47b96cdd8de8433242095
                    • Opcode Fuzzy Hash: 5f46f5439a7a94fdcc74ae5b4f034017013174dc954522259d011b1a0ebd4cf3
                    • Instruction Fuzzy Hash: 69112EB4900359BFEB10DFA59DC9EAFBBBCFB45658F40806EE505E2201D7748D008B64
                    Function 1009AD3F Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • _malloc.LIBCMT ref: 1009AD4B
                      • Part of subcall function 1009003B: __FF_MSGBANNER.LIBCMT ref: 10090052
                      • Part of subcall function 1009003B: __NMSG_WRITE.LIBCMT ref: 10090059
                      • Part of subcall function 1009003B: RtlAllocateHeap.NTDLL(013F0000,00000000,00000001), ref: 1009007E
                    • _free.LIBCMT ref: 1009AD5E
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: AllocateHeap_free_malloc
                    • String ID:
                    • API String ID: 1020059152-0
                    • Opcode ID: 6704fa286e2b27cc2cd7c1bf5a38e4ae3a74056a993084c8e6e6ec82b180a6a3
                    • Instruction ID: 44d4fa8bfc128058d9819447111a39adf613ddc0fcc8826051a033a7af67f356
                    • Opcode Fuzzy Hash: 6704fa286e2b27cc2cd7c1bf5a38e4ae3a74056a993084c8e6e6ec82b180a6a3
                    • Instruction Fuzzy Hash: 0711E73250A622AFDF259B70DC456CE37D8DF022A2B120129F90E86951DB3198C0F3D4
                    Function 10020B4E Relevance: 7.6, APIs: 5, Instructions: 64windowCOMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Focus$ChildH_prolog3Window
                    • String ID:
                    • API String ID: 3907702801-0
                    • Opcode ID: e07d45bf450fa2b4e041dbae97c66611a6ae8b912a971147ef2558d929711508
                    • Instruction ID: 31c8a09eb10407bbc634bf9ae3990095daf2557d7c6c3589ea9022a78309dcd8
                    • Opcode Fuzzy Hash: e07d45bf450fa2b4e041dbae97c66611a6ae8b912a971147ef2558d929711508
                    • Instruction Fuzzy Hash: F72158B0600707AFEB15DFB0CD89A6AFBB6FF09358F014658F92597662CB70A950CB50
                    Function 10023102 Relevance: 7.6, APIs: 5, Instructions: 61windowCOMMON
                    Download Yara Rule
                    APIs
                    • GetParent.USER32(?), ref: 1002311B
                      • Part of subcall function 1001F805: GetParent.USER32(?), ref: 1001F810
                      • Part of subcall function 1001F805: GetWindowRect.USER32(?,?), ref: 1001F81F
                      • Part of subcall function 1001F805: ScreenToClient.USER32(00000000,?), ref: 1001F82D
                      • Part of subcall function 1001F805: ScreenToClient.USER32(00000000,?), ref: 1001F838
                    • DestroyWindow.USER32(?), ref: 1002312F
                    • CreateWindowExW.USER32(00000020,100CAAE8,100C90D4,50010000,?,?,?,?,00000000,?,00000000), ref: 10023167
                    • SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 1002317F
                    • SendMessageW.USER32(?,00000030,00000000,00000000), ref: 10023189
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Window$ClientMessageParentScreenSend$CreateDestroyRect
                    • String ID:
                    • API String ID: 3649825060-0
                    • Opcode ID: 9252d4427acb0c81d314db276cf56f93e0d50f52b3e524210c1f62897cca5a36
                    • Instruction ID: 157f0618e7cabfbaa4c880d37a17b9cb1d0499dc4cb6542b5eb211091fa214c7
                    • Opcode Fuzzy Hash: 9252d4427acb0c81d314db276cf56f93e0d50f52b3e524210c1f62897cca5a36
                    • Instruction Fuzzy Hash: 9C113076A01129BFDB11DBA9CE89EAFBBBCFF48250F100055F605A3150CB70AA10DBA5
                    Function 100671C1 Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 1008ABD5: _malloc.LIBCMT ref: 1008ABED
                    • std::exception::exception.LIBCMT ref: 10051E04
                    • __CxxThrowException@8.LIBCMT ref: 10051E19
                    • __CxxThrowException@8.LIBCMT ref: 10051E3D
                    • std::exception::exception.LIBCMT ref: 10051E56
                    • __CxxThrowException@8.LIBCMT ref: 10051E6B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw$std::exception::exception$_malloc
                    • String ID:
                    • API String ID: 3942750879-0
                    • Opcode ID: 893bc34ecb3cb2fa2edbd229926adce37b921934aa49ca1c6b681d3e51d40e55
                    • Instruction ID: c1acdd6e2fc5d6787b1a0d97d77469015d8cf18d14c19a00bf05dfc936c45d13
                    • Opcode Fuzzy Hash: 893bc34ecb3cb2fa2edbd229926adce37b921934aa49ca1c6b681d3e51d40e55
                    • Instruction Fuzzy Hash: 0A11777980020DAFCB04EFA5C941DEEB7B8FF04200F5081A9EA19D7551EB71A705CB92
                    Function 100592E0 Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 1008ABD5: _malloc.LIBCMT ref: 1008ABED
                    • std::exception::exception.LIBCMT ref: 10051E04
                    • __CxxThrowException@8.LIBCMT ref: 10051E19
                    • __CxxThrowException@8.LIBCMT ref: 10051E3D
                    • std::exception::exception.LIBCMT ref: 10051E56
                    • __CxxThrowException@8.LIBCMT ref: 10051E6B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw$std::exception::exception$_malloc
                    • String ID:
                    • API String ID: 3942750879-0
                    • Opcode ID: 33de5845a04a1fd800bb0ebf49d8dc6f6d0067fc01d0a2d65cee3dfb86eee024
                    • Instruction ID: 3f78bd4dc125ffe72016e7a036d2745d693cd5809dc7d4a7ba79528c7718030b
                    • Opcode Fuzzy Hash: 33de5845a04a1fd800bb0ebf49d8dc6f6d0067fc01d0a2d65cee3dfb86eee024
                    • Instruction Fuzzy Hash: 7C11377980060DAFCB04EFE5C955DEEB7B8FF04200F5081A9E919D7551EB71A709CB92
                    Function 1005930B Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 1008ABD5: _malloc.LIBCMT ref: 1008ABED
                    • std::exception::exception.LIBCMT ref: 10051E04
                    • __CxxThrowException@8.LIBCMT ref: 10051E19
                    • __CxxThrowException@8.LIBCMT ref: 10051E3D
                    • std::exception::exception.LIBCMT ref: 10051E56
                    • __CxxThrowException@8.LIBCMT ref: 10051E6B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw$std::exception::exception$_malloc
                    • String ID:
                    • API String ID: 3942750879-0
                    • Opcode ID: 8e308104812f402b5955a840244f26fbab448add0c7fb99adc6f90b129b1471a
                    • Instruction ID: 3a12fa45f1853d8489fdce143b09c438d87c4ba271593316e212f0ecab2edab3
                    • Opcode Fuzzy Hash: 8e308104812f402b5955a840244f26fbab448add0c7fb99adc6f90b129b1471a
                    • Instruction Fuzzy Hash: C911777980020DAFCB04EFA5C951DEEB7B8FF04200F5081A9E919D7551EB71A709CB92
                    Function 1003332A Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 1008ABD5: _malloc.LIBCMT ref: 1008ABED
                    • std::exception::exception.LIBCMT ref: 10051E04
                    • __CxxThrowException@8.LIBCMT ref: 10051E19
                    • __CxxThrowException@8.LIBCMT ref: 10051E3D
                    • std::exception::exception.LIBCMT ref: 10051E56
                    • __CxxThrowException@8.LIBCMT ref: 10051E6B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw$std::exception::exception$_malloc
                    • String ID:
                    • API String ID: 3942750879-0
                    • Opcode ID: 0a398eedf5d662bbbb6f05e65a9878eebe075a6df42ee5a3dc7d17d38274c0c9
                    • Instruction ID: 9da00793687c6cd26aa1d768f8697f2f7598a9baf364e8b78861eb759e13c77e
                    • Opcode Fuzzy Hash: 0a398eedf5d662bbbb6f05e65a9878eebe075a6df42ee5a3dc7d17d38274c0c9
                    • Instruction Fuzzy Hash: 4B11517980020DAFCB04EFA5C941EEEB7B8FF04200F5081A9E91997651EFB1A605CB92
                    Function 1002FCCF Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 1008ABD5: _malloc.LIBCMT ref: 1008ABED
                    • std::exception::exception.LIBCMT ref: 10051E04
                    • __CxxThrowException@8.LIBCMT ref: 10051E19
                    • __CxxThrowException@8.LIBCMT ref: 10051E3D
                    • std::exception::exception.LIBCMT ref: 10051E56
                    • __CxxThrowException@8.LIBCMT ref: 10051E6B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw$std::exception::exception$_malloc
                    • String ID:
                    • API String ID: 3942750879-0
                    • Opcode ID: 3d3fffb696580375839b0f858c7f5223550f44c68914cd550f295eeecae2b93a
                    • Instruction ID: f67a0e299b904336c67af36baa413bb11a6674849a66b9cb289537a77cdf1f4a
                    • Opcode Fuzzy Hash: 3d3fffb696580375839b0f858c7f5223550f44c68914cd550f295eeecae2b93a
                    • Instruction Fuzzy Hash: A7117779C0060DAFCB04EFA5C951DEEB7B8FF04200F5081A9E915D7551EBB1A705CB92
                    Function 1002FCFA Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 1008ABD5: _malloc.LIBCMT ref: 1008ABED
                    • std::exception::exception.LIBCMT ref: 10051E04
                    • __CxxThrowException@8.LIBCMT ref: 10051E19
                    • __CxxThrowException@8.LIBCMT ref: 10051E3D
                    • std::exception::exception.LIBCMT ref: 10051E56
                    • __CxxThrowException@8.LIBCMT ref: 10051E6B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw$std::exception::exception$_malloc
                    • String ID:
                    • API String ID: 3942750879-0
                    • Opcode ID: 3d3fffb696580375839b0f858c7f5223550f44c68914cd550f295eeecae2b93a
                    • Instruction ID: d72b6c068674b01a1b106c75d290d25819ee6adc97bb18e896927c1639e72a34
                    • Opcode Fuzzy Hash: 3d3fffb696580375839b0f858c7f5223550f44c68914cd550f295eeecae2b93a
                    • Instruction Fuzzy Hash: 3A11777980020DAFCB04EFA5D941EEEB7B8FF04200F5081A9E919D7551EBB1A605CB92
                    Function 1002FD25 Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 1008ABD5: _malloc.LIBCMT ref: 1008ABED
                    • std::exception::exception.LIBCMT ref: 10051E04
                    • __CxxThrowException@8.LIBCMT ref: 10051E19
                    • __CxxThrowException@8.LIBCMT ref: 10051E3D
                    • std::exception::exception.LIBCMT ref: 10051E56
                    • __CxxThrowException@8.LIBCMT ref: 10051E6B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw$std::exception::exception$_malloc
                    • String ID:
                    • API String ID: 3942750879-0
                    • Opcode ID: 3d3fffb696580375839b0f858c7f5223550f44c68914cd550f295eeecae2b93a
                    • Instruction ID: a368ed66d2c6479daae2ad6028995d4b2aaacda98ab78882f1e1d4bb6c199780
                    • Opcode Fuzzy Hash: 3d3fffb696580375839b0f858c7f5223550f44c68914cd550f295eeecae2b93a
                    • Instruction Fuzzy Hash: B411737980020DAFCB04EFE5C951DEEB7B8FF04200F9081A9E919D7551EBB1A609CB92
                    Function 1002FD50 Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 1008ABD5: _malloc.LIBCMT ref: 1008ABED
                    • std::exception::exception.LIBCMT ref: 10051E04
                    • __CxxThrowException@8.LIBCMT ref: 10051E19
                    • __CxxThrowException@8.LIBCMT ref: 10051E3D
                    • std::exception::exception.LIBCMT ref: 10051E56
                    • __CxxThrowException@8.LIBCMT ref: 10051E6B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw$std::exception::exception$_malloc
                    • String ID:
                    • API String ID: 3942750879-0
                    • Opcode ID: 0aa8be9f3c3ce23d215f61bc44f313904d8e9a4a3230c4fb1304ca449d60e107
                    • Instruction ID: cde403ef8bb95399163b239307f80273512068787ae15c8f3f1c82ce7256d412
                    • Opcode Fuzzy Hash: 0aa8be9f3c3ce23d215f61bc44f313904d8e9a4a3230c4fb1304ca449d60e107
                    • Instruction Fuzzy Hash: 2D117779C0060DAFCB04EFA5C941DEEB7B8FF04240F5081A9EA19D7551EB71A605CB92
                    Function 1002FD7B Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 1008ABD5: _malloc.LIBCMT ref: 1008ABED
                    • std::exception::exception.LIBCMT ref: 10051E04
                    • __CxxThrowException@8.LIBCMT ref: 10051E19
                    • __CxxThrowException@8.LIBCMT ref: 10051E3D
                    • std::exception::exception.LIBCMT ref: 10051E56
                    • __CxxThrowException@8.LIBCMT ref: 10051E6B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw$std::exception::exception$_malloc
                    • String ID:
                    • API String ID: 3942750879-0
                    • Opcode ID: 0aa8be9f3c3ce23d215f61bc44f313904d8e9a4a3230c4fb1304ca449d60e107
                    • Instruction ID: e15be2a6c224a02fb9fc5c238110814f309b24a0df1abf058a451862d1055a85
                    • Opcode Fuzzy Hash: 0aa8be9f3c3ce23d215f61bc44f313904d8e9a4a3230c4fb1304ca449d60e107
                    • Instruction Fuzzy Hash: BF11777980020DBFCB04EFE5C941DEEB7B8FF04200F5081A9EA19D7551EBB1A605CB92
                    Function 1002FDA6 Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 1008ABD5: _malloc.LIBCMT ref: 1008ABED
                    • std::exception::exception.LIBCMT ref: 10051E04
                    • __CxxThrowException@8.LIBCMT ref: 10051E19
                    • __CxxThrowException@8.LIBCMT ref: 10051E3D
                    • std::exception::exception.LIBCMT ref: 10051E56
                    • __CxxThrowException@8.LIBCMT ref: 10051E6B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw$std::exception::exception$_malloc
                    • String ID:
                    • API String ID: 3942750879-0
                    • Opcode ID: e9c5c750ea1650055a074ef9a107ab08f461e74fa13cf016d3910de5c3bc2ed6
                    • Instruction ID: 24415b6b84cdd3a199381a39f55124e3c4ded6c35cef685df1d25d884b09322b
                    • Opcode Fuzzy Hash: e9c5c750ea1650055a074ef9a107ab08f461e74fa13cf016d3910de5c3bc2ed6
                    • Instruction Fuzzy Hash: 1611777980020DAFCB04EFE5C951DEEB7B8FF04200F5085AAE919D7551EF71A605CB92
                    Function 1000A33E Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 1008ABD5: _malloc.LIBCMT ref: 1008ABED
                    • std::exception::exception.LIBCMT ref: 10051E04
                    • __CxxThrowException@8.LIBCMT ref: 10051E19
                    • __CxxThrowException@8.LIBCMT ref: 10051E3D
                    • std::exception::exception.LIBCMT ref: 10051E56
                    • __CxxThrowException@8.LIBCMT ref: 10051E6B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw$std::exception::exception$_malloc
                    • String ID:
                    • API String ID: 3942750879-0
                    • Opcode ID: 0aa8be9f3c3ce23d215f61bc44f313904d8e9a4a3230c4fb1304ca449d60e107
                    • Instruction ID: 720628deb540fe7d472371227cf0ed14ebfc237ef158f264820520ca74227e04
                    • Opcode Fuzzy Hash: 0aa8be9f3c3ce23d215f61bc44f313904d8e9a4a3230c4fb1304ca449d60e107
                    • Instruction Fuzzy Hash: 9F115479C0060DAFCB04EFE5C941EEEB7B8FF04200F5081A9EA19D7551EB71A645CB92
                    Function 1000A369 Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 1008ABD5: _malloc.LIBCMT ref: 1008ABED
                    • std::exception::exception.LIBCMT ref: 10051E04
                    • __CxxThrowException@8.LIBCMT ref: 10051E19
                    • __CxxThrowException@8.LIBCMT ref: 10051E3D
                    • std::exception::exception.LIBCMT ref: 10051E56
                    • __CxxThrowException@8.LIBCMT ref: 10051E6B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw$std::exception::exception$_malloc
                    • String ID:
                    • API String ID: 3942750879-0
                    • Opcode ID: e9c5c750ea1650055a074ef9a107ab08f461e74fa13cf016d3910de5c3bc2ed6
                    • Instruction ID: 5f176d952553cd484de76b969cb4602ef9a9bd64dce1fa17d113952d9c9b4ef8
                    • Opcode Fuzzy Hash: e9c5c750ea1650055a074ef9a107ab08f461e74fa13cf016d3910de5c3bc2ed6
                    • Instruction Fuzzy Hash: F611777980020DAFCB04EFA5C941DEEB7B8FF04240F5081A9E919D7551EF75A745CB92
                    Function 1000A394 Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 1008ABD5: _malloc.LIBCMT ref: 1008ABED
                    • std::exception::exception.LIBCMT ref: 10051E04
                    • __CxxThrowException@8.LIBCMT ref: 10051E19
                    • __CxxThrowException@8.LIBCMT ref: 10051E3D
                    • std::exception::exception.LIBCMT ref: 10051E56
                    • __CxxThrowException@8.LIBCMT ref: 10051E6B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw$std::exception::exception$_malloc
                    • String ID:
                    • API String ID: 3942750879-0
                    • Opcode ID: e9c5c750ea1650055a074ef9a107ab08f461e74fa13cf016d3910de5c3bc2ed6
                    • Instruction ID: 24300d435b76fc81a9f5524ec756c9a65dc3a67e1d90a8ffb5b9d5c41cf80248
                    • Opcode Fuzzy Hash: e9c5c750ea1650055a074ef9a107ab08f461e74fa13cf016d3910de5c3bc2ed6
                    • Instruction Fuzzy Hash: B711777980020DAFCB04EFA5C941DEEB7B8FF04200F5081A9EA19D7551EB71A745CB92
                    Function 1007C660 Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 1008ABD5: _malloc.LIBCMT ref: 1008ABED
                    • std::exception::exception.LIBCMT ref: 10051E04
                    • __CxxThrowException@8.LIBCMT ref: 10051E19
                    • __CxxThrowException@8.LIBCMT ref: 10051E3D
                    • std::exception::exception.LIBCMT ref: 10051E56
                    • __CxxThrowException@8.LIBCMT ref: 10051E6B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw$std::exception::exception$_malloc
                    • String ID:
                    • API String ID: 3942750879-0
                    • Opcode ID: 347e26018178a9d7cdcd09e36fcde00fd113495cf024c2e6676b1fd9d281471c
                    • Instruction ID: 963189c8c743e2500102134fdb492978669f98e4c2e31a772a0dfc3208c5bee4
                    • Opcode Fuzzy Hash: 347e26018178a9d7cdcd09e36fcde00fd113495cf024c2e6676b1fd9d281471c
                    • Instruction Fuzzy Hash: 891124B9C0020DAFCB04EFA5C941DEEB7B8FF04240F5081A9E91997551EB75A709CB92
                    Function 1007C690 Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 1008ABD5: _malloc.LIBCMT ref: 1008ABED
                    • std::exception::exception.LIBCMT ref: 10051E04
                    • __CxxThrowException@8.LIBCMT ref: 10051E19
                    • __CxxThrowException@8.LIBCMT ref: 10051E3D
                    • std::exception::exception.LIBCMT ref: 10051E56
                    • __CxxThrowException@8.LIBCMT ref: 10051E6B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw$std::exception::exception$_malloc
                    • String ID:
                    • API String ID: 3942750879-0
                    • Opcode ID: 347e26018178a9d7cdcd09e36fcde00fd113495cf024c2e6676b1fd9d281471c
                    • Instruction ID: 891b9eb1240db8cd6889a56c00d412a02d40cbcc6ef9e16b7f1917f99b1c2c34
                    • Opcode Fuzzy Hash: 347e26018178a9d7cdcd09e36fcde00fd113495cf024c2e6676b1fd9d281471c
                    • Instruction Fuzzy Hash: DE1128B9C0020DAFCB04EFA5C941DEEB7B8FF04200F5081A9E919D7551EB75A705CB92
                    Function 1007C6C0 Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 1008ABD5: _malloc.LIBCMT ref: 1008ABED
                    • std::exception::exception.LIBCMT ref: 10051E04
                    • __CxxThrowException@8.LIBCMT ref: 10051E19
                    • __CxxThrowException@8.LIBCMT ref: 10051E3D
                    • std::exception::exception.LIBCMT ref: 10051E56
                    • __CxxThrowException@8.LIBCMT ref: 10051E6B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw$std::exception::exception$_malloc
                    • String ID:
                    • API String ID: 3942750879-0
                    • Opcode ID: 347e26018178a9d7cdcd09e36fcde00fd113495cf024c2e6676b1fd9d281471c
                    • Instruction ID: 47077948013c2056d3e7132bc8a8ee13a3fc9107e16140c88e0b61e560205a63
                    • Opcode Fuzzy Hash: 347e26018178a9d7cdcd09e36fcde00fd113495cf024c2e6676b1fd9d281471c
                    • Instruction Fuzzy Hash: 191124B9D0020DAFCB04EFA5C941DEEB7B8FF04200F5081A9E919D7551EB75A709CB92
                    Function 1007C6F0 Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 1008ABD5: _malloc.LIBCMT ref: 1008ABED
                    • std::exception::exception.LIBCMT ref: 10051E04
                    • __CxxThrowException@8.LIBCMT ref: 10051E19
                    • __CxxThrowException@8.LIBCMT ref: 10051E3D
                    • std::exception::exception.LIBCMT ref: 10051E56
                    • __CxxThrowException@8.LIBCMT ref: 10051E6B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw$std::exception::exception$_malloc
                    • String ID:
                    • API String ID: 3942750879-0
                    • Opcode ID: 347e26018178a9d7cdcd09e36fcde00fd113495cf024c2e6676b1fd9d281471c
                    • Instruction ID: 09741a46072bd741b55f893ae1d811456cc855e2f06abc08e3ff39d87248e82c
                    • Opcode Fuzzy Hash: 347e26018178a9d7cdcd09e36fcde00fd113495cf024c2e6676b1fd9d281471c
                    • Instruction Fuzzy Hash: 5B1124B9C0020DAFCB04EFA5C941DEEB7B8FF04240F5081A9E91997551EB75A709CB92
                    Function 1007C720 Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 1008ABD5: _malloc.LIBCMT ref: 1008ABED
                    • std::exception::exception.LIBCMT ref: 10051E04
                    • __CxxThrowException@8.LIBCMT ref: 10051E19
                    • __CxxThrowException@8.LIBCMT ref: 10051E3D
                    • std::exception::exception.LIBCMT ref: 10051E56
                    • __CxxThrowException@8.LIBCMT ref: 10051E6B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw$std::exception::exception$_malloc
                    • String ID:
                    • API String ID: 3942750879-0
                    • Opcode ID: 13037ee0ab8bdb3374920d4d91220741a78a8299265d9b8eeb525ab682d9eda7
                    • Instruction ID: 95e764123224645bcfa07f2b9227dadaea550278580f12339ac0f406b4b1ef57
                    • Opcode Fuzzy Hash: 13037ee0ab8bdb3374920d4d91220741a78a8299265d9b8eeb525ab682d9eda7
                    • Instruction Fuzzy Hash: 1F1124B9C0020DAFCB04EFA5C941EEEB7B8FF04200F5081A9EA1997551EB75A705CB92
                    Function 1007C750 Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 1008ABD5: _malloc.LIBCMT ref: 1008ABED
                    • std::exception::exception.LIBCMT ref: 10051E04
                    • __CxxThrowException@8.LIBCMT ref: 10051E19
                    • __CxxThrowException@8.LIBCMT ref: 10051E3D
                    • std::exception::exception.LIBCMT ref: 10051E56
                    • __CxxThrowException@8.LIBCMT ref: 10051E6B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw$std::exception::exception$_malloc
                    • String ID:
                    • API String ID: 3942750879-0
                    • Opcode ID: 13037ee0ab8bdb3374920d4d91220741a78a8299265d9b8eeb525ab682d9eda7
                    • Instruction ID: 1e6b5c300526810257f15ee84c220ab852f50e3d4251bbae96bf6a06bdc4aede
                    • Opcode Fuzzy Hash: 13037ee0ab8bdb3374920d4d91220741a78a8299265d9b8eeb525ab682d9eda7
                    • Instruction Fuzzy Hash: EC1124B9C0060DAFCB04EFA5C941EEEB7B8FF04240F5081A9EA1997551EB75A605CB92
                    Function 1007C780 Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 1008ABD5: _malloc.LIBCMT ref: 1008ABED
                    • std::exception::exception.LIBCMT ref: 10051E04
                    • __CxxThrowException@8.LIBCMT ref: 10051E19
                    • __CxxThrowException@8.LIBCMT ref: 10051E3D
                    • std::exception::exception.LIBCMT ref: 10051E56
                    • __CxxThrowException@8.LIBCMT ref: 10051E6B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw$std::exception::exception$_malloc
                    • String ID:
                    • API String ID: 3942750879-0
                    • Opcode ID: 13037ee0ab8bdb3374920d4d91220741a78a8299265d9b8eeb525ab682d9eda7
                    • Instruction ID: 3906ff31fcb3017d92073324ad44ffa816e1f5a0bf65edd97ca0078f5150f9be
                    • Opcode Fuzzy Hash: 13037ee0ab8bdb3374920d4d91220741a78a8299265d9b8eeb525ab682d9eda7
                    • Instruction Fuzzy Hash: C91124B9C0020DAFCB04EFA5C945EEEB7B8FF04200F5081A9EA1997551EB75A605CB92
                    Function 1007C7B0 Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 1008ABD5: _malloc.LIBCMT ref: 1008ABED
                    • std::exception::exception.LIBCMT ref: 10051E04
                    • __CxxThrowException@8.LIBCMT ref: 10051E19
                    • __CxxThrowException@8.LIBCMT ref: 10051E3D
                    • std::exception::exception.LIBCMT ref: 10051E56
                    • __CxxThrowException@8.LIBCMT ref: 10051E6B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw$std::exception::exception$_malloc
                    • String ID:
                    • API String ID: 3942750879-0
                    • Opcode ID: 347e26018178a9d7cdcd09e36fcde00fd113495cf024c2e6676b1fd9d281471c
                    • Instruction ID: 6941a2acb21e823f8cc0d20375474ad5d30d192c5d6303a6f254f199f701281a
                    • Opcode Fuzzy Hash: 347e26018178a9d7cdcd09e36fcde00fd113495cf024c2e6676b1fd9d281471c
                    • Instruction Fuzzy Hash: 811124B9C0060DAFCB04EFA5C941DEEB7B8FF04200F5081A9E91997551EBB5A709CB92
                    Function 100448CA Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 1008ABD5: _malloc.LIBCMT ref: 1008ABED
                    • std::exception::exception.LIBCMT ref: 10051E04
                    • __CxxThrowException@8.LIBCMT ref: 10051E19
                    • __CxxThrowException@8.LIBCMT ref: 10051E3D
                    • std::exception::exception.LIBCMT ref: 10051E56
                    • __CxxThrowException@8.LIBCMT ref: 10051E6B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Exception@8Throw$std::exception::exception$_malloc
                    • String ID:
                    • API String ID: 3942750879-0
                    • Opcode ID: 3ce37b152eb003d03f63ead8aec79d62fa41a02e3e276b93dc6ed25bb0482cc3
                    • Instruction ID: 3aefdcee643a2d4190b0b16abdb91ee115a1c9883c3558158f12a061e348dba7
                    • Opcode Fuzzy Hash: 3ce37b152eb003d03f63ead8aec79d62fa41a02e3e276b93dc6ed25bb0482cc3
                    • Instruction Fuzzy Hash: 8F112179C0060DAFCB04EFA5C951EEEB7B8FF04200F5081A9E919D7551EFB1A605CB92
                    Function 1005D0D5 Relevance: 7.6, APIs: 5, Instructions: 56libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1005D0DF
                    • GetModuleHandleW.KERNEL32(100D2F68,100D40BC,00000254,1005BC18), ref: 1005D0FB
                    • GetProcAddress.KERNEL32(00000000), ref: 1005D0FE
                    • GetModuleHandleW.KERNEL32(100D2F68,100D40CC), ref: 1005D13E
                    • GetProcAddress.KERNEL32(00000000), ref: 1005D141
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: AddressHandleModuleProc$H_prolog3_
                    • String ID:
                    • API String ID: 762132516-0
                    • Opcode ID: d65d574af2199e09296ca343c1700b57c501bd4389b87ed074c407bad2f98665
                    • Instruction ID: 3b44b10916b517fd5c0a0025f4e729a8a29709e7002e24c8f3dff6a60e14fff8
                    • Opcode Fuzzy Hash: d65d574af2199e09296ca343c1700b57c501bd4389b87ed074c407bad2f98665
                    • Instruction Fuzzy Hash: 1B11A775900628EBCB20EBA4CC849ED37A4EB44370F51475AF915971D0DB34AE0ECB95
                    Function 1000415B Relevance: 7.6, APIs: 5, Instructions: 53COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 10004162
                    • SafeArrayGetElement.OLEAUT32(?,?,?), ref: 1000418E
                    • __CxxThrowException@8.LIBCMT ref: 100041AA
                      • Part of subcall function 1008BE0A: RaiseException.KERNEL32(?,?,10051E9E,?,?,?,?,?,10051E9E,?,100ECD18,00000000), ref: 1008BE5B
                    • SysFreeString.OLEAUT32(?), ref: 100041D3
                    • SysFreeString.OLEAUT32(?), ref: 100041EF
                      • Part of subcall function 10004A75: __EH_prolog3.LIBCMT ref: 10004A7C
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: FreeH_prolog3String$ArrayElementExceptionException@8RaiseSafeThrow
                    • String ID:
                    • API String ID: 3478101042-0
                    • Opcode ID: d28269cd8d1c0d18383ce2144102520102f11c1711715bbd68719706d6c8e6f6
                    • Instruction ID: f2fa212915636f9f1412c87bea5c0b023f5df7f473424660e38a9c04f984d366
                    • Opcode Fuzzy Hash: d28269cd8d1c0d18383ce2144102520102f11c1711715bbd68719706d6c8e6f6
                    • Instruction Fuzzy Hash: 8F114CB9900119AFEF05DFA4CC819EEBBB8FF54355B01801AF809E7245DB70AB44CBA5
                    Function 1005E65A Relevance: 7.6, APIs: 5, Instructions: 52libraryloadertimeCOMMON
                    Download Yara Rule
                    APIs
                    • GetModuleHandleW.KERNEL32(100D2F68,100D3F14,?,?,?,1005DF17,00000000,?,?,?,?,?,0000006C,1001786F,?,00000000), ref: 1005E67B
                    • GetProcAddress.KERNEL32(00000000), ref: 1005E682
                    • OpenProcess.KERNEL32(001FFFFF,00000001,00000000,?,?,?,?,1005DF17,00000000,?,?,?,?,?,0000006C,1001786F), ref: 1005E6A2
                    • GetProcessTimes.KERNEL32(?,?,?,?,?,?,?,?,?,1005DF17,00000000,?,?,?,?,?), ref: 1005E6BB
                    • CloseHandle.KERNEL32(?,?,?,?,?,1005DF17,00000000,?,?,?,?,?,0000006C,1001786F,?,00000000), ref: 1005E6C8
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: HandleProcess$AddressCloseModuleOpenProcTimes
                    • String ID:
                    • API String ID: 4254294609-0
                    • Opcode ID: 5f278e0011d285f210a317afd1657d72f9fc92a4c339a4aa2238f30927a0b3fc
                    • Instruction ID: c536c0a03408c90ceb89deba87452ce2620288afbfdf5f5ef3277c19c09a3369
                    • Opcode Fuzzy Hash: 5f278e0011d285f210a317afd1657d72f9fc92a4c339a4aa2238f30927a0b3fc
                    • Instruction Fuzzy Hash: 6C01DB336413A57B9B028F648D4499B37ADEE957F17164025FD84D3210DB70CD1557E4
                    Function 10023262 Relevance: 7.5, APIs: 5, Instructions: 22windowCOMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • IsWindow.USER32(?), ref: 10023267
                    • PostMessageW.USER32(?,00000468,0000000A,00000001), ref: 1002327C
                    • IsWindow.USER32(?), ref: 10023285
                    • RemovePropW.USER32(?,100CAB2C), ref: 10023297
                    • DestroyWindow.USER32(?,?,?,10023956), ref: 100232A0
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Window$DestroyMessagePostPropRemove
                    • String ID:
                    • API String ID: 904420128-0
                    • Opcode ID: 6b0c1eac46f0405d2803b44ca52ea7afabb727582d49414fc04aa07615046bd7
                    • Instruction ID: 20c64a05fcb194fd1524a3c3272cab2fda998c9b346e7e690f71ad41d9e056b0
                    • Opcode Fuzzy Hash: 6b0c1eac46f0405d2803b44ca52ea7afabb727582d49414fc04aa07615046bd7
                    • Instruction Fuzzy Hash: DBE0BF31250A20EFFB612F20DE8AF567BA6FF05B51B4185ADF142D10B4DBE29D10DB14
                    Function 1002D868 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 179COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1002D872
                      • Part of subcall function 1000395E: GetLastError.KERNEL32(?,?,?,10007B00,?,?,?,?,00000000,00000040,1000A532,?,?,?,?,?), ref: 1000397D
                      • Part of subcall function 1000395E: SetLastError.KERNEL32(?,?,?,?,10007B00,?,?,?,?,00000000,00000040,1000A532,?,?,?,?), ref: 100039AB
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$H_prolog3_
                    • String ID: \
                    • API String ID: 3339191932-2967466578
                    • Opcode ID: 06d4a6c6dd89adab5ddaa8d721144aa6cd18126478f02194cb1a6fdb41f05f1c
                    • Instruction ID: 34f7c75da66c8cfd682435f60010cee258f045c5386670616ec3c346272e9d1e
                    • Opcode Fuzzy Hash: 06d4a6c6dd89adab5ddaa8d721144aa6cd18126478f02194cb1a6fdb41f05f1c
                    • Instruction Fuzzy Hash: FE713A75904269DFEB21DB54C884FDEB7B9EF45240F1082DAE84AA7251DB30AE44CF62
                    Function 10007C57 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 179COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 10007C61
                      • Part of subcall function 1000395E: GetLastError.KERNEL32(?,?,?,10007B00,?,?,?,?,00000000,00000040,1000A532,?,?,?,?,?), ref: 1000397D
                      • Part of subcall function 1000395E: SetLastError.KERNEL32(?,?,?,?,10007B00,?,?,?,?,00000000,00000040,1000A532,?,?,?,?), ref: 100039AB
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$H_prolog3_
                    • String ID: \
                    • API String ID: 3339191932-2967466578
                    • Opcode ID: ab0b65f3973b75452fb72331a86061acffb7736053d009afdb9d8137953118de
                    • Instruction ID: 65b1e07a54abe857f4981f462a60f2db8447a1494c606e5435efa8cdb3dae988
                    • Opcode Fuzzy Hash: ab0b65f3973b75452fb72331a86061acffb7736053d009afdb9d8137953118de
                    • Instruction Fuzzy Hash: 4F714675901268DFEB24CB64C884BDEB7B9FF49240F1082D9E84AA7245DB30AE44CF61
                    Function 070B2860 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 178COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 070B3E50: GetLocaleInfoW.KERNEL32(00000000,00000001,00000000,00000000), ref: 070B3E87
                      • Part of subcall function 070B3E50: GetLocaleInfoA.KERNEL32(00000080,00000000,00000001,00000000), ref: 070B3EDB
                    • GetLastError.KERNEL32 ref: 070B28C0
                    • __malloc_dbg.LIBCMTD ref: 070B295C
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: InfoLocale$ErrorLast__malloc_dbg
                    • String ID: inithelp.c
                    • API String ID: 3458877551-3264364157
                    • Opcode ID: 5b2ae4ed7fec0ad8dd379a8d429e8cb6e7d493d7724894ae9e9061d03ca68423
                    • Instruction ID: dfe91a29547cee7c09b5f0fac78865239053669728c2f89806ddb6a23a31cd3a
                    • Opcode Fuzzy Hash: 5b2ae4ed7fec0ad8dd379a8d429e8cb6e7d493d7724894ae9e9061d03ca68423
                    • Instruction Fuzzy Hash: 36717AF5E10219EFDB30DF64CC81BEEB7B0BB46714F108699E519AB281D6749B84CB12
                    Function 070AAE00 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 151COMMON
                    Download Yara Rule
                    APIs
                    • SetConsoleCtrlHandler.KERNEL32(070AB030,00000001), ref: 070AAE5A
                    • GetLastError.KERNEL32 ref: 070AAE71
                      • Part of subcall function 070A4EF0: LeaveCriticalSection.KERNEL32(?,?,070AE9AE,00000011,?,?,00000000), ref: 070A4EFE
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: ConsoleCriticalCtrlErrorHandlerLastLeaveSection
                    • String ID: winsig.c
                    • API String ID: 272450902-2233460225
                    • Opcode ID: fd070d12e4b4ae6e11065cc9553dc002249ee5e089a8bec9b1ed2ac36d83926c
                    • Instruction ID: 1468099f72d5a4acdc003f0e7300c5f03a47d93732d10e385bc1033a42e2b86d
                    • Opcode Fuzzy Hash: fd070d12e4b4ae6e11065cc9553dc002249ee5e089a8bec9b1ed2ac36d83926c
                    • Instruction Fuzzy Hash: 1A514AF4A0020AFFCB18DFD8D485AADB7F1BB49314F15C36AE8155B291D7799A80CB81
                    Function 070B1940 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • InterlockedIncrement.KERNEL32(070D1E24), ref: 070B1951
                    • InterlockedDecrement.KERNEL32(070D1E24), ref: 070B1965
                      • Part of subcall function 070A4E50: __malloc_dbg.LIBCMTD ref: 070A4E6F
                      • Part of subcall function 070A4E50: InitializeCriticalSection.KERNEL32(00000000,?,00000009), ref: 070A4EA5
                      • Part of subcall function 070A4E50: EnterCriticalSection.KERNEL32(00000000,00000000,?,070A273A,00000009), ref: 070A4EDD
                    • InterlockedDecrement.KERNEL32(070D1E24), ref: 070B1AAA
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: Interlocked$CriticalDecrementSection$EnterIncrementInitialize__malloc_dbg
                    • String ID: %
                    • API String ID: 552792009-2567322570
                    • Opcode ID: 621bcb2747cd261885198a7d9d081d9061f4be59091e3297e2a6ba40d5c37e17
                    • Instruction ID: 8e0459569f04330134d7d0bd40831a7d37969fd22d3c8276597d5be230d8f97e
                    • Opcode Fuzzy Hash: 621bcb2747cd261885198a7d9d081d9061f4be59091e3297e2a6ba40d5c37e17
                    • Instruction Fuzzy Hash: FA5139B490428EDFCB14CF68C8A47EE7BB2BF49308F048659E8255B341D775AA54CB91
                    Function 070AC1C6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: __aulldiv__aullrem
                    • String ID: 0$9
                    • API String ID: 3839614884-1975997740
                    • Opcode ID: 632878648175b6912781c3647362cc2135b703ef3703b3a444976cb3c6080e57
                    • Instruction ID: 2691875d4418939407b153a7d23332783e24f30e3f17f0ad3263069f525d2693
                    • Opcode Fuzzy Hash: 632878648175b6912781c3647362cc2135b703ef3703b3a444976cb3c6080e57
                    • Instruction Fuzzy Hash: 2651D3B1D09229DFEF64DFA8C9987AEB7B1BB44304F2482D9D44DAA240D7355E85CF20
                    Function 070A3FD0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON
                    Download Yara Rule
                    APIs
                    • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exe,00000104,?,?,?,?,070A10EC), ref: 070A3FF0
                    • __malloc_dbg.LIBCMTD ref: 070A4053
                    Strings
                    • C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exe, xrefs: 070A3FE9, 070A3FF6
                    • stdargv.c, xrefs: 070A4042
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: FileModuleName__malloc_dbg
                    • String ID: C:\Users\user\AppData\Local\Temp\{550D56F5-BA13-447E-836D-F7C9187A59A9}\setup.exe$stdargv.c
                    • API String ID: 3332595345-2666118454
                    • Opcode ID: e255337e7529214da03454497848401c5967fbe0d137e349d863bc3fe5cd022c
                    • Instruction ID: e03b907451c6b8a82710970ebabc40c97ceedab1203b31d6aa360f6d564031b5
                    • Opcode Fuzzy Hash: e255337e7529214da03454497848401c5967fbe0d137e349d863bc3fe5cd022c
                    • Instruction Fuzzy Hash: A8211BB9E01309FFCB04DFD8D842FAEB7B5AB44304F114359E915A7241E6756A04CB91
                    Function 070B4370 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMON
                    Download Yara Rule
                    APIs
                    • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,070B4282), ref: 070B439E
                    • __malloc_dbg.LIBCMTD ref: 070B43BF
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: ByteCharMultiWide__malloc_dbg
                    • String ID: wtombenv.c
                    • API String ID: 2549311186-4180475916
                    • Opcode ID: 8c1e04c4633eaeefc968b2ec4609104e32f7fe22aa3afcf665c56b163156d36d
                    • Instruction ID: d96d1a21c61c9a964a416e310dce10383842c4d5196f3a4f69400cc64d19c7ae
                    • Opcode Fuzzy Hash: 8c1e04c4633eaeefc968b2ec4609104e32f7fe22aa3afcf665c56b163156d36d
                    • Instruction Fuzzy Hash: BD215CB0E40248BBEB20DAA4CC42FAD77B4AB05B25F204368F525BA2C2D6B45B448B55
                    Function 070AEDB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64COMMON
                    Download Yara Rule
                    APIs
                    • ___free_lc_time.LIBCMTD ref: 070AEE62
                      • Part of subcall function 070A1FD0: __malloc_dbg.LIBCMTD ref: 070A1FF0
                    • ___free_lc_time.LIBCMTD ref: 070AEE00
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: ___free_lc_time$__malloc_dbg
                    • String ID: inittime.c
                    • API String ID: 2517587566-3509000034
                    • Opcode ID: 11da7489bc66fe01436f29745bcffadd23ab0f666bc2974a5f7255a999d2d1d8
                    • Instruction ID: e5f27a3808bda7497ce3df353dd2d7b7b8e35248cfe587a0f325c5336d6dfdd4
                    • Opcode Fuzzy Hash: 11da7489bc66fe01436f29745bcffadd23ab0f666bc2974a5f7255a999d2d1d8
                    • Instruction Fuzzy Hash: 9C117FF5A01308FBD340DBA4E943FAE36E5A710609F014764E9099B382EAB9DE548792
                    Function 070A4E50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • __malloc_dbg.LIBCMTD ref: 070A4E6F
                    • InitializeCriticalSection.KERNEL32(00000000,?,00000009), ref: 070A4EA5
                    • EnterCriticalSection.KERNEL32(00000000,00000000,?,070A273A,00000009), ref: 070A4EDD
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: CriticalSection$EnterInitialize__malloc_dbg
                    • String ID: mlock.c
                    • API String ID: 864973794-2717161476
                    • Opcode ID: e4907b17b58a0658c9f63e8026e8a84fae0968a34b92b0b29192dee7bbdd2c01
                    • Instruction ID: 55e01689b2d11fb5d2d4b93df7b9f660a71ed171a809fb52c72fa01b624c1f15
                    • Opcode Fuzzy Hash: e4907b17b58a0658c9f63e8026e8a84fae0968a34b92b0b29192dee7bbdd2c01
                    • Instruction Fuzzy Hash: 1F0180FCA4024CFFDB40DF94E852BDD77A0EB51709F004224F9051B281E6FA9A609AC2
                    Function 070ACE70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • InterlockedIncrement.KERNEL32(070D1E24), ref: 070ACE9C
                    • InterlockedDecrement.KERNEL32(070D1E24), ref: 070ACEB0
                    • InterlockedDecrement.KERNEL32(070D1E24), ref: 070ACEF6
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: Interlocked$Decrement$Increment
                    • String ID: z
                    • API String ID: 2574743344-1657960367
                    • Opcode ID: 9c805b1405b92df7478d132b58d71d20ad0d8831666d3e3231f2e344813a8c0e
                    • Instruction ID: e35d1b862636706923bd200fd3ae1a533acf396a1d17c40027a07c3ae29ea4ab
                    • Opcode Fuzzy Hash: 9c805b1405b92df7478d132b58d71d20ad0d8831666d3e3231f2e344813a8c0e
                    • Instruction Fuzzy Hash: 0D0140F450530DFFEB10DF94E44679E3AE0AB15349F168318FC055A240DB799E84DAA2
                    Function 070B4010 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON
                    Download Yara Rule
                    APIs
                    • InterlockedIncrement.KERNEL32(070D1E24), ref: 070B403C
                    • InterlockedDecrement.KERNEL32(070D1E24), ref: 070B4050
                    • InterlockedDecrement.KERNEL32(070D1E24), ref: 070B4096
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: Interlocked$Decrement$Increment
                    • String ID: Z
                    • API String ID: 2574743344-1505515367
                    • Opcode ID: 8d79c9942d294b959afd6bf10c2f16825886c6e30864e161620f985ec52092a5
                    • Instruction ID: 23a3d7121d1d75799358bd4e983114c872deea7db0b4c7d788a0599372d7e759
                    • Opcode Fuzzy Hash: 8d79c9942d294b959afd6bf10c2f16825886c6e30864e161620f985ec52092a5
                    • Instruction Fuzzy Hash: F70140F491538DEFDB20DF94E4567D93AA0AB05349F014328FC098A242D7799F84CB83
                    Function 070A14C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42memoryCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 070A4D70: InitializeCriticalSection.KERNEL32(070D1C10,?,070A14C9,00004A65,?,070A10BD), ref: 070A4D79
                      • Part of subcall function 070A4D70: InitializeCriticalSection.KERNEL32(070D1C40,?,070A14C9,00004A65,?,070A10BD), ref: 070A4D86
                      • Part of subcall function 070A4D70: InitializeCriticalSection.KERNEL32(070D1C28,?,070A14C9,00004A65,?,070A10BD), ref: 070A4D93
                      • Part of subcall function 070A4D70: InitializeCriticalSection.KERNEL32(070D1BF8,?,070A14C9,00004A65,?,070A10BD), ref: 070A4D9F
                    • TlsAlloc.KERNEL32(00004A65,?,070A10BD), ref: 070A14C9
                    • TlsSetValue.KERNEL32(00000035,00000000), ref: 070A150A
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: CritiusernitializeSection$AllocValue
                    • String ID: tidtable.c
                    • API String ID: 3805685275-1617207422
                    • Opcode ID: cd4ff152b46d70845e6bcebcff6155450264bf4432eee3cd6fbc3cb2e02c12cf
                    • Instruction ID: a32ffa72e6217247e982939cb6ffb9830f8793766134ce0ac2f7fbbdc2b5963b
                    • Opcode Fuzzy Hash: cd4ff152b46d70845e6bcebcff6155450264bf4432eee3cd6fbc3cb2e02c12cf
                    • Instruction Fuzzy Hash: 0F0171F4A41309FFDB20EBF8A946B9977F5A704314F204368E916973C1E779DA009B51
                    Function 1004B288 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34windowCOMMON
                    Download Yara Rule
                    APIs
                    • GetCursorPos.USER32(?), ref: 1004B29D
                    • ScreenToClient.USER32(?,?), ref: 1004B2A8
                    • SendMessageW.USER32(?,00001111,00000000,?), ref: 1004B2BA
                      • Part of subcall function 1004AE28: SendMessageW.USER32(?,0000113E,00000000,?), ref: 1004AE56
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: MessageSend$ClientCursorScreen
                    • String ID: @
                    • API String ID: 41388912-2766056989
                    • Opcode ID: 78cca2ec8002e6c51b54e02d7dca87fd5d7c984f9e1d6dc1a4dbe86c0f2727df
                    • Instruction ID: 1a4faa0bc452e7e5c412c00e976559c7aad9e88c256c38822d95a2f8d30ec0ec
                    • Opcode Fuzzy Hash: 78cca2ec8002e6c51b54e02d7dca87fd5d7c984f9e1d6dc1a4dbe86c0f2727df
                    • Instruction Fuzzy Hash: 94F0FE7250152ABFEB049B64CD89AEFB77CFF41625F200455F911E6140D7706A4687A8
                    Function 070A5F90 Relevance: 6.6, APIs: 5, Instructions: 375COMMONLIBRARYCODE
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: cb527942d135eb460d6eb2a48c81aa361ace949961e22aae344d650460ead2a4
                    • Instruction ID: f734a0880e7f39424dd5f04eaf7e28d325e8e333273790789d1dee70072870b1
                    • Opcode Fuzzy Hash: cb527942d135eb460d6eb2a48c81aa361ace949961e22aae344d650460ead2a4
                    • Instruction Fuzzy Hash: A8E107F5900208FFDF14CFE4D944AEEB7B5EB48314F188728E819AB241D776AA41CB51
                    Function 070A84B0 Relevance: 6.4, APIs: 5, Instructions: 130memoryCOMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • HeapAlloc.KERNEL32(073A0000,00000000,00002020,?,?,070A8CC1), ref: 070A84D5
                    • VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004), ref: 070A84F9
                    • VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004), ref: 070A851C
                    • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 070A8666
                    • HeapFree.KERNEL32(073A0000,00000000,070CDCA0), ref: 070A8682
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: AllocVirtual$FreeHeap
                    • String ID:
                    • API String ID: 714016831-0
                    • Opcode ID: 54f763b9d689ab209679e47e2de342338ecad206d11f66a0794b335e72e4cbe4
                    • Instruction ID: 3450306ed93feed74aa03b4b535c5ce701b6943cb6d042e396833fc04c7f22bd
                    • Opcode Fuzzy Hash: 54f763b9d689ab209679e47e2de342338ecad206d11f66a0794b335e72e4cbe4
                    • Instruction Fuzzy Hash: 7C5129B4A01209FFDB15CFA4C585B9DB7B1FB44304F21C2A9E8156B381C7B8AA40DF80
                    Function 10029C4F Relevance: 6.3, APIs: 4, Instructions: 269COMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 10027BBD: _memset.LIBCMT ref: 10027BDA
                      • Part of subcall function 1001FEA7: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,00000000,0000001C,1002245C,00000000,1001ED96,00000010,1001E23D,?), ref: 1001FEAC
                      • Part of subcall function 1001FEA7: GetLastError.KERNEL32 ref: 1001FEB6
                    • GetModuleFileNameW.KERNEL32(10000000,?,00000104), ref: 10029CD2
                    • GetModuleHandleW.KERNEL32(00000000), ref: 10029D2C
                    • GetModuleFileNameW.KERNEL32(10000000,?,00000104), ref: 10029E9B
                      • Part of subcall function 10027E88: __EH_prolog3.LIBCMT ref: 10027E8F
                      • Part of subcall function 10027E88: RtlEnterCriticalSection.NTDLL(?), ref: 10027EA7
                      • Part of subcall function 10027E88: RtlLeaveCriticalSection.NTDLL(?), ref: 10027EC6
                    • GetModuleHandleW.KERNEL32(00000000), ref: 10029EF6
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Module$CriticalSection$FileHandleName$CountEnterErrorH_prolog3InitializeLastLeaveSpin_memset
                    • String ID:
                    • API String ID: 2359842439-0
                    • Opcode ID: 3650c5f7036afa08dab62df896b9e48156c076e264809f2a988298904efe5d1e
                    • Instruction ID: 12f573db5e56c2a0625aaa7256f03698f7bf2c648a4fdcb47fed1c18a84b6a65
                    • Opcode Fuzzy Hash: 3650c5f7036afa08dab62df896b9e48156c076e264809f2a988298904efe5d1e
                    • Instruction Fuzzy Hash: 6DA18076A002289ADB60DB54ED45FDE73BCEF05380F9504AAE909E3151DB31EF848B66
                    Function 1007FE80 Relevance: 6.3, APIs: 4, Instructions: 251COMMON
                    Download Yara Rule
                    APIs
                    • GetLastError.KERNEL32(?,?,?,100C9528,?), ref: 100800BB
                    • SysFreeString.OLEAUT32(?), ref: 100800D7
                    • SysFreeString.OLEAUT32(?), ref: 100800E2
                    • SetLastError.KERNEL32(?), ref: 10080100
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorFreeLastString
                    • String ID:
                    • API String ID: 3822639702-0
                    • Opcode ID: bd1f19cfc8fb04b2ed11dadae9f4e67ecbf3ab0841c691e29b51213de8316843
                    • Instruction ID: bd64f592a532236a02d68ddce32fa949dc5d8af71a19f957d28ac7a8075fb185
                    • Opcode Fuzzy Hash: bd1f19cfc8fb04b2ed11dadae9f4e67ecbf3ab0841c691e29b51213de8316843
                    • Instruction Fuzzy Hash: FDB13774A042819FD751CB18C084B55FBE1FF46328F29C5ADE4898B252C7BAEC86CF95
                    Function 10080200 Relevance: 6.3, APIs: 4, Instructions: 251COMMON
                    Download Yara Rule
                    APIs
                    • GetLastError.KERNEL32(?,?,?,100C9528,?,100C9528,?), ref: 1008043B
                    • SysFreeString.OLEAUT32(?), ref: 10080457
                    • SysFreeString.OLEAUT32(?), ref: 10080462
                    • SetLastError.KERNEL32(?,?,100C9528,?,100C9528,?), ref: 10080480
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorFreeLastString
                    • String ID:
                    • API String ID: 3822639702-0
                    • Opcode ID: 80c041fa2aac967b764fa2c4ddb0a709134818d7910a58341bf7cbefa725aff8
                    • Instruction ID: b21d5742d105b66274cdfda832d81d634edcb7426c697531a8b81ecd4534da46
                    • Opcode Fuzzy Hash: 80c041fa2aac967b764fa2c4ddb0a709134818d7910a58341bf7cbefa725aff8
                    • Instruction Fuzzy Hash: 67B13A74A042969FD791CF18C088B49FBE1FF46368F19C19EE4894B252C7B6EC85CB91
                    Function 10080580 Relevance: 6.3, APIs: 4, Instructions: 251COMMON
                    Download Yara Rule
                    APIs
                    • GetLastError.KERNEL32(?,?,?,100C9528,?,100C9528,?,100C9528,?), ref: 100807BB
                    • SysFreeString.OLEAUT32(?), ref: 100807D7
                    • SysFreeString.OLEAUT32(?), ref: 100807E2
                    • SetLastError.KERNEL32(?,?,100C9528,?,100C9528,?,100C9528,?), ref: 10080800
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorFreeLastString
                    • String ID:
                    • API String ID: 3822639702-0
                    • Opcode ID: 61cdb382685013576f55eb046cb13ddf25e77edbe0f4c7ddabfe03e5f7de6e8d
                    • Instruction ID: c48893c5b6c4f127332f5bb6fa539a3f68f3aec27cd0273eb38dc5aaeb6c12bc
                    • Opcode Fuzzy Hash: 61cdb382685013576f55eb046cb13ddf25e77edbe0f4c7ddabfe03e5f7de6e8d
                    • Instruction Fuzzy Hash: 5CB15674A042829FD781CF18C084B45FBE1FF45368F29C59AE4898B252D7B6EC96CF91
                    Function 070AD310 Relevance: 6.2, APIs: 4, Instructions: 182fileCOMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 070AD45D
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: FileWrite
                    • String ID:
                    • API String ID: 3934441357-0
                    • Opcode ID: 28522a2f6d5ab94283f8f13b20290a029e33184bf176b03d3c0332a793239e6e
                    • Instruction ID: c75148107fe5d1477e53bfee6227865dee4ed42a48553793df37cbf4e69ffe2e
                    • Opcode Fuzzy Hash: 28522a2f6d5ab94283f8f13b20290a029e33184bf176b03d3c0332a793239e6e
                    • Instruction Fuzzy Hash: 938192F0A10209EFCF14CFA8C894BEDBBB1BF45308F148298E9159B249D774AA80CF54
                    Function 100453BC Relevance: 6.2, APIs: 4, Instructions: 177COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 100453C6
                      • Part of subcall function 1000395E: GetLastError.KERNEL32(?,?,?,10007B00,?,?,?,?,00000000,00000040,1000A532,?,?,?,?,?), ref: 1000397D
                      • Part of subcall function 1000395E: SetLastError.KERNEL32(?,?,?,?,10007B00,?,?,?,?,00000000,00000040,1000A532,?,?,?,?), ref: 100039AB
                    • LocalFree.KERNEL32(00000000), ref: 100454FE
                    • LocalFree.KERNEL32(?,00000000,00000004,00000004,00000000,00000000,?,00000000,?,?), ref: 100455AB
                    • LocalFree.KERNEL32(?,00000000,00000004,00000004,00000000,00000000,?,00000000,?,?), ref: 100455B5
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: FreeLocal$ErrorLast$H_prolog3_
                    • String ID:
                    • API String ID: 2560389977-0
                    • Opcode ID: 3aae7b161d6eba9bee46e9f53fee67888d9ecd1c33a3d8e70b24ac992534a650
                    • Instruction ID: 469952f68578752b9a1d879ac18170aa4423c81c358bfa8f4f402e1334a3018b
                    • Opcode Fuzzy Hash: 3aae7b161d6eba9bee46e9f53fee67888d9ecd1c33a3d8e70b24ac992534a650
                    • Instruction Fuzzy Hash: 9F616575900118EFDB15CBA4CD84AEDBBB9FF48304F6440ADE605A7252DB71AA45CF90
                    Function 1004CA06 Relevance: 6.2, APIs: 4, Instructions: 150COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1004CA0D
                    • FindResourceW.KERNEL32(?,00002EEC,00000005,?,?,?,?,?,?,?,?,?,00000000), ref: 1004CA95
                    • SysFreeString.OLEAUT32(?), ref: 1004CAFE
                    • _CtrlGetParentWindowHelper.ISRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1004CB1D
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: CtrlFindFreeH_prolog3_HelperParentResourceStringWindow
                    • String ID:
                    • API String ID: 3382274388-0
                    • Opcode ID: 7e302a61f6db9a2a8909e2a5fd2f5e63d3bf8c2b22e8b291446d199e9315ea76
                    • Instruction ID: eaf087f47a65624316aa864c14736a60f1c8b771097e4944470cc13637864b5f
                    • Opcode Fuzzy Hash: 7e302a61f6db9a2a8909e2a5fd2f5e63d3bf8c2b22e8b291446d199e9315ea76
                    • Instruction Fuzzy Hash: A651AA34904258EFEB40DFA0C88AF9E7BF5FF44350F2440A9E855AB291DB71AD02DB95
                    Function 10016DAD Relevance: 6.1, APIs: 4, Instructions: 148COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 10016DB7
                      • Part of subcall function 10004EC2: GetLastError.KERNEL32(00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10004ED0
                      • Part of subcall function 10004EC2: SysFreeString.OLEAUT32(?), ref: 10004EE4
                      • Part of subcall function 10004EC2: SetLastError.KERNEL32(?,00000001,00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000), ref: 10004EFE
                    • _wcsncpy.LIBCMT ref: 10016EBE
                    • _memmove.LIBCMT ref: 10016F4D
                    • _memmove.LIBCMT ref: 10016F72
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast_memmove$FreeH_prolog3_String_wcsncpy
                    • String ID:
                    • API String ID: 3422716067-0
                    • Opcode ID: 2164a0546e10aa1aacb9fcb5a4a2f64ac4b6de32575bb0cc42f051d358b8d427
                    • Instruction ID: c62cbe6a04c03e844d1fe9bbc59e8cdb73f1c85bdede0eb3dbbb5110fca4141a
                    • Opcode Fuzzy Hash: 2164a0546e10aa1aacb9fcb5a4a2f64ac4b6de32575bb0cc42f051d358b8d427
                    • Instruction Fuzzy Hash: 17515F75D003298BEB24DFA4DC91BEAB7B5FF44300F1086AAE5099B181DB74AA85CF51
                    Function 100596A5 Relevance: 6.1, APIs: 4, Instructions: 143COMMON
                    Download Yara Rule
                    APIs
                    • _memmove.LIBCMT ref: 10059718
                    • _memmove.LIBCMT ref: 10059751
                    • _memmove.LIBCMT ref: 10059789
                    • _memmove.LIBCMT ref: 100597B2
                      • Part of subcall function 10051E71: std::exception::exception.LIBCMT ref: 10051E84
                      • Part of subcall function 10051E71: __CxxThrowException@8.LIBCMT ref: 10051E99
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: _memmove$Exception@8Throwstd::exception::exception
                    • String ID:
                    • API String ID: 1300846289-0
                    • Opcode ID: 1f796835635c7dde674308f459f21a590493e10eb7f5c32a15f2216376b7e39c
                    • Instruction ID: 35c9013fa4fabdb1b1e0d495ea22a648a648f702cfbf5dd6cb8bd31743b579ea
                    • Opcode Fuzzy Hash: 1f796835635c7dde674308f459f21a590493e10eb7f5c32a15f2216376b7e39c
                    • Instruction Fuzzy Hash: BF41E572E10215ABD710CFA8CC86AABB7A9FB45250F048629E924E7641D774FD58CBD0
                    Function 10014169 Relevance: 6.1, APIs: 4, Instructions: 141COMMON
                    Download Yara Rule
                    APIs
                    • _memmove.LIBCMT ref: 100141D9
                    • _memmove.LIBCMT ref: 10014212
                    • _memmove.LIBCMT ref: 1001424A
                    • _memmove.LIBCMT ref: 10014273
                      • Part of subcall function 10051E71: std::exception::exception.LIBCMT ref: 10051E84
                      • Part of subcall function 10051E71: __CxxThrowException@8.LIBCMT ref: 10051E99
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: _memmove$Exception@8Throwstd::exception::exception
                    • String ID:
                    • API String ID: 1300846289-0
                    • Opcode ID: cb8e08bed85e4b9d5b03289d355e976f9e29c807bed7ea554eac42260911d449
                    • Instruction ID: 2e48c91a603c5b333f80900e30c6435362c1442e0521d2784f532b3aeebc6a82
                    • Opcode Fuzzy Hash: cb8e08bed85e4b9d5b03289d355e976f9e29c807bed7ea554eac42260911d449
                    • Instruction Fuzzy Hash: 0341E6B2D00625ABD714CFA8CC86A9EB7A9FB40210F158729F924E7681D774FD94C7D0
                    Function 10044BD6 Relevance: 6.1, APIs: 4, Instructions: 135COMMON
                    Download Yara Rule
                    APIs
                    • _memmove.LIBCMT ref: 10044C46
                    • _memmove.LIBCMT ref: 10044C7F
                    • _memmove.LIBCMT ref: 10044CB7
                    • _memmove.LIBCMT ref: 10044CE0
                      • Part of subcall function 10051E71: std::exception::exception.LIBCMT ref: 10051E84
                      • Part of subcall function 10051E71: __CxxThrowException@8.LIBCMT ref: 10051E99
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: _memmove$Exception@8Throwstd::exception::exception
                    • String ID:
                    • API String ID: 1300846289-0
                    • Opcode ID: ae3d8c7c1d50fc88a7790e50ece79d4f24acaad15e37da459ac29b4c07e8b4bc
                    • Instruction ID: ec4784f7288e0a67a6886096b8203a7332394b5b02eeeb797d3316484886d2f6
                    • Opcode Fuzzy Hash: ae3d8c7c1d50fc88a7790e50ece79d4f24acaad15e37da459ac29b4c07e8b4bc
                    • Instruction Fuzzy Hash: D541E5B2D00629ABD710CF58CC86A9FB7A9EB40210F158639F924E7641D774FE54CBD4
                    Function 100203C0 Relevance: 6.1, APIs: 4, Instructions: 131COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 100203C7
                    • SysFreeString.OLEAUT32(00000000), ref: 100204BF
                    • SysStringLen.OLEAUT32(00000000), ref: 100204CC
                    • SysFreeString.OLEAUT32(?), ref: 100204F0
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: String$Free$H_prolog3
                    • String ID:
                    • API String ID: 2834181473-0
                    • Opcode ID: 30a86754bf852d4ad09b262642cdd59e7e3367d19b6247662d74b7170e886912
                    • Instruction ID: 7139d61a22a86fdfdb9c1ceb2e67eba27de8abc984aeb952dd2043e89e86e974
                    • Opcode Fuzzy Hash: 30a86754bf852d4ad09b262642cdd59e7e3367d19b6247662d74b7170e886912
                    • Instruction Fuzzy Hash: D34149B1A0021AEFDB48DFA4D8859AEBBF5FF48350B10811AF915EB251D734DA41CFA4
                    Function 1000D92B Relevance: 6.1, APIs: 4, Instructions: 122COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1000D932
                    • _strlen.LIBCMT ref: 1000D962
                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000048,1000D902,100C90D8,?,00000000,00000000,?,00000000,0000003C,10003DD9), ref: 1000D97E
                    • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000), ref: 1000D9B0
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ByteCharMultiWide$H_prolog3__strlen
                    • String ID:
                    • API String ID: 708778256-0
                    • Opcode ID: 648a380f18d979a9073e9a52e17834fce4bf8261c651e2a6ee5b0876ef343667
                    • Instruction ID: de990fe3ad10ecff621fd28b89ffb9cc2b2b3f6907a72147ded40a778eb24657
                    • Opcode Fuzzy Hash: 648a380f18d979a9073e9a52e17834fce4bf8261c651e2a6ee5b0876ef343667
                    • Instruction Fuzzy Hash: 7C319F76D04214AFEB10DFA8DC91AEEB7B8EF49390F14012AF915A72C5DB74AD018B61
                    Function 10014CB1 Relevance: 6.1, APIs: 4, Instructions: 122COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 10014CB8
                    • _strlen.LIBCMT ref: 10014CE8
                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000048,10014C88,100C90E8,?,00000000,00000000,?,00000000,0000003C,10011CE5), ref: 10014D04
                    • MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 10014D36
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ByteCharMultiWide$H_prolog3__strlen
                    • String ID:
                    • API String ID: 708778256-0
                    • Opcode ID: c4e42c1af700c4a84b572590ce16ecf3728a841da953acd6d273e6d199ce8c4e
                    • Instruction ID: bba596d31170faf49b5f0ccf229d493f23645d9590275c8f6b158909746fbb16
                    • Opcode Fuzzy Hash: c4e42c1af700c4a84b572590ce16ecf3728a841da953acd6d273e6d199ce8c4e
                    • Instruction Fuzzy Hash: 9A319D79D00218AFEB10DBA8EC91AEEB7B8EF45350F150129F905AB291DF74AD458B60
                    Function 10077640 Relevance: 6.1, APIs: 4, Instructions: 115libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • GetLastError.KERNEL32(AD4A72FF,?,100134B4), ref: 1007767D
                    • SetLastError.KERNEL32(?), ref: 100776AD
                      • Part of subcall function 10003BE6: __EH_prolog3.LIBCMT ref: 10003BED
                      • Part of subcall function 10003BE6: GetLastError.KERNEL32(00000004,10003F3B,00000000,?,00000000,?), ref: 10003C0F
                      • Part of subcall function 10003BE6: SetLastError.KERNEL32(00000000,00000000,?), ref: 10003C48
                      • Part of subcall function 1005E075: __EH_prolog3_GS.LIBCMT ref: 1005E07C
                    • LoadLibraryW.KERNEL32(-00000004,?,00000000), ref: 10077771
                    • GetProcAddress.KERNEL32(?,100D48F8), ref: 100777B8
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$AddressH_prolog3H_prolog3_LibraryLoadProc
                    • String ID:
                    • API String ID: 2791025668-0
                    • Opcode ID: 4c3733ac9d4e78f04258378b972f8f6449d979b400c531934505be8540864ac8
                    • Instruction ID: 502c68e9b13daba65c79d66ebeacb69e873b57d1b400e239889097c9820580a0
                    • Opcode Fuzzy Hash: 4c3733ac9d4e78f04258378b972f8f6449d979b400c531934505be8540864ac8
                    • Instruction Fuzzy Hash: 56515AB4904A96EFE744CF65C988B9ABBF4FF08304F10815DD50987A80DB79B528CF94
                    Function 1003BA2A Relevance: 6.1, APIs: 4, Instructions: 108COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID:
                    • API String ID: 431132790-0
                    • Opcode ID: b264aa92f93d197d53619a47c6ccc4d69f6cb75abcacb1740bbaa7b13e82e7e7
                    • Instruction ID: 6ea5fb87028a34979767e05554c0d63aac86a94f542ff23b2f2139ae414c8bd1
                    • Opcode Fuzzy Hash: b264aa92f93d197d53619a47c6ccc4d69f6cb75abcacb1740bbaa7b13e82e7e7
                    • Instruction Fuzzy Hash: 3741BE31900A1AEFCB12CF64C844A9EBBB4EF44369F118159ED55DF290DB71EE01CB90
                    Function 1003BB4B Relevance: 6.1, APIs: 4, Instructions: 107COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: H_prolog3
                    • String ID:
                    • API String ID: 431132790-0
                    • Opcode ID: 446e4f6ed654ccf9c26f9327e73264e69cda8a0f26269e1e5ab0d5a53fb61f96
                    • Instruction ID: abc9d615f971bad9c8edc8e2af171080e033481cff6723dca16b0436ddc302b4
                    • Opcode Fuzzy Hash: 446e4f6ed654ccf9c26f9327e73264e69cda8a0f26269e1e5ab0d5a53fb61f96
                    • Instruction Fuzzy Hash: C9419C31900A5AEFCB16CF64C894A9E7BB4EF45329F11C159ED19DF290DB35DA01CB80
                    Function 1001FBF7 Relevance: 6.1, APIs: 4, Instructions: 106COMMON
                    Download Yara Rule
                    APIs
                    • GetClientRect.USER32(?,00000000), ref: 1001FCC0
                    • GetClientRect.USER32(?,?), ref: 1001FCC8
                    • CreateAcceleratorTableW.USER32(?,00000001), ref: 1001FCE2
                    • GetParent.USER32(?), ref: 1001FD06
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ClientRect$AcceleratorCreateParentTable
                    • String ID:
                    • API String ID: 2716292469-0
                    • Opcode ID: ae6c441fa54d2344e9c768ac057da1d5d603eb30a5d242737fb45c8eeda6b2cb
                    • Instruction ID: 284c2d6c310be37206de4f51a9127078b5daa3685e12b50bfd63d2fc2b679426
                    • Opcode Fuzzy Hash: ae6c441fa54d2344e9c768ac057da1d5d603eb30a5d242737fb45c8eeda6b2cb
                    • Instruction Fuzzy Hash: C9414F7260061AAFDB40CF64D985BAAB7E9FF18358F008429F905DB610D775E994CBD0
                    Function 1004EFD1 Relevance: 6.1, APIs: 4, Instructions: 106COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1004EFD8
                      • Part of subcall function 100171EC: GetDC.USER32(?), ref: 1001720F
                      • Part of subcall function 100171EC: CreateCompatibleDC.GDI32(00000000), ref: 1001723C
                      • Part of subcall function 100171EC: CreateCompatibleBitmap.GDI32(00000003,?,00000000), ref: 1001724D
                      • Part of subcall function 100171EC: SelectObject.GDI32(00000000,00000000), ref: 10017257
                      • Part of subcall function 100171EC: DeleteObject.GDI32(00000000), ref: 1001727F
                      • Part of subcall function 100171EC: SelectObject.GDI32(00000000,?), ref: 1001728C
                      • Part of subcall function 100171EC: DeleteObject.GDI32(00000000), ref: 10017293
                      • Part of subcall function 100171EC: ReleaseDC.USER32(?,00000003), ref: 1001729F
                    • LoadImageW.USER32(00000000,-00000004,00000000,00000000,00000000,00000010), ref: 1004F0B0
                    • GetObjectW.GDI32(00000000,00000018,?), ref: 1004F0D3
                    • DeleteObject.GDI32(00000000), ref: 1004F108
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Object$Delete$CompatibleCreateSelect$BitmapH_prolog3_ImageLoadRelease
                    • String ID:
                    • API String ID: 2061247475-0
                    • Opcode ID: a42ab76c3e44f61de662da2d249fcd5d9930756b685c2f6f0449f9331f561c98
                    • Instruction ID: 172e8127d9a6ac45488751633265bdd2d5e1a2e359865f3974b34829d2de339e
                    • Opcode Fuzzy Hash: a42ab76c3e44f61de662da2d249fcd5d9930756b685c2f6f0449f9331f561c98
                    • Instruction Fuzzy Hash: 8231D275911218EBEB21DBB0CC99EEE7B78FF44300F10451AF616AA192DF70AA01EB10
                    Function 1001619F Relevance: 6.1, APIs: 4, Instructions: 99libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_catch_GS.LIBCMT ref: 100161A6
                      • Part of subcall function 1006472E: GetModuleHandleW.KERNEL32(100D3E90,100D3EA4,?,?,?,100161C2,00000048,10016958,?,?,?,?), ref: 10064741
                      • Part of subcall function 1006472E: GetProcAddress.KERNEL32(00000000), ref: 10064748
                      • Part of subcall function 1006472E: GetCurrentProcess.KERNEL32(00000000,?,?,?,100161C2,00000048,10016958,?,?,?,?), ref: 10064758
                    • GetProcAddress.KERNEL32(00000000,100C9BDC), ref: 1001628C
                      • Part of subcall function 1000EA30: SysStringLen.OLEAUT32(00000024), ref: 1000EA3D
                      • Part of subcall function 1000EA30: SysReAllocStringLen.OLEAUT32(00000024,00000004,?), ref: 1000EA57
                      • Part of subcall function 1000EA8B: SysStringLen.OLEAUT32(?), ref: 1000EA98
                      • Part of subcall function 1000EA8B: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 1000EAB2
                      • Part of subcall function 10001123: GetLastError.KERNEL32(00000000,100C90D4,10005872,100C90D8,100C90D4,?,00000000,100C90D4,?,00000000), ref: 10001131
                      • Part of subcall function 10001123: SysFreeString.OLEAUT32(?), ref: 10001145
                      • Part of subcall function 10001123: SetLastError.KERNEL32(?,00000001,00000000), ref: 1000115F
                    • _wcsncpy.LIBCMT ref: 10016249
                    • SysFreeString.OLEAUT32(?), ref: 1001625C
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: String$AddressAllocErrorFreeLastProc$CurrentH_prolog3_catch_HandleModuleProcess_wcsncpy
                    • String ID:
                    • API String ID: 3396369990-0
                    • Opcode ID: 7fdfee6ee164ffbe0ff89e8437f63bfb4132eac0b137342d2c6397d88a17bce9
                    • Instruction ID: 9c82e92244e846f6edbaf2e7c5e6229ac83e3bb08cb76e10e6bd1c3fa9741540
                    • Opcode Fuzzy Hash: 7fdfee6ee164ffbe0ff89e8437f63bfb4132eac0b137342d2c6397d88a17bce9
                    • Instruction Fuzzy Hash: CC318C35D00659EFDB11DBE4CD85BDEB7B8EF09340F144069E801AB252DB75AE86CBA0
                    Function 100A6BA0 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 100A6BD4
                    • __isleadbyte_l.LIBCMT ref: 100A6C02
                    • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 100A6C30
                    • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 100A6C66
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                    • String ID:
                    • API String ID: 3058430110-0
                    • Opcode ID: 704cb36564ea17be934eff1d5983493e9149dbe7dd2396fa86f1adbb09278632
                    • Instruction ID: 2f6bbeaf8f17cf4b087036e859fb875e8a727dac5a4ded66ba00285c9619ec05
                    • Opcode Fuzzy Hash: 704cb36564ea17be934eff1d5983493e9149dbe7dd2396fa86f1adbb09278632
                    • Instruction Fuzzy Hash: EB31B231600256EFDB11CFB5CC44BAA7BF5FF89360F114429E8A1971A0D730E990DB50
                    Function 100721C0 Relevance: 6.1, APIs: 4, Instructions: 95COMMON
                    Download Yara Rule
                    APIs
                    • GetLastError.KERNEL32(?,?,00000000,?,10077EAC,?,?), ref: 100721E7
                    • SysFreeString.OLEAUT32(?), ref: 10072203
                    • SysFreeString.OLEAUT32(00000004), ref: 1007220E
                    • SetLastError.KERNEL32(?), ref: 1007222C
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorFreeLastString
                    • String ID:
                    • API String ID: 3822639702-0
                    • Opcode ID: 15106ed6e7d8014389008d9fde243bb247285184706f26242950addb5754e201
                    • Instruction ID: 9a491583fc92b055c0793f94e8a57064ec1a8c850e5d7258e5c75df4f89f8b46
                    • Opcode Fuzzy Hash: 15106ed6e7d8014389008d9fde243bb247285184706f26242950addb5754e201
                    • Instruction Fuzzy Hash: 0A416D71900291AFEB51CF28C484B05BBE5FF05394F1AC0A9E8899B263C775FD96CB84
                    Function 10092D97 Relevance: 6.1, APIs: 4, Instructions: 90COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: _wcsnlen
                    • String ID:
                    • API String ID: 3628947076-0
                    • Opcode ID: 245627dc547bd751365ead13ab973f8c4facc80f89baeea35a72fa8cb2196fd6
                    • Instruction ID: afd24a7f03ab65dc360466b80816b94793ceec1458b79b3aa70e22209278b859
                    • Opcode Fuzzy Hash: 245627dc547bd751365ead13ab973f8c4facc80f89baeea35a72fa8cb2196fd6
                    • Instruction Fuzzy Hash: 6221E435604208AEEB40DBA4DC45FAF73ECDB856A0F214065FD0DCA1C1EA71EE40AB90
                    Function 1004043F Relevance: 6.1, APIs: 4, Instructions: 88COMMON
                    Download Yara Rule
                    APIs
                    • _Ucopy.LIBCPMT ref: 100404A2
                      • Part of subcall function 1004096D: _memmove.LIBCMT ref: 10040981
                    • _Ucopy.LIBCPMT ref: 100404BE
                    • _Ucopy.LIBCPMT ref: 100404B0
                      • Part of subcall function 1004094A: _memmove.LIBCMT ref: 1004095E
                    • _Ucopy.LIBCPMT ref: 100404F7
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Ucopy$_memmove
                    • String ID:
                    • API String ID: 554287086-0
                    • Opcode ID: 69f0918e0d8e2070cc1ca4982ccaf6fcf60b5b12d5f4b646b95d8fda77f404e4
                    • Instruction ID: f56c206d71d8d2adc775b9d4fc8e879a00448677e6f78952f06b54350ca875e6
                    • Opcode Fuzzy Hash: 69f0918e0d8e2070cc1ca4982ccaf6fcf60b5b12d5f4b646b95d8fda77f404e4
                    • Instruction Fuzzy Hash: 5E218DBAA0010AAFDB15CF68CC45D6EBBA9FF44310B244629F815E7651DB32FD20CB94
                    Function 10015AF0 Relevance: 6.1, APIs: 4, Instructions: 83COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 10015AFA
                    • __CxxThrowException@8.LIBCMT ref: 10015B5E
                    • SetFilePointer.KERNEL32(?,?,?,?,00000108,10015734,00000000,00000000,00000000,00000000,00000000,00000010,10015912,00000000,00000000,100FBAB8), ref: 10015B6A
                    • GetLastError.KERNEL32 ref: 10015BBD
                      • Part of subcall function 10003AA0: __EH_prolog3.LIBCMT ref: 10003AA7
                      • Part of subcall function 10003AA0: GetLastError.KERNEL32(00000004,100049CB,0000005C,00000000,00000000,00000000,?,1000DB12,00000000,00000001,00000000,?,000000FF,00000001,00000048,1000E682), ref: 10003AC9
                      • Part of subcall function 10003AA0: SetLastError.KERNEL32(?,00000000,?,1000DB12,00000000,00000001,00000000,?,000000FF,00000001,00000048,1000E682,?), ref: 10003B01
                      • Part of subcall function 1001227A: __EH_prolog3.LIBCMT ref: 10012281
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$H_prolog3$Exception@8FileH_prolog3_PointerThrow
                    • String ID:
                    • API String ID: 2919269545-0
                    • Opcode ID: 5e6612fb89c1ff4edcd256c911971e3ebb78425a6e992c4f93acb722938255dc
                    • Instruction ID: 96d7c02d3d7048392994527c40b636a4468cf371bec45081123ccc5cfe7ce754
                    • Opcode Fuzzy Hash: 5e6612fb89c1ff4edcd256c911971e3ebb78425a6e992c4f93acb722938255dc
                    • Instruction Fuzzy Hash: 96314D75900228EFDB14DFA4CD85FDEB778FF04310F404299E652AB180EB71AA45CB91
                    Function 10050480 Relevance: 6.1, APIs: 4, Instructions: 79stringCOMMON
                    Download Yara Rule
                    APIs
                    • InvalidateRect.USER32(?,00000000,00000001), ref: 10050546
                      • Part of subcall function 1004F7DB: _memset.LIBCMT ref: 1004F7F9
                      • Part of subcall function 1004F7DB: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1004F838
                      • Part of subcall function 1004F7DB: _memset.LIBCMT ref: 1004F85A
                    • lstrcatW.KERNEL32(?,100CDC5C), ref: 100504E6
                    • lstrcatW.KERNEL32(?,100FB980), ref: 100504F1
                    • SetWindowTextW.USER32(?,?), ref: 100504FD
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: _memsetlstrcat$InvalidateRectTextUnothrow_t@std@@@Window__ehfuncinfo$??2@
                    • String ID:
                    • API String ID: 2562388530-0
                    • Opcode ID: e91433a2a26d6ac4ccb138633f2d60bd19e966395b5b6c544e3f585109580823
                    • Instruction ID: 7f1ace8d91e918786f4f6c86b5d9c2998228458e68d11655ce74c9d0edc7de31
                    • Opcode Fuzzy Hash: e91433a2a26d6ac4ccb138633f2d60bd19e966395b5b6c544e3f585109580823
                    • Instruction Fuzzy Hash: 01215CB5A00519BBDB00EFB4CC89EEEBBBCFF48740F000129F604A6151DB75A955DB90
                    Function 1004B5F1 Relevance: 6.1, APIs: 4, Instructions: 75stringCOMMON
                    Download Yara Rule
                    APIs
                    • GetDlgItem.USER32(?,?), ref: 1004B5FF
                      • Part of subcall function 1008ABD5: _malloc.LIBCMT ref: 1008ABED
                      • Part of subcall function 1004ABF9: _memset.LIBCMT ref: 1004AC06
                    • lstrlenW.KERNEL32(?), ref: 1004B659
                    • lstrcpyW.KERNEL32(?,?), ref: 1004B68A
                    • lstrcpyW.KERNEL32(00000000,?), ref: 1004B690
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: lstrcpy$Item_malloc_memsetlstrlen
                    • String ID:
                    • API String ID: 4280845979-0
                    • Opcode ID: 7a3c228b9f3675464c0004d64bb04725265d106134339c971e49796640d1b3f3
                    • Instruction ID: 266b841bb9cffd3fc117953ce4da9a6fe4c02e97bbdfdcd446b774bdd9dfb321
                    • Opcode Fuzzy Hash: 7a3c228b9f3675464c0004d64bb04725265d106134339c971e49796640d1b3f3
                    • Instruction Fuzzy Hash: 0E21EB36600606BFDB04DF75DC49A6BBBA9FF48260F21023AF928C6151DF34A451DB94
                    Function 100418F4 Relevance: 6.1, APIs: 4, Instructions: 75stringCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 10043B10: __EH_prolog3_GS.LIBCMT ref: 10043B1A
                      • Part of subcall function 10043B10: IsWindow.USER32(?), ref: 10043B96
                      • Part of subcall function 10043B10: GetClassNameW.USER32(?,00000000,00000100), ref: 10043C01
                    • GetClassNameW.USER32(?,?,00000100), ref: 1004194E
                    • lstrcmpiW.KERNEL32(?,100CCDA4), ref: 10041966
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ClassName$H_prolog3_Windowlstrcmpi
                    • String ID:
                    • API String ID: 1661564607-0
                    • Opcode ID: e985d4f3be39d2328048f6df76bfcbbdf7b0b57bfb4adb74f6984c48ef2358a3
                    • Instruction ID: 49736187284b1aaf09ab4c8fc41eef8856b3a623b5ff5b675ef907da6a60274b
                    • Opcode Fuzzy Hash: e985d4f3be39d2328048f6df76bfcbbdf7b0b57bfb4adb74f6984c48ef2358a3
                    • Instruction Fuzzy Hash: E521E47570461AA7EB24DA79AC64ACEB3D8EB04394F310273EAA0D7280D730EE549758
                    Function 1001579E Relevance: 6.1, APIs: 4, Instructions: 69fileCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 100157A8
                      • Part of subcall function 100154F3: __EH_prolog3_GS.LIBCMT ref: 100154FA
                      • Part of subcall function 10014DF4: __EH_prolog3_GS.LIBCMT ref: 10014DFB
                      • Part of subcall function 1000EA8B: SysStringLen.OLEAUT32(?), ref: 1000EA98
                      • Part of subcall function 1000EA8B: SysReAllocStringLen.OLEAUT32(?,00000001,?), ref: 1000EAB2
                    • GetTempFileNameW.KERNEL32(00000004,-00000004,00000000,?,?,?,?,00000104,00000090,1001352F,?,00000000), ref: 10015815
                    • __CxxThrowException@8.LIBCMT ref: 10015858
                    • DeleteFileW.KERNEL32(?,?,?,?,?,00000104,00000090,1001352F,?,00000000), ref: 1001586C
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: H_prolog3_$FileString$AllocDeleteException@8NameTempThrow
                    • String ID:
                    • API String ID: 2639571246-0
                    • Opcode ID: 7dba95ffd9c7d348f75343172c406c99b3b58e60a0153592f9d19acb44192a28
                    • Instruction ID: 33b89be23d2a563f69d81de5f1842fa178453ab085b007b4e4b8fe0796c1915d
                    • Opcode Fuzzy Hash: 7dba95ffd9c7d348f75343172c406c99b3b58e60a0153592f9d19acb44192a28
                    • Instruction Fuzzy Hash: D6219874A11244DFDB14DBA8C899B9DB7B5FF04301F1445A9E206AF292EF70EE49CB60
                    Function 10015C2E Relevance: 6.1, APIs: 4, Instructions: 66COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 10015C38
                    • __CxxThrowException@8.LIBCMT ref: 10015C9D
                    • GetFileSize.KERNEL32(?,?,00000108,1001564D,00000000,00000010,10015912,00000000,00000000,100FBAB8,00000000,00000000,00000000,00000021), ref: 10015CA6
                    • GetLastError.KERNEL32 ref: 10015CB3
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorException@8FileH_prolog3_LastSizeThrow
                    • String ID:
                    • API String ID: 4197087271-0
                    • Opcode ID: 32d6977da0226476375537495f1b58ca8892f40c3f73d1b7be53d00c127fe465
                    • Instruction ID: 7180aab12d40a03a81a4b50aa11d86e8e17d3de3e6fccac7e6e6a8792d0c4540
                    • Opcode Fuzzy Hash: 32d6977da0226476375537495f1b58ca8892f40c3f73d1b7be53d00c127fe465
                    • Instruction Fuzzy Hash: 8A21A475900629EFDB10DFA4CD81ADDB7B8FF04310F40026AE912AB180DB71EE41CB91
                    Function 10039E1E Relevance: 6.1, APIs: 4, Instructions: 62libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 10039E25
                      • Part of subcall function 10039A46: __EH_prolog3_GS.LIBCMT ref: 10039A50
                      • Part of subcall function 10039A46: LoadLibraryW.KERNEL32(100CC1BC,000000C8,10039E3D,00000054,100398BB,00000058,10038F62,?,00000000,?,00000000,?,00000000,00000004,1003AC7F,?), ref: 10039A5C
                      • Part of subcall function 10039A46: GetProcAddress.KERNEL32(00000000,100CC1F0), ref: 10039A70
                    • LoadLibraryW.KERNEL32(100CC1BC), ref: 10039E52
                    • __CxxThrowException@8.LIBCMT ref: 10039E6F
                    • GetProcAddress.KERNEL32(00000000,100CC1D4), ref: 10039E7A
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: AddressH_prolog3_LibraryLoadProc$Exception@8Throw
                    • String ID:
                    • API String ID: 1030482162-0
                    • Opcode ID: 7fb843e14db9801e313a4f726e51472a6cddc1b57632213bcf02b2319190e477
                    • Instruction ID: 0fee1ea913fd1b27a2ad552c0cf300651396d4f47502af454ba42f518c9f5c11
                    • Opcode Fuzzy Hash: 7fb843e14db9801e313a4f726e51472a6cddc1b57632213bcf02b2319190e477
                    • Instruction Fuzzy Hash: 0E118874A00209EFDB15DBA0CD99F9EB7B5FF04302F100859F606AB192EB74AE46CB45
                    Function 1004DE50 Relevance: 6.1, APIs: 4, Instructions: 62windowCOMMON
                    Download Yara Rule
                    APIs
                    • CreateCompatibleDC.GDI32(1004FC44), ref: 1004DEAB
                    • SelectObject.GDI32(00000000,?), ref: 1004DEB7
                    • BitBlt.GDI32(1004FC44,00000000,C033FFFF,?,?,00000000,00000000,00000000,00CC0020), ref: 1004DED2
                    • DeleteDC.GDI32(00000000), ref: 1004DED9
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: CompatibleCreateDeleteObjectSelect
                    • String ID:
                    • API String ID: 3360107340-0
                    • Opcode ID: fc581e39cacb6dadd2336b14e7de911f5209661c93859cb0dc2a54a348c23ec5
                    • Instruction ID: 077f4136a56d6b78c6e9d7021f89c1635cd284925aefbbc39cedf03636a25320
                    • Opcode Fuzzy Hash: fc581e39cacb6dadd2336b14e7de911f5209661c93859cb0dc2a54a348c23ec5
                    • Instruction Fuzzy Hash: 57116D3250011AAFDB10DFA8CD86E9E7BB9FF44254F294064F904A6160E731EA16CB98
                    Function 070AE461 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 60COMMON
                    Download Yara Rule
                    APIs
                    • InitializeCriticalSection.KERNEL32(?), ref: 070AE4EA
                    • EnterCriticalSection.KERNEL32(?), ref: 070AE510
                    • LeaveCriticalSection.KERNEL32(?), ref: 070AE52B
                    • __malloc_dbg.LIBCMTD ref: 070AE584
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: CriticalSection$EnterInitializeLeave__malloc_dbg
                    • String ID: @
                    • API String ID: 676519209-2766056989
                    • Opcode ID: 1250078c7a2a6c9e4423951d99dbd14a2a741f5018ffe225239a5d16cec9ec02
                    • Instruction ID: 55fc163aba53809c072559db7728becaf5edfc347bb5b53d797f9f12082dc5a8
                    • Opcode Fuzzy Hash: 1250078c7a2a6c9e4423951d99dbd14a2a741f5018ffe225239a5d16cec9ec02
                    • Instruction Fuzzy Hash: 61211AB4D00249FFCF04DB94E596BADB7B2EF40309F298698E80567342E779AE50DB41
                    Function 100503E7 Relevance: 6.1, APIs: 4, Instructions: 57COMMON
                    Download Yara Rule
                    APIs
                    • ComponentViewSetInfo.ISRT(?,00000015,00000000,00000000), ref: 1005040C
                    • ComponentViewSetInfo.ISRT(?,00000014,00000000,00000000), ref: 10050420
                    • DeleteObject.GDI32(00000000), ref: 1005044C
                    • DeleteObject.GDI32(00000000), ref: 10050458
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ComponentDeleteInfoObjectView
                    • String ID:
                    • API String ID: 2346936532-0
                    • Opcode ID: b84fb17b53eb14b304445aeaa9e42ac1b4719a0efedd327c0abd0c9fd5490001
                    • Instruction ID: 2e4d01ac380262359a0e0248d62db4081458ddb9590c425b01ee7fdb60989ae4
                    • Opcode Fuzzy Hash: b84fb17b53eb14b304445aeaa9e42ac1b4719a0efedd327c0abd0c9fd5490001
                    • Instruction Fuzzy Hash: 9801C0B1600A1567EB10EB7A8C88E4F77DDEB81BA0B11801AF611D3190DAB4E804DE61
                    Function 100137ED Relevance: 6.1, APIs: 4, Instructions: 56COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 100137F4
                      • Part of subcall function 1000380E: __EH_prolog3.LIBCMT ref: 10003815
                      • Part of subcall function 1000380E: GetLastError.KERNEL32(00000004,10002E96,?,00000000,00000004,10002ADC,00000000,?,00000008,10002A85,?,?,00000000,?,00000000,00000000), ref: 10003837
                      • Part of subcall function 1000380E: SetLastError.KERNEL32(100C90E0,00000000,?,?,1000C93A,?,0000000E,00000000,00000010,1000CA32,00000000,0000000E,?,?,?), ref: 1000386F
                    • IsWindow.USER32(?), ref: 1001384A
                    • IsWindow.USER32(?), ref: 1001387A
                    • EnableWindow.USER32(?,00000000), ref: 1001388B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Window$ErrorLast$EnableH_prolog3H_prolog3_
                    • String ID:
                    • API String ID: 380292646-0
                    • Opcode ID: fbf849ea7bacc023010aa298faf938a959131a40bbc96832922d86d77b7353a1
                    • Instruction ID: a375f75572506cf598d32b1b33403342f7f8f69453109f8d406afce49394604c
                    • Opcode Fuzzy Hash: fbf849ea7bacc023010aa298faf938a959131a40bbc96832922d86d77b7353a1
                    • Instruction Fuzzy Hash: 63115678900645EFEB05DBA0C885BEEB7B4FF00280F4484ACF556AB161DF70AA85CB90
                    Function 100714F0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 53COMMON
                    Download Yara Rule
                    APIs
                    • GetLastError.KERNEL32(AD4A72FF,00000000,`cu,00000004,100C5938,000000FF,?,10078CF6,00000004,00000004,00000000,00000004,AD4A72FF), ref: 10071526
                    • SetLastError.KERNEL32(?,00000000,00000000,000000FF,?,10078CF6,00000004,00000004,00000000,00000004,AD4A72FF), ref: 10071582
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast
                    • String ID: `cu$`cu
                    • API String ID: 1452528299-1913218207
                    • Opcode ID: 7683a489497655b49e4b33136c9103542cf57038dfa4a3b16bd5f353dfa831b9
                    • Instruction ID: c8b9040d74ecf51c3f77bde4126bf9c1a8821b918606f9db6eb743417de78a8f
                    • Opcode Fuzzy Hash: 7683a489497655b49e4b33136c9103542cf57038dfa4a3b16bd5f353dfa831b9
                    • Instruction Fuzzy Hash: BC1134B5504A14EFE714CF18C944B9ABBF8FF08724F10869EE85A877A0D775E901CB94
                    Function 1005B874 Relevance: 6.1, APIs: 4, Instructions: 51libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • GetModuleHandleW.KERNEL32(100D2F68,100D41D4,?,00000000,?,10015900,?,?,?,100C9110,?,?,00000008,?,00000000,1005451E), ref: 1005B88A
                    • GetProcAddress.KERNEL32(00000000), ref: 1005B88D
                    • GetModuleHandleW.KERNEL32(100D2F68,100D41E0,?,00000000,?,10015900,?,?,?,100C9110,?,?,00000008,?,00000000,1005451E), ref: 1005B8C2
                    • GetProcAddress.KERNEL32(00000000), ref: 1005B8C5
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: AddressHandleModuleProc
                    • String ID:
                    • API String ID: 1646373207-0
                    • Opcode ID: 6db8423316138ffde29bc5a17256e9feb72972c182dae65d5aa4379e46b238c7
                    • Instruction ID: c0342119abf99e467882e07b17865a50990f1c6a1202ae629b77d03decab3b2c
                    • Opcode Fuzzy Hash: 6db8423316138ffde29bc5a17256e9feb72972c182dae65d5aa4379e46b238c7
                    • Instruction Fuzzy Hash: 06014C32800369BBDF018FA4DC44CEE3F6AFF082647055519FE1556260CB36D920DFA0
                    Function 1007CCA0 Relevance: 6.1, APIs: 4, Instructions: 51COMMON
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorFreeLastString
                    • String ID:
                    • API String ID: 3822639702-0
                    • Opcode ID: 4b46e768cdc95dced13dda790ce173d1bdad92120f203c3674fd559f2397d270
                    • Instruction ID: 0e163266900aae24172cc1130cd4fbc4f94207c94c22e6fd7d59872ea8e29568
                    • Opcode Fuzzy Hash: 4b46e768cdc95dced13dda790ce173d1bdad92120f203c3674fd559f2397d270
                    • Instruction Fuzzy Hash: 5111A0B1900214AFEB05CF68CDC4A467FA5FF49224F1581A9ED095B227C732ED60CB94
                    Function 1007CD40 Relevance: 6.1, APIs: 4, Instructions: 51COMMON
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorFreeLastString
                    • String ID:
                    • API String ID: 3822639702-0
                    • Opcode ID: cd43ecfff9fcb6c3957a15da7bdc7295d755dc6e9d9b70d5518c12f1f6fd6458
                    • Instruction ID: fc82fce21c612b8303e2c6045f5e294846ab59a170989ad3cd5509e8504cfbbb
                    • Opcode Fuzzy Hash: cd43ecfff9fcb6c3957a15da7bdc7295d755dc6e9d9b70d5518c12f1f6fd6458
                    • Instruction Fuzzy Hash: 80117CB5900214AFDB14CF58DDC4A46BFA8FF49224F1581A9ED085B227D736ED60CB94
                    Function 1007CDE0 Relevance: 6.1, APIs: 4, Instructions: 51COMMON
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorFreeLastString
                    • String ID:
                    • API String ID: 3822639702-0
                    • Opcode ID: a86e213157b871842938bd0a955977e0ed9d80eeea7afb763369bb7430810ed3
                    • Instruction ID: d0091c88695e13734df3ef2ea708e6fe37d21767e0b3f7d810efab17081e9405
                    • Opcode Fuzzy Hash: a86e213157b871842938bd0a955977e0ed9d80eeea7afb763369bb7430810ed3
                    • Instruction Fuzzy Hash: 3111ACB1900214AFDB04CF18CDC4A46BFA8FF09324F1581A9EC099B227D732EDA0CB94
                    Function 1003EA1B Relevance: 6.0, APIs: 4, Instructions: 50COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 1003EA22
                    • _memset.LIBCMT ref: 1003EA38
                    • VariantInit.OLEAUT32(?), ref: 1003EA44
                      • Part of subcall function 1000EA30: SysStringLen.OLEAUT32(00000024), ref: 1000EA3D
                      • Part of subcall function 1000EA30: SysReAllocStringLen.OLEAUT32(00000024,00000004,?), ref: 1000EA57
                      • Part of subcall function 10001123: GetLastError.KERNEL32(00000000,100C90D4,10005872,100C90D8,100C90D4,?,00000000,100C90D4,?,00000000), ref: 10001131
                      • Part of subcall function 10001123: SysFreeString.OLEAUT32(?), ref: 10001145
                      • Part of subcall function 10001123: SetLastError.KERNEL32(?,00000001,00000000), ref: 1000115F
                    • VariantClear.OLEAUT32(?), ref: 1003EA9B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: String$ErrorLastVariant$AllocClearFreeH_prolog3_Init_memset
                    • String ID:
                    • API String ID: 2892416389-0
                    • Opcode ID: 5de15195ded70b52189ca0cb4078e7604f50705efc9e87217daf786933804f68
                    • Instruction ID: 83b7ae42f7bd3084cbd1c44b57e404a495099af71b5d798d85d1199cf8c28773
                    • Opcode Fuzzy Hash: 5de15195ded70b52189ca0cb4078e7604f50705efc9e87217daf786933804f68
                    • Instruction Fuzzy Hash: 81117C36900229AFDB01DBE0C945BED7778FF44711F108445F901AB285DB75AE09C7A1
                    Function 10095166 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                      • Part of subcall function 100957F8: __getptd_noexit.LIBCMT ref: 100957F9
                    • __lock.LIBCMT ref: 100951A3
                    • InterlockedDecrement.KERNEL32(?), ref: 100951C0
                    • _free.LIBCMT ref: 100951D3
                    • InterlockedIncrement.KERNEL32(067D4460), ref: 100951EB
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Interlocked$DecrementIncrement__getptd_noexit__lock_free
                    • String ID:
                    • API String ID: 2704283638-0
                    • Opcode ID: 072127dea02f364024a2b04000a2069aafcc5aa93edd96cbc1f598d2902d9eb7
                    • Instruction ID: 89af2b12050a275fdc97d7b6ad7d2dd821f223fa0b5035d0d210c2f6f1f38b47
                    • Opcode Fuzzy Hash: 072127dea02f364024a2b04000a2069aafcc5aa93edd96cbc1f598d2902d9eb7
                    • Instruction Fuzzy Hash: 76010C39E06725ABE711CB228846B4D73A0FF04BA2F120009E808A3280CB306D81FBD5
                    Function 100219D7 Relevance: 6.0, APIs: 4, Instructions: 45windowCOMMON
                    Download Yara Rule
                    APIs
                    • GetClientRect.USER32(?,?), ref: 10021A00
                    • BitBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00CC0020), ref: 10021A27
                    • DeleteDC.GDI32(?), ref: 10021A2E
                    • ReleaseDC.USER32(?,?), ref: 10021A3B
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ClientDeleteRectRelease
                    • String ID:
                    • API String ID: 2015589292-0
                    • Opcode ID: 20d62b1575207498c991727212fb568606b8c5b191681bbdad60ae2ce0e03f5c
                    • Instruction ID: 47c02e5eb72979ecdcf354505d915f322737fc77d6955e3a38788b35e0140cd2
                    • Opcode Fuzzy Hash: 20d62b1575207498c991727212fb568606b8c5b191681bbdad60ae2ce0e03f5c
                    • Instruction Fuzzy Hash: 24012932900218EFEB11DFA8CE48EAFBBF8FB48710F104459E901A2250C770AA05DB68
                    Function 1001C07F Relevance: 6.0, APIs: 4, Instructions: 45COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3.LIBCMT ref: 1001C086
                    • VariantInit.OLEAUT32(?), ref: 1001C0CD
                    • VariantChangeType.OLEAUT32(?,?,00000000,00000008), ref: 1001C0DC
                    • VariantClear.OLEAUT32(?), ref: 1001C0F9
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Variant$ChangeClearH_prolog3InitType
                    • String ID:
                    • API String ID: 2893332592-0
                    • Opcode ID: b59b9f06bc33e3715dfa7f4798aa9c262242a7522e71534208b273c9fd9d0a2d
                    • Instruction ID: 118c53dc01c2522c6e6a0e22273509f7902661b888e0d2f80d0e1f4ba82efb03
                    • Opcode Fuzzy Hash: b59b9f06bc33e3715dfa7f4798aa9c262242a7522e71534208b273c9fd9d0a2d
                    • Instruction Fuzzy Hash: E2014075900659EBDB21DF908849FDDB778FB08751F50440AF641AB180DBB9E688CBA4
                    Function 100149F1 Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 100149FB
                    • InterlockedDecrement.KERNEL32(00000000), ref: 10014A0B
                    • CloseHandle.KERNEL32(000000FF), ref: 10014A33
                    • __CxxThrowException@8.LIBCMT ref: 10014A79
                      • Part of subcall function 10014A90: InterlockedDecrement.KERNEL32(100FDAFC), ref: 10014AB5
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: DecrementInterlocked$CloseException@8H_prolog3_HandleThrow
                    • String ID:
                    • API String ID: 104201321-0
                    • Opcode ID: 8cdde845db344d09c63780be88a505ef9b6cd3e58805df0f10c50a21ec8cb2fd
                    • Instruction ID: cc29a45d589ccb12dec0590933255d500b0fc1303156e68ee587a335f0cc4321
                    • Opcode Fuzzy Hash: 8cdde845db344d09c63780be88a505ef9b6cd3e58805df0f10c50a21ec8cb2fd
                    • Instruction Fuzzy Hash: D9115A759406159EDB20CBA0C955BAA73B8FF00322F82851DE196968A0DB71A981CB41
                    Function 1009587F Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • __lock.LIBCMT ref: 100958C3
                      • Part of subcall function 1009205A: __mtinitlocknum.LIBCMT ref: 1009206C
                      • Part of subcall function 1009205A: RtlEnterCriticalSection.NTDLL(00000000), ref: 10092085
                    • InterlockedIncrement.KERNEL32(?), ref: 100958D0
                    • __lock.LIBCMT ref: 100958E4
                    • ___addlocaleref.LIBCMT ref: 10095902
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: __lock$CriticalEnterIncrementInterlockedSection___addlocaleref__mtinitlocknum
                    • String ID:
                    • API String ID: 1687444384-0
                    • Opcode ID: ae6739262b2855f830a3ebc29de4b8bbc12346cd021db7c5641dd56e4c05baeb
                    • Instruction ID: 21419533db677d02c0c0fdc58a52db0cbe652aaca06a3c20899a5d326016570f
                    • Opcode Fuzzy Hash: ae6739262b2855f830a3ebc29de4b8bbc12346cd021db7c5641dd56e4c05baeb
                    • Instruction Fuzzy Hash: BE012D75500B04DFE760CF66C906B4AB7E0FF44321F20890EE4AE972A1CBB4B644EB55
                    Function 1003B012 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: FreeString$H_prolog3
                    • String ID:
                    • API String ID: 3629739108-0
                    • Opcode ID: d213fe4456fab9fb227b0a82fab956c62f9b8b595733fc3c1af674a080ce7462
                    • Instruction ID: 3da86666aaa7282bec07f173ede6a187eea2a3f6cf6652526ca4d7131c4dc645
                    • Opcode Fuzzy Hash: d213fe4456fab9fb227b0a82fab956c62f9b8b595733fc3c1af674a080ce7462
                    • Instruction Fuzzy Hash: 15015A3460025AEFCF02DF64CC85AAE3F61FF18365F104554F9546B2A2CB719E25EB52
                    Function 1001DFC5 Relevance: 6.0, APIs: 4, Instructions: 35threadCOMMON
                    Download Yara Rule
                    APIs
                    • RaiseException.KERNEL32(C0000005,00000001,00000000,00000000,00000000,100FDA70,10023002,?,1001D72F,?,10023002,?,?,80004005,00000000,00000000), ref: 1001DFDD
                    • GetCurrentThreadId.KERNEL32 ref: 1001DFF3
                    • RtlEnterCriticalSection.NTDLL(10023006), ref: 1001E000
                    • RtlLeaveCriticalSection.NTDLL(10023006), ref: 1001E010
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: CriticalSection$CurrentEnterExceptionLeaveRaiseThread
                    • String ID:
                    • API String ID: 2662421713-0
                    • Opcode ID: ee6fd44ba1b462bafc0c04443ce9c45d17d65f559c9e99b9bab1388528caa037
                    • Instruction ID: 8e5420e3e6d8b040063131a9452db7a68cc44866c9212f44e43c6e21ebf58d29
                    • Opcode Fuzzy Hash: ee6fd44ba1b462bafc0c04443ce9c45d17d65f559c9e99b9bab1388528caa037
                    • Instruction Fuzzy Hash: C6F09075200315ABEB00AF65CDC8F86BBE8FF48B61F01802AFA048B201D770E6118FA0
                    Function 10037621 Relevance: 6.0, APIs: 4, Instructions: 33stringCOMMON
                    Download Yara Rule
                    APIs
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: lstrcpy$_wcschrlstrcpyn
                    • String ID:
                    • API String ID: 1599052328-0
                    • Opcode ID: faec97ef84196f3b833d1982efe4d87709a5da80173811aa669bc39cd757d217
                    • Instruction ID: 47bd8da4fb7bf5ccf78d9925a8dd7ff64af6cd48714c33053f2ef310f07a0b49
                    • Opcode Fuzzy Hash: faec97ef84196f3b833d1982efe4d87709a5da80173811aa669bc39cd757d217
                    • Instruction Fuzzy Hash: 98F0BE36004508FFDF099F18DD5ACAE3FA9FF84321B008019FD0A4A160DB32AA21DB44
                    Function 1008A0B0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON
                    Download Yara Rule
                    APIs
                    • GetDC.USER32(?), ref: 1008A0B9
                    • GetDeviceCaps.GDI32(00000000,0000000C), ref: 1008A0CA
                    • GetDeviceCaps.GDI32(00000000,0000000E), ref: 1008A0D1
                    • ReleaseDC.USER32(?,00000000), ref: 1008A0D9
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: CapsDevice$Release
                    • String ID:
                    • API String ID: 1035833867-0
                    • Opcode ID: 6af13f193daabd2164fffcf601cb6d32007135a0f39b6f95702497c4a85fc2f3
                    • Instruction ID: 2de87d2787f8203e471571a76a83a4fd215dfd347890367451fc1cddf5c64fae
                    • Opcode Fuzzy Hash: 6af13f193daabd2164fffcf601cb6d32007135a0f39b6f95702497c4a85fc2f3
                    • Instruction Fuzzy Hash: 6BE04F7290023C7BFB202B769D8ED9B7F5CEB442B0B060462FD08AB290D5719D518AE0
                    Function 1001F805 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                    Download Yara Rule
                    APIs
                    • GetParent.USER32(?), ref: 1001F810
                    • GetWindowRect.USER32(?,?), ref: 1001F81F
                    • ScreenToClient.USER32(00000000,?), ref: 1001F82D
                    • ScreenToClient.USER32(00000000,?), ref: 1001F838
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ClientScreen$ParentRectWindow
                    • String ID:
                    • API String ID: 2099118873-0
                    • Opcode ID: 5e805b72707840716e6618e5d2055da09ca331ad1a5906037246162b165b9f95
                    • Instruction ID: 323cdebbf1a5ac9804bab1a85a7fed9082e3cf35b7a20c49a5877660ac4e51c7
                    • Opcode Fuzzy Hash: 5e805b72707840716e6618e5d2055da09ca331ad1a5906037246162b165b9f95
                    • Instruction Fuzzy Hash: DDE04F77500269BFE6105BA2DD88C97BFACEB89BB13014467FA0583211DA71ED10CBB4
                    Function 1002429A Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 311COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_GS.LIBCMT ref: 100242A4
                      • Part of subcall function 10003BE6: __EH_prolog3.LIBCMT ref: 10003BED
                      • Part of subcall function 10003BE6: GetLastError.KERNEL32(00000004,10003F3B,00000000,?,00000000,?), ref: 10003C0F
                      • Part of subcall function 10003BE6: SetLastError.KERNEL32(00000000,00000000,?), ref: 10003C48
                      • Part of subcall function 10004EC2: GetLastError.KERNEL32(00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10004ED0
                      • Part of subcall function 10004EC2: SysFreeString.OLEAUT32(?), ref: 10004EE4
                      • Part of subcall function 10004EC2: SetLastError.KERNEL32(?,00000001,00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000), ref: 10004EFE
                      • Part of subcall function 10090710: __wcstoi64.LIBCMT ref: 1009071A
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast$FreeH_prolog3H_prolog3_String__wcstoi64
                    • String ID: ,$;
                    • API String ID: 3081063817-2398449172
                    • Opcode ID: 817b8ea030cf6d9f00e38be007e8506ea04bc66cff5d08ff08ee2bcb523d8730
                    • Instruction ID: 5f97262b6c07ba331269f16d870c67a6e8e30e65723c841b61677f2baac368f1
                    • Opcode Fuzzy Hash: 817b8ea030cf6d9f00e38be007e8506ea04bc66cff5d08ff08ee2bcb523d8730
                    • Instruction Fuzzy Hash: DDC1BF70D00269DFEB60CF60D844BDEBBB9EF05354F518299EA56A3191DF30AA84CF51
                    Function 070A9B70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 175COMMON
                    Download Yara Rule
                    APIs
                    • GetCPInfo.KERNEL32(000004E4,?), ref: 070A9B87
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: Info
                    • String ID: $z
                    • API String ID: 1807457897-2251613814
                    • Opcode ID: 5c09a622fbd4cbf74253d15a2ebeaf9d30278d0c097fd3e91991494b732ebb86
                    • Instruction ID: fcf35a1af31dd575b8be6d9f62b9108717e20effd3c4c951d74ac2a489acb81c
                    • Opcode Fuzzy Hash: 5c09a622fbd4cbf74253d15a2ebeaf9d30278d0c097fd3e91991494b732ebb86
                    • Instruction Fuzzy Hash: EA81D3B4A5465CDBDB20CB84CD91BEBFBB5AB49301F0482D9D8495B342C6722F82CF95
                    Function 10081790 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: __wcsnicmp
                    • String ID: `cu
                    • API String ID: 1038674560-4120539311
                    • Opcode ID: 754edd6b6c704e2a0daca86207e8dc50fa2f3a56a2522d3bcb43764a7d7dcc35
                    • Instruction ID: a4f0a17d722a3ee593dd0aca575b361ca5959c7c82ac2a81411106d62e176f5e
                    • Opcode Fuzzy Hash: 754edd6b6c704e2a0daca86207e8dc50fa2f3a56a2522d3bcb43764a7d7dcc35
                    • Instruction Fuzzy Hash: 17518E76A00201DFDB24CF68C895F9A7BF5FF48310F1145AAE9568B391DB32E941DB90
                    Function 070AC21C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: __aulldiv__aullrem
                    • String ID: 9
                    • API String ID: 3839614884-2366072709
                    • Opcode ID: c9f53a034dbe8626d80d9075163c3235e49f4649232cdbbad44cff86ee65cb59
                    • Instruction ID: b6f273818f085402196021d37468df84b4cdc9c0a4557b62b889b93f18d29902
                    • Opcode Fuzzy Hash: c9f53a034dbe8626d80d9075163c3235e49f4649232cdbbad44cff86ee65cb59
                    • Instruction Fuzzy Hash: E841C6B1D09619DFEF64DFA8C988BEEB7B5BB44300F2482D9D449AA240D7359E85CF10
                    Function 070AC1BA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: __aulldiv__aullrem_get_int_arg
                    • String ID: 9
                    • API String ID: 1225292562-2366072709
                    • Opcode ID: 834a3ccdaf6b405b916b054bbae46e6c52f9a37ebe843cbe81decb3f9ee2bcb9
                    • Instruction ID: 57e85af7dde4f5c8838adbf1e59aa9b75d2c89e36e91709d864a38f8b807a5f2
                    • Opcode Fuzzy Hash: 834a3ccdaf6b405b916b054bbae46e6c52f9a37ebe843cbe81decb3f9ee2bcb9
                    • Instruction Fuzzy Hash: 8841B4B1D09619DFEF64DFA8C988BAEB7B5BB44300F2482D9D449AA240D7355E85CF20
                    Function 1005BCFB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON
                    Download Yara Rule
                    APIs
                    • __EH_prolog3_catch_GS.LIBCMT ref: 1005BD05
                      • Part of subcall function 10011DEB: __EH_prolog3.LIBCMT ref: 10011DF2
                      • Part of subcall function 10003AA0: __EH_prolog3.LIBCMT ref: 10003AA7
                      • Part of subcall function 10003AA0: GetLastError.KERNEL32(00000004,100049CB,0000005C,00000000,00000000,00000000,?,1000DB12,00000000,00000001,00000000,?,000000FF,00000001,00000048,1000E682), ref: 10003AC9
                      • Part of subcall function 10003AA0: SetLastError.KERNEL32(?,00000000,?,1000DB12,00000000,00000001,00000000,?,000000FF,00000001,00000048,1000E682,?), ref: 10003B01
                      • Part of subcall function 10015898: __EH_prolog3.LIBCMT ref: 1001589F
                      • Part of subcall function 10004EC2: GetLastError.KERNEL32(00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000,00000001,00000000), ref: 10004ED0
                      • Part of subcall function 10004EC2: SysFreeString.OLEAUT32(?), ref: 10004EE4
                      • Part of subcall function 10004EC2: SetLastError.KERNEL32(?,00000001,00000000,?,10004A49,00000000,00000001,00000000,?,?,00000000,0000003C,1000DBA1,?,00000000,00000000), ref: 10004EFE
                      • Part of subcall function 1001227A: __EH_prolog3.LIBCMT ref: 10012281
                    • __CxxThrowException@8.LIBCMT ref: 1005BDC4
                      • Part of subcall function 1008BE0A: RaiseException.KERNEL32(?,?,10051E9E,?,?,?,?,?,10051E9E,?,100ECD18,00000000), ref: 1008BE5B
                      • Part of subcall function 10012768: __EH_prolog3.LIBCMT ref: 1001276F
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: H_prolog3$ErrorLast$ExceptionException@8FreeH_prolog3_catch_RaiseStringThrow
                    • String ID:
                    • API String ID: 864150388-3916222277
                    • Opcode ID: 988b79ff461819ae93c3c9c71af2b23f279cfdd02d84e3dec604f62c35d53276
                    • Instruction ID: 1b050f13ecea2081744c04f546eba51bd9b16cc18cf3df957e138f885e3181ad
                    • Opcode Fuzzy Hash: 988b79ff461819ae93c3c9c71af2b23f279cfdd02d84e3dec604f62c35d53276
                    • Instruction Fuzzy Hash: 2C31A479800658EEEF11CBE0C996BDD7778FF14340F444089EA457B182DBB46B48CB61
                    Function 070B4BD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: __malloc_dbg
                    • String ID: setenv.c
                    • API String ID: 95588982-187379886
                    • Opcode ID: 80202644ec329b84f42a3bc8ff74b7410b789ce3af7c6c2eea92a2fa5f89785d
                    • Instruction ID: e0b6398fa2f73062600b29888598cabdf1fc2220f63f5e8acb06080d33995823
                    • Opcode Fuzzy Hash: 80202644ec329b84f42a3bc8ff74b7410b789ce3af7c6c2eea92a2fa5f89785d
                    • Instruction Fuzzy Hash: 773118F4E00209EFDB44DF94C891B9EB7B1EF45704F1082A9E915AB381E771AB40CB81
                    Function 070AD590 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: __malloc_dbg
                    • String ID: _getbuf.c$str != NULL
                    • API String ID: 95588982-3136621515
                    • Opcode ID: c8e8ae250b41084b96e386c4cf9a622b657e7c407311bd30102b0b49d7ff86af
                    • Instruction ID: 2c8a044287448b104a6ff8327edbddf7234d6ee0c008bf871aca8825df445ce8
                    • Opcode Fuzzy Hash: c8e8ae250b41084b96e386c4cf9a622b657e7c407311bd30102b0b49d7ff86af
                    • Instruction Fuzzy Hash: 00213DB4B40208EFDB04CF84C996B9DB7F5FB84359F208299E9096B386D7719E41DB80
                    Function 10055606 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON
                    Download Yara Rule
                    APIs
                    Strings
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: Event
                    • String ID: d
                    • API String ID: 4201588131-2564639436
                    • Opcode ID: b9d013bc43860b0c4ab50fcdf6ec8f6a61f24c972914f3aee4bf342e67c5eb86
                    • Instruction ID: 9738ffb286a232aaa813fbdfd55a72a2a13c867540465a2dec1d247e8b980165
                    • Opcode Fuzzy Hash: b9d013bc43860b0c4ab50fcdf6ec8f6a61f24c972914f3aee4bf342e67c5eb86
                    • Instruction Fuzzy Hash: 7C216731600785DFCB24DF24D964A5AB7F4FF08326F11886AE916CB661C772E95ACF80
                    Function 10080FB0 Relevance: 5.2, APIs: 4, Instructions: 203COMMON
                    Download Yara Rule
                    APIs
                    • GetLastError.KERNEL32(AD4A72FF,00000158,00000000,7572E010), ref: 10080FFB
                    • SetLastError.KERNEL32(100C90B8), ref: 1008102D
                    • GetLastError.KERNEL32 ref: 1008103D
                    • SetLastError.KERNEL32(100C90B8), ref: 10081069
                      • Part of subcall function 10085D10: GetLastError.KERNEL32(AD4A72FF,00000000,00000000,?,?,100C6C68,000000FF,?,10080BEB,?,00000000,00000000,100D4A60,000000FF,00000001,100D4A60), ref: 10085D4E
                      • Part of subcall function 10085D10: SetLastError.KERNEL32(?,00000000,?,00000000,?,10080BEB,?,00000000,00000000,100D4A60,000000FF,00000001,100D4A60,00000000,00000001,00000000), ref: 10085DAA
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast
                    • String ID:
                    • API String ID: 1452528299-0
                    • Opcode ID: 17359f10c539eeeaaa164aadb4420d80c0dc357cb97e74707a6a57f537116f27
                    • Instruction ID: c440ed582d3deb87dc4afe71bbaa1175ba8d0de13cbef176844780a251377b93
                    • Opcode Fuzzy Hash: 17359f10c539eeeaaa164aadb4420d80c0dc357cb97e74707a6a57f537116f27
                    • Instruction Fuzzy Hash: 88814D75D002589FDB14DFA4CC81BDEB7B8FF08350F50419AE915A7291EB746A44CFA1
                    Function 10071C90 Relevance: 5.1, APIs: 4, Instructions: 101COMMON
                    Download Yara Rule
                    APIs
                    • GetLastError.KERNEL32(AD4A72FF,?), ref: 10071CDC
                    • SetLastError.KERNEL32(100C90B8,00000000,00000000,000000FF), ref: 10071D36
                    • GetLastError.KERNEL32(100D4988,100D4986), ref: 10071D7A
                    • SetLastError.KERNEL32(?,00000000,00000000,000000FF), ref: 10071DC5
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast
                    • String ID:
                    • API String ID: 1452528299-0
                    • Opcode ID: c5a263b9809189810a1c0f59af9c52e5dd3fc26e9122fd01351fa01433b994b1
                    • Instruction ID: cfe5be4a29c9074683fd62690c06714a647b0efa505da72e4c9993d011869c2c
                    • Opcode Fuzzy Hash: c5a263b9809189810a1c0f59af9c52e5dd3fc26e9122fd01351fa01433b994b1
                    • Instruction Fuzzy Hash: 63416D75900219EFEB04CF98C954BDEBBB5FF08324F104259E815AB790D77AA905CF94
                    Function 10071F00 Relevance: 5.1, APIs: 4, Instructions: 96COMMON
                    Download Yara Rule
                    APIs
                    • GetLastError.KERNEL32(AD4A72FF,7563E860), ref: 10071F4C
                    • SetLastError.KERNEL32(100C90C8,00000000,00000000,000000FF), ref: 10071FAC
                    • GetLastError.KERNEL32(00000000,00000000,000000FF), ref: 10071FDA
                    • SetLastError.KERNEL32(?,?,00000000,000000FF), ref: 10072028
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast
                    • String ID:
                    • API String ID: 1452528299-0
                    • Opcode ID: 617172cf23e2ad5a1f5e8693873449484b84e93a5871aea0476aa5465e187cd5
                    • Instruction ID: 9df8d1ca564ce7fcabccc40c12295be6f5597375430882be7bc7a15b9033c0e2
                    • Opcode Fuzzy Hash: 617172cf23e2ad5a1f5e8693873449484b84e93a5871aea0476aa5465e187cd5
                    • Instruction Fuzzy Hash: 39415BB5904208DFEB10CF98C944B9EBBF4FF48324F204659E816A7390DB76A905CB94
                    Function 10079960 Relevance: 5.1, APIs: 4, Instructions: 92COMMON
                    Download Yara Rule
                    APIs
                    • GetLastError.KERNEL32 ref: 100799AE
                    • SetLastError.KERNEL32(100C99EC,00000000,00000000,000000FF), ref: 10079A08
                    • GetLastError.KERNEL32(?), ref: 10079A2F
                    • SetLastError.KERNEL32(100C99EC,00000000,00000000,000000FF), ref: 10079A85
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast
                    • String ID:
                    • API String ID: 1452528299-0
                    • Opcode ID: c957c1e339bb3363391a8650a0d18b0a9b016119ff79d4a129a98d242855cb5e
                    • Instruction ID: b86572ae00215dd1a03e6aa61d49df2ec7826d800558bf1a372538514fe6ebb4
                    • Opcode Fuzzy Hash: c957c1e339bb3363391a8650a0d18b0a9b016119ff79d4a129a98d242855cb5e
                    • Instruction Fuzzy Hash: B64149B5900248DFEB10CFA8C944B9EBBF4FF48324F10425DE855A7390DB76AA06CB94
                    Function 070A7430 Relevance: 5.1, APIs: 4, Instructions: 78memoryCOMMONLIBRARYCODE
                    Download Yara Rule
                    APIs
                    • HeapReAlloc.KERNEL32(073A0000,00000000,00000000,-00000010,?,?,070A7037), ref: 070A745D
                    • HeapAlloc.KERNEL32(073A0000,00000008,000041C4,?,?,070A7037), ref: 070A74AC
                    • VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004,?,070A7037), ref: 070A74D3
                    • HeapFree.KERNEL32(073A0000,00000000,00000000,?,070A7037), ref: 070A74F8
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: AllocHeap$FreeVirtual
                    • String ID:
                    • API String ID: 3499195154-0
                    • Opcode ID: 89f1ceec3118fb5a77cacb26e68f369d6de82a4005e95decfcd42fa0028f484c
                    • Instruction ID: 00cf4e6b5d7bfd176f727891eb02f34819e606a9be4d7370976b0acb30383baa
                    • Opcode Fuzzy Hash: 89f1ceec3118fb5a77cacb26e68f369d6de82a4005e95decfcd42fa0028f484c
                    • Instruction Fuzzy Hash: 6D3129B4601304EFDB05CF98D99AB69B7F1BB48314F218758E9019B381D3BCAE41CB55
                    Function 10077560 Relevance: 5.0, APIs: 4, Instructions: 35COMMON
                    Download Yara Rule
                    APIs
                    • GetLastError.KERNEL32(00000000,10083A67,?,?,?,?,?,?,?,?,?,AD4A72FF,?,000001A4,00000000), ref: 10077571
                    • SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,AD4A72FF,?,000001A4,00000000), ref: 100775A1
                    • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,AD4A72FF,?,000001A4,00000000), ref: 100775B5
                    • SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,AD4A72FF,?,000001A4,00000000), ref: 100775E5
                    Memory Dump Source
                    • Source File: 00000012.00000002.2505511701.0000000010001000.00000040.00000001.01000000.0000000E.sdmp, Offset: 10000000, based on PE: true
                    • Associated: 00000012.00000002.2505447302.0000000010000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F4000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F7000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.00000000100F9000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    • Associated: 00000012.00000002.2505511701.0000000010101000.00000040.00000001.01000000.0000000E.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_10000000_setup.jbxd
                    Similarity
                    • API ID: ErrorLast
                    • String ID:
                    • API String ID: 1452528299-0
                    • Opcode ID: 73851c0b191ff897e4b536b2922fa66c9008fe9c6f46115853696a354bcf2444
                    • Instruction ID: 4bdc00c4cd9c3dc0b2211eca507c2c629df5f88908c7bd78b401c18e0e0ad60d
                    • Opcode Fuzzy Hash: 73851c0b191ff897e4b536b2922fa66c9008fe9c6f46115853696a354bcf2444
                    • Instruction Fuzzy Hash: 1A1139B49012808FDB88CF69CAC97487BE4FF08314B6591EADC09CB22AE779D845DF44
                    Function 070A4D70 Relevance: 5.0, APIs: 4, Instructions: 16COMMON
                    Download Yara Rule
                    APIs
                    • InitializeCriticalSection.KERNEL32(070D1C10,?,070A14C9,00004A65,?,070A10BD), ref: 070A4D79
                    • InitializeCriticalSection.KERNEL32(070D1C40,?,070A14C9,00004A65,?,070A10BD), ref: 070A4D86
                    • InitializeCriticalSection.KERNEL32(070D1C28,?,070A14C9,00004A65,?,070A10BD), ref: 070A4D93
                    • InitializeCriticalSection.KERNEL32(070D1BF8,?,070A14C9,00004A65,?,070A10BD), ref: 070A4D9F
                    Memory Dump Source
                    • Source File: 00000012.00000002.2501668604.00000000070A1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 070A0000, based on PE: true
                    • Associated: 00000012.00000002.2501622328.00000000070A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501937065.00000000070CB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2501997435.00000000070CD000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502043197.00000000070CF000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502111787.00000000070D3000.00000004.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000070D5000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.00000000071FB000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    • Associated: 00000012.00000002.2502173025.0000000007264000.00000002.00000001.01000000.0000000F.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_18_2_70a0000_setup.jbxd
                    Similarity
                    • API ID: CriticalInitializeSection
                    • String ID:
                    • API String ID: 32694325-0
                    • Opcode ID: 012e792c634bee62d837b0738bf5b062be350ccdf5341f582a86a22b74236127
                    • Instruction ID: 445de9977171e32eb305819e6ea3e9c07c14197c1a7a7b287b9ba5e84fda35e3
                    • Opcode Fuzzy Hash: 012e792c634bee62d837b0738bf5b062be350ccdf5341f582a86a22b74236127
                    • Instruction Fuzzy Hash: D6D0B776651344EBC604ABE4F45EC2A77EDF7587013428715FD0983241EA3DB841DB50