Each of the links highlighted in red led to a malicious payload hosted directly on the same server: hxxps://xn--electrms2a[.]org/electrum-3.0.3.exe (Fig. 28). The electrum-3.0.3.exe is a backdoored PyInstaller that is configured to download a